Slashdot Mirror

← Back to Stories (view on slashdot.org)

Secure Webmail Providers?

Posted by Cliff on from the a-little-paranoia-is-a-healthy-thing dept.

Rainier Wolfecastle asks: "I am looking for information on any webmail providers that support PGP/GnuPG encryption. Up until now I have been using Lok Technology's excellent service, but it appears that they have gone out of business, since their site has been unreachable for over two weeks now. I am aware of Hushmail, but that doesn't work well under Linux. I am considering using Name.Space's LokMail service (based on Lok Technology's..er...technology) but I was wondering if anyone out there has any other suggestions. Free email is coming to an end, and if I'm going to pay for it (which I don't mind at all) then I want a decent product."

4 of 56 comments (clear)

  1. Re:What's the point... by crow · · Score: 5, Informative

    The server-to-server communication is not in plaintext if you use PGP or GPG. Of course, the headers are, so an observer can see who you're talking to, just not what they're saying.

  2. Hushmail in linux by rocketfairy · · Score: 5, Informative

    Hushmail works fine for me in linux; it runs on java, so you need a browser (Mozilla works swimmingly) and a working virtual machine. Grab the latest one from Sun, make sure there's a link to it in the mox plugins dir. If it keeps breaking, try making the account on a windoze machine, and then accessing it in linux -- that worked for me the 1st time when my jvm was crashy.

    Oh, and remember -- hush security is only as good as your passphrase. Diceware!

  3. Problems with Encrypted Webmail by pete-classic · · Score: 5, Interesting

    Encrypted webmail is a tricky issue. In the final analysis you basically have to use a passphrase that is so good that you don't mind having your (encrypted) private key publicly available.

    Consider that the webserver admin(s) will have access to the encrypted private key. Also consider that the webserver (process) has read access to the key. The upshot is that if anyone gets root access to the box, gets a shell under the webserver's UID, or convinces the webserver to serve up a file that it is supposed to have read access to, the only thing between your private key and an attacker is your passphrase.

    I find all this unsettling to the point of believing that it can't be safely done.

    If anyone knows any better, please fill me in.

    -Peter

  4. Re:Web mail with i18n support - any? by pete-classic · · Score: 5, Informative

    SquirrelMail has handled this for years.

    It is totally paranoid about HTML email.

    Even comes with a bunch of translations.

    So, either set up your own mailserver (like a real man!) or find a provider that uses SquirrelMail. I use Fairplay Communications here in Colorado. They rock, and provide SquirrelMail. (And the only affiliation I have with them is that I am a paying customer.)

    SquirrelMail is where it's at. (But I am a little biased ;-)

    -Peter