Which email providers (e.g. Gmail, Yahoo, etc) offer the most robust security for a personal email account? The recent article about Mat Honan getting hacked illustrates the challenge. The account owner is responsible for some aspects (e.g. choose a strong password, partition your information by avoiding daisy-chaining), but the service provider also has responsibilities (e.g. verify identity of people calling support, provide robust authentication).

GMail offers two-factor authentication, and Yahoo has the same feature in beta (as of August 2012). Are there other aspects to consider?

UPDATE: I accepted the answer below. The discussion has reminded me to consider the people and process involved, not just the technology.

2 Answers 2


For email security you can consider the following. These are common issues which are not well secured because of other factors, so the basics like XSS, virus scanning etc are not considered.

  • Strict SSL-only access with no known attacks like BEAST
  • Log of previous logon attempts
  • Encrypted storage
  • S/MIME, PGP support
  • TLS on SMTP and IMAP
  • High security application, which is not the case for most Webmail providers

So all of that is OK with GMAIL, Hotmail had issues with cookie handling recently (so it was enough to submit simple empty cookie for a session).

The most secure is to have email server on your own location, and protected the way, that without logging in with mailbox login / password, you cant read mail, and then simply run auto-update on the server, to make sure that the mailbox storage is not breached. Basically webmail with updates and good hardening does the effective trick good even for 100.000 mailboxes for business use.

  • 3
    Could you go into more detail about how you're saying GMail is "OK" with S/MIME & PGP? As far as I know they don't implement anything particular to support e-mail encryption. Granted you can send PGP messages through GMail (I don't know about S/MIME) but I don't believe that's because of anything in particular that GMail itself does.
    – Iszi
    Aug 7, 2012 at 20:00
  • Heh, I use outlook for this, but via webmail it's not supported because the private key in browser is not implemented properly for s/mime or something. I have my own s/mime webmail trough no issues. Aug 7, 2012 at 21:16
  • Yes, I should have been more clear to specify that sending PGP via GMail (and, presumably S/MIME also) requires you to use an e-mail client that supports it - not the webmail interface.
    – Iszi
    Aug 7, 2012 at 21:21

Hushmail seems to be the standard for email security :

  • mail encryption is directly supported
  • you can either use it as a standard webmail with SSL
  • or install their Java applet that will encrypt your mails locally before going to their servers
  • your saved emails are strongly encrypted on their servers
  • mail headers are easily accessible (one click)
  • they only answer to Canadians court of law
  • they can't recover your password

For more : http://www.hushmail.com/about/technology/security/


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.