secure webmail provider

Question

Which email providers (e.g. Gmail, Yahoo, etc) offer the most robust security for a personal email account? The recent article about Mat Honan getting hacked illustrates the challenge. The account owner is responsible for some aspects (e.g. choose a strong password, partition your information by avoiding daisy-chaining), but the service provider also has responsibilities (e.g. verify identity of people calling support, provide robust authentication).

GMail offers two-factor authentication, and Yahoo has the same feature in beta (as of August 2012). Are there other aspects to consider?

UPDATE: I accepted the answer below. The discussion has reminded me to consider the people and process involved, not just the technology.

Answer 1

For email security you can consider the following. These are common issues which are not well secured because of other factors, so the basics like XSS, virus scanning etc are not considered.

• Strict SSL-only access with no known attacks like BEAST
• Log of previous logon attempts
• Encrypted storage
• S/MIME, PGP support
• TLS on SMTP and IMAP
• High security application, which is not the case for most Webmail providers

So all of that is OK with GMAIL, Hotmail had issues with cookie handling recently (so it was enough to submit simple empty cookie for a session).

The most secure is to have email server on your own location, and protected the way, that without logging in with mailbox login / password, you cant read mail, and then simply run auto-update on the server, to make sure that the mailbox storage is not breached. Basically webmail with updates and good hardening does the effective trick good even for 100.000 mailboxes for business use.

Answer 2

Hushmail seems to be the standard for email security :

• mail encryption is directly supported
• you can either use it as a standard webmail with SSL
• or install their Java applet that will encrypt your mails locally before going to their servers
• your saved emails are strongly encrypted on their servers
• mail headers are easily accessible (one click)
• they only answer to Canadians court of law
• they can't recover your password

For more : http://www.hushmail.com/about/technology/security/