🔗 David Sommerseth<p>So I've given <span class="h-card" translate="no"><a href="https://noc.social/@mailfence" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>mailfence</span></a></span> a very quick test on their Free tier.</p><p>That seems to be quite reasonable alternative for e-mail services. In som parts it's what I would expect <span class="h-card" translate="no"><a href="https://social.mailbox.org/@mailbox_org" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>mailbox_org</span></a></span> being. Except of one thing: Unencrypted incoming e-mails will not be stored encrypted. </p><p>Since I'm on the free tier currently, I've not tested the IMAP integration.</p><p>The weakness of <a href="https://infosec.exchange/tags/Mailfence" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Mailfence</span></a> and <a href="https://infosec.exchange/tags/Mailbox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>Mailbox</span></a> are that the PGP setup requires some efforts to happen. The "settings" panel on Mailfence is cleaner and better organized than mailbox.org, but the latter one is capable of ensuring all received e-mails are stored encrypted - regardless if it was encrypted at arrival or not.</p><p>PGP key management is still not as easy as it should be for non-tech users. "It should just happen automatically", is my stance here. It's close to being good, but you need to explicitly enable encryption on each mail you send - unless you reply to an already encrypted mail. This will confuse users and it will result in more unencrypted mails sent than intended.</p><p>Neither Mailfence nor mailbox.org will decrypt encrypted Subject fields.</p><p>I've briefly tested the WebDAV integration, which seems to work. But WebDAV is not end-to-end-encrypted, so uploaded data will not be stored in so-called "zero access" mode. This means the Mailfence people managing their servers can access and read your data. This will be the same for CalDAV/CardDAV too (calendar and contacts synching)</p><p>Mailbox.org recently announced they will upgrade their login system - which is long overdue. Their OTP setup is currently just confusing and very far from user friendly. Here Mailfence is very straight forward.</p><p>Both Mailfence and <a href="https://infosec.exchange/tags/mailbox_org" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>mailbox_org</span></a> still got quite a long way to provide a properly privacy enabled service. They're on a good path, but currently far from the capabilities of <span class="h-card" translate="no"><a href="https://mastodon.social/@protonprivacy" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@<span>protonprivacy</span></a></span>, even on the most basic features in e-mail.</p><p><a href="https://infosec.exchange/tags/privacy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>privacy</span></a> <a href="https://infosec.exchange/tags/email" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>email</span></a> <a href="https://infosec.exchange/tags/pgp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>pgp</span></a> <a href="https://infosec.exchange/tags/openpgp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>openpgp</span></a> <a href="https://infosec.exchange/tags/emailservice" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#<span>emailservice</span></a></p>