Thank you. The questions posed were quite enlightening, and showed me that this needs a bit more thought.

I believe first question you need to answer is: what is your threat model?

Are you afraid of losing all your mails (backups)? Losing control over your email address? What are you going to do if you can't login to your mailbox tommorow? How much do you mind if someone else gain access to your old mails? Computer criminalists, government, rouge google admin, google scanning your emails content for targeted advertising (privacy / security)? Are delays in delivering mail acceptable? (there are more questions) Off the top of my head, the most basic fears are loss of emails and access, and people who aren't me or who haven't received specific authorization from me reading my emails. Delays are fine, as long as the mail gets out there.

backups: getmail or imapsync and backup them like files control over mail address: buy your own domain, setup on your own server or something like google apps Is buying the domain necessary? I can get five free subdomains on freedns. I do own a server, which is, for a lack of a better place to put it, in my room. privacy / security: computer criminalists: good unique password, 2-factor authentication, use only trusted devices, don't do anything stupid Sound advice. Bit of an issue since I don't control most devices available to me and the other people using the devices I do control would be annoyed at the measures I would take to secure it. privacy / security: government and google: use gpg to encrypt / sign your mails or setup your own server (with luks; remember, government can just steal your server from datacenter and there is nothing you can do about it) Signing emails is something I've been wanting to set up for a while now. How do I encrypt the mail on google's servers? It seems like my best choice in this arena is trying to minimize the window of attack on google's servers and strongly securing my own. I think your own domain + backups + google apps is pretty good setup. Secure, reliable, cheap and you can switch to other hosting without changing your email address. If you don't trust google or government (well, you shouldn't :P) then setup your own email box. Doesn't google apps require you to install their apps on your server? How would you migrate from them? Use cheap vps with static ip, it will be much easier. I doubt anyone keeps their mail server in home with dynamic ip. Problem - as a high school graduate, I don't exactly have a steady source of income. I could try to find income sources, but I'm not aware of what cheap VPSs exist.

-- Krzysztof Warzecha

Again, thanks a lot. You have certainly clarified some of the issues I need to think about. Gesh

Use cheap vps with static ip, it will be much easier. I doubt anyone keeps their mail server in home with dynamic ip.

Why should you doubt that, I've read many a blog where that is the case. A few also block any dsl ip even though there are far better ways of detecting spamming viruses which often connect from corporate networks anyway. If your provider blocks for this reason, they don't know what they are doing and you should change. Still, you can't fix the world in a day. Has your ISP refused a static IP? -- _______________________________________________________________________ 'Write programs that do one thing and do it well. Write programs to work together. Write programs to handle text streams, because that is a universal interface' (Doug McIlroy) _______________________________________________________________________

I do a combination of #1 and #2.

I have a (cheap!) web hosting account (with Dreamhost) which also provides me with an email address on their mail system. I have the DNS entries for my domain point to Dreamhost, so any mail for my domain gets delivered there.

But I only use Dreamhost as a mail drop-off point - I don't store my mail there. I have a cron job that runs fetchmail every few minutes which pulls the mail down to my home server, where I'm running dovecot, exim, and squirrelmail (webmail), and I access my mail there. (As well as make periodic backups of all the mail stored there.)

For outgoing mail I do the same in reverse. I have exim on my home server set up to relay any outgoing mail up to dreamhost's SMTP server. That gets me around the issue of not being able to send mail from a dynamic IP.

HTH,

DR

That sounds more or less like what I intended to do before asking for advice here... Thanks. Gesh

On Thu, Oct 11, 2012 at 3:56 PM, Taylor Hedberg <tmhedberg@gmail.com> wrote:

Menachem Moystoviz, Thu 2012-10-11 @ 13:23:32+0200:

...

Which do you suggest? Do you have an alternative?

I use Postfix + Dovecot on an Arch Linux Linode VPS and I'm pretty happy with it.

...

2) Hard to maintain, can crash at any moment, will drive me to early grave

It is a bit of a pain to initially configure, but after spending a couple hours getting it set up, I've almost never had to touch the configuration, except when I added SpamAssassin and, later, procmail to the stack.

Aye, but I have the following concerns regarding hosting the server myself: - Only have one server - no redundancy or reliability - No source of income -> no possibility of VPS AFAIK - DKIM, PTR, SPF, rDNS all require money and static IP (more money) Will keep this option in mind. Gesh

Basically, the suggestion I'm seeing here is: go, work, get a VPS - can probably get one for cheap - and setup Arch on it. Sounds good. Will only have to figure out how to get money... Gesh

On Thu, Oct 11, 2012 at 6:29 PM, phanisvara <listmail@phanisvara.com> wrote:

On Thursday 11 Oct 2012 18:18:10 Menachem Moystoviz wrote:

...

Basically, the suggestion I'm seeing here is: go, work, get a VPS - can probably get one for cheap - and setup Arch on it. Sounds good. Will only have to figure out how to get money...

seen this on G+ today. no idea if it can help you, but it might, depending on many different things...

http://www.wikihow.com/Make-Money-Fast

-- phani.

