Our valued sponsor

Finding a Secure, Fast, and Stable Email Alternative to ProtonMail for Use with Outlook

EliasIT

Corporate Services
Mentor Group Lifetime
Dec 10, 2010
1,475
831
113
Now that we've discussed how to best secure a laptop in another thread and many excellent solutions with an incredible level of expert knowledge have emerged here, I'm still missing one last piece of the puzzle.

Today, I use ProtonMail via Bridge and Outlook. It works reasonably well, but it becomes incredibly slow over time. The smart part is that you can share emails this way while ensuring that all mail is encrypted. I know you say that ProtonMail is a big lie and that it’s not more secure than other email systems when it comes to handing over information to authorities and for surveillance.

But what is the best alternative then? And above all, a stable and fast system that can still work with Outlook and remains secure?
 
Today, I use ProtonMail via Bridge and Outlook. It works reasonably well, but it becomes incredibly slow over time. The smart part is that you can share emails this way while ensuring that all mail is encrypted.
I personally do not like Outlook as it is heavily bloated.

I know you say that ProtonMail is a big lie and that it’s not more secure than other email systems when it comes to handing over information to authorities and for surveillance.
Yes, definitely. They are also a company and need to comply with all laws.

But what is the best alternative then? And above all, a stable and fast system that can still work with Outlook and remains secure?
I think we need to split the issue in three parts:
  • Mail client
  • Mail transmission and choice of server
  • Mail encryption
Proton is like the combination of all of them and you can use all or just parts of the puzzle:
  • Client: Proton provides a secure webclient which decrypts all mail that has been encrypted at Proton's servers
  • Transmission: Proton offers the latest technology to receive/send mail over secure connections (POP3/IMAP/SMTP over SSL/TLS)
  • Encryption: Proton has integrated OpenPGP
Now, let's split the matter in parts.

Client
There are many capable mail clients out there. I guess many people here use Thunderbird and K9 on Android, both of which are open source and support most required features. Popular alternatives include The Bat! or Becky!
https://en.wikipedia.org/wiki/Comparison_of_email_clients
I am not sure if anybody out here would state that Outlook can be trusted, I personally do not like the software as it is heavily bloated with useless features giving hackers a myriad of opportunities to intrude (there really is no need for HTML mails in the first place, TNEF and all the Office features in emails (sic!) is just a security risk). Guys, please write plain text emails. We really do not need HTML and inline images. It makes email fast and secure.

No matter your choice, you want to ensure that
  • The mail client only stores data on your premises (your computer or your cloud) and does not transmist anything to his motherhouse.
  • SMTP and POP3/IMAP are supported with support for SSL/TLS on all of them.
  • There is at least a plugin for OpenPGP and S/MIME (see below)
You most often have the choice between POP3 and IMAP. Both protocols have the same functionality to download incomimg mails from a server, but have slight differences. While with POP3, mails are normally deleted from the server or deleted after like 14 days (Gmail is an exception to this, they move deleted mails to its archive), IMAP offers access to the mailserver while keeping all mails there.

POP3
  • Mails can be deleted immediately from the server
  • Mails can be left on the server for like 14 days (you can set the number in any mail client), this allows you to access recent emails on all devices like computer and phone
  • No mail archive is on the server and can be compromised there
  • You can operate with typically less than 500 MB of mail space

IMAP
  • All mails are on the server and can be accessed anytime from any device
  • You can access the whole mail structure (not just the inbox as with POP3): Inbox, Drafts, Sent, Spam, Trash
  • "Collaboration" with many devices (or many people) is very easy as all is synced
  • If you fall in coma and your boss has your login, your colleagues can continue working (good for companies)
  • You probably need 20+ GB mailspace per year in business
Of course I would only recommend IMAP if you operate your own server and you can ensure that the mails are all encrypted on the server with a public key and that the private key lies on the server but is encrypted with the IMAP password. I am not aware of any such server which is widely used.

