I’m happy to be supporting a slightly smaller provider. I don’t have to admin anything and I still feel like I’m contributing to an open ecosystem. Plus I own my domain so I can always change providers.
I have made peace with the compromise.
I generally don't have issues with the big boys and girls. Yes, they send me shit loads of spam and I drop it on the floor. I generally only go as far as SPF and getting A and PTR to match HELO and don't send any spam. I use Exim and rspamd and a few other things.
Google and MS email fettlers are not complete wankers and they seem to be quite reasonable.
I could quite easily add your Mom's mail domain to my non work post office and probably deliver her mail. I already do it for several others. However, sadly, I don't know you, nor you know me, so a trust relationship is out of the question.
Just in case anyone is going to get whizzed up about US vs UK: my company email domain is within .net, which is nominally US based. When we incorporated and eventually sorted out a name, it turned out that the .co.uk domain was "taken", hence why we went for second best.
And the article linked from their article (hilarious itself) pointed out that this basically comes down to State Actors (Mossad as the example) or Everyone Else. If it's Mossad then there's nothing anyone else can do to protect you (because they can do secret-squirrel things through special security courts and stuff like installing black boxes on undersea cable routers). If Everyone Else, then the normal run-of-the-mill transport encryption is probably good enough, just don't click on any herbal boner-pill adverts.
tldr; If you want to be protected, you have to do PGP at the local machine level yourself.
[0] Given that Fastmail are Aussies, and that our idiotic government have given the spooks full, secret, access to anything they want, then this is a very real prospect for anyone that five-eyes might be interested in.
This is oversimplification if not misleading. There are also Bad Guys (who aren't state actors), who usually can't reach for your data. But occasionally they can, when rare Planet Parades like Heartbleed or Meltdown make the news. And they are happy to use this one-in-a-lifetime chance to sell access to your data to everyone else.
There was a time, long, long ago, when mail from your email provider to your recipient's provider would often go through other providers in transit. Nowadays (and for the last 20 years) all of the intermediary mail-servers in the Received: headers belong to either the sender's provider or the recipient's provider. They're usually spam-filters, application gateways, secondary servers.
I guess the major exception is people who use gmail or Mailchimp as an outbound relay. But that's deliberate, and entirely under the sender's control.
Which kinda begs the question about what Proton thinks they're doing by implementing PGP on behalf of their users...?
> If it’s running in the browser with code downloaded from our servers, then if we get compromised, we can serve up a version of the PGP code which leaks keys or plaintext.
is well-known but only applicable to the web app, the other clients are less susceptible to this. Even for the web app, we are proposing to solve this problem: https://github.com/twiss/source-code-transparency
That’s a wildly unfair characterisation, and not in the slightest bit supported by your citation. The Assistance and Access Act which that article is talking about (though it doesn’t even name it!), although a dodgy piece of legislation in the opinion of most technologists, is completely irrelevant to Fastmail, because Fastmail doesn’t offer end-to-end encryption. Fastmail was always subject to the Telecommunications Act, which allows Australian police access with warrants, and Fastmail has always made no bones about the fact that it complies with legal warrants. But that’s nothing like what you’re describing.
(Disclosure: I was a Fastmail employee from 2017–2020.)
1. Search isn’t possible
- It's possible on the client. The total text in an email account is not prohibitively large and can be cached on the client.
2. Previews can’t be calculated
- It can be on the client, then reuploaded encrypted.
3. If you lose your private key, we can’t recover your email
- Of course, this is equivalent to losing your email account password.
4. Spam checking on content isn’t possible
- It is on the client, and on the server based on headers.
5. To access mail on multiple devices, the private key needs to be shared securely between them
- Protonmail solved this, what's the problem?
The idea of spam filters is that you don’t get the spam so the client never sees it.
Also running highly specialized spam filters that actually work reliably might be prohibitive for a lot of people.
I think most peoples non technical relatives could follow the pictured steps easily but if for some reason they can not then a desktop sharing session should get around helping someones mom set it up. I've had no issue with my non technical friends.
I should add that if Fastmail added PGP in their interface I would not use it. Nobody could convince me that when a mail provider or anyone else adds E2EE in their application that it's anything other than PP Pinky Promise. They can tamper with it to intercept my communications and no app provider could possibly convince me otherwise. There should probably be an RFC for PP.
[1] - https://support.startmail.com/hc/en-us/articles/360014775437...
Fact is that there isn't a way to use a convenient 3rd party email provider if you want secure emails. Only local clients can provide that feature - which means both sides of the message have to be using trusted local clients, and at some point one side of the conversation will forget their secret and lose access to their email history. It is a tough problem.
[0] https://www.fastmail.com/blog/why-we-dont-offer-pgp/
[1] https://www.bbc.com/news/world-australia-46463029