forwardemail
Re:Privacy focused platform Skiff is joining Notion, Skiff to be sunset.
on Saturday February 10, 2024 @02:59AM (#39324447)
Thanks for your kind words!
Re:Privacy focused platform Skiff is joining Notion, Skiff to be sunset.
on Saturday February 10, 2024 @02:55AM (#39324435)
Yes, we released it recently last year. We fully support SMTP/IMAP/POP3, and are testing and improving our CalDAV implementation (calendar).
Re:Privacy focused platform Skiff is joining Notion, Skiff to be sunset.
on Friday February 09, 2024 @11:14PM (#39323528)
Switch to Forward Email!
Re:Privacy focused platform Skiff is joining Notion, Skiff to be sunset.
on Friday February 09, 2024 @11:13PM (#39323523)
Re:Google will disable all but OAuth for IMAP, SMTP and POP starting S...
on Friday January 19, 2024 @01:12PM (#39058942)
Thanks for your feedback. We've updated our home page at https://forwardemail.net and added a dedicated link/section in our FAQ for "What is Forward Email" at https://forwardemail.net/faq#what-is-forward-email.
Commit: https://github.com/forwardemail/forwardemail.net/commit/5942...
Re:Google will disable all but OAuth for IMAP, SMTP and POP starting S...
on Friday January 19, 2024 @10:45AM (#39056798)
We are an email host (we support IMAP/POP3/SMTP). We will try to make that clearer.
Re:Google will disable all but OAuth for IMAP, SMTP and POP starting S...
on Friday January 19, 2024 @05:12AM (#39053713)
Re:Google will disable all but OAuth for IMAP, SMTP and POP starting S...
on Friday January 19, 2024 @05:10AM (#39053696)
Happy to help onboard your university!
We currently serve UMD, Tufts, Swarthmore, and more.
Re:Skiff: Various Privacy Failures
on Monday January 15, 2024 @01:19AM (#38997914)
Our policies for law enforcement are publicly available at https://forwardemail.net/en/report-abuse#for-law-enforcement
Also - you should note that we largely operate in-memory and don't store to disk any information or logs (unless essential, e.g. IMAP storage, or if they are error logs). We have all of this in our privacy policy and terms on our website. We are extremely transparent.
Re:Skiff: Various Privacy Failures
on Sunday January 14, 2024 @10:00PM (#38996994)
Hi there @shortformblog - yes, we are releasing calendar, contacts, and newsletter support early this year.
Re:Skiff: Various Privacy Failures
on Sunday January 14, 2024 @07:40PM (#38996037)
Hi there @jacooper - we already support this via domain-wide catch-all passwords. We also support filtering such as [email protected].
Re:Skiff: Various Privacy Failures
on Sunday January 14, 2024 @05:22PM (#38995020)
We use MTA-STS (for inbound AND outbound) with our mode set to enforce[1], to require senders to communicate with us only using TLS encrypted sockets. There is no legal precedence currently requiring software services to implement backdoors.
[1]: https://github.com/forwardemail/mta-sts.forwardemail.net/blo...
Re:Skiff: Various Privacy Failures
on Sunday January 14, 2024 @05:10PM (#38994929)
@cedws I think one of us might be confused with the context here (?) TLS is just a form of encryption to establish socket connections. Please thoroughly read through our article and our source code.
A PGP encrypted email doesn't get "decrypted" when it's being transferred. That's the whole purpose of PGP encryption, to encrypt it before it even gets transferred or stored, which is what we do. If you set up a PGP key, use WKD, then your emails will be stored as encrypted (not only is your database encrypted with your password, but the emails themselves can be PGP encrypted this way), and any sender attempting to send to you will automatically have their message PGP encrypted to you, if it is not already (in case their mail client doesn't use WKD).
Re:Skiff: Various Privacy Failures
on Sunday January 14, 2024 @05:07PM (#38994914)
Here is the actual code in the back-end where we use your PGP public key:
Source code for PGP encryption for storage when you're connected (we only use your password in-memory, and never write it to disk on our side) @ https://github.com/forwardemail/forwardemail.net/blob/562a52...