Mail Transmission & Choice of Server
Even when all is encrypted (see below), you should ensure all mail is only transmitted in encrypted form. It is like accessing www.offshorecorptalk.com over HTTPS instead over HTTP. With free Let's Encrypt certificates, there is no reason not to use TLS throughout. Gmail and many other clients are now starting to show padlocks on emails that have only been transmitted in encrypted form:
https://support.google.com/a/answer/2520500?hl=en
If you are operating your own domain, you just need to have a TLS certificate for the MX server and have the server using it when receiving email. It maybe takes an hour to set it up but definitely is worth the effort.

Some furhter reads:
https://sectigostore.com/page/what-to-know-about-an-ssl-certificate-for-your-mail-server/https://docs.plesk.com/en-US/obsidi...e-mail-server-with-ssltls-certificates.59466/
Now with the transmission also comes also the choice of server. There are basically two strategies:
  • operate your own server
  • use freemail / public mail (Gmail, Yahoo, Hotmail, Proton)
Operating your own server is more secure, but you need to buy a domain. Of course, you can use WHOIS pricavy and pay with your registrar and host with cryptos, but this still gives some surface to attack your privacy. However, I personally would recommend that route as it allows you to control your server. While law enforcement agencies have direct APIs to Gmail etc. they won't have this for your own server. You can set up your own server correctly and have all encrypted. Or you can use a hosting company you can trust and use POP3, so your emails stay on your severs just for minutes.

The alternative is to use freemail providers. It often takes only a computer to register and you do not have to disclose any personal information when registering and can stay mainly anonymous. However, even if you use encryption (see below) your mail provider will learn a lot about you: whom you are emailing with, when and how often. You will also disclose your IP address to them and they will have your full location history.

Please note that the mail headers always will use your own IP address. There are a few ways to preven this:

Encryption
There are two common ways to encrypt mails: S/MIME and OpenPGP
https://en.wikipedia.org/wiki/S/MIMEhttps://en.wikipedia.org/wiki/Pretty_Good_Privacy#OpenPGP
Both work in a similar manner and basically do the same: they encrypt emails so that only the intended recipient can read them and they sign emails so that the recipient can verify it comes from you. While S/MIME relies on certificate sellers to issue the certificates (trust in the reseller is implied and the certificate for the counter part immediately accepted), OpenPGP relies on zero trust and requires you to exchange the certificate with your counterpart yourself (a signed message includes the certificate, you can then add the certificate to your client). While S/MIME certificates usually expire after 3 years, you can have OpenPGP certificates which never expire (although you should upgrade to stronger encryption, i.e. longer key length, from time to time).

While S/MIME is built in in many clients, less clients support the more secure OpenPGP. Thunderbid supports both of them. If there is no support, you can still rely to the command line to use OpenPGP. To create a key use
gpg --generate-key
to encrypt use
gpg --encrypt -r DEADBEEF -o b.txt -a a.txt
where DEADBEEF is the keyname of the receiving party.

You could (notice the subjunctive form) use Proton's built-in OpenPGP feature. But I would not recommend as it stores they keys on the server and you never know who has access to them.

I would say that in gereral both S/MIME and OpenPGP does the job, while S/MIME is more widely used in corporate environments while OpenPGP is the choice of geeks and nerds.

For communication with trusted parties, I would definitely recommend using encryption. You could techinically use Gmail, Yahoo, Hotmail and encrypt all emails. The providers would then only know whom you are mailing to and how often but none of the contents.

Recommendation
My personal recommendation would be to use Thunderbird or any reliable mail clients, preferrably open source. Operating your own mail gives you quite some advantages and I would definitely recommend you to encrypt all your email with OpenPGP (or S/MIME if the counter party has such preference). Of course, I set up my thunderbird to compose plain text emails by default.
 
Last edited:
I hope some good recommendations come up here as alternatives to ProtonMail that are just as easy to install and use, but more secure.
Thunderbird with OpenPGP is easy to install and very secure.

Buying a domain and webhosting at www.metanet.ch is also fast and cheap. And if used with POP3 and TLS on the mailserver, gives you almost identical security to Proton.
 
  • Like
Reactions: 0xDEADBEEF
Some of my friends use posteo or mailbox.org.
But I'm not sure whether Germany is really trustworthy in this matter.

