My email provider has been taken over by some group with a new privacy policy. The contents of my email will now be cross-referenced with other data about my online usage. In addition, there is a forced arbitration clause and a "class action waiver". I.e., they want to do things that people might sue them about. Big red flag.

So I'm looking for a new email provider. I have done a bit of searching, and secure email can be problematic if you send email to people who are not tech savvy. There are providers who have good reputations, but it is hard to tell what the experience is like. If anyone has any suggestions, I would appreciate them. Thanks.

_________________
The Adkins Principle:
At some point, doesn't thinking have to go on?
— Winona Adkins

Visualize whirled peas.

Everything with love. Stay safe.

I've heard good things about protonmail (https://protonmail.com/) but I have not personally used it.

I have had protonmail for a long time. Works fine. Fits the 'best you can do when worried about security' use case. Run by people who have displayed the right attitude of not treating you badly over a long period.

For the more paranoid scenarios ( i.e. a government agency wants to read your mail ), email is fundamentally no good. The old analogy of you are really writing your message on a post card, and the postie or telephone operator can read or overhear the salacious gossip. The NSA/GCHQ people are really good at reading email, if they want to. So the trick there is either not to be a person of interest, or don't use email for stuff you don't want the government to read.

Having said that I have protonmail, my actual prime usage is gmail for the high quality of IT engineering leading to reliability, in with the herd, excellence of spam and virus filtering. I accept the fact that google's computers read everything to create targeted ads. Google staff (i.e. people) do not. If the government via courts, asks Google to show them my email they get it all. If I was of really serious interest to the government, I'm confident they can read it all without asking Google by getting the NSA/GCHQ on the case.

The spam and virus filtering is an often un-highlighted benefit of Gmail. Google's staff are keeping those up-to-date and tested while you sleep. Even after the virus has landed in your inbox an update on Google's infrastructure can dip into your inbox and delete the previously delivered but unread email it now knows is a virus. That is significantly better than desktop anti-virus reliability.

With protonmail to another protonmail address, everything is encrypted all the way. Which is good, when you are dealing with intelligent sensible people. But the inevitable however. If a protonmail user sends you a virus it had better be one that your desktop anti-virus knows about at the time you open it. There is no-way any IT infrastructure at your company or at protonmail can detect a virus for you, because their computers can't read the encrypted email.

Thanks, Herman.

I had heard of Protonmail, which has a good reputation. I will check it out further.

_________________
The Adkins Principle:
At some point, doesn't thinking have to go on?
— Winona Adkins

Visualize whirled peas.

Everything with love. Stay safe.

Strictly speaking, there is no such thing as (totally) secure email. Totally secure email does not exist. How secure you want it to be? And, secure from who or what?
Remember, email goes through several hubs and internet exchanges (average perhaps around 10 to 20 exchange points). Every point in the chain is government or authority controlled, can be intercepted, can be retrieved, can be used and misused. Your email to your neighbour next door may even transfer through several hubs in other countries.
Best I think is you encrypt email yourself locally, nevermind provider and hubs/exchanges, and have recipient decrypt locally. You can use PGP for this.
Also, do you mean email or webmail. Webmail is a different matter and needs other security measures.
How secure you want it to be?

If I were a lawyer I would send each client a one time pad and a program to use it.

I have never used webmail, but I am open to whatever.

It depends upon the recipient, how secure they need it to be, how tech savvy they are. I do not want the email provider to think that they own the content of my email.

_________________
The Adkins Principle:
At some point, doesn't thinking have to go on?
— Winona Adkins

Visualize whirled peas.

Everything with love. Stay safe.

Thanks, Peter. Your experience gives you a valuable perspective.



Guess I better use my old TRS-80 for email, eh?

_________________
The Adkins Principle:
At some point, doesn't thinking have to go on?
— Winona Adkins

Visualize whirled peas.

Everything with love. Stay safe.

I am curious as to what exactly are your goals in seeking extra security.

As somebody already said, each email you send goes through many servers all over the world, potentially, each being its own access point for anybody who wants to read your email, no matter what you do. On top of it, your computer can be hacked, so can the computers of the people you email with. And the actual mailing server as well. And there are other dangers for security as well...

In short, if somebody with enough skill has an eye on you, they can read your mail no matter what. If the government has it for you, they will read your mail. If a hacker wants to hack you, they will.

So, the best solution is really being careful what you send.
If you send personal info - don't.
If you send financial info - ditto.
If you send your browser history - who cares?... do you?
And so on...

My personal solution is gmail - and using multiple accounts. I know this is not as secure as it could be, but I really do not care. I do not send stuff that can hurt me if somebody hacks it, and I don't really care if anybody reads me exchanging recipes with my mom or giving advise on which snickers to buy. I figure the best protection is large numbers - if somebody hacks gmail and gets literally billions of emails, chances that they zero in on me is slim.

On the other hand, if somebody manages to hack into one of these smaller but 'extra secure' services, chances are they will hit a bonanza and go nuts! Also, such 'extra secure' emails are more lucrative targets, when you think about it - people who use such services are usually people who send more 'interesting' messages, and are worth hacking.