Outbound email automatically checks for PGP key in case you didn't include the recipients (we use WKD): https://github.com/forwardemail/forwardemail.net/blob/562a52...
Your individual mailbox is a SQLite database file and is encrypted using ChaCha20-Poly1305 as well (using your password, which only you have access to; we only use it in-memory and don't write it to disk).
Re:Skiff: Various Privacy Failures
on Sunday January 14, 2024 @05:02PM (#38994880)
That is not true. You can upload a PGP key and all your email written to SQLite (IMAP/POP3) will be stored with your PGP key. Not plain text. SMTP is for outbound, IMAP/POP3 is for inbound.
https://forwardemail.net/en/faq#do-you-support-openpgpmime-e...
Re:Skiff: Various Privacy Failures
on Sunday January 14, 2024 @04:53PM (#38994788)
Forward Email team here (https://forwardemail.net), we have a write-up and comparison @ https://forwardemail.net/en/blog/docs/best-quantum-safe-encr...
We've considered adding a E2EE comparison column as well (with the issues such as Proton rewriting your emails @ http://jfloren.net/b/2023/7/7/0 highlighted).
Privacy Guides Discussion @ https://discuss.privacyguides.net/t/forward-email-email-prov...
Unlike Skiff, Proton, and Tuta... we're _actually_ 100% open-source. Those providers that advertise as open-source really only open-source the front-end, when the back-end is the most sensitive part of an email service.
Re:Show HN: Forward Email – Open-Source Quantum Safe Encrypted Email S...
on Thursday December 28, 2023 @04:36PM (#38798979)
Hi there @kseistrup - we can easily increase limitations on a per user basis (just email us if you run into limitations) at [email protected]. This is mainly a deterrent for spammers, much like our KYC process for our outbound SMTP verification post DKIM/DMARC/Return-Path automated verification process.
Re:Show HN: Forward Email – Open-Source Quantum Safe Encrypted Email S...
on Thursday December 28, 2023 @04:34PM (#38798960)
Hi there @vinniepukh - we already support this! If you upload your public key, then all messages stored to temporary storage will be encrypted. We have a guide at https://forwardemail.net/en/faq#do-you-support-openpgpmime-e... (note the "Optional Add-on" section).
Re:Show HN: Forward Email – Open-Source Quantum Safe Encrypted Email S...
on Thursday December 28, 2023 @01:05AM (#38790564)
FYI: We are a complete email service, not just forwarding.
SMTP, POP3, IMAP, and more were released in 2023. Calendar and contacts early 2024.
For a comparison of Forward Email to other services, see our email service comparison https://forwardemail.net/blog/docs/best-quantum-safe-encrypt...
Re:Show HN: Forward Email – Open-Source Quantum Safe Encrypted Email S...
on Wednesday December 27, 2023 @08:58PM (#38789100)
We are happy to answer questions here, via email [email protected], or using our Matrix chat channel #forwardemail:matrix.org [1]. Additional Q&A is available on Reddit [2].
[1]: https://matrix.to/#/#forwardemail:matrix.org
[2]: https://www.reddit.com/r/privacy/comments/18sheem/forward_em...
Re:Show HN: Forward Email – Open-Source Quantum Safe Encrypted Email S...
on Wednesday December 27, 2023 @08:53PM (#38789074)
RE: Competition:
We are the *only* email service provider that is 100% open-source. Proton Mail [1], Skiff [2], and Tuta [3] all have closed-source back-ends, despite advertising as closed-source.
RE: Quantum Safe:
ChaCha20-Poly1305 is generally considered to be quantum safe [4] [5].
[1]: https://www.reddit.com/r/ProtonMail/comments/b847n7/comment/...
[2]: https://www.reddit.com/r/Skiff/comments/10yn8a5/comment/j811...