A few years ago, many people recommended ctemplar from Iceland.
Unfortunately they have no IMAP or SMTP support.
And they cancelled all mailboxes a few years ago because they wanted to end their services.
No idea why they are still on the market.
 
Some of my friends use posteo or mailbox.org.
But I'm not sure whether Germany is really trustworthy in this matter.
Probably not.

But again, using somebody else's security for mail handing is like putting all your high-security keys in a Master 5400D outside your fence. Of course, you can do this for convenience as you do not have to carry any keys when running outside. But would you put the key to your gold vault in a Master 5400D on the street?

Why would you use somebody's mail server when it costs close to nothing to use your own server and implementation is just 10 minutes? Have you ever thought about National Security Letters?
https://en.wikipedia.org/wiki/National_security_letterThey are just sent to your provider, he will give away all your data and cannot even inform you. If you run your own system, at least they must send the letter to... you. And then you know and you know what is next? I will reach out to @JohnnyDoe for his amazing patent to simply blow up all the data they wanted:
https://www.offshorecorptalk.com/threads/patent-for-secure-erasing-of-data.42666/
 
avoid third party services

rent VPS server (backup and/or replicate to another one) and setup our own mailserver - Zimbra used to be great for this purpose, one was able to configure it without any deep knowledge and administrative skills by clicking the wizard forms - not sure nowadays, there were some changes in their licensing policies and all the fuss with DKIM, SPF, spam databases etc. makes it a little harder to configure - if anyone knows such a read-to-deploy solution I'm interested to learn
 
avoid third party services
How about a VPS (or even shared hosting) with Plesk? It is very easy to setup and provides better security than what you would have gotten elsewhere? I would say it is the most non-geek it can get and provides good security for acceptable effort.

rent VPS server (backup and/or replicate to another one) and setup our own mailserver - Zimbra used to be great for this purpose, one was able to configure it without any deep knowledge and administrative skills by clicking the wizard forms - not sure nowadays, there were some changes in their licensing policies and all the fuss with DKIM, SPF, spam databases etc. makes it a little harder to configure - if anyone knows such a read-to-deploy solution I'm interested to learn
You need DKIM and SPF fore sure. Otherwise, Gmail will not like you much in the near future.
You also need Let's Encrypt support for your SMTP and POP3/IMAP server to avoid emails being transmitted unencrypted. The alternative would be to buy commercial certificates each year, which sounds like too much troubles.

How about those:
https://www.axigen.com/linux-mail-server/https://github.com/docker-mailserver/docker-mailserverhttps://github.com/mailcow/mailcow-dockerized
 
How many mailboxes? Can't you just use the Proton windows app?
Yeah there are a lot of recommendations here, I thought the same :)
 
How many mailboxes? Can't you just use the Proton windows app?

Yeah there are a lot of recommendations here, I thought the same :)

I think we once had a discussion about Proton and how they complied with nearly 6000 data requests:
https://www.offshorecorptalk.com/threads/do-you-still-trust-proton-mail.44955/https://restoreprivacy.com/protonmail-data-requests-user-logs/
Hence, it does make sence as also @void said, you should not rely on third parties to handle things for you. You also do not put your gold vault's key in a Master 5400D on the street. Even a shared hosting will provide you with more security than that, at a cost of just a coffee per month. And then at least install OpenPGP.
 
  • Like
Reactions: 0xDEADBEEF
Excellent points raised by @daniels27, and I'll try to approach this from a slightly different angle without retreading too much ground.

Email, at its core, is like sending postcards through the postal system. Anyone along the way can potentially read it. That's why I treat email like receiving letters: legally you're fine, but there's always some insider risk at the 'post office' (read: email provider).

For true security, imagine sending a coded message inside a sealed envelope. In email terms, that's encrypting on your device before putting the content into the email client. This way, even if someone intercepts it, they can't read the actual message. When transmitting sensitive information over email, it makes sense for you and your business partners to learn about OpenPGP or alternatives. New risks may arise, but as with crypto currencies, if you don't control the keys, you don't control the $THING_PROTECTED_BY_CRYPTOGRAPHY. Plus, approaching someone and asking for their public key might be a great conversation starter...

