With the recent thread on privacy in Chrome, I'm thinking of switching off Gmail. What email service is best for privacy? Or if you self-host, what email client do you like best?
It is worth noting that these don't support IMAP and Contacts/Calendar like most email services do. (They say that it has to do with how they handle their encryption)
Thanks for noting that. Strictly speaking, email doesn't include contacts and calendaring, but it completely slipped my mind and I had already shortlisted Tutanota.
ProtonMail. Definitely ProtonMail. You can live off it for free as long as you delete old stuff but paying better for I think $5 a month (maybe more or less). Free is perfectly adequate for me personally though, I made the switch a couple months ago and haven't looked back. Might wanna set up auto forwarding though:
https://support.google.com/mail/answer/10957?hl=en
Another happy customer of Fastmail here, and these are my opinions why you should give it a try:
1. They often express their opinions on topics like security and privacy. Like how things impact their users, where they stand, and how they plan to do. As a user I am happy to see a company actively talk about hard topics like these.
2. While they are not the most stable software service I ever use, but they always provide timely update. They also write postmortem to explain what happened technically, what did they do, and their future plans. As a developer, I am appreciated when a software company spent extra effort to acknowledge and explain issues of their service.
3. Their business model is simple. I pay money, they provide service.
I like fastmail personally because aside from being a fast experience, I like their well written guides and articles. It helps me set stuff up without feeling like I'm just following instructions and helps me understand what I'm doing and why I'm doing it.
I can't recommend them because they recycle email addresses when you stop paying for them. Not really something I can take seriously. They should just hold your email hostage until you start paying them again. Instead, they leave money on the table and create an amateur security failure.
On this matter, Runbox is clear that it will not release/recycle the email address ever. Posteo, which I like and use, has a policy of recycling addresses after six months, which is quite harmful.
We do have plans to stop recycling email addresses quite so quickly. Having said that, if you have your own domain (recommended by most people so you can move providers) you also don't get the namespace reserved forever if you stop paying. Domains get recycled too.
I still have a hotmail account from like 20 years ago and like it. Good thing is you can convert it to an @outlook.com alias if wanted, as that might look cooler. But I don't mind the hotmail name. Who knows, maybe one day it might be cool again. I pretty much skipped gmail entirely because of the personalized ad business. I also have a protonmail account which is good, but am not using it as much.
I had one of their email account but after chaning my Skype profile, it somehow released it and had to register @outlook.com address and I had no way of getting back the old address which made a few web accounts inaccessible including Google which asked me to check my email for accessing it from a new device. All previous emails are inaccessible too. Unbelievable.
Most important thing is to buy a domain so you can port your email address from provider to provider. I’ve had the same email address and several hosts over the years.
I’m currently on Fastmail and find the service good.
Another vote for fastmail. They even do a pretty decent job being a DNS host as well. Simple setup to add subdomains if you're already using them as your primary/sec NS.
Fastmail has worked well for me with custom domains. It's nice being able to create custom aliases for when an address is publicly visible e.g. GitHub so I know through what funnel emails are coming from.
Like others have said, the Android app is not worth installing unless you're okay with limited and, in some cases, poor functionality.
I suppose you can set it up with the Gmail or Outlook Android apps? I've never tried, as this defeats the purpose of not having those companies as your email provider :)
You can funnel mail with Gmail, too using extensions. Although some online forms incorrectly reject this. Looks like this: notmyaddress+github@gmail.com
- IMAP Idle support: e-mails appear instantly, configurable on a by-folder basis.
- Mature and stable: it's been around forever, updates are infrequent, it just works.
- Free software: apache license
- No fanciness: it is very traditional-email oriented. The only "fancy" feature is a unified inbox (showing mails from all your folders), and it can be turned off.
If your e-mail is "complicated" you'll have to spend a bit of time setting everything up. For instance, my server classifies e-mail as it arrives, and I setup different synchronization schedules and notification preferences for different folders. Best time investment of my life.
