One of my friends has his own personal email hosting. Let's assume for the sake of argument that it is "secure", meaning that no third party can read the emails in his server either through hacking or a backdoor.

Does this mean that a government email surveillance system really cannot read his emails? Indeed, so long as his email conversations are with correspondents whose email hosting services are compromised, it may be possible to retrace all his emails from the compromised correspondents.

Is a personal (and secure) personal email hosting system really a protection against government snooping?


2 Answers 2


Nope it will be as secure as you can configure it and like you say the end point might not be secure. If you want to have security you should encrypt your emails with pgp/gpg.

  • And… you should secure the (all) endpoints (from any form of spyware or keylogger).
    – dan
    Jun 23, 2013 at 22:13

For the sake of argument even if the endpoints are secure, what is stopping the govt from intercepting the email within transit? PGP/GPG will solve the problem of intercepting the email within the transit. However, then security will depend on the security of the private key stored on the email server itself or in your personal computer.

In case of PRISM (as I assume that is prompting you for such a concern) not only the data itself but the meta data is also very important and can leak a lot of information. PGP/GPG can protect the contents of the email but not the header so the sender and receiver will be in clear. You can't encrypt those because otherwise SMTP servers will not be able to route the email. Also, your IP addresses will be leaked in the email header as well if you have an email server hosted personally.

It always comes down to the capability of your adversary. If you are talking about government, that is a tough adversary to beat. You need to protect the email server itself, you need to protect the server where the PGP/GPG keys are stored, you need to protect not only your own servers but the servers of the recipients as well. And it is not just installing the latest patches on the servers, you have to deal with zero day attacks if your data (the emails) are worth this much to the government.

In short, always do your risk assessment first before deciding whether personal hosting is better or not. "Risk involves threats, assets, impacts, and controls. If you're not talking about all 4, you're talking about something but it ain't risk"

  • If you want to defend from government surveillance, hiding and masquerading traffic is a must. E-mail simply does not fit the bill - it stands out too much. Jun 22, 2013 at 18:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.