:-S I will try other methods, plus I'm looking for something on the order of at least a year's worth of VPS. Thank you in any case. Gesh

Reading through the responses, I find that my previous evaluation of my options was correct. The most reliable and easiest solution, by far, would be to set up a standard account, and to download a copy of all emails. The only problems with this are the lack of control and privacy. My other option is to host my own mail server, either at home or on a VPS (which would cost more), which means much lowered reliability, a couple of days' worth of time setting up a rudimentary system, and sleepless nights wondering whether it was being compromised or used to relay spam. Benefits: control and semi-ascertained privacy. Therefore, I think I should go with the first route, possibly searching for ways to ensure end-to-end encryption and to make the email address's domain my own. However, to those who support using a VPS or hosting at home - how do you deal with the lessened reliability, costs and headache? Is it as bad as I think it is, or is it possibly a fruitful and useful endeavor? Thank you all, Gesh

On Thu, Oct 11, 2012 at 06:18:10PM +0200, Menachem Moystoviz wrote:

Basically, the suggestion I'm seeing here is: go, work, get a VPS - can probably get one for cheap - and setup Arch on it. Sounds good. Will only have to figure out how to get money...

Gesh

Yes, and then spend the rest of your nights worrying about the security and stability of your own server. Seems like a lovely waste of time and money for someone who, by their own word, has little of each to spend. Really, just add two-factor auth to a gmail account and be done with it. Google has no interest in singular people. Moreover, Googlers who take an interest in data or logs belonging to singular people find themselves no longer working at Google. d

On Fri, Oct 12, 2012 at 8:49 AM, <sungpae@gmail.com> wrote:

Neither of these things would stop a truly determined government-level attacker (unencrypted mail is still vulnerable in-flight for instance), but it would be useful if you have not yet been identified as someone of interest.

guns

Being ON the Internet in itself means you cannot truly stop a 'determined government-level attacker', unfortunately. Especially true in some countries (China, for instance). My own government, for instance, probably has more reason to snoop on my communications than most criminals, all other governments, and Google/Microsoft/Apple/Facebook. Obligatory slightly-related xkcd ref - http://xkcd.com/538/ In the end, the price of being connected (and convenience) is a loss of privacy and anonymity. You could always do a John Conner and live off-the-grid, though.

On Thu, Oct 11, 2012 at 07:49:00PM -0500, sungpae@gmail.com wrote:

On Thu, Oct 11, 2012 at 02:13:54PM -0400, Dave Reisner wrote:

...

Really, just add two-factor auth to a gmail account and be done with it. Google has no interest in singular people.

It should be noted that Gmail's two-factor authentication provides no extra security if you're planning on using it with a mail client. You will have to set up an "application specific password", which is a fixed-length alphanumeric password given to you by Google. Despite the name, it is simply another password that can be used to log in via IMAP/POP through any client (`openssl s_connect`, etc), without the out-of-band verification.

Sure, what I had in mind was actually to take advantage of it. Disable POP/IMAP access and use OTP with webmail. This is true two factor auth and *does* provide added security.

...

Moreover, Googlers who take an interest in data or logs belonging to singular people find themselves no longer working at Google.

This is true, but if you were really very paranoid, you would notice

No, if you were really very paranoid, you'd realize that you just need to stay off the Internet.

that you don't have any control over how long Google keeps "deleted" email on the server, and that any unencrypted emails on a server can be obtained by governments with relative ease.

Well, I happen to know the retention policies, so this doesn't apply to me. I'll further point out that Google in particular is extremely transparent about what they give out to the government: http://www.google.com/transparencyreport/removals/government/ I'm not sure what you're trying to imply about unencrypted email and government bodies, but it sounds rather silly. Perhaps I don't drink enough koolaid.

If you control the server and mailserver, you can encrypt your drive and also have all incoming email encrypted with your public key, so that your mail isn't just sitting around on a box for the taking.

Receive encrypted email? How are you going to ensure that this always happens? I suppose you could simply deny anyone who isn't relaying over TLS (and just accept that you're going to miss out on a lot mail), but how do you control the sender's environment? There's equally many things on the sender's side (assuming they're vulnerable) that could potentially implicate you in whatever it is you're trying to hide. To expand on this, how do you control what happens to a message that you forward or write? You need to equally paranoid friends.

Neither of these things would stop a truly determined government-level attacker (unencrypted mail is still vulnerable in-flight for instance), but it would be useful if you have not yet been identified as someone of interest.

Again, if you're really going to be paranoid, just stay off the Internet. What we have here is an OP who's merely "waking up" to the realization that the definition of freedom is a bit different between meatspace and cyberspace. d

2012/10/12 Menachem Moystoviz <moystovi@g.jct.ac.il>

From the responses I've received, I gather the following: - Crypto is only going to get me so far, unless I can coerce all incoming email to use TLS - Until I have a steady income, my best bet is to use Google Apps for my domain and to download all incoming mail - probably deleting it from Google's servers while I'm doing it - Once I have a steady income, I can afford to pay for a VPS, on which it will be more likely that a mail server set up on it will be able to send and receive mail

I really appreciate the help you guys gave. Thank you.

