Can someone tell me what a perfect mail or VPN service would offer?
from Squizzy@lemmy.world to privacy@lemmy.ml on 01 Nov 19:46
https://lemmy.world/post/53868373
from Squizzy@lemmy.world to privacy@lemmy.ml on 01 Nov 19:46
https://lemmy.world/post/53868373
I see a lot of comparisons and stances that cause issues. I am tangentially related to the space and am interested in what could be done. I don’t know anyone who works for these companies and do not myself. Nor do I have any financial stake.
threaded - newest
For mail, a few things I’d look for:
Standard protocol compatibility (POP/IMAP/JMAP/SMTP) so you can use a client that’s not controlled by the service provider.
Easy E2EE setup with PGP/GPG.
Custom domain support.
Email alias support (though this can be done with a third-party service, potentially).
Server-side filter rules for incoming mail.
Proton and Tuta, for example, fail on point #1. The E2EE promise really doesn’t mean a lot when the service provider ultimately controls the client. If they control the client, they could very easily exfiltrate your keys via a backdoor. This can be mitigated with open-source clients and reproducible builds, but if you’re using a web client or apps from Google/Apple stores, that’s never going to be verifiable.
For VPN:
No-logs policy.
Independent audits.
Port forwarding support.
Anonymous payment options.
These are not exhaustive lists, just off the top of my head.
The #1 is true - but I don’t really mind. SMTP is tragic at this - even if the egress is perfect and over TLS - Tuta & Proton are getting my mail unencrypted at the ingress and only then encrypt it with my private key for the rest of the journey. Now - I DO believe them they do so perfectly - but do I “really” know 🤔? If it was me - I am giving every phone a public ipv6 address and running mailservers directly on phones but that is everything but an elegant solution🤷.
The issue with VPNs is there is no way to verify their claims.
Typically, you want VPNs to promise not to collect data about you, or what sites you visit. They can promise to delete or never store data, but there’s no way to verify they are doing what they say.
Many, many VPNs have claimed they don’t store user data or allow traffic sniffing, only to later have been compromised by a government or other entity to track everything you do and hand it over to a hostile government after a subpoena / information request.
This is a more important issue than any feature or service they may provide.
But there are independent audits aren’t there? Mullvad has passed loads of these.
Quis custodiet ipsos custodes?
Quite frequently, the companies responsible for being watchdogs are in bed or compromised. One example of “trusted” companies caught flat out lying about the very thing they should have been warning everyone about are the Credit Rating Agencies:
en.wikipedia.org/…/Credit_rating_agencies_and_the…
You want one with a canary on their website
Do the canaries really work though,nothing stopping a state sponsor saying do not remove any terms and conditions or other information that may expose an operation.
It all boils down to trust in the end. Trust they don’t keep records, trust they don’t share your info, trust the canary is real, … There’s always someone else you have to trust.
Vpn: Mullvad but Port Forwarding is back.