Add Purelymail as a provider

[GilOliveira]

Purelymail is a no-frills email provider that seems to tick all the boxes as for requirements:

• All data (emails, CalDAV and WebDAV/CardDAV) encrypted at rest with user's password as long as user disables password reset.
• SSL/TLS on IMAP and SMTP.
• Roundcube web client integrates with Mailvelope.
• Supports custom domains, with SPF, DKIM and DMARC records.
• Comprehensive privacy policy and solid security practices.
• Sign up doesn't require PII.
• Webmail and admin console support 2FA with TOTP and WebAuthn.
• Thorough documentation.
• Transparent ownership.

Possible drawbacks:

• It's still in beta.
• It is owned and maintained by a single individual, through a company.
• Does not accept cryptocurrencies (only credit cards or PayPal).
• US-based.
• Seems to be hosted by AWS.

Seems solid, unless I'm missing something.

[dngray]

This provider doesn't provide zero knowledge storage of the contents of your email. As it's also based in the US there's ECPA.

When they are stored on an internet server however, no warrant is needed, starting 180 days after receipt of the message, under the law.

Further information about it can be found here https://epic.org/ecpa/

[GilOliveira]

@ScottPeterJohnson is the owner of the service, he would be the one better suited to explain their privacy practices.

[ScottPeterJohnson]

I would not recommend using email at all if your main concern is extreme privacy, including Protonmail or Tutanota. If you have only a reasonable level of concern, I think Purelymail does a fine job. You would have to be in a strange state of ineffective paranoia to value the marginal security Protonmail provides but not stop using email entirely.

Seems like a strange requirement to need to disable password resets for that. Smarter solutions are possible if you manage cryptography well.

I'm not familiar with any solutions but would be interested in details. If a service can "reset your password", e.g. change it to a known value that will let you access your data once they give it to you, then how could it not effectively have access to your data?

And parts of your email are indexable, implying that your social graph is exposed to amazon, doesn't sound great.

You can disable that if you want. I find the suggestion that Amazon would decrypt, figure out how to decode, then dig through customer data like that without extreme pressure from a nation-state actor questionable in the extreme. If you are afraid of nation-state actors, do not use email.

@ScottPeterJohnson is the owner of the service, he would be the one better suited to explain their privacy practices.

Happy to answer any specific questions?

[ph00lt0]

I'm not familiar with any solutions but would be interested in details. If a service can "reset your password", e.g. change it to a known value that will let you access your data once they give it to you, then how could it not effectively have access to your data?

Well for example one could work with key encryption keys derivation from a password as well as a token for reset. You are right that the user will always need to carry some sort of secret but it can be more convenient then just no reset at all. Other options would be to not allow the unlock of data but only the account - i believe that is what Proton does, but I haven't been in the need to try that :)

You can disable that if you want. I find the suggestion that Amazon would decrypt, figure out how to decode, then dig through customer data like that without extreme pressure from a nation-state actor questionable in the extreme. If you are afraid of nation-state actors, do not use email.

Not sure who suggested nation state actors here? I didn't. Amazon is known to analyses and misuse the data of it's customers (both b2b and b2c) to their advantage. I really wouldn't be surprised if data containing common identifiers and mail addresses are being picked up by them as a chance for social graph data in their data models. From what I am reading they wouldn't need to decrypt anything as it is stored without encryption. The parts that are encrypted I also doubt will be affected by this. I was purely talking about the unencrypted data used for indexing. Glad to know it can be disabled and it should be.

Anyhow, I don't think this should be listed until it's out of beta fase. Protonmail and Tutanota are proven and we have yet to see for Purelymail, besides the comments about lacking of zero knowledge.

Also a comment to OP: it seems actually more payment methods are available through paypal on this website, depending on region.

[namazso]

@dngray

This provider doesn't provide zero knowledge storage of the contents of your email.

Has the contents of the site linked in OP changed? currently they do say it does provide that.

[GilOliveira]

Also a comment to OP: it seems actually more payment methods are available through paypal on this website, depending on region.

Yeah, I'm aware you can top up your PayPal account through multiple methods. In my region, if I'm not mistaken, you can even top up with cash, but my point was that you need a PayPal account, which may have some privacy implications to some as opposed to paying with something like Monero.

[freddy-m]

This looks like an interesting project... but we tend not to list beta services, and therefore won't be listing this.