But, as I do not really know your situation, it might not be a good advice.

_________________
- Bantari
______________________________________________
WARNING: This post might contain Opinions!!

My email provider has been taken over by an entity whose privacy policy is no privacy, we can do whatever we want with your emails. I know the problems with email. I have been online since 1983. The culture was different back then.

_________________
The Adkins Principle:
At some point, doesn't thinking have to go on?
— Winona Adkins

Visualize whirled peas.

Everything with love. Stay safe.

Oh, sorry, I guess I did not make myself clear. I know the above, you said so in the original post. I guess my question is: what exactly are you worried that they will do with your emails? I guess the answer is: read them... but then - what? Blackmail you? Sell your prose to the highest bidder... to do what? Publish it as their own?

I mean - if you really send sensitive info over the email, stuff that can really hurt you, there is no safe solution, no matter what people tell you. No 'better' service, no encryption, really... Best just not to do it.

Unless you have to, in which case, I see your point, and ProtonMail might be the best of bad choices. For example - if you sell stuff via email, and this is how people get their CC info to you. Or if you email your tax form to your tax guy. Just be aware - there is no really 'safe' solution. Best to try to find another way. Just saying...

_________________
- Bantari
______________________________________________
WARNING: This post might contain Opinions!!

I remember in college running across the idea of the Master/Slave relationship among European intellectuals of the 19th century. How 19th century! I thought. We have abolished slavery across almost all the world. But now, surveying the cultural changes since then, it seems to me that the Master/Slave relationship is making a comeback, in various forms. While Master/Slave may be an extreme and inappropriate description of a number of relationships, often the question is, Who is the Master?

_________________
The Adkins Principle:
At some point, doesn't thinking have to go on?
— Winona Adkins

Visualize whirled peas.

Everything with love. Stay safe.

Has anyone here used StartMail? It is the mail service of StartPage. I've used StartPage as one of the ways to limit Google's ownership of my life. Recently I have gotten annoyed at targeted adds showing up on unrelated web sites within minutes of Amazon sending me a confirmation email on a purchase. I don't know whether to blame Amazon on Gmail, so I have also been vaguely thinking about the rather daunting task of changing email providers.

_________________
Dave Sigaty
"Short-lived are both the praiser and the praised, and rememberer and the remembered..."
- Marcus Aurelius; Meditations, VIII 21

It's definitely very disconcerting. I've had the "pleasure" of ads showing up on my work computer for products my wife was looking at on Amazon on my home computer. With my logged in email being the only connecting piece. Good times. :/

And people wonder why I've started to use privacy mode almost all the time while I'm browsing the web (at least it helps). Thanks for starting this thread, Bill. At least it's giving me a little bit of info that may help, eventually.

_________________
KGS: schultz [?].

I am really asking a practical question. But it is one that has to do with online culture. I don't mean to hijack my own thread, but here is an anecdote from recently.

I had an interesting discussion with a supervisory technical support rep at Apple, about the security of personal data on the iCloud. He told me that it was so secure that users were sometimes unable to access their own data because they had forgotten not only their password, but the answers to their security questions. He was apparently unaware of the irony that the users' data was secure for Apple but not for the users, whom it was secured against.

I did not bring up the fact that I had gotten locked out of my account by Apple a couple of years before, when I had been unable to remember the answer to a security question. My answer had been a joke. I remembered the joke, but not the exact phrasing. As a last resort I was asked a security question, the answer to which I had not given. I answered it correctly, but Apple had the wrong answer on file.

Edit: BTW, this was not a case where I had called Apple up and had to identify myself. They had called me up at home! It was not as though someone had broken into my house, tried to upgrade my iPhone OS, and then waited around for an hour for them to call.

_________________
The Adkins Principle:
At some point, doesn't thinking have to go on?
— Winona Adkins

Visualize whirled peas.

Everything with love. Stay safe.

Bill,

A practical suggestion that may not have occurred to you is to move to Apple mail. I hadn't realized before that you had Apple devices and therefore an Apple ID. Apple take IT security and reliability seriously. There is a webmail interface in their icloud (https://www.icloud.com/#mail) . That isn't encrypted email exchange with others, but it is stored securely at rest in Apple's servers with strong access controls and a commitment not to trawl your data to sell the contents to 3rd parties, e.g. advertisers. So a practical answer for you that avoids the advertising indexing in Gmail.

As for your problem with security questions and whatnot. I copy and paste all those account set up questions together with my answers as well as the password into password safe https://pwsafe.org/ . Use different unique strong passwords for each different website. I treat those password recovery questions as an anti-feature really. So when it asks your pet dogs name you don't give it that but rather a >30 character close to random string just as you do for passwords.

Thanks again, Peter.

_________________
The Adkins Principle:
At some point, doesn't thinking have to go on?
— Winona Adkins

Visualize whirled peas.

Everything with love. Stay safe.