Finance and economics mentoring
New Horizons Paraguay
Ticker tape by TradingView

Finding a Secure, Fast, and Stable Email Alternative to ProtonMail for Use with Outlook

Status
Not open for further replies.
EliasIT

EliasIT

Fake user - Alias of JohnLocke
Dec 10, 2010
2,154
0
161
Now that we've discussed how to best secure a laptop in another thread and many excellent solutions with an incredible level of expert knowledge have emerged here, I'm still missing one last piece of the puzzle.

Today, I use ProtonMail via Bridge and Outlook. It works reasonably well, but it becomes incredibly slow over time. The smart part is that you can share emails this way while ensuring that all mail is encrypted. I know you say that ProtonMail is a big lie and that it's not more secure than other email systems when it comes to handing over information to authorities and for surveillance.

But what is the best alternative then? And above all, a stable and fast system that can still work with Outlook and remains secure?

Toggle signature
If money is your hope for independence you will never have it. The only real security that a man will have in this world is a reserve of knowledge, experience, and ability!
My personal favorite thread posted in the Mentor Group. Group of investment companies to avoid licensing.
 
I personally do⁠ not like Outlook as it is heavily bloated.

Yes, definitely. They are also a company and need to comply with all laws.

I think︁ we need to split the issue in three parts:
  • Mail client
  • Mail transmission and choice︂ of server
  • Mail encryption
Proton is like the combination of all of them and you︃ can use all or just parts of the puzzle:
  • Client: Proton provides a secure webclient︄ which decrypts all mail that has been encrypted at Proton's servers
  • Transmission: Proton offers the︅ latest technology to receive/send mail over secure connections (POP3/IMAP/SMTP over SSL/TLS)
  • Encryption: Proton has integrated︆ OpenPGP
Now, let's split the matter in parts.

Client
There are many capable mail clients︇ out there. I guess many people here use Thunderbird and K9 on Android, both of︈ which are open source and support most required features. Popular alternatives include The Bat! or︉ Becky!
https://en.wikipedia.org/wiki/Comparison_of_email_clients
I am not sure if anybody out here would state that Outlook can︊ be trusted, I personally do not like the software as it is heavily bloated with︋ useless features giving hackers a myriad of opportunities to intrude (there really is no need︌ for HTML mails in the first place, TNEF and all the Office features in emails︍ (sic!) is just a security risk). Guys, please write plain text emails. We really do︎ not need HTML and inline images. It makes email fast and secure.

No matter your️ choice, you want to ensure that
  • The mail client only stores data on your premises‌ (your computer or your cloud) and does not transmist anything to his motherhouse.
  • SMTP and‍ POP3/IMAP are supported with support for SSL/TLS on all of them.
  • There is at least⁠ a plugin for OpenPGP and S/MIME (see below)
You most often have the choice between⁤ POP3 and IMAP. Both protocols have the same functionality to download incomimg mails from a⁣ server, but have slight differences. While with POP3, mails are normally deleted from the server⁢ or deleted after like 14 days (Gmail is an exception to this, they move deleted︀ mails to its archive), IMAP offers access to the mailserver while keeping all mails there.︁

POP3
  • Mails can be deleted immediately from the server
  • Mails can be left on the︂ server for like 14 days (you can set the number in any mail client), this︃ allows you to access recent emails on all devices like computer and phone
  • No mail︄ archive is on the server and can be compromised there
  • You can operate with typically︅ less than 500 MB of mail space

IMAP
  • All mails are on the server and︆ can be accessed anytime from any device
  • You can access the whole mail structure (not︇ just the inbox as with POP3): Inbox, Drafts, Sent, Spam, Trash
  • "Collaboration" with many devices︈ (or many people) is very easy as all is synced
  • If you fall in coma︉ and your boss has your login, your colleagues can continue working (good for companies)
  • You probably need 20+ GB mailspace per year in business
Of course I would only recommend︊ IMAP if you operate your own server and you can ensure that the mails are︋ all encrypted on the server with a public key and that the private key lies︌ on the server but is encrypted with the IMAP password. I am not aware of︍ any such server which is widely used.

