What do you folks use instead of Proton and Google? Ideally I’m looking for:
- Non-profit.
- European-based if possible.
- Paid is fine.
- Low-risk. E.g. unlikely to disappear, unlikely to go bankrupt.
My reason to want non-profit is that it’s the best way to align mine and the provider’s incentives, I think. I’d consider for-profit as well, but it’s best if it’s a non-profit.
So far I like disroot a lot. But they are principled about being unpaid, so if the financial ends don’t meet each other my emails will be in trouble. I’m donating to them, but I have my worries. I’m willing to pay a little if I know that my money will go for a quality service, for expansion of coverage (new users) and for open-source technologies.
Proton and their founder Andy are just a piece of sh*t in terms of upper management, so that’s not worth discussing.
Posteo seems adequate. Tuta feels similar to Posteo with a bit more push for fanciness. Is there something similar but non-profit?
Is the impression I’m in a minority and a lot of folks aren’t fans, but I’ve been absolutely satisfied with Tuta for email and calendaring, and with a private domain attached I have virtually unlimited email accounts. I choose to pay 36 Euros per year to that vendor, over the alternatives.
I am using Soverin and they are neat, private, no ads, no tracking and hosted in Europe.
Wrote a blog post about it: EU made email, feel free to check it out
Looks quite good to me actually! I like infinite aliases stated right away. The price seems reasonable. I’d wish they’d have inbound encryption with user-provided PGP keys though - a feature I’m looking for, personally.
I’ve settled on switching to startmail. Its pretty cheap, based in the Netherlands, offers aliases, (which are important to me for keeping emails organized and privacy.) and allows emails to be pgp encrypted. The pgp encryption is honestly a better feature than proton’s encryption since you can communicate with people who don’t have a proton account and still keep emails secret from the provider. (cough cough)
Also it offers IMAP support so I set it up with thunderbird, and I don’t have to bother with plugins or anything like with proton. I’m honestly more happy with startmail than I was with proton so far, although its only been a few days.
Thanks for the response! Do you know if startmail has inbound encryption? That is, I give them my locally-generated public key, and they encrypt all incoming emails immediately as they arrive?
Happy posteo.de customer here. Keep in mind you can not use your own domain and the payment process is a bit weird due to privacy reasons.
I used int.pl as burner in the past. Idk about their reputation but their imap/smtp work fine.
mailbox.org is noteworthy too, but I don’t think I know any non-profit ones unfortunately.
Thank you for your response! This was one of two main contenders for me. What I’ve found about mailbox is that they have medium-strength stance on open-source (using, but not using only this). They likely support inbound encryption with a user-provided PGP key (“PGP-encrypted inbox” https://mailbox.org/en/prices/#compare-all-features--2). They are reasonably priced and upgradable with some additional payment to have VoIP support.
The other main contender for me was posteo, and after thinking and reading over the last 2 days, I’ve decided to go with them. In particular, I’ve liked:
- Very good docs, saying what exactly they do. I could read all the details I wanted to know.
- Strong stance on open-source: “our product offering exclusively uses open source software and free protocols, for security reasons. We only use Javascript which has open source code.”
- Sustainability, e.g. they only use permanent contracts for employees. (And many other points that resonated with me.)
- They don’t have calling support, but I consider it even better actually, because I want my emails to be very reliable, cheap and de-coupled from the rest of things. Calling I can honestly self-host just fine, since I don’t have to worry much if stuff breaks or changes (as opposed to email, which would better be stable for me).
Again I actually value having read about mailbox as well - it’s a very good alternative!
This. Very happy mailbox.org user.
Amazing service. They had a price increase recently I think. They never bother me and the service works great so no complaints.
price increase and yet still the cheapest i’ve seen for what they’re offering.
I will wait how the situation at Proton evolves I have recently prolonged so I am not in hurry. Right now nothing changes the fact that most of the services are still e2e and more secure than most alternatives, if that changes I have no problem switching. And I find encouraging that despite Yen being an ass there is actually good amount of employees that consider what they do in Proton their mission and they have passion for it and I hope Andy won’t squash that…
who knows if this will have any impact, but users are voicing their opinions here, asking Yen to be removed
Thanks for posting this, I just voted on the issue as well.
I voted there too 😀
For me personally, this quote was insightful:
When someone shows you who they are, believe them
That being said, man, you’ve just paid them. Of course I’d also not just jump overboard all of a sudden.
