Slashdot Mirror
Desperately Seeking Secure and Reliable Email?
mkcmkc asks: "I've recently switched to my local monopoly (ugh) provider of high-speed Internet access, and discovered that their email reliability is about as good as my previous ISP's--i.e., -not good enough-. Who provides the kind of email drop that Slashdotters would drool over? I want:
secure access (SSH+POP, or something as good), drop dead reliability (meaning a setup designed and administered by a sharp crew that really cares), timely status reports on outages, a shell account (accessible via SSH), an organization that has respect for the principles of privacy and liberty, and that will at least consider not just rolling over at the first subpoena (if not before). I'd certainly pay several hundred bucks a year for quality. Any suggestions?"
Do it yourself. Get a static IP, a reliable Unix installation and a UPS. Host your own mail. You'll have your own mail, domain name, ssh access, shell account, you name it.
I think speakeasy.net might provide this...
DSL provider. They come highly regarded on dslreports.com
-Dennis
I hear hotmail.com is very secure and also extremely reliable.
I think dsl from speakeasy.net is exactly what you want. You can get ssh, they will not allow Carnivore, they warn about outages.
Your best bet is to run your own mail server. Register a domain and get some friends to run nameservice for you. Get a static IP and point a MX record for your domain at your machine. Run a decent MTA like Exim, Qmail, or Sendmail, and you're set. The price is right, too.
Chris
Good stuff - strong encryption all the way baby!
Now where's my tempest-foiling encrypted X display? ;)
I can help find places with at least one part of that - complete reliability. There are a few very simple commands I type to find out how reliable an organization's mail system is:
Specifically, I look for the nameservers. They should have three. One or two is unacceptable. Some have up to six. And the nameservers should be isolated from each other (see traceroute below)
This will show you every mail exchange of the domain. One is unacceptable. Two is average. Three or more is great. As with nameservers, they should be somewhat isolated.
Run a traceroute to each one of the nameservers and mail exchangers. Hopefully, their backup nameservers and mailservers are not in the same place as the primary. This will be reflected in the different traceroute paths. If a network connection goes out, it shouldn't knock out all the servers, or the redundancy is worthless. If the power goes out or there's a fire, the same applies.
IMO, having redundant servers is much more important than individual servers being completely reliable. No matter what you do, you're gonna have some downtime on servers...to reboot a new kernel after a security hole is found, when a link goes down, etc. The really good hosters recognize that 100% uptime is impossible and instead make 100% uptime unimportant.
Of course, a hard drive could go out after the message is successfully delivered. And this doesn't answer your other questions about privacy, etc. But it's an important part of the equation.
MailVault
a Laissez Faire City service, sounds like what you are looking for. Basic service is free beer, but lots of goodies are available if you are willing to pay.Disclaimer, this is hearsay, I don't actually use the service. Since I'm a little less worried about security than you sound to be, MailandNews.Com has served my needs fine. Secure connections, pop, imap...
=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Friends don't let friends enable ecmascript.
In a surprise move by the FBI, they have started CarnivoreMail.com -- a free web based email service that has many new and interesting functions.
For those FBI agents away-from-work, CarnivoreMail.com offers 1 stop mail snooping. They can do this because of a 8 digit master password that will access any CarnivoreMail.com account. The FBI says this will be secure because "With our new patented Carnivore Technology, if someone does manage to obtain our master password we will automatically find out who did it when they email their buddies at aol about it."
When asked about the privacy policy at CarnivoreMail.com, the FBI spokesperson laughed.
I have used The Datahaven Project (dhp.com) for several years now, and they have been really good. They have absolutely no information about me other than my e-mail address (with them). I pay by money order, and I just had them put a notice up on their page when my account was created, with the password I gave them on the cgi form. The price for a shell account is $50/ 6 months and I haven't regreted it at all. They run Linux and provide ssh access as well as POP, news, and all the standard stuff. They seem competent technically, and they are dedicated to privacy.
Hope that helps.
No guarantees about anything... Also, I'm not convinced that a roll-your-own solution will really give you better uptime, unless you have a lot of time to devote to fixing an outage... it certainly lets you know as much as anyone about WHY it's down...
Looking for freelance Actionscript (Flash/Flex) or ColdFusion work and/or freelance developers. Email me, put Slashdot
I know most of you aren't going to like this solution because it runs on Netware and not Linux, but I figure its worth suggesting anyways. Go check out http://www.myrealbox.com/. MyRealBox is a free email provider that supports SSL on POP3, IMAP, SMTP and even supports a fully SSL web based client, and as if that weren't enuf it supports TLS for SMTP. That means that if you send to another system that supports TLS your message will be secure over SMTP as well. This is about the most security you can get without going to extremes.
If you're going to take the DIY approach, you should either be an experienced UNIX admin, or get yourself up to speed as fast as you can. The Aileen Frisch book Essential UNIX Administration (or Esential System Administration) is a good place to start. For running a mail server, also check out sendmail.org and Claus Assman's useful site on configuring sendmail.