Mail Transmission & Choice of Server
Even when︎ all is encrypted (see below), you should ensure all mail is only transmitted in encrypted️ form. It is like accessing www.offshorecorptalk.com over HTTPS instead over HTTP. With free Let's Encrypt‌ certificates, there is no reason not to use TLS throughout. Gmail and many other clients‍ are now starting to show padlocks on emails that have only been transmitted in encrypted⁠ form:
https://support.google.com/a/answer/2520500?hl=en
If you are operating your own domain, you just need to have a⁤ TLS certificate for the MX server and have the server using it when receiving email.⁣ It maybe takes an hour to set it up but definitely is worth the effort.⁢

Some furhter reads:
https://sectigostore.com/page/what-to-know-about-an-ssl-certificate-for-your-mail-server/https://docs.plesk.com/en-US/obsidi...e-mail-server-with-ssltls-certificates.59466/
Now with the transmission also comes also the choice of︀ server. There are basically two strategies:
  • operate your own server
  • use freemail / public mail︁ (Gmail, Yahoo, Hotmail, Proton)
Operating your own server is more secure, but you need to︂ buy a domain. Of course, you can use WHOIS pricavy and pay with your registrar︃ and host with cryptos, but this still gives some surface to attack your privacy. However,︄ I personally would recommend that route as it allows you to control your server. While︅ law enforcement agencies have direct APIs to Gmail etc. they won't have this for your︆ own server. You can set up your own server correctly and have all encrypted. Or︇ you can use a hosting company you can trust and use POP3, so your emails︈ stay on your severs just for minutes.

The alternative is to use freemail providers. It︉ often takes only a computer to register and you do not have to disclose any︊ personal information when registering and can stay mainly anonymous. However, even if you use encryption︋ (see below) your mail provider will learn a lot about you: whom you are emailing︌ with, when and how often. You will also disclose your IP address to them and︍ they will have your full location history.

Please note that the mail headers always will︎ use your own IP address. There are a few ways to preven this:

Encryption
There are two common ways⁠ to encrypt mails: S/MIME and OpenPGP
https://en.wikipedia.org/wiki/S/MIMEhttps://en.wikipedia.org/wiki/Pretty_Good_Privacy#OpenPGP
Both work in a similar manner and⁤ basically do the same: they encrypt emails so that only the intended recipient can read⁣ them and they sign emails so that the recipient can verify it comes from you.⁢ While S/MIME relies on certificate sellers to issue the certificates (trust in the reseller is︀ implied and the certificate for the counter part immediately accepted), OpenPGP relies on zero trust︁ and requires you to exchange the certificate with your counterpart yourself (a signed message includes︂ the certificate, you can then add the certificate to your client). While S/MIME certificates usually︃ expire after 3 years, you can have OpenPGP certificates which never expire (although you should︄ upgrade to stronger encryption, i.e. longer key length, from time to time).

While S/MIME is︅ built in in many clients, less clients support the more secure OpenPGP. Thunderbid supports both︆ of them. If there is no support, you can still rely to the command line︇ to use OpenPGP. To create a key use
gpg --generate-key
to encrypt use
gpg --encrypt︈ -r DEADBEEF -o b.txt -a a.txt
where DEADBEEF is the keyname of the receiving party.︉

You could (notice the subjunctive form) use Proton's built-in OpenPGP feature. But I would not︊ recommend as it stores they keys on the server and you never know who has︋ access to them.

I would say that in gereral both S/MIME and OpenPGP does the︌ job, while S/MIME is more widely used in corporate environments while OpenPGP is the choice︍ of geeks and nerds.

For communication with trusted parties, I would definitely recommend using encryption.︎ You could techinically use Gmail, Yahoo, Hotmail and encrypt all emails. The providers would then️ only know whom you are mailing to and how often but none of the contents.‌

Recommendation
My personal recommendation would be to use Thunderbird or any reliable mail clients, preferrably‍ open source. Operating your own mail gives you quite some advantages and I would definitely⁠ recommend you to encrypt all your email with OpenPGP (or S/MIME if the counter party⁤ has such preference). Of course, I set up my thunderbird to compose plain text emails⁣ by default.
 
I hope some good recommendations come up here as alternatives to ProtonMail that are just‌ as easy to install and use, but more secure.
 
Thunderbird with OpenPGP is easy to install and very secure.

Buying a domain and webhosting at‍ www.metanet.ch is also fast and cheap. And if used with POP3 and TLS on the⁠ mailserver, gives you almost identical security to Proton.
 
Some of my friends use posteo or mailbox.org.
But I'm not sure whether Germany‌ is really trustworthy in this matter.

A few years ago, many people recommended ctemplar from Iceland.
Unfortunately they have no IMAP or SMTP support.
And they cancelled all mailboxes a‍ few years ago because they wanted to end their services.
No idea why they are⁠ still on the market.
 
Probably not.

