I’m tempted, but Disroot has two things that will probably keep me away, unfortunately.
Email is stored unencrypted on their servers
The site is associated with political activism
There are technical reasons for #1 being true (and ultimately, even if they encrypted the email, I would have to trust them anyway) but this opens extra venues for exploitation. Coupled with #2, the site may be targeted by activist groups who don’t like the politics associated with them, or participants on the service might be automatically associated with it. Personally, either of these issues on their own tends to be enough for me to avoid a service. I respect Disroot but it’s probably not for me.
#2 is fair, but I really don’t see any point in encrypting emails at rest when they by design are going to third parties who can do whatever they want with it. I don’t trust emails with sensitive information, so that’s not a problem for me. I wouldn’t have email if that was an option.
I think #1 is important in part due to #2, and because it’s due diligence for maximizing privacy where possible. If you’re sending emails to somebody on a different server, then you might not want them to be accessible on your own server if it gets breached, regardless of someone else’s security. (And if their server gets breached, attackers would then only have a subset of your messages.)
Yes, I understand, but I think it’s a false premise that email can be secure at all. You shouldn’t treat it as such and you should never send incriminating or sensitive information through email regardless of what promises are made about it being secure lest it is your own server. You can talk to people in much more convenient and actually secure and even anonymous ways and email does none of that so I don’t know why it’s expected to.
Email should, for 2-way communication, at best be used to establish actually secure connections elsewhere.
For all else, it should just be treated as an inbox that random people from the internet can dump stuff in for you to check out at your discretion.
I agree with you that email is fundamentally broken, and I use it minimally for communication, but I find it to be mostly inescapable when it comes to registering any online account. That’s where I most appreciate an online service doing due diligence and making the messages unreadable to themselves as rapidly as they can.
It’s one thing to leave their proverbial door unlocked for a moment where somebody could get in, it’s quite another to leave it unlocked all the time. I just want a service that does the best they can given the terrible circumstances email provides.
I’m tempted, but Disroot has two things that will probably keep me away, unfortunately.
There are technical reasons for #1 being true (and ultimately, even if they encrypted the email, I would have to trust them anyway) but this opens extra venues for exploitation. Coupled with #2, the site may be targeted by activist groups who don’t like the politics associated with them, or participants on the service might be automatically associated with it. Personally, either of these issues on their own tends to be enough for me to avoid a service. I respect Disroot but it’s probably not for me.
#2 is fair, but I really don’t see any point in encrypting emails at rest when they by design are going to third parties who can do whatever they want with it. I don’t trust emails with sensitive information, so that’s not a problem for me. I wouldn’t have email if that was an option.
I think #1 is important in part due to #2, and because it’s due diligence for maximizing privacy where possible. If you’re sending emails to somebody on a different server, then you might not want them to be accessible on your own server if it gets breached, regardless of someone else’s security. (And if their server gets breached, attackers would then only have a subset of your messages.)
Yes, I understand, but I think it’s a false premise that email can be secure at all. You shouldn’t treat it as such and you should never send incriminating or sensitive information through email regardless of what promises are made about it being secure lest it is your own server. You can talk to people in much more convenient and actually secure and even anonymous ways and email does none of that so I don’t know why it’s expected to.
Email should, for 2-way communication, at best be used to establish actually secure connections elsewhere.
For all else, it should just be treated as an inbox that random people from the internet can dump stuff in for you to check out at your discretion.
I agree with you that email is fundamentally broken, and I use it minimally for communication, but I find it to be mostly inescapable when it comes to registering any online account. That’s where I most appreciate an online service doing due diligence and making the messages unreadable to themselves as rapidly as they can.
It’s one thing to leave their proverbial door unlocked for a moment where somebody could get in, it’s quite another to leave it unlocked all the time. I just want a service that does the best they can given the terrible circumstances email provides.