Gesh

P.S. I'm aware of the fact that, given a determined enough attacker with enough resources, anything is hackable. However, this does not, in my opinion, absolve us from our responsibility to try and secure our systems to the extent of our abilities

Even if you delete the messages right away there is a a chance someone can recover it. By default most mail providers won`t really delete your messages but put then in a queue to be deleted. This is used in the case you loose a valuable email or so on. I work in a governmental company on the mail infrastructure and by default we retain any mail for 45 days which is vacations + a buffer in case someone deletes something and needs it when coming back from vacations. Of course the mail won`t be on your inbox but the goverment or google will be able to look on it upon request.

[2012-10-14 00:21:15 +0200] Menachem Moystoviz:

On Fri, Oct 12, 2012 at 3:19 PM, Kevin Chadwick <ma1l1ists@yahoo.co.uk> wrote:

...

Sending to you directly as this mail was rejected by the list!!! That's a pity, this mail is informative, however the mods might disagree with the tone you used with respect to Yahoo and Microsoft.

The problem isn't Kevin's tone, it's that he never gives any single reference to support his claims. He assumes people will just believe him and gives them no means to search for more information.

...

That's debateable, DOS sure, but you have much greater control and speed of access with a local mail server and past mail will still be accessible during any attack. I wasn't referring to DOS/DDOS-style reliability. In my mind, reliability ~= uptime > 99.999% Of course, you're correct in noting that the fact that a VPS is, by definition, distant from me, means that in case of a network outage or DOS attack, email is inaccessible and therefore a server at home is better in this respect.

So to access your emails when your server is being DDOS'd, you need to sit at home where you are virtually cut off from the Internet. Clearly, in this respect, a VPS is much better as its connection will withstand much larger DDOS attacks than your home DSL.

...

For other parts of the thread, it's worth noting that Google is the only one of the largest three providers that offers encryption between MTAs though it's SSL is also incompatible with some/possibly many servers and falls back to plain text. You can only check that on your own server of course. So basically, you're saying that when I send email through Google's SMTP services, they try their best to keep the connections secure? Shouldn't that be, you know, standard?

The fact Yahoo and Microsoft offer ssl to pop clients without telling them they don't offer SSL between MTAs for performance reasons is actually quite disgusting. If this is true, then it is definitely an objectionable practice, and should be widely published.

I asked Kevin for references regarding his above claims of Google, Microsoft, and Yahoo practices. He couldn't give me any. So you can decide to believe him or not, that's about it. Your "If this is true" really shows what the problem here is... This list should not be a vector for unsupported claims. -- Gaetan

[2012-10-14 10:19:10 +0200] Menachem Moystoviz:

So in essence, what you're proposing is to only upgrade from VPS to private hosting when the resiliency of my private server is good enough - i.e. not most naive setups? It does make sense, and would make backups more urgent and important.

Backups are a must regardless of your setup. Next comes the question of reliability: how much downtime are you willing to trade for convenience? Here is what I do: I nearly exclusively use my official email addresses (professional, university alumni, Arch Linux) because there are people who will notice and fix any issue 24/7, and I care deeply that every email sent to me reaches its destination; whenever I feel like reading emails, I pull them from those accounts onto my machine (and send a copy to gmail automatically - I only use them as a backup service); I read my emails comfortably using mutt and have a unison regularly synchronize the (encrypted) copy of my emails I have on all my machines. I also run postfix on my home server but only use it to run a couple of silly mailing lists that I am perfectly willing to lose for a few weeks if it so happens that I am travelling and my server breaks down. I would not trust a private VPS more, nor any server that has a single admin. Cheers. -- Gaetan

On Thu, Oct 11, 2012 at 02:13:54PM -0400, Dave Reisner wrote:

Google has no interest in singular people. Moreover, Googlers who take an interest in data or logs belonging to singular people find themselves no longer working at Google.

I would believe that googlers who are "caught" peeking at people's data are fired, though this would apply to other service providers too, not just google.

Aye, but I have the following concerns regarding hosting the server myself: - Only have one server - no redundancy or reliability - No source of income -> no possibility of VPS AFAIK - DKIM, PTR, SPF, rDNS all require money and static IP (more money)

Easydns is cheap for spf but charges per year and offer email redundancy when down. I'm not sure DKIM and SPF will help as those that block dsl connections are unlikely to be that savvy and likely drop the connection at the ip layer. I'd be interested in evidence/references to the contrary though. The RFCs say as long as your connection is down for less than 4 hours any mail shall be queued, though hotmail only waits an hour!!. In any case, any important mail will usually (some automated mail may be an exception?) be phoned through or resent due to failure notices. -- _______________________________________________________________________ 'Write programs that do one thing and do it well. Write programs to work together. Write programs to handle text streams, because that is a universal interface' (Doug McIlroy) _______________________________________________________________________