But again, using somebody else's security for mail handing is like putting all your high-security keys‍ in a Master 5400D outside your fence. Of course, you can do this for convenience⁠ as you do not have to carry any keys when running outside. But would you⁤ put the key to your gold vault in a Master 5400D on the street?

Why would you use somebody's mail server when it costs close to nothing to use your⁣ own server and implementation is just 10 minutes? Have you ever thought about National Security⁢ Letters?
https://en.wikipedia.org/wiki/National_security_letterThey are just sent to your provider, he will give away all your︀ data and cannot even inform you. If you run your own system, at least they︁ must send the letter to... you. And then you know and you know what is︂ next? I will reach out to @JohnnyDoe for his amazing patent to simply blow up︃ all the data they wanted:
https://www.offshorecorptalk.com/threads/patent-for-secure-erasing-of-data.42666/
 
avoid third party services

rent VPS server (backup and/or replicate to another one) and setup‌ our own mailserver - Zimbra used to be great for this purpose, one was able‍ to configure it without any deep knowledge and administrative skills by clicking the wizard forms⁠ - not sure nowadays, there were some changes in their licensing policies and all the⁤ fuss with DKIM, SPF, spam databases etc. makes it a little harder to configure -⁣ if anyone knows such a read-to-deploy solution I'm interested to learn
 
How about a VPS (or even‌ shared hosting) with Plesk? It is very easy to setup and provides better security than‍ what you would have gotten elsewhere? I would say it is the most non-geek it⁠ can get and provides good security for acceptable effort.

You need DKIM and SPF fore sure. Otherwise, Gmail︃ will not like you much in the near future.
You also need Let's Encrypt support︄ for your SMTP and POP3/IMAP server to avoid emails being transmitted unencrypted. The alternative would︅ be to buy commercial certificates each year, which sounds like too much troubles.

How about︆ those:
https://www.axigen.com/linux-mail-server/https://github.com/docker-mailserver/docker-mailserverhttps://github.com/mailcow/mailcow-dockerized
 
Yeah there are a lot of recommendations here, I thought the same 🙂
 
I think we once had a discussion about Proton and how they⁠ complied with nearly 6000 data requests:
https://www.offshorecorptalk.com/threads/do-you-still-trust-proton-mail.44955/https://restoreprivacy.com/protonmail-data-requests-user-logs/
Hence, it does make sence as also⁤ @void said, you should not rely on third parties to handle things for you. You⁣ also do not put your gold vault's key in a Master 5400D on the street.⁢ Even a shared hosting will provide you with more security than that, at a cost︀ of just a coffee per month. And then at least install OpenPGP.
 
Excellent points raised by @daniels27, and I'll try to approach this from a slightly‌ different angle without retreading too much ground.

Email, at its core, is like sending postcards‍ through the postal system. Anyone along the way can potentially read it. That's why I⁠ treat email like receiving letters: legally you're fine, but there's always some insider risk at⁤ the 'post office' (read: email provider).

For true security, imagine sending a coded message inside⁣ a sealed envelope. In email terms, that's encrypting on your device before putting the content⁢ into the email client. This way, even if someone intercepts it, they can't read the︀ actual message. When transmitting sensitive information over email, it makes sense for you and your︁ business partners to learn about OpenPGP or alternatives. New risks may arise, but as with︂ crypto currencies, if you don't control the keys, you don't control the $THING_PROTECTED_BY_CRYPTOGRAPHY. Plus, approaching︃ someone and asking for their public key might be a great conversation starter...

Hosting your︄ own email server is not a silver bullet. You're essentially becoming your own 'post office',︅ but still relying on a third party (your IaaS provider) who could potentially access your︆ emails. Plus, you're opening up to new problems:
  1. Maintaining a secure email server requires significant︇ overhead.
  2. Many ISPs are wary of emails from residential IPs or small servers, potentially landing︈ your emails in spam folders more often.
  3. If you become a person of interest, your︉ server becomes a single point of failure. Professional email providers have dedicated teams to fend︊ off attacks.
Personally, I recommend approaching email security similarly to how I handle MFA via︋ SMS. I use one number for MFA on my most sensitive accounts (banking, cloud, etc.).︌ Nobody has that number, it's a physical SIM, and my telco only allows swaps in-person.︍ The rest of the world gets another number that I don't mind potentially ending up︎ in some call center's database.

For instance, if I subscribe to emails from HSBC, I️ create an 'unpredictable' alias like [email protected]. Every important account will have a different email‌ address, but I end up seeing it in one inbox anyways. Just need to be‍ careful with the sender address in some cases.

