If you search for private email on google, you'll get this nonsense.
Bunch of spam, scam, false advertising and maybe one or two real suggestions hidden in
the mess.
I guess the only positive result is that they don't rank gmail as neither private nor
secure email provider, 'cause that would be gross.
When you use Gmail, Yahoo or Hotmail, your messages are sent as postcards, visible for
everyone to catch, read, and store, as they make their way transferring the Internet.
However, your email messages should be treated as letters in envelopes, where only senders
and receivers know about their content.
Isn't every email secure?
No.
Encryption forbids the business model of the tech monopolies like Google or Microsoft.
If they encrypted your mailbox, they couldn't read your gmail or hotmail messages and send
them to the advertisers for targeted manipulation.
Only ethical email providers that don't require you to pay with your private data
for using their services also give you secure email accounts.
I want to make this easy to follow guide to private email providers so that you, dear
Internet citizen, have several options of private, secure, and encrypted email accounts
to choose from.
You know, just like the free market should actually be without monopoly abuses.
Even though Google, Yahoo and Microsoft don't want you to know it, there are plenty of gmail/yahoo/hotmail
alternatives that keep your messages private and secure from prying eyes of advertisers
and governments.
Email communication is personal and should be completely private.
When Gmail takes your private email messages to make profit off of you, they are exposing
your data to hackers, cyber criminals, identity thieves, and governments around the world
you can't trust.
When your email provider gets hacked, like Yahoo did couple of years ago revealing data
of its billion users, you should know about it immediately and not after your login credentials
have been on sale on the darknet for three years.
You should not be required to have a blind faith in your provider, but the code of the
service you use should be available to public to audit it for any potential backdoors, bugs,
and security issues.
Even if you don't have the technical knowledge to participate in the audit, you can at least
rely on a community consensus rather than just a single centralized company.
Your private data should be protected.
And that's why I am here.
In this guide to private and secure email services, I am hoping to make it easier for
you decide which service to switch to based on features and functionalities they offer.
Vetting process for all email providers to make it into this list includes the following
features: free basic entry for account creation, end-to-end encryption using asymmetric public
key cryptography, public cause and activism, anonymous sign-up.
There exist other features, in which providers listed here differ – do they own their domain?
Can you pay with a cryptocurrency for premium plans?
Do they have a mobile app?
Do they support IMAP or POP for account exports to use their emails on a mail client (like
Mozilla Thunderbird).
Can you sign in through tor with an onion link?
What account verification do they require?
How user friendly is their interface?
What other features do they offer?
I am going to talk about these features in all four cases, but I am not going to make
any judgments about their email services.
It's up to you to make your choice based what you consider most important with your
email provider.
Asymmetric encryption is the one where users generate two keys to encrypt their data – a
private key, and a public key.
When someone wants to contact you securely, they use your public key to encrypt the message.
To read the message when you receive it, you decrypt it with your private key.
Since public keys are available to everyone, you need to make sure nobody tried to spoof
your identity using your public key to impersonate you and communicate with your contacts.
To do that, you can encrypt the message using your contact's public key, and then additionally
sign the encrypted message with your private key.
Your contact receives the message, and then verifies your identity by pairing the signature
encrypted by your private key with your public key available to them.
In case of a match, your contact then proceeds to read the message you encrypted with their
public key, by decrypting it with their private key.
You can either manage these keys yourself, which means each time you want to securely
communicate with a new email account, you'll need to manually exchange public keys between
one other.
This gives you maximum security because only you have the access to your private keys to
unlock your messages.
It's a slower and less convenient method but certainly more secure.
If you want to sacrifice a little bit of security for significantly more convenience, you can
turn to these email providers that offer various implementation of end-to-end encryption.
The good news is that you don't need any technical knowledge.
You don't even need to understand public key cryptography I tried to briefly explain
before.
The manipulation of your email account is the same as with gmail.
You still have a private account that only you can access and only you can read the messages
from.
The only trade-off is that private keys are copied to the providers' servers to decrypt
your messages when you log in.
To maintain the end-to-end aspect of encryption, the private keys are locked by your password
that these private email services cannot access.
If you forget your password, only access to your account can be recovered, but all your
messages will discarded forever.
If you made your password strong enough, even if the government requests access to your
account, they won't be able to read your messages.
They can't ask providers for password recovery, because that would destroy the data.
You have to trust these providers that they protect your keys properly.
Fortunately, it's not entirely a blind faith.
All of the email services listed in this video have published their source codes, to make
a global audit that reviews the authenticity and security of their webmail possible.
The first private email we are going to look at is Tutanota.
Tutanota is a free and open source email service based in Germany.
The name stems from Latin and translates as "secure message".
The service offers intuitive, minimalistic and natural webdesign.
It's only an email service so there is nothing else in your way – no external links, no
advertisements, no flashy javascript.
Tutanota lets you create your secure email anonymously.
No personal information are required, no need for any contact details for verification.