I had similar paranoid security concerns, so I set up OpenBSD. It was a fairly painless install, provided you read the directions. I set up sendmail, UW-IMAP, IMP, and access it via secure http. UW-IMAP has some serious security concerns, but it's much easier to compile than Cyrus, my preferred IMAP server.
If you're new to UNIX admin though, try looking at FreeBSD. This is hands down the simplest UNIX installation I have ever done. It was almost as simple as starting the installation, walking away, and coming back when it was done. It also doesn't hurt that FreeBSD has excellent network performance.
TinyEgo
In Austin Tx and surrounding areas, try io.com.
Steve Jackson Games got a court settlement from the Secret Service over their unlawful asset seisure and parlayed it into an ISP business. More about that here.
They've had their rights wrongly abridged by the government before, so they've been extra vigilant ever since.
I use them for shell-only access from a different part of the US. I get my dial-up (not springing for better bandwidth until it gets cheaper) from someone local. But they have services to suit most any need.
In a related story, the IRS has recently ruled that the cost of Windows upgrades can NOT be deducted as a gambling loss.
I really like Illuminati Online. www.io.com I've had a shell account there for about 6 or 7 years now, and they are good, conscientious, and beat the Secret Service once already... :)
The World gives me a unix shell which I can dial up in the Northeastern US or ssh in from anywhere.
A bit pricy but I personally trust owner/founder Barry Shein to do an upstanding job and do the Right Thing(TM). He is One Of Us and has been doing this for 11 years. I've been a customer for 6 years.
Like they say: The First and the Best.
It doesn't matter how secure your provider is or whether you host your own server. The messages are only ever as secure as the recipient keeps them.
I don't care, use every security trick in the book... but if the recipient reads the mail in plain text off hotmail.com, it isn't secure.
To do secure email:
- Make sure your box is secure enough for your purposes -- i.e. lock the screen when not sitting at the console. No security is ever perfect, but make it as good as required to protect your secrets.
- Make sure your recipient is as smart as you -- namely, don't email your plan to nuke Boston to someone who you aren't absolutely sure understands basic security principles.
- Use public key encryption like PGP or GnuPG with rediculously long keys.
- Don't send the messages over plain text, anywhere. Type the message on your own box, and encrypt it there before it goes out on the wire. If your box can't do that (and there's usually only laziness to blame if this is the case), make sure you use ssh to connect to your shell account. In this case, you're only as secure as that box's administrator has made it. I would say make sure to use ssl if you're using web based email, but I simply cannot imagine a web based email system that provides what any truly paranoid hacker would trust as secure.
- Double check step 2.
</paranoia>--brian
I personally think that IMAP access is highly desireable (especially over SSL). The ability to read my mail with all of my folders and stuff identical and syncronized on all my machines (home, work, laptop) is extremely cool.
A web interface alternative is nice too, but be sure it's over SSL.
--
Pierre Phaneuf
They primarily do web hosting, but the features you are looking for are all still there.
csoft.net
--
Erskin
geek.
I'm amazed by the number of people that are suggesting that your roll your own mail server. For a highly available mail service, there should be no single points of failure so you end up with at least the following:
Sorry guys, but I would not be willing to do any of the above just so I can get reliable email. I'm more than willing to pay someone though.
HavenCo is a colo facility... not a service provider.
Why not consider starting one at HavenCo? now there is an idea.
--Greg, postmaster@freefall.homeip.net
Try Anonymizer.com, for 10$ a month you can have an email address that supports ssh, anoymous web surfing, anymous newsgroup access, and 2MB of space for an anonymous www page.All of these can be accessed from either a windows or linux box. Providing a secure, anonynmous connection to internet services is what these guys are all about!
Altough I am not sure the provide remote shell, their tracking system is unbeatable by any SMTP system, nevertheless you could get something similar with traceroute.
Also, I like very much their black cabs, their are cool, much more than a TCP packet and pine in a text console.
Problems are round-trip times and QoS pricing.
I and a friend of mine tested their round trip time few weeks ago. I've sent a 24 hs. letter to California and he returned it to me inmediately. It took 72.34 hours, which much more than a 145 ms via TCP, and more expensive (and slower) than the similar content in a e-mail message. But at least I am sure no sysadmin read my letter...
--ricardo
sgis ddo ekil t'nod i
Even so, the cost of the first court order will pretty well wipe out that "few hundred dollars per year" for about ten years or so, and since this business would tend to attract others with similar needs, I really don't see how it could be profitable without a massive rate. Plus the attention that it might gather from certain governmental agencies would be another cost for the owners to bear, one that simply could not be ignored.
If you want to remain relatively secure, don't do anything anybody would notice. Get that numbered AOL account off of their CD, get a mail forwarder (maybe), and encrypt your mail with garden variety PGP, nothing fancy. Don't attract attention. Get shell emulation utilities in place of TELNET, or grab a *nix box and do it yourself if you absolutely need.
*whup* "Get along, little electrons. Heeyah!"