Quoted from Home , Cock.li E-mail Hosting⁠:

"How can I trust you?​

You can't. Cock.li doesn't parse your E-mail to⁤ provide you with targeted ads, nor does cock.li read E-mail contents unless it's for a⁣ legal court order. However, it is 100% possible for me to read E-mail, and IMAP/SMTP⁢ doesn't provide user-side/client-side encryption, so you're just going to have to take my word for︀ it. Any encryption implementation would still technically allow me to read E-mail, too. This was︁ true for Lavabit as well -- while your E-mail was stored encrypted (only if you︂ were a paid member, which most people forget), E-mail could still technically be intercepted while︃ being received / sent (SMTP), or while being read by your mail client (IMAP). For︄ privacy, we recommend encrypting your E-mails using PGP using a mail client add-on like Enigmail, or downloading your mail locally with POP and regularly deleting your mail from our︅ server.

Also, there's this quote from /g/:

Administering a mail host is sort of like︆ being a nurse; there's a brief period at the start when the thought of seeing︇ people's privates might be vaguely titillating in a theoretical sense, but that sort of thing︈ doesn't last long when it's up against the daily reality of s**t, piss, blood, and︉ vomit.

Now that I think about it, administering a mail host is exactly like being︊ a nurse, only people die slightly less often"

A final note: if you're concerned about︋ authorities or surveillance, remember that metadata (who you're emailing, when, how often) can be just︌ as revealing as content. No email system can fully protect against this without resorting to︍ more extreme measures like anonymous remailers or peer-to-peer systems.

P.S. Outlook really is shitty software,︎ I hate that almost all enterprises I deal with have the Outlook + Teams setup.️ stupi#21
 
In other words, it doesn't really matter which server you host your email on or‌ which provider you use. It's about securing the sent emails with OpenPGP and then hoping‍ that no one intercepts your emails.
 
I think it always depends⁠ on what you do and what your objectives and skills are.

Proton / Tuta are⁤ certainly a viable solution. They offer their own clients etc. making it much harder to⁣ use Thunderbird with OpenPGP integration. So what can it be used for then? I would⁢ say just the daily business but nothing where you need to be sure nobody can︀ access your communication. Of course, if you are doing outright illegal things, they won't protect︁ your from any police action.

Using Gmail with OpenPGP is certainly more secure than Proton︂ / Tuta. But they still have access to email headers and know whom, when and︃ how often you communicate with.

Using a shared hosting, properly setup of course, and only︄ using POP3 makes things already better as at least they do normally do nothave a︅ FBI API integrated. Hence, the government would have to contact you or your provider.

Using your own server is certainly the best, but requires skills and the time to manage︆ it. If you do not manage it, there will be known vulnerabilities and the whole︇ setup is for nothing. You then have full control and if the counter party uses︈ the same setup, no data will be leaked.
 
The desktop version is stable⁠ to work with but there are missing lot's of functionality which you have in Outlook⁤ and other e-mail clients, for business use not the best this way.
 
Posteo.de, more secure and private than Protonmail, and cheaper. Even you can do a cash‌ payment sending the money in an anonymous letter. You cand find on the link a‍ huge comparative with many providers: E-mail providers - which one to choose?

As an email⁠ client, I personally like Betterbird.
 
now we are talking about⁠ a good solution that could work well. Sweet list btw.
 
Ubuntu 22.04 LTS as an O/S base image installed in VM with secure boot and LUKS︂ CDE (complete disk encryption - FDE) at an IaaS provider that doesn't block - or︃ will unblock - the mail ports tcp/{25,110,143,465,587,993,995}. A good provider would be Clouvider.

As for︄ mail server, a Modoboa

https://github.com/modoboa/modoboa
will perfectly fit your needs fin4774" It has intuitive interface and︅ provisioning it would be simple for you - even with several domains.

I'm not a︆ fan of Docker - using podman where non-persistent storage is required - but Mailcow and︇ Mailu, while optimaly packed are Docker containers. iRedMail is simply not serious solution and Mail-in-a-box︈ is sub-optimal - even though those solutions are installed as shell scripts.
 
Status
Not open for further replies.

JohnnyDoe.is is an uncensored discussion forum
focused on free speech,
independent thinking, and controversial ideas.
Everyone is responsible for their own words.

Quick Navigation

Forums

User Menu

Login
Community platform by JohnnyDoe © 2025 JohnnyDoe
Top Bottom