[3]: https://www.reddit.com/r/tutanota/comments/10hghin/comment/j...
[4]: https://crypto.stackexchange.com/questions/79518/is-xchacha2...
[5]: https://old.reddit.com/r/crypto/comments/suk2k7/is_chacha20p...
Re:Show HN: Forward Email – Open-Source Quantum Safe Encrypted Email S...
on Wednesday December 27, 2023 @08:42PM (#38789010)
Thank you, we've put a ton of work into this. Not only are your mailboxes encrypted with SQLite using ChaCha20-Poly1305 [1], but you can also now add an OpenPGP key [2] (for double encryption).
We support SMTP, POP3, IMAP, API, webhooks, regular expressions, and more.
[1]: https://forwardemail.net/blog/docs/best-quantum-safe-encrypt...
[2]: https://forwardemail.net/faq#do-you-support-openpgpmime-end-...
Re:MongoDB is actively investigating a security incident
on Saturday December 16, 2023 @06:53PM (#38668982)
We switched from MongoDB to SQLite for email; see https://forwardemail.net/encrypted-email
Re:MongoDB is actively investigating a security incident
on Saturday December 16, 2023 @05:38PM (#38668428)
We store each user's individual mailbox as its own encrypted SQLite database file on an encrypted volume. Even if the volume is decrypted, mailboxes can still not be read. This is the main reason and we detail this in the link we shared.
Another requirement was full text search on the mailboxes with the data itself being encrypted at rest (SQLite fit our needs for that too; not many others provide this). We have a comparison chart at https://forwardemail.net/blog/docs/best-quantum-safe-encrypt....
Re:MongoDB is actively investigating a security incident
on Saturday December 16, 2023 @04:57PM (#38668118)
Encryption at rest is not supported in the community/free version of MongoDB.
We built an email service (IMAP support added a month ago) and wrote a WebSocket to SQLite layer to solve our encryption at rest needs for storage.
See our deep dive at https://forwardemail.net/blog/docs/best-quantum-safe-encrypt... for insight.
Re:Mail-in-a-Box: a mail server in a box
on Sunday November 26, 2023 @01:27AM (#38419620)
Correct, we offer indexing[0], regexp[1][2], and FTS5[2].
We've put a lot of effort into security hardening (e.g. disabled swap entirely, disabled usb-storage devices, disabled core dumps, disabled apport, etc).
[0]: https://github.com/forwardemail/forwardemail.net/blob/ef67fe...
[1]: https://github.com/forwardemail/forwardemail.net/blob/ef67fe...
[2]: https://github.com/forwardemail/forwardemail.net/blob/ef67fe...
[3]: https://github.com/forwardemail/forwardemail.net/blob/ef67fe...
Re:Mail-in-a-Box: a mail server in a box
on Friday November 24, 2023 @02:53PM (#38407534)
Correct, the former. There are no other open-source email servers (or closed even) that does the former that we know of. The deep-dive write-up is here if you want to read more https://forwardemail.net/encrypted-email.
Edit: It matters because if someone has access to the filesystem, or our MongoDB database, then they still can't read/write to your email mailbox because they don't have your IMAP password (which we only show to you _once_ for 30 seconds and render in-memory). We use ChaCha20-Poly1305 encryption on the SQLite mailboxes (which is generally considered quantum-secure[0]). Passwords are generated[1] via Node.js `crypto.pbkdf2`.
[0]: https://crypto.stackexchange.com/a/90311 [1]: https://github.com/forwardemail/forwardemail.net/blob/d537fc...
Re:Mail-in-a-Box: a mail server in a box
on Friday November 24, 2023 @02:33PM (#38407326)
We also thought of renaming it to "Mailboxes Encrypted Individually". We really wanted to make it clear that each individual mailbox is encrypted. Any other suggestions?
Re:Mail-in-a-Box: a mail server in a box
on Friday November 24, 2023 @02:26PM (#38407267)
Included in our comparison list here https://forwardemail.net/en/open-source/linux-email-server#e...