Oh I believe them. But I also see that he built a fairly successful company focused on privacy (and security) and despite everything he has done lately they, the company, are listening to users (albeit quite slow) and they have no obligations to investors and that is one of their more important premises. So while I agree that Yen really needs to go, I still like Proton as a whole and I sincerely hope that whoever comes after Yen will be better and not worse than him… A
posteo.de Mail, calendar, contacts. Wonderful.
Thank you for the comment! This is the provider I went with in the end. In particular, I’ve liked:
- They support inbound encryption with my public PGP key.
- Very good docs, saying what exactly they do. I could read all the details I wanted to know.
- Strong stance on open-source: “our product offering exclusively uses open source software and free protocols, for security reasons. We only use Javascript which has open source code.”
- Sustainability, e.g. they only use permanent contracts for employees. (And many other points that resonated with me.)
- They don’t have calling support, but I consider it even better actually, because I want my emails to be very reliable, cheap and de-coupled from the rest of things. Calling I can honestly self-host just fine, since I don’t have to worry much if stuff breaks or changes (as opposed to email, which would better be stable for me).
It’s a bit limiting that they don’t support an unlimited number of aliases, but at least they support 3 of them, and the “+” sign same as google and many others do.
They also offer 3 aliases as a base and you could add more for extra payment. They’re pretty cheap too.
In wish they would allow custom domains.
Im happy user of https://www.migadu.com/ - they are located in Europe (Switzerland).
Migadu is great!
Happy user of Infomaniak, they’ve been in this business since 4 years before the web existed, so I hope that translates to more staying power. And they’ve only grown every year since then, so far without selling out. The majority stake is owned by the non-profit Infomaniak Foundation.
It looks interesting. However, few things are hard for me to process:
- They seem to be busy with hosting, an IPO last month and honestly quite interesting sounding projects like home heating as a heat sink for their datacenters. That honestly sounds interesting. But on the other hand, for emails specifically, I’m thinking of something very single-focused, narrow-scoped. “Do one thing but do it well” type of approach.
- I got lost in their docs trying to understand if they support inbound encryption with a user-provided PGP key or not.
- They require SMS registration. Like reaaalllyyyy? Sorry for this emotional part, I just so didn’t expect this. It’s a disaster from almost every possible angle. It’s terrible security, trivially remotely hackable. Terrible privacy. I guess it may help them just a tiny bit with their non-paid accounts as a throttle barrier (so that I don’t register 1000 times in a row). But man, it’s not worth all the negative aspects that this brings.
I was looking at Infomaniak on alternativeto and found these :
- https://www.tomsguide.com/computing/vpns/infomaniak-breaks-rank-and-comes-out-in-support-of-controversial-swiss-encryption-law
- https://discuss.privacyguides.net/t/infomaniak-breaks-rank-and-comes-out-in-support-of-controversial-swiss-encryption-law/28065/11
- https://xitter.cf/infomaniak/status/1931658700743135261#m
I’m not sure what to make of them, as when I tried to sign up they wanted phone verification, their offering in free tier seems too generous, and with no encryption, they could hand over information easily (and yes ik email isn’t the most secure form of communication and there are better tools)
I don’t trust any e-mail encryption done by the provider (including Protonmail) and there are cryptography nerds who say things like “forget encrypted e-mail, wrong tech, wrong use-case, use something else like Magic Wormhole or Signal” (search for “the PGP problem”, most of the problems have been addressed in at least GnuPG but still, the metadata leakage for example is still an issue).
Unless I really control my end of the channel including choice of encryption software, algorithms, placement and validity of keys, etc. I don’t think it can ever be trustworthy. Protonmail for example even use web crypto which adds another layer of potential insecurity. And that’s just the tech layer, what if my recipient is an idiot and forwards my message unencrypted (because that’s what their e-mail client is gonna allow)?
So I don’t pick my e-mail provider based on how they encrypt, I can use any insecure provider because it’s me and my hardware doing the encryption. If Infomaniak ever goes completely nuts, I can be moved off them in a weekend.
I guess that sidesteps the question but I didn’t follow the controversy back then about Infomaniak because I didn’t care that much, I work with Digitale Gesellschaft and other digital rights organizations to shoot these things down on a political level no matter what a single company thinks. So far DG has been very successful. e.g. they prevented the launch of an electronic ID card that would have been insecure, privacy-invasive and run by private corporations.
