The author also appears to want an email service that doesn’t store your email or have a spam filter, because they are offended by these parts of FastMail’s privacy policy:
> We process mail sent and received from your account to block spam and fraud.
> We also collect the email content you create, upload, or receive from others
It seems to me that what the author wants does not resemble email, which is why they are so unhappy with so many email providers. Perhaps they would be happier with some form of E2E-encrypted instant messaging. In any case, getting angry at email providers for storing your email seems like a waste of time and energy.
> When you register an account with us, we collect and process certain personal data from you as your registration data. For example, we need your name, address information, telephone number, payment information and your email address to process your order.
— https://www.hetzner.com/rechtliches/datenschutz
From the article:
> Name, phone number, address. You're off to a fast start towards privacy hell, FastMail.
1) What is my use case for email?
2) Who am I emailing with?
3) What are the threats and malicious actors I’m concerned about?
I think this brings up something not addressed... It seems that free SMTP hosting services are incredibly ill-suited to the privacy requirements of the author. Signal or Wire perhaps?
It's actually better that people start to treat their mailboxes as somewhat ephemeral, as communicating that you are you encourages use of things like PGP signatures. And then people can send encrypted email for things that are worth keeping secret.
Suppose myself and the recipient are using x509 certs with outlook and our laptops have encrypted disks with bitlocker or equivalent - my impression is that it mostly covers the basis, is that unjustified?
"It's actually better that people start to treat their mailboxes as somewhat ephemeral, as communicating that you are you encourages use of things like PGP signatures"
Correct me if I misunderstood you, but I don't think emails should be ephemeral. I am have currently several emails from my landlord, the police, etc. that I have to keep for years as evidence in case of a future dispute. While I cannot prove that they are not fake, it's the same for physical letters, yet both are admissible in court as evidence. If I tried to get more reliable proof out of either of them, they might send me a hand-signed letter by post but they'd never figure out PGP.
The risk is that someone steals your laptop while you're signed in and then your disk encryption doesn't do squat. There are ways to deal with this, but very few people are actually doing them.
> Correct me if I misunderstood you, but I don't think emails should be ephemeral. I am have currently several emails from my landlord, the police, etc. that I have to keep for years as evidence in case of a future dispute. While I cannot prove that they are not fake, it's the same for physical letters, yet both are admissible in court as evidence. If I tried to get more reliable proof out of either of them, they might send me a hand-signed letter by post but they'd never figure out PGP.
You did not misunderstand me, but emails absolutely should be considered ephemeral. Google can kill your gmail accounts. Providers come and go. Email chain of custody is difficult and in most cases are easily faked.
Email is an absolutely shit system to use for any kind of identity work. And yet we do, at our own peril. Billions have been lost to email fraud.
With the goal posts having shifted to someone gaining full access to your powered on, unlocked device, we have arrived at XKCD 538.
You're offloading all of your risk upstream and basically hoping and praying that your provider or however many relay services in between don't default SMTP sans-TLS. Or that rogue employees don't go reading your shit. You're one misconfigured server from showing your ass all over the internet.
Remember that Google literally uses the contents of your gmail to market to you. Google being a company with a highly-politicized employee base with lots of motivated engineers & product people looking to "change the world".
If you rely on your email for vital services your want email provide to operate like an (idealised) bank - store my private information with respect, and to be able to retrieve email even if my PC or account is stolen, and I am happy to pay for the privilege. Furthermore, handing over real money gives you standing to sue in the court of law if the provider doesn't uphold their side of the bargain. I don't mind providing real ID if it's a trustworthy institution with a real address and a phone number I can dial for customer support.
By contrast if you Gmail is hijacked, there is no-one you can call for help and they can also ban you with no warning for no reason. You have almost no legal recourse on their misbehaviour because they can do anything for any reason and it's free.
I was further surprised to read that the author sees no daylight between free Gmail, outlook, outlook Premium with your own domain (paid service), business office 365, etc. I don't think it's fair to call them all data collectors and the difference between then are not trivial.
I am not claiming the author is misinformed or hasn't done his homework - just that this take is from the perspective of 'internet of anonymity' of 2000's, not 'internet of service I can trust my life with' that we deserve.