I signed up for Tutanota email through Tor and they still didn't require any verification.
Just type your email, create a password and you are good to go.
Not so quickly.
Every email provider needs to have a good captcha verification to prevent spammers from
flooding their servers.
I really love that they didn't ask me to mark all pictures with store fronts.
I was a bit surprised they asked to me to read a clock.
Which was trivial to me and I did it on first try.
When your account is created, you just type in your password one more time and you are
logged in.
But because I created such a great username, my account got flagged as spam and needed
additional 48 hours for Tutanota to verify it.
I did try to create a second account with a more valid looking name to see if this is
a bug or not, and Tutanota created my account with no extra steps or getting caught in the
spam filter.
Overall, Tutanota user experience feels very nice and smooth.
Intuitive, logical, nothing new to learn.
This is exactly what a privacy email alternative should look like.
The basic option is 1 GB of free space that you can devote to your emails and contacts.
Tutatona offers you a premium version and several options to purchase more space or
aliases.
You'll have to sacrifice some anonymity because as of making of this video, Tutanota
doesn't accept bitcoins.
Which is weird because they do have a bitcoin wallet if you just want to donate.
As you can see the website is easy to navigate and requires pretty flat transitioning curve.
There is also a mobile app for android and iOS, which is still in development.
Tutanota doesn't allow you to export your public key so you won't be able to exchange
encrypted messages with external users.
Also there is no IMAP support so using mail client is not going to be possible.
However Tutanota is planning to add PGP support, 2FA, encrypted calendar and encrypted cloud
storage.
It's possible to send encrypted messages via Tutanota's application to external accounts.
You first set up a contact and enter a password that your recipient needs to know before you
send an encrypted message.
As soon as you hit send, your contact will receive a notification email with a link that
will direct them to a secure application of Tutanota, where they can read and reply to
your message confidentially, with end-to-end encryption.
This allows you to send encrypted messages to any email account, be it gmail, yahoomail,
or Protonmail.
Just make sure they know a correct password to decrypt the messages on their browser.
Tutanota can be a trusted company as they don't make any revenue from advertising,
but rely solely on premium membership and donations.
The security of their encryption is so hardcore that they are not even able to recover your
password.
Which is something to keep in mind when transferring to this email provider.
Next encrypted email service is provided by mailfence.
This is another end-to-end encryption email service but unlike Tutanota, Mailfence supports
OpenPGP so that you can manually exchange encryption keys independent from Mailfence
servers.
This is, of course, an extra security step because you are in full control.
But I'll leave it up to your judgment whether you want this much control, or could bring
yourself to trust a company with protection of your data.
Mailfence is based in Belgium, which generally offers stronger privacy customs than any of
the 5 eyes countries.
The website's interface is also simple and clean-looking.
Right in front it asks you if you want to sign up for a secure and private email service.
You can click the blue button, but if you click "No", it will take you to gmail
sign in page.
Yeah, cryptographic nerds are brilliant trolls.
Upon sign up, mailfence will require you to provide them with a verification email, where
your activation key will be sent.
I prefer methods where you can create your email without the need to tie it with your
other accounts.
If someone would want an anonymous email account on mailfence, they would need to have some
other anonymous email already created.
Email is the only verification they need so they don't necessarily require to fill in
all your personal details.
It's a privacy and not anonymity service after all.
After you sign up and log in for the first time, you get to fill in some information
about you and get to know your new mailbox.
User interface of mailfence webmail application looks a bit like from mid 2000's, and not
exactly as friendly as today's websites trying to attract the most brainless user
base possible.
Mailfence puts in you full control of your encryption.
You can generate your own keys directly in the settings of your mailbox, or you can use
a third party and upload them to mailfence.
If you are new to email encryption, you can learn it by following Mailfence's guide.
It's not too complicated, just requires some extra steps from you to learn.
Mailfence is not just a private and secure email service.
It also provides calendar and file storage where you can save your documents or encryption
keys.
Basic account will give you 200 MB in messages and additional 500 MB for documents.
You can upgrade for 5 and 12 GB plan with unlimited calendars and contacts, or get a
pro account with 30 GB in messages and 24 in documents for only a little over 8 bucks
a month.
The best thing is that you can pay with bitcoins, so if you set up your account with an anonymous
email address, you can still remain anonymous by paying in cryptocurrency.
Another option is disroot.org This company offers various services and webmail
is just one out of many applications.
As you can tell disroot is trying to go about their experience different way.
It looks like they are trying to attract people who can't afford not to use encryption – like
journalists, reporters, activists, political refugees and so on.
Disroot is one of the two services on this list that similarly to mailfence, enables
you to use third party mail clients via POP or IMAP to store your messages locally.
Disroot is an encrypted email service with SSL and TLS to transfer your messages as "envelope"
and not a "postcard".
Singing up is not difficult either.
You don't even need to supply any additional account.
There are security questions to secure your new address.