Thanks for all the work you and the organizations do! I didn’t think like you, but now I’m interested, being able to jump ship quickly as I have control is interesting. I’m a noob to this, can you share resources/software you use for encrypting emails and stuff ?
Ah, thanks, my contribution is mostly just money/donations and then voting correctly 4 times a year so the government doesn’t get any crazy ideas ;)
I have to say I barely even use encrypted e-mail, when I do it’s just through GnuPG. I’ve used Claws-Mail’s GPG plugin and Thunderbird’s built-in PGP support, works well enough. But I’m not very up to date, maybe you can find better information and nicer tools from e.g. Privacy Guides. They have a section on OpenPGP but it’s dry because this is just a dry topic :(
I think they specifically say to not use email encryption at all. Instead they mention Magic Wormhole and Signal.
I second this. Moved our company email and cloud service to Infomaniak. One of my best decisions in a long while.
Migrated to Fastmail about a year ago, away from Proton. Mostly to have an alternative that was easy to use for my partner too, but its honeslty the vest mail experience money can buy imo. Has a lot of nice features and the UI is excellent.
Also the developers there really seem to care about what they do. Love reading their blogoosts about how they store the data, or how they’re also hwlping develop the new open standard JMAP.
Fastmail is a failsafe option worth the penny.
Thank you for the response! It was interesting to read about them. However, it’s also notable that they don’t offer inbound encryption with user-provided GPG keys. For me that part matters. Again thanks for the response in any case!
But they are based in Australia correct? If I’m not mistaken, Australia has an incredibly bad anti privacy laws. I’d never rely on Australian digital services. No idea what the impact of having the EU users served by EU servers is though
Indeed they are. This obviously boil down to each individuals threat model. Mine i mostly: fuck big tech/corpos… I personally have no issue with Fastmail in the regard you mention. Either way, the data is stored in the EU: https://www.fastmail.com/blog/fastmail-offers-eu-data-region/
Any love for disroot.org?
Now, they are experiencing a disk issue at the moment and one of the admins had a death in the family. But before that, I have been testing them thinking that I might start using them.
I’m using them already! Actually mentioned in the post body, too:
So far I like disroot a lot. But they are principled about being unpaid, so if the financial ends don’t meet each other my emails will be in trouble. I’m donating to them, but I have my worries. I’m willing to pay a little if I know that my money will go for a quality service, for expansion of coverage (new users) and for open-source technologies.
But I’m also wary of continuity in case of financial struggles, hence this post. Maybe I should just wait out the current struggle with the failing disk and hope they will continue to operate on donations as they successfully have been for years and years… In any case, I’d like to know the alternatives, too.
Just as i wanted to check my old disroot account after i saw your comment.
Yup. They work very reliably on average, but the recent failure of 2 drives at once together with a personal loss of one of the founders (and the most active externally visible developer I think) was really tough for them. They’re currently recovering, but it’s tough.
Duh… reading is hard. /s
I think that they are in a good place financially. I seem to remember a page on their site that showed they are above water, although without a terribly big budget. I bought my first domain many months ago, and thought about moving it to disroot, since they do catch-all emails out of the box. But, still going to wait for them to get their disk situation ironed out.
I will say I had a ticket open and reached out to mappeth via xmpp, and it was a positive interaction. So, I’m still leaning towards disroot as a matter of just helping the scrappy little guy.
I have been using Runbox for several years and I’m happy with them. I choose them because they are one of the few email providers that allow you to create aliases/identities.
They are not non-profit, but they say they take ethical (and other) responsibilities very seriously. They do use LLM, but again they say they use it only as a tool and it is used responsibly. They do take transparency seriously, so they have all this information written on their website.
Thank you! Depending on the use case, they seem to be pretty reasonably priced as well. One feature that I’d personally be happy to see but they don’t seem to support it is inbound PGP encryption with a user-provided key tough.
You are welcome. But I have never heard about “inbound PGP encryption”. Does that mean they would encrypt inbound emails with your key? Email is inherently unsecure communication (unless encrypted before sending), so I wonder how much security/privacy does that actually provide.
I’m considering thundermail, though it’s new and not perfect. Data is hosted in the EU, they don’t market your data, and it’s managed by the thunderbird subsidiary of the Mozilla group. Some basic things like E2E and at rest encryption are either half-baked or missing, but their project plan looks promising and they include calendar and contact sync as well.
Believe they’re using Stalwart as their backend, which looks rather promising!
I have used mailfence for 10 years or so. Not non profit (I think) but should fit your other needs.