I use K-9 Mail too, and while I think it's great (fast and customizable) I think it could use some gestures or more in general a UI revamp to reflect the fact we are not using Ice Cream Sandwich anymore :)
I use AquaMail as well, it's one of the few apps I pay for. I paid so I could attach more inboxes though the limit is quite relaxed. The only fancy feature they've added really is a unified mailbox, other than that it's the only android mail client I've used for the past 4-5 years now. I'm a big fan!
Co signed on Aquamail - the original author was very receptive to feature requests and fixing bugs (It was nice when he eventually added scheduled outgoing emails). The software has since been acquired but developement appears to be continuing.
Other clients that caught my eye also were Bluemail or Nine, depending on the need.
I've been using Aquamail on my tablet for years, it's a nice mail app and they continue to support is. I use it on my tablet for the swipe feature especially.
On my smartphone I'm using MailDroid Pro. Like Aquamail, I'm using it for several years now, steady updates and good support. The reason I use MailDroid on my smartphone is the anti-spam plug-in (they charge extra for that though).
This is exactly what I did a few years back. And exactly for the same reason — so I can easily migrate to different provider with low cost of swiching. So far I’ve used gmail as provider but I’m considering switching now.
Although I like the control and portability of having my own domain, as a less technologically-proficient user on a shoestring budget, I've found it more challenging to set up and configure on shared hosting services. There's a need to get your head around things like DNS records, reverse DNS, DKIM, SPF, SpamAssassin, cPanel etc. to stand a reasonable chance of successful delivery and low-maintenance inboxes. I've been through a few hosts and fortunately seem to have settled with a reliable provider now (Squidix), but it's not always been so easy.
Fastmail allows you to set them as the DNS provider and they take care of all DNS records for you. Just buy a domain, set their nameservers, and you're good to go.
I switched from Gmail too a few months ago, setting up my own domain as well.
I went with Mailfence, it's slightly cheaper than proton mail (€2.50 per month, but there's also a free tier), and still privacy focused. I think a few things could be improved (no catch all email address available, for example), but for that price I don't think I can complain.
I went with Outlook 365. I've been using it for the last 2 years at my office and really like the rules options. It's been really pleasant and the Office web compatibility is nice.
I'd love to switch away from Gmail, but its security is so compelling that, afaik, nobody else comes close. How many other companies have Tavis Ormandy's on staff to do security audits for their users, let alone free users? Is there a single other email provider that gets security right to the extent Google does?
Yeah I completely agree this is something that needs consideration. I do have an email address with my own domain but for security reasons any accounts I create are tied to my gmail address. I've known too many people who have had personal domain email addresses intercepted, particularly through compromised domain/DNS settings. One simple MX record adjustment could mean every single bank account, social media profile, etc. all can be taken over.
How does using gmail address compromised DNS? I mean if they compromise your DNS it doesn't matter who is hosting your email, they just point the MX at a different service.
Sorry, you're probably talking about using the @gmail.com domain where you wouldn't have to worry about DNS. I was thinking about custom domains in G-Suite.
> I do have an email address with my own domain but for security reasons any accounts I create are tied to my gmail address. I've known too many people who have had personal domain email addresses intercepted, particularly through compromised domain/DNS settings.
If your Gmail account is lost or compromised, good luck getting any help from Google; while G Suite support is decent, free Gmail account users are basically on their own.
To be fair here, two of these are obvious user error.
In the Etherium case, he deleted the email and wanted to get it back 2 full years later. The only way he would have recovered from this would have been to take meticulous backups (and test them regularly). I would expect any 3rd party provider to honor my wish to delete data, especially 2 years down the line (and, in fact, they are probably legally required to do so).
In the "lost in the Google void" situation, the user set up 2fa but lost all access to their 2nd factors. I don't see any reasonable recourse to this, as any "solution" Google implements would undermine the entire purpose of 2fa.
The remaining two are obvious issues with Google's service. The "gender pronoun" one is a bit odd because gender pronouns don't seem to have anything to do with the account closure (there's speculation that he was mass-reported to exploit their abuse response systems).