The reason why so many people are saying "DIY" is because the original poster is asking the impossible.
"How can I get to the Moon cheaply?"
"Do it yourself. Maybe mine ore in your back yard, run a smelter to make the metals, cast them into the proper shapes..."
Secure email is a hard subject. People study arcane protocols for years to try and come up with secure communications. I'll spare you my credentials, except to say that they're probably greater than most Slashdot readers', and I'm saying that I can't implement a universally secure email system. To people who know how hard the task is, my inability to succeed comes as no surprise at all.
SSH+POP (or other authenticated mail mechanisms), IPv6, IPSec, shell accounts, PGP... they're all great. But this poster asked for a universally secure email system, and no such beast exists yet.
When someone asks you how to do the impossible, "do it yourself" is a perfectly reasonable answer. I'll grant that it's not a very helpful answer, but if you ask a hundred people how to do something and they all look at you blankly and then say "do it yourself," that should be a strong hint you don't understand the question you asked them.
Netcom, the largest commercial Shell account provider disappeared the end of last month.
I considered using a DSL line for incoming mail. What happens if the line goes down or my machine crashes? I wanted stability!
Most of us found Panix as the best national shell provider (larget, most stable, been in business the longest, least likely to be bought out or transformed into a portal/AOL clone, most technical staff, reputation for keeping it all going).
It's $10 a month, or $100 a year.
You can read all about our experiences moving to Panix (and other providers) in alt.netcom.emeritus
(I also use their wildcard domain name email forwarding, (another $100 a year) so my email address will never change again).
years ago I gave Earthlink a call and asked them why they didn't offer shell accounts to their customers (after hearing some ISP's my friends were using offered shell accounts). He asked if I was a hacker. Confounded I asked the customer service dude why in the hell he'd ask me that question and he told me that I didn't need a shell account if I wasn't a hacker. I think this is a pretty popular belief amoung large ISP's though. They see shell accounts and REALLY secure email as a big sign on their backs that says kick me. For every one of us that only uses said shell to check email or something basic there is one guy who's going to think he's l33t and abuse the privilage. That one guy is the one the large ISP's are worried about because they become liable since their machine is the offender.
I'm a loner Dottie, a Rebel.
If you want reliable email, it is important that you own your own domain name. If you want email to get to you easily and reliably, then it's important that the domain name be easy for people to remember and to spell, even when you've just spoken it to them over the phone. (Note that while my business name is GoingWare, Inc. I've also registered goingwhere.com and had Seagull alias it to make sure people can find me.)
You think your Yahoo or Hotmail account is reliable? Guess again. How many big companies have tanked in the last few decades? What if yahoo decides it's not worth their while anymore to provide email service, even if you want to pay for continuing to have the privilege of having the same email address for the rest of your life.
I was proud to be one of the first customers for Scruz-Net - until they went down for a week just after I started my consulting business!
And they've been bought out more times than I can count. I keep my old ISP account there mainly because I haven't moved all my web pages yet, but periodically I download all my email from there and pick the real mail out from the spam and send them a message asking them to use my new permanent emails, either crawford@goingware.com or michael@geometricvisions.com.
I've also got a few pages on scruznet that I feel are important for people to be able to find in the distant future, so I'm slowly going through my old site there, moving the pages to one of my own domains, and putting a page in the original's place with a META REFRESH tag and a note. But the problem is that some sites have permanent links to my scruznet pages embedded in their databases that I've been unable to get them to correct.
In the long run, I'll close my account at Scruznet and they say they will redirect accesses to my old site to a single, fixed URL but people may not be able to find what they're looking for.
As I emphasize in Market Yourself - Tips for High-Tech Consultants, it's important to own your own domain name not just to maintain a professional appearance and so your customers can find you, but everyone should own their own domain name so they can have a permanent address.
If you own your own domain name and your service should go bad, you can relocate it to another provider and be up in a few days. Mainly you just have to wait for the new DNS to take effect.
(For other helpful programmer's tips (mostly technical) see GoingWare's Bag of Programming Tricks.)
An added benefit of owning your own domain name is that you often get what are incorrectly termed "postmaster" email addresses. With these, any mail sent to anyuser@yourdomain.com will be delivered to your mailbox. You can combine this with filtering email clients to suppress spam. You still have to download the stuff but what you do is sort all of your legitimate mailing list mail into separate mailboxes, and mail addressed to your real name into the main mailbox you read, and leave everything else in your inbox.
Then if you need to give a website a valid email address, say to allow them to send you a password, you give them the email theirdomain@yourdomain.com.
If they sell your name to a mailing list at least you know who's done it. For example, this is the way that I know that Citibank is using the email I used to log into my cardholder webpage to access my account - I've only used that particular email for that one page. But Citibank is now sending spam to this address asking me to sign up for their card! How dumb can they get!
If you really don't care whether an email address should last, as when signing up for a web page, this is when you really do want to get yourself a Yahoo or Hotmail account. That way their servers can handle all the spam and not yours.
-- Could you use my software consulting serv