I’ve been looking to switch from gmail to a different email provider that’s more private. I’ve been hearing about Tuta, are there any drawbacks to it? Are there better options?

For a while I was planning on making the switch to protonmail but that’s off the table now due to the recent events surrounding them.

  • Arthur Besse@lemmy.ml
    link
    fedilink
    English
    arrow-up
    8
    arrow-down
    3
    ·
    edit-2
    6 hours ago

    Tuta’s product is snake oil.

    A cryptosystem is incoherent if its implementation is distributed by the same entity which it purports to secure against.

    If you don’t care about their (nonstandard, incompatible, and snake oil) end-to-end encryption feature and just want a freemium email provider which (purports to) protect your privacy in other ways, the fact that their flagship feature is snake oil should still be a red flag.

      • Arthur Besse@lemmy.ml
        link
        fedilink
        English
        arrow-up
        2
        ·
        3 hours ago

        StartPage/StartMail is owned by an adtech company who’s website boasts that they “develop & grow our suite of privacy-focused products, and deliver high-intent customers to our advertising partners” 🤔

        They have a whitepaper which actually does a good job explaining how end-to-end encryption in a web browser (as Tuta, Protonmail, and others do) can be circumvented by a malicious server:

        The malleability of the JavaScript runtime environment means that auditing the future security of a piece of JavaScript code is impossible: The server providing the JavaScript could easily place a backdoor in the code, or the code could be modified at runtime through another script. This requires users to place the same measure of trust in the server providing the JavaScript as they would need to do with server-side handling of cryptography.

        However (i am not making this up!) they hilariously use this analysis to justify having implemented server-side OpenPGP instead 🤡