Is it more likely that your DNS host or domain registrar could be compromised or that Google might shut you out of your account? There's risks with either decision, personally I put more trust that my Google account will be there than in my registrar's security.
DNS as well as registrar, which may be two different entities. You can either change the MX with the DNS host, or you can change the nameserver with the registrar.
Their "end-to-end" encryption claims as well as their schtick about being hosted in Switzerland make it abundantly clear that I will never trust their security. I would go so far as to use almost any other major email provider over ProtonMail.
No OP, perhaps one could think they make such a big thing about security to try to attract lucrative accounts, which they then have backdoors into.
As you can't verify their claims, all you can do is trust. If you want end-to-end encryption you should be gpg encrypting every mail, not relying on the unverifiable word on a provider. Any provider worth its salt will know that, thus wouldn't actually advertise an insecure (as verify can't be done) system as a secure one.
You don't have to trust any of their server code - you only have to trust that the JavaScript blob they send you is actually the same as the open source version. This is the same threat model as trusting Signal from the App store instead of side-loading it yourself.
As has been frequently pointed out, they could choose one account and serve that account a different webpage just once, and harvest their password in order to decrypt all their email in perpetuity. This would be a trivial change that would certainly go unnoticed.
I fail to see how this is any worse than any of their competition, which does server side encryption. At least with ProtonMail there is the chance of them being caught serving backdoored client-side pages - with server-side you would never know.
I feel like the hate is a case of people thinking not being perfect is worse than being average or bad.
If protonmail is billed as a pgp replacement, then people will think it is reasonable to use protonmail's encryption instead of 'offline' encryption, when that's not the case at all.
Could you be more specific about these 2 issues you have?
I mean, of course the actual transit of the email from the sender to your inbox is out of their control, but after that client-side decryption is entirely feasible.
And what is wrong with hosting in Switzerland? Switzerland has very strong privacy laws.
I don't really like them anymore (for similar reasons), but I don't know as I would put all other providers over them. Certainly, I think they're miles better than gmail.
Neither Tavis Ormandy nor Google have a good track record when it comes to pragmatic security. Google's business model is incompatible with proper security. Chances are that you know Tavis from him being arrogant on project zero so everyone who runs old versions of something, like all the millions of insecure android handsets, can get owned by script kiddies. People have been listing alternatives, but the whole point of giving something like gmail away for free is so there won't be any real alternatives. It isn't like it is going to make a difference either way, since Google's position in the market mean most people won't switch.
If you have your own domain, and self-host or have a small reliable provider host for you, client doesn't matter so much. You can pick your mix of clients for various devices. This is how I've done it for over 20 years now.
Outlook.com (free) and Office365 (a few $/month/user on your own domain) are both great options. I personally much prefer both the web client and the various app clients to gmail's equivalents.
MS built Win10 to spy on you and build a business from data mining. Why would they not do that for email? (Or, more likely, change Outlook's ToS to allow it once you are hooked.)
You could say that of any email provider, but ProtonMail is under GDPR so it makes it a safer alternative.
I personally use hosted Exchange for $4/month¹ and think it's the best option out there. What matters to me is support is good, your email won't get detected as spam, they support push on iOS and they have datacenters in Europe, USA and Asia.
Since yours is a new account here, I have to ask. Are you part of the team there or are you just a user? How’s the support? Whenever I, as a non-customer, contacted Migadu, it seemed like nobody read the emails.
I also find the pricing logic a bit like it’s too good to be true, and am wary of providers who cannot sustain themselves.
I'm just a user and I'm pretty happy with Migadu as well. I only contacted them once, and got a reply within a few hours. And a real reply, with technical details, written by someone who obviously understood the question very well.
The webmail is really basic though: it's basically Rainloop (https://www.rainloop.net/) without any plugin.
I like the way that you can have regex based email address filters, so for example you could have name.youtube.com@example.com forwarding to name's inbox, this is similar to gmail's "+" feature.
I'd like to switch to Fastmail, but I have a handful of seldom-used secondary accounts (e.g., for family members), and it doesn't make sense to pay $5/mo/each when they're free on G Suite. Their pricing structure is designed for organizations or single users, but somehow my use case falls in between.
