2

I am looking for an alternative for my current e-mail provider (gmail). I would like to gain back a little bit more "privacy" on the internet. I would like the following things:

  1. The e-mails I send and receive are not available in bulk for companies like NSA(so best is to locate the servers outside the USA).
  2. The company that host the e-mail server stores my mails encrypted so only me and the receiver can view it.

These are the most important 2 point which come in mind right now, but maybe there are more things that can be added.

I have founded 3 options to achieve this:

  1. protonmail.ch
  2. tutanota.com
  3. posteo.de

I am kind leaning towards the first one for the reason that that the only one is that is located in switzerland. The other two are located in (I hope this is correct) Germany. After some research became clear that Germany has worked in the past with the NSA and is not really what I want.

Question: Is protonmail.ch the way to go? Am I approaching the problem from the good angle? Any thought or advise is welcome!!

Improve this question
5
  • 3
    End-to-end encryption is the only way to go. It then doesn't matter who your provider is as long as you don't use their webmail interface Commented Sep 23, 2015 at 20:37
  • You founded those? ​ ​ Commented Sep 23, 2015 at 21:00
  • Part, and only part, of your question is a product recommendation. Those are prohibited on this site. I suspect that you can reword that part of your question per blog.stackoverflow.com/2010/11/qa-is-hard-lets-go-shopping. Commented Sep 23, 2015 at 21:39
  • 1
    I'm not sure why you think that using a non-US based email carrier protects you from the NSA? I'm pretty sure that Angela Merkel's phone provider wasn't US based even though the NSA tapped it. In fact, the NSA has much greater restriction on their behaviors when working within the US, so US-based email may actually be better protected against the NSA. That said, I'm not sure why you are worried about the NSA, but that's a different topic. Commented Sep 23, 2015 at 21:42
  • I want to point out that any encrypted email solution that meets the requirements you request will also require the sender to use a compatible email client to transmit encrypted email. So email from, for example, your bank won't be encrypted no matter the email provider you use is. Commented Sep 23, 2015 at 21:45

2 Answers 2

Reset to default
3

You want end-to-end encryption. For e-mail, you can use things like PGP. There are several e-mail hosts offering users advanced Web clients to perform end-to-end crypto with JavaScript, but any second party needs to either have their own account (for hosts that do not use PGP or similar), or their own PGP key pair if applicable: you must know a public key for any secure recipient, and a recipient must be able and willing to engage in end-to-end-encrypted correspondence in this way.

If you want an actual alternative to e-mail, Bitmessage is an option that comes with several other benefits, in particular the condition of identity bound to cryptographic key components, and there are no servers that need to host your messages distinct from any others (can't tell who a message is to/from; all nodes handle all messages, seeing if they can decrypt each message they receive). See Blinked if you are interested in exploring Bitmessage these days. There are also native clients on the main site linked above, and using it this way helps you contribute to the network.

Improve this answer
0
  1. The e-mails I send and receive are not available in bulk for companies like NSA(so best is to locate the servers outside the USA).
  2. The company that host the e-mail server stores my mails encrypted so only me and the receiver can view it.

As @Neil McGuigan and @AJAr pointed out end-to-end encryption is the only way to go. However, I would suggest that you do not rely on service providers for setting all this up for you.

  1. The e-mails I send and receive are not available in bulk for companies like NSA(so best is to locate the servers outside the USA).

You want none of your e-mails to be traced back to you by any 3-letter organizations. Hence, you have to anonymize your location and your account.

VPN Clients and TOR anonymize your location. Then you would need to create an e-mail account with a provider who allows you to create one anonymously like Yandex Mail. Please note that you need to create the account using the TOR browser and always use the TOR browser to access it.

Once this is set up, you need to address your 2nd concern:

  1. The company that host the e-mail server stores my mails encrypted so only me and the receiver can view it.

For Windows, install GnuPG (a PGP implementation), Thunderbird and add the following add-ons:

  1. Enigmail (integration with GnuPG)
  2. TorBirdy (integration with TOR)

Using Enigmail, create a pair of PGP keys with a secure passphrase (say a 100 character password generated by a Cryptographically Secure Random Number Generator)

Share your signed public key with your contacts and set Enigmail to encrypt and sign all e-mails. Assuming they have similar set up too, you have successfully set up a secure and private e-mail system.

Finally, store the secure passphrase which you can never remember in a offline Password Vault like KeePass whose database file is stored within your TrueCrypt-encrypted USB drive.

Improve this answer
5
  • Thanks for your reaction. So in general both (sender and receiver) have to set up something. You can't just setup a system where you are save by using a anonymously e-mail account and that it does not matter what the other person has? Commented Sep 27, 2015 at 11:01
  • Additionally, protonmail.ch requires an invite. posteo.de requires payments. Both of which can be traced back to you. tutanota.com seems a good option to try. Commented Sep 27, 2015 at 11:06
  • You could just set up the first part of the procedure to make the mail account anonymous while setting up and using it, i.e., accessing it over TOR and/or VPN services. But doing that you would putting your trust on the mail service provider to not access or allow other organizations to access your mail. Commented Sep 27, 2015 at 11:10
  • However, setting up end-to-end encryption ensures that only you and your recipient read the contents of your mail. I would suggest that you set up your end and educate your recipient about it. Commented Sep 27, 2015 at 11:12
  • tutanota.com does not offer IMAP/POP3 and SMTP suport. The reason they give is that with those, they cannot offer the end-to-end encryption they are promising. My concerns: They say they are offering end-to-end encryption. But the mails have to be opened on the browsers. Thus, the encryption they offer is limited to their servers and by "end-to-end" they mean only till your account in their server. They are in control of the encryption which makes me sceptical about their service. Commented Sep 27, 2015 at 13:20

You must log in to answer this question.