I personally don't like this method because many answers to the security question can
be easily social engineered by reading your social media profiles.
If they want to keep this method, I would suggest they allow you to make your own questions
rather then use the most easily guessable answer to the question - "what's your
mother's maiden name".
After my account was successfully created, it prompted me to a dashboard, which kind
of confused me because I wanted to see my mailbox and this wasn't it.
Then I realized I have to use disroot's main page and use the login button.
Design of their webmail is by default actually very elegant and sleek.
You have all the features disroot provides you one click away.
I am also surprised that despite being fairly new, their interface is translated to so many
foreign languages.
Like actual mailbox, and not just main website.
Protonmail should definitely take notes here.
You are allowed to make some basic customization and create filters for your inbox.
Themes are a nice feature to have that personal feel with your email.
Something I didn't see much with other private emails.
For server side encryption, disroot uses GPG encryption where you are not in control of
your keys.
If you want that extra security and are willing to trade some convenience, you can generate
OpenPGP keys and manage your encryption manually on a desktop mail client.
Disroot gives you access to a range of applications like calendar, file storage and other stuff,
which I am not going to get into because this is about mail security and privacy.
You can check it out yourself and see how disroot's offer balances against other secure
email providers in this video.
Disroot gives you option to enable second factor authentification, which is another
great feature.
You can view your activity, which can also be useful to observe any potential breaches.
And Calendar looks very nice too.
Final offer on the list is Swiss based encrypted email service made by Protonmail.
Developed by scientists from CERN and MIT, Protonmail offers top security and privacy
in their end-to-end encrypted webmail application.
Protonmail has simplicity without sacrificing security in their core.
And they really do a good job.
Setting up your email account cannot be any easier.
Pick a username, create a password, avoid recovery mail option if you want to stay hidden.
I used tor to sign up for a protonmail account to see if they cheat me and require some personal
identification but I was not disappointed.
There are several options to choose from – either email, SMS, donate or CAPTCHA.
Protonmail now takes bitcoins if you want to support their service and stay anonymous.
But if you can't do that for some reason, CAPTCHA is also an option.
A lot of CAPTCHA in this case.
But you'll get there eventually and your account will be created in no time.
Right of the bet, Protonmail will greet you with four messages.
This may be annoying to someone, but from my perspective, it gives me nice first look
at my new mailbox and I can actually start interacting with it, while being guided with
this Protonmail tutorial.
It boots up with vertical layout by default, but you can switch to horizontal with one
click from your inbox, without going to the settings tab.
I think that's pretty neat.
With 500 MB of inbox data for free, you are given tons of features.
You can sort your mailbox with labels.
In the settings menu, you can menage your protonmail subscription to notify you about
important information regarding their service, and tweak some other webmail actions.
Protonmail offers two-factor-authentification, but you can also create separate mailbox password.
This way when you want to sign in, you are going to have to enter your login password
to access your account, and then mailbox password to decrypt your messages.
If you loose your mailbox password, you can still access your account but your messages
will be discarded.
To upgrade from basic, there are several premium options as well as option to buy ProtonVPN.
While their VPN might have some credible merits, good security practice is to avoid having
all eggs in one basket.
A rule that so many sys admins ignore in today's times.
Do with that information whatever you will.
You can upgrade your storage, addresses, make a custom domain, and get some extra features
like filters, autoresponder, and more.
You can pay for all this nice things with bitcoins.
There are other features and pros and cons to every private email I mentioned here.
If I didn't get to some of them that you might think are important, tell us about them
in the comments.
This video aims to make a simple guide to the best private and secure email providers
that Internet citizens can switch to as alternatives to gmail or hotmail.
I hope I helped you make a decision on which service to choose from.
You can adjust your choice according to your needs.
Even if you don't opt in for an NSA-proof alternative where you manage your encryption
keys independently from your provider, webmail public key encryption is good enough if your
goal is to combat mass surveillance.
When a provider offers end-to-end encryption, no government can just step in with a court
order and request all user information.
They would have to break in, make more steps, narrow down their collection to a smaller
unit of targets instead of dragging everything in bulk.
In short, these private and secure email providers make government surveillance and bulk collection
uneconomical.
Too expensive for an intelligence agency to break into.
And that's our goal of the privacy advocates community.
If you are looking for unbreakable communication, then webmail interface is not for you.
In that case you'll have to do more to remain secure.
For general privacy and combat against mass surveillance and invasive advertisers, you
can still kick them in their teeth with end-to-end encrypted email providers featured in this
video.
I hope you enjoyed this guide to secure and private emails and if you do, help me by engaging
in the discussion and clicking the like button.
If you leave a comment or like, my videos will rank better and will be discovered by
more people, spreading the message for better privacy on the Internet even further.
Thank you for watching and subscribe for more coverage of cyberspace and digital freedom
in the future.
For more infomation >> London Districts: Peckham (Tour guide) - Duration: 4:14. 
Không có nhận xét nào:
Đăng nhận xét