News for hackers. Stuff that matters.
Re:E-Mail Security in the Wake of Petraeus by liotier on Friday November 23, 2012 @11:28AM (#4822692)
Yes another reason why I still bother to maintain an email server for 150 people in our family and friends circles.

It is one hundred times more expensive than industrial hosting but, if you know what you want there is only one way to get it.

Re:E-Mail Security in the Wake of Petraeus by ZoFreX on Friday November 23, 2012 @11:48AM (#4822783)
I think you might be kidding yourself if you think that gives you any meaningful protection against government agencies. As the article said, one of the dangers of taking some protections is being lulled into a false sense of security.
Re:E-Mail Security in the Wake of Petraeus by rsync on Friday November 23, 2012 @12:00PM (#4822818)
Running your own mail server changes everything.

At the end of the day Men With Guns(TM) may still come to your colo facility and just take the equipment, but even in that edge scenario, you would know something was up in a way you wouldn't with gmail.

In non edge cases, you are the provider and the owner of the equipment, and it is you who will be given the court order - you'll see what is going on and have the opportunity to respond as YOU see fit, not as google sees fit. Furthermore, depending on your practices and countermeasures, you may have actions available to you with your own assets that, of course, you wouldn't have with gmail.

In fact, the advantages of running your own mail server are so great, that over the past few years I've decided it's probably time to start self-providing my own dialtone and voicemail the same way I self-provide my own email. For all of the same reasons.

Re:E-Mail Security in the Wake of Petraeus by DanBC on Friday November 23, 2012 @01:02PM (#4823057)
Some people are not able to keep up with the security patching required to host their own server.

Some people are not able to keep up with best current practice to ensure that email from their server is deliverable.

Running your own email server is for many people a sub-optimal solution. Sure, for a small number of people it's a great idea.

Re:E-Mail Security in the Wake of Petraeus by rsync on Friday November 23, 2012 @04:37PM (#4823762)
I think it's the only idea ... what other alternative is there ?

Not "encryption" since that's not the problem we are trying to solve - you can do that with gmail right now. I'm talking about the "I woke up this morning and my email was delivered to the local DA and I had no idea and played no part in it" problem ...

Re:E-Mail Security in the Wake of Petraeus by sliverstorm on Friday November 23, 2012 @05:08PM (#4823830)
Or the, "Chinese hackers dragnetted my account after they found a hole in GMail". Something to be said for being a small fish when the big boys go at it.
Re:E-Mail Security in the Wake of Petraeus by ZoFreX on Saturday November 24, 2012 @11:02AM (#4825540)
If they can subpoena ISPs for the data, they don't even need to seize your server to get your emails, and you'll be none the wiser.
Re:E-Mail Security in the Wake of Petraeus by liotier on Tuesday November 27, 2012 @04:51AM (#4836425)
Actually they would need to seize my server physically - my ISP does not have the root password. But :

- It is located in France, which makes it difficult for the US government. Easy for the French government though.

- It is a mom & pop ISP, who will tell me if someone forces them to yield access to he hardware.

- I will notice if the server goes offline.

That said, a competent, motivated and well endowed intruder will probably find a way through one of the other services on the same host - if intrusion occurs, I guess it will be through a Wordpress plugin. But if I wanted elevated security, a host with just sshd, courrier, postfix and the afferent mail processing is a pretty tough nut to crack.

Re:E-Mail Security in the Wake of Petraeus by sliverstorm on Friday November 23, 2012 @05:05PM (#4823823)
If you don't use a colo, how do you get around blanket IP range blocks? Are you hosting at home over "business" class internet service?
Re:E-Mail Security in the Wake of Petraeus by sliverstorm on Friday November 23, 2012 @05:06PM (#4823824)
I mostly like being able to manage my email as files. Can't do "tar zcf /backup/mail.tar.gz ~/mail" on GMail.
Re:E-Mail Security in the Wake of Petraeus by samjohnson on Friday November 23, 2012 @05:47PM (#4823937)
You almost can with http://gmvault.org/
Re:E-Mail Security in the Wake of Petraeus by bct on Friday November 23, 2012 @06:07PM (#4823974)
getmail, fetchmail, etc.
Re:E-Mail Security in the Wake of Petraeus by sliverstorm on Friday November 23, 2012 @06:26PM (#4824018)
At that point though, I feel like you're already taking most all of the risks of hosting your own mail, and also taking all the risks of going through public webmail. Worst of both worlds sort of thing. So you might as well host yourself at that point :)