Private Email Recommendations

[Peter Loew]

You are aware that it is the meta data that is important. While they may not know the content of your email to ISIS they know you've emailed ISIS.

All they then need to do is ask you for your private key which legally you have to hand over..

I'm considering (but not addressing) different layers of security here:

1) Email and file storage and whether companies have access to your data. Should be 100% private and encrypted so that not even the hosting company can access your mail, or use bots to snoop to deliver you relevant ads
2) Hosting companies should not be at the whim or any government agencies to hand over data unjustifiably, be this for personal email accounts or corporate ones. In the US there's not even a debate or public disclosure. Companies in Norway and Switzerland have a long and proven history or taking privacy and RFI from external agencies seriously, they have different laws that better protect your privacy against these 'requests'.
2) The actual sending and receiving of emails, which will mostly be unencrypted and open to snooping anyway (message body and headers). Where possible there should be a secure feature for sending sensitive documents (e.g. passport, personal form data, etc.)
3) Internet search history and profiling to advertisers and companies that build risk-assessed social profiles on you, all without your knowledge of course. But this is what you sign up to when you use Gmail and the like. I was pretty annoyed that I found that my voiceprint was stored on my google account, funny listening to myself from over a year ago saying, 'OK google..'. I wonder who has those prints now, other than Google? Anyway, turning all that fluff off actually made my Nexus 5 battery last two days with normal use

[Peter Loew]

Also an encrypted mailbox means jack tulip, when NSA and the like can intercept your message in transit or at the source server.

It's still important there are no back doors to allow external bodies to directly access your data, like there are with the big providers. At least you have the option of sending encrypted messages when sending highly personal and sensitive information like passport copies and the like.

And if you are so paranoid, have you consider the possibility that many of the so called secure e-mail services are honey traps set by the NSA, FBI etc.?

I don't think I'm paranoid, and I have nothing to hide, just like you. I just don't want to be subject to profiling, custom ads, search history retention, location data, and more importantly the joining of all this information, of which it will be possible to infer different conclusions about my profile. I also don't want my private data to be subject to unwarranted snooping.

Edit: honey traps, yes. I've thought about StartMail in this regard, but those providers that have been around for decades now (e.g. RedBox) are trusted and proven as far as possible in my estimation.

[Peter Loew]

Also while the MTA might be in one country, the stored mail might be in another....

I'd check this before signing up.

[sal]

I don't think I'm paranoid, and I have nothing to hide, just like you. I just don't want to be subject to profiling, custom ads, search history retention, location data, and more importantly the joining of all this information, of which it will be possible to infer different conclusions about my profile. I also don't want my private data to be subject to unwarranted snooping.

I feel your pain, but that's the world we are living in. If you want to use the Internet inevitably the Internet will use you.

[Peter Loew]

I feel your pain, but that's the world we are living in. If you want to use the Internet inevitably the Internet will use you.

But a at least you can take some steps towards protecting your data. The uncoupling of your email / chat / search maps providers is probably the most important thing to consider, as well as the actual email a/ data providers themselves.

As a thought, I wonder what will happen if Google ever get into the insurance business. Or if and when rules and regulations change about who they can provide profiled data to (e.g. banks, lenders, health insurance companies, etc.). Imagine not being offered health insurance or example, based on an accumulation and joining of your personal information such as chat history, search history, location history and emails, that essentially render you a high risk and therefore either not eligible or eligible but at premium rates.

[Cliphead]

I built my own mail server using iRedMail - Free, Open Source Mail Server Solution for Linux/BSD on a VPS from DigitalOcean

Hosted in London. Dunno if that helps.

[jmo21]

I consider myself tech savvy, and none of that bothers me in the slightest.

I don't want my data hacked of course, and I get the big brother side of things (if they can get access to do this...what about in the future they push for and then do something worse)

I just struggle to care enough about it.

Each to their own and all that.

[sal]

But a at least you can take some steps towards protecting your data. The uncoupling of your email / chat / search maps providers is probably the most important thing to consider, as well as the actual email a/ data providers themselves.

As a thought, I wonder what will happen if Google ever get into the insurance business. Or if and when rules and regulations change about who they can provide profiled data to (e.g. banks, lenders, health insurance companies, etc.). Imagine not being offered health insurance or example, based on an accumulation and joining of your personal information such as chat history, search history, location history and emails, that essentially render you a high risk and therefore either not eligible or eligible but at premium rates.

And you think that when this Orwellian future comes you are not going to be charged at premium rates, just because there is no data about you? I bet it will be the exact opposite and you will be deemed maximum risk as obviously you have something to hide.

If you so wish to uncouple yourself why not just invent a virtual identity, don't link it to your real identity and use it for normal email / chat/ search / maps in the virtual world.

The biggest single problem with personal in-house e-mail server is the absolute PITA of keeping it in the White lists and out of the black lists only to be sure your e-mails will be received, which is a full time job.

[Peter Loew]

And you think that when this Orwellian future comes you are not going to be charged at premium rates, just because there is no data about you? I bet it will be the exact opposite and you will be deemed maximum risk as obviously you have something to hide.

If you so wish to uncouple yourself why not just invent a virtual identity, don't link it to your real identity and use it for normal email / chat/ search / maps in the virtual world.

It can't be the exact opposite because you can't make a quote for example on the lack of evidence, there will be information you're required to fill in and just like now it'll be based off that. Whereas, you could infer a number of things from innocent conversations, exchanges and personal data in general by continuing to expose your data to external agencies and ad companies. If your data is available and up to date then you can bet they'd take it and use it to form a conclusion. This is hypothetical of course but it really would not surprise me if it starts to find footing in reality.

The biggest single problem with personal in-house e-mail server is the absolute PITA of keeping it in the White lists and out of the black lists only to be sure your e-mails will be received, which is a full time job.

I agree, I really wouldn't bother trying to maintain a personal email server, but you wouldn't have to. Consider Runbox's email policy for example: https://runbox.com/why-runbox/email-privacy/, they provide the assurance that private really means private and is not subject to snooping or data mining.

[Batcher]

they provide the assurance that private really means private and is not subject to snooping or data mining.

Well, GCHQ & NSA would say that, wouldn't they?