It seems a bit off that my household can stream as many movies as we want for $11/mo, or have unlimited access to an enormous music catalog for $15/mo, but e-mail service costs more.
ProtonMail looks about the same, actually more expensive, though they have a more attractive $30/mo plan for 6 users that it includes VPN access.
"Have as many email addresses on as many domains you need, anytime. No extra costs. All your projects, ideas, employees, family members and IoT devices are welcome. Pets too.
Migadu is a radically different, independent email hosting from Switzerland. We do not count your domains, mailboxes, gigabytes or teeth."
I'd highly recommend it, I've been a customer for about 2 years now I think. As per my comment above, I've found them to be rock solid so far. I also can't speak highly enough of their customer service either.
I'm just browsing their website and it seems a bit too good to be true... The only drawback I see are daily sending limits (which I'm very happy with).
I've been using them for 2 years now, I'm a big fan of the service. I thought it was a bit too good to be true at first but I was slowly transitioning from a gmail address to my own domain so it wasn't a huge issue if it fell over or something. Turns out to be pretty rock solid and I'm a very happy customer now.
As an ex-customer (with Migadu for about a year), I have nothing but good things to say. Customer support was always very quick and knowledgable. It's not a huge team so it has that "I'm a regular" kinda vibe when you chat with them. Obviously I left but it was to try out Fastmail's JMAP (?) format because I had a lot of emails that web UIs struggle to handle. That's maybe the only improvement I could suggest?
I've been using migadu for nearly two years now. I've got multiple domains hooked up with no fuss. Their service is reliable, I've only had 1 down-time issue I can remember with their service going down but it only seemed to last 20 minutes and I don't believe I lost any emails during it.
The only downside I've seen is they don't have 2FA for individual mail accounts. They do have it for the top level account management UI though which is the most important thing for me.
The support team is also great, I've not had many issues but when I have I often end up emailing the same few people and they respond very quickly (I am in an EU timezone though).
I'm incredibly happy with their quiet and high quality service.
maybe https://posteo.de/en (Berlin based) would make sense for you or your family accounts ? It's just 1 EUR/mo for basic accounts and they focus on privacy, security and being sustainable.
>Those are the guys that don't let you use special chars in passwords "in order to prevent unintentional wrong password entries".
is that really an issue? using all the special characters (assuming uniform distribution) gives you ~33% more entropy[1] for the same amount of characters, at the expense of increased input time (especially on touch keyboards) and being much harder to remember. why not just make your passwords 33% longer instead?
I would recommend Posteo, like kayoone did. Another alternative that may be even cheaper for you would be Runbox, which has lower prices for secondary accounts.
> and it doesn't make sense to pay $5/mo/each when they're free on G Suite.
It is a matter of perception. Your family members probably pay that $5 for a random coffee at starbucks. If you value your time and privacy, you'll be able to put that $5/month aside.
I'm super happy with mailbox.org, it has a feature that I've never seen in other place which is disposable addresses so that you can make accounts wherever you want without fear of spam! You just deactivate that email when you want or it will expire in 30 days.
Regardless of which provider you choose, consider getting your own domain name. Then your email address its not linked to the provider, and you can easily change again in the future.
I found that what’s even harder is dealing with commercial entities who can’t propagate the email address change throughout all their systems. So don’t release your existing accounts soon.
My recommendation is posteo.de. It’s a lot cheaper than Fastmail if you need multiple mailboxes. Browse through the site and read through the company’s values. A bonus is its focus on being better for the environment.
One point to note about Posteo is that it doesn’t allow custom domains (but there are plenty of Posteo domains to choose from). I don’t see this as a disadvantage for my use though.
Other recommendations are Runbox and mailbox.org, both being near the price of Posteo while also allowing custom domains for certain plans.
Posteo, Runbox and Mailbox.org provide IMAP support. So you’re not stuck with the provider if you want to move your mails out (unlike ProtonMail, which has an IMAP bridge only for paid accounts and is a bit more cumbersome to install/use than the alternative of just picking any email client of your preference).
