0

I am aware of some of the main competitors in this space, including: Lavabit, Countermail, Fastmail, Proton. But, I don't have enough knowledge to differentiate them. Along the same line, I don't think I truly understand what Lavabit does. It seems like it is more of a sophisticated third party encryption system than a true user friendly email system.

Although I am somewhat concerned about privacy, my main concern is security. I don't want to be tracked by google ad text as I am when I use my current gmail. And, I feel like that renders me vulnerable not only to ads, pop ups, videos but also outright spamware, bugs, etc. I recently suffered a related attack. And, I want to reduce my risk along those lines.

4

Although I am somewhat concerned about privacy, my main concern is security. I don't want to be tracked by google ad text as I am when I use my current gmail. And, I feel like that renders me vulnerable not only to ads, pop ups, videos but also outright spamware, bugs, etc. I recently suffered a related attack. And, I want to reduce my risk along those lines.

Use gmail. If the ads are unacceptable, use an ad-blocker, or a imap client such as Thunderbird.

When it comes to security, few can beat google. They have huge resources, and they can infer connections between happenings tat someone with a smaller service can't. They offer the advanced protection programme, which makes phishing attacks next to impossible, and standard password recovery attacks very much more difficult.

They monitor your habits, and blocks logins from unknown location. They alert you on the phone if they see a new login. And so on and so on.

From a security perspective, this is good. It makes it hard for an attacker to gain access, even more so without your knowledge.

So my suggestion? Stay with gmail if security is your focus. Consider using a mail client such as Thunderbird if the ads in the interface bugs you. If you want encryption, there's many possibilities, including browser extensions if you prefer to use the web-mail interface.

Regarding popups, I have never seen an popup in gmail that was unsolicited. I've never seen spamware or videoes either. I've found bugs, but all software has bugs. And google tends to be pretty good at patching bugs, especially if they affect security.

  • 2
    I don't often condone the use of Google services, but your answer is spot-on. Google is terrible for privacy, but their security is really good and their email's phishing/spam/hijack protection is excellent, especially with 2FA. – forest Mar 30 at 1:15
  • 1
    @forest and they even have Advanced Protectioin, where you have to use hardware tokens, and they will do manual password resets after verifying documents you send, delaying it for 2-3 days. If only John Podesta had used 2FA... – vidarlo Mar 30 at 8:04
1

To start, a pedantic semantic tidbit: There is a difference between a private email system (where you run the exchanging transport agent and mailbox storage yourself, on your own private systems) and a public email service that utilizes strong encryption (like the ones you listed in the question). A private server can be that much more "secure", but only if you fundamentally understand security and constantly maintain your servers and systems to keep them appropriately update-to-date and hardened. You can have much more security with a private system, but it will cost you in time & effort to keep it that way.

On the other hand, you have public services (like Lavabit) that take care of all the security hardening for you. In the cloud world this is the SaaS approach, you let someone else do all the "infrastructure, system, and application stuff" and all you care about it your data (the email). As far as security goes, the weak point is your trust in the company that you are outsourcing your email service to. And to be fair, this is always true; if you trust Lavabit (or Gmail, or Hotmail, etc) then you'll be fine. But there is nothing to prevent the guys at Lavabit from doing content analysis and ad targeting based on your emails the exact same way that Google does -- you've relinquished all control of your email over to the third party.

If you want to minimize the ability for anyone to use your mail message content, then you need to be working on message payload encryption. Think PGP here. Your message body is "garbled looking" cipher text, and you decrypt using software on your local PC(s) -- that last bit is important, if the SaaS-email provider never has the decryption key then they can't ever read the messages. Which means you could keep using free Gmail and just start using something like GPG (Gnu PGp) to handle your cryptography; but the cost of that is that everyone you communicate with will also need to consistently use PGP to read your messages and to send messages to you. In security, everything is a trade off, so we can increase security by decreasing convenience (which is the standard trade off for security, more secure means more hassle to use).

The other approach is to host your own private email system. Since nobody (Google or Lavabit) would ever have access to your email on your end (they might from the other end) then they won't be serving you [as many] directed ads. But back to that convenience trade-off, and I mentioned this one up above, you now have a freaking mail server that you have to take care of -- continually updating and securing and generally protecting from the fact that "The 'net is dark and full of terrors." So you have to chose your trade off, decide upon how un-easy-to-use you are OK with, and then follow that path to enhanced data privacy.

  • Thanks for an incredibly informative answer. I gather given my ignorance I misused the word "private" in my question, and I have removed. And, in your better reframed context I am interested in whether Lavabit, Proton, Countermail etc. compare and especially how much safer and ad-free they are relative to gmail. I bet there is a big difference. But, I would love to know a bit more about the relative position of the mentioned competitors and how much safer and ad-free would they be relative to gmail. Thanks for any additional input either within your answer or the comment area. – Sympa Mar 29 at 17:09
  • 1
    @Sympa I can't speak directly to the differences between those mail systems as I've only ever used Proton (and then only briefly). The issue with the calling any of them "safer and ad-free" is the same as saying Hotmail is "safer and ad-free." I know I might be showing my age here, but I remember when HoTMaiL (pre-MS) didn't have any ads in it; then one day they decided to turn them on. If you chose to give your email to a 3rd party, then you chose to let them have at it, period. They may not be using the email to target ads right now but they can at any time. True for any SaaS email. – Ruscal Mar 29 at 22:18
  • 1
    The other 2 answers up right now make great recommendation of buying a MS or Google mail account if ads are your only concern. That's cheaper than the services you listed, and the paid accounts aren't ad targeted. If content privacy/security is your concern you're going to be back to hosting it yourself, or using content encryption throughout. Otherwise, you're letting someone else hold onto your plainly readable email and just trusting that they won't peek... But at any time they choose, they can. – Ruscal Mar 29 at 22:22
1

I would suggest paying for a major commercial cloud product, like Office 365 or G Suite.

You get the benefits of centrally managed security. Microsoft and Google have dedicated security teams, they handle patching, disaster recovery, and so forth. Many of these points are covered by vidarlo.

Additionally, there's some significant advantages that paying ~$5/mailbox/month gives you: first, there are no ads or data collection for ads in any of these services. This addresses your privacy concerns.

Second, these services offer advanced logging and visibility that the consumer services do not. For example, you can view logging information when messages were opened. This can help detect malicious activity.

They also provide comprehensive certifications and disclosure policies that do not apply to consumer products.

Finally, Microsoft offers advanced threat protection for several dollars a month. This is a service like Fireeye that opens potentially hazardous URLs and attachments in a VM for analysis.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.