588 comments
[ 3.5 ms ] story [ 366 ms ] threadhttps://protonmail.com/bridge/install
1. They often express their opinions on topics like security and privacy. Like how things impact their users, where they stand, and how they plan to do. As a user I am happy to see a company actively talk about hard topics like these.
2. While they are not the most stable software service I ever use, but they always provide timely update. They also write postmortem to explain what happened technically, what did they do, and their future plans. As a developer, I am appreciated when a software company spent extra effort to acknowledge and explain issues of their service.
3. Their business model is simple. I pay money, they provide service.
It runs a lot of the enterprise and I think it's been quite underrated in a lot of the Gmail discussions here.
I’m currently on Fastmail and find the service good.
Used fastmail for a few years and it is fine although their android app isn't great and hangs a fair bit needing to be restarted.
I eventually paid for the aquamail app which is a significant improvement
Like others have said, the Android app is not worth installing unless you're okay with limited and, in some cases, poor functionality.
I suppose you can set it up with the Gmail or Outlook Android apps? I've never tried, as this defeats the purpose of not having those companies as your email provider :)
Still searching for a good Android mail app...
https://en.wikipedia.org/wiki/Email_address#Subaddressing
K-9 Mail has served me very well over the years!
https://k9mail.github.io/about.html
Edit: Highlights for me:
- IMAP Idle support: e-mails appear instantly, configurable on a by-folder basis.
- Mature and stable: it's been around forever, updates are infrequent, it just works.
- Free software: apache license
- No fanciness: it is very traditional-email oriented. The only "fancy" feature is a unified inbox (showing mails from all your folders), and it can be turned off.
If your e-mail is "complicated" you'll have to spend a bit of time setting everything up. For instance, my server classifies e-mail as it arrives, and I setup different synchronization schedules and notification preferences for different folders. Best time investment of my life.
Give AquaMail a try.
I find it efficient, fast and featureful. I've never noticed any bugs.
The user interface is perhaps not fancy, but IMO not ugly either, and certainly functional.
I've been using it for years, and they keep updating it diligently.
Other clients that caught my eye also were Bluemail or Nine, depending on the need.
On my smartphone I'm using MailDroid Pro. Like Aquamail, I'm using it for several years now, steady updates and good support. The reason I use MailDroid on my smartphone is the anti-spam plug-in (they charge extra for that though).
I thought the same for a while, until I noticed tapping the body of an email changed the top bar options...
IMO that's the hardest piece to replace, and I'm still not happy with any alternative
Edit: forgot to add that I used this website to compare different email providers: https://thatoneprivacysite.net/email-section/
I’m not really sure if Google is more likely to fuck me over than any external actor, but it doesn’t feel right.
Not sure if it's simple but how do you intend to protect against DNS record hacks?
"How?" is not the unanswerable question for them and for that domain, that it is for you & me and you&me.com
If your Gmail account is lost or compromised, good luck getting any help from Google; while G Suite support is decent, free Gmail account users are basically on their own.
Ask HN: Lost $400k USD in a deleted email, how contact a Gmail engineer? https://news.ycombinator.com/item?id=14452969
Ask HN: What to do about a wrongly shut down GMail account? https://news.ycombinator.com/item?id=2033474
Another account lost in the Google void – how many are there? https://news.ycombinator.com/item?id=17745761
Professor who refused to use other genders pronouns, was banned by Google https://news.ycombinator.com/item?id=14905384
In the Etherium case, he deleted the email and wanted to get it back 2 full years later. The only way he would have recovered from this would have been to take meticulous backups (and test them regularly). I would expect any 3rd party provider to honor my wish to delete data, especially 2 years down the line (and, in fact, they are probably legally required to do so).
In the "lost in the Google void" situation, the user set up 2fa but lost all access to their 2nd factors. I don't see any reasonable recourse to this, as any "solution" Google implements would undermine the entire purpose of 2fa.
The remaining two are obvious issues with Google's service. The "gender pronoun" one is a bit odd because gender pronouns don't seem to have anything to do with the account closure (there's speculation that he was mass-reported to exploit their abuse response systems).
If security is your concern and long-term search isn't, consider giving them a go. Great mobile app, too.
As you can't verify their claims, all you can do is trust. If you want end-to-end encryption you should be gpg encrypting every mail, not relying on the unverifiable word on a provider. Any provider worth its salt will know that, thus wouldn't actually advertise an insecure (as verify can't be done) system as a secure one.
- https://protonmail.com/blog/protonmail-open-source-crytograp...
- https://protonmail.com/blog/protonmail-secure-email-open-sou...
You don't have to trust any of their server code - you only have to trust that the JavaScript blob they send you is actually the same as the open source version. This is the same threat model as trusting Signal from the App store instead of side-loading it yourself.
I feel like the hate is a case of people thinking not being perfect is worse than being average or bad.
I mean, of course the actual transit of the email from the sender to your inbox is out of their control, but after that client-side decryption is entirely feasible.
And what is wrong with hosting in Switzerland? Switzerland has very strong privacy laws.
Source: https://www.blog.google/products/gmail/g-suite-gains-tractio...
Reading your email for data gathering is their entire business model so if they don't explicitly say they don't, you should assume they do.
MS built Win10 to spy on you and build a business from data mining. Why would they not do that for email? (Or, more likely, change Outlook's ToS to allow it once you are hooked.)
You could say that of any email provider, but ProtonMail is under GDPR so it makes it a safer alternative.
I thought GDPR was European union? Protonmail is in Switzerland.
https://fastmail.blog/2018/05/24/gdpr-is-here/
https://www.sevenforums.com/tutorials/280093-outlook-com-opt...
[1] https://products.office.com/en-us/exchange/exchange-online
I also find the pricing logic a bit like it’s too good to be true, and am wary of providers who cannot sustain themselves.
The webmail is really basic though: it's basically Rainloop (https://www.rainloop.net/) without any plugin.
It seems a bit off that my household can stream as many movies as we want for $11/mo, or have unlimited access to an enormous music catalog for $15/mo, but e-mail service costs more.
ProtonMail looks about the same, actually more expensive, though they have a more attractive $30/mo plan for 6 users that it includes VPN access.
"Have as many email addresses on as many domains you need, anytime. No extra costs. All your projects, ideas, employees, family members and IoT devices are welcome. Pets too.
Migadu is a radically different, independent email hosting from Switzerland. We do not count your domains, mailboxes, gigabytes or teeth."
The only downside I've seen is they don't have 2FA for individual mail accounts. They do have it for the top level account management UI though which is the most important thing for me.
The support team is also great, I've not had many issues but when I have I often end up emailing the same few people and they respond very quickly (I am in an EU timezone though).
I'm incredibly happy with their quiet and high quality service.
Also, it doesn't work on your domain.
is that really an issue? using all the special characters (assuming uniform distribution) gives you ~33% more entropy[1] for the same amount of characters, at the expense of increased input time (especially on touch keyboards) and being much harder to remember. why not just make your passwords 33% longer instead?
[1] according to https://en.wikipedia.org/wiki/Ascii85
It is a matter of perception. Your family members probably pay that $5 for a random coffee at starbucks. If you value your time and privacy, you'll be able to put that $5/month aside.
[1]https://www.fsf.org/resources/webmail-systems
Good opportunity to adopt a password manager and make your passwords strong.
One point to note about Posteo is that it doesn’t allow custom domains (but there are plenty of Posteo domains to choose from). I don’t see this as a disadvantage for my use though.
Other recommendations are Runbox and mailbox.org, both being near the price of Posteo while also allowing custom domains for certain plans.
Posteo, Runbox and Mailbox.org provide IMAP support. So you’re not stuck with the provider if you want to move your mails out (unlike ProtonMail, which has an IMAP bridge only for paid accounts and is a bit more cumbersome to install/use than the alternative of just picking any email client of your preference).