Hosting your own email server is not a silver bullet. You're essentially becoming your own 'post office', but still relying on a third party (your IaaS provider) who could potentially access your emails. Plus, you're opening up to new problems:
  1. Maintaining a secure email server requires significant overhead.
  2. Many ISPs are wary of emails from residential IPs or small servers, potentially landing your emails in spam folders more often.
  3. If you become a person of interest, your server becomes a single point of failure. Professional email providers have dedicated teams to fend off attacks.
Personally, I recommend approaching email security similarly to how I handle MFA via SMS. I use one number for MFA on my most sensitive accounts (banking, cloud, etc.). Nobody has that number, it's a physical SIM, and my telco only allows swaps in-person. The rest of the world gets another number that I don't mind potentially ending up in some call center's database.

For instance, if I subscribe to emails from HSBC, I create an 'unpredictable' alias like [email protected]. Every important account will have a different email address, but I end up seeing it in one inbox anyways. Just need to be careful with the sender address in some cases.

Quoted from Home — Cock.li E-mail Hosting:

"How can I trust you?

You can't. Cock.li doesn't parse your E-mail to provide you with targeted ads, nor does cock.li read E-mail contents unless it's for a legal court order. However, it is 100% possible for me to read E-mail, and IMAP/SMTP doesn't provide user-side/client-side encryption, so you're just going to have to take my word for it. Any encryption implementation would still technically allow me to read E-mail, too. This was true for Lavabit as well -- while your E-mail was stored encrypted (only if you were a paid member, which most people forget), E-mail could still technically be intercepted while being received / sent (SMTP), or while being read by your mail client (IMAP). For privacy, we recommend encrypting your E-mails using PGP using a mail client add-on like Enigmail, or downloading your mail locally with POP and regularly deleting your mail from our server.

Also, there's this quote from /g/:

Administering a mail host is sort of like being a nurse; there's a brief period at the start when the thought of seeing people's privates might be vaguely titillating in a theoretical sense, but that sort of thing doesn't last long when it's up against the daily reality of s**t, piss, blood, and vomit.

Now that I think about it, administering a mail host is exactly like being a nurse, only people die slightly less often"


A final note: if you're concerned about authorities or surveillance, remember that metadata (who you're emailing, when, how often) can be just as revealing as content. No email system can fully protect against this without resorting to more extreme measures like anonymous remailers or peer-to-peer systems.

P.S. Outlook really is shitty software, I hate that almost all enterprises I deal with have the Outlook + Teams setup. stupi#21
 
What about
https://tuta.com/blog/own-domain-email
I have been using them a lot the last few years, it seems to be similar to Protonmail, just that Tuta has also a Desktop Client for Windows if you prefer it.
I think it always depends on what you do and what your objectives and skills are.

Proton / Tuta are certainly a viable solution. They offer their own clients etc. making it much harder to use Thunderbird with OpenPGP integration. So what can it be used for then? I would say just the daily business but nothing where you need to be sure nobody can access your communication. Of course, if you are doing outright illegal things, they won't protect your from any police action.

Using Gmail with OpenPGP is certainly more secure than Proton / Tuta. But they still have access to email headers and know whom, when and how often you communicate with.

Using a shared hosting, properly setup of course, and only using POP3 makes things already better as at least they do normally do nothave a FBI API integrated. Hence, the government would have to contact you or your provider.

Using your own server is certainly the best, but requires skills and the time to manage it. If you do not manage it, there will be known vulnerabilities and the whole setup is for nothing. You then have full control and if the counter party uses the same setup, no data will be leaked.
 
What about
https://tuta.com/blog/own-domain-email
I have been using them a lot the last few years, it seems to be similar to Protonmail, just that Tuta has also a Desktop Client for Windows if you prefer it.
The desktop version is stable to work with but there are missing lot's of functionality which you have in Outlook and other e-mail clients, for business use not the best this way.
 
  • Like
Reactions: clemens
Posteo.de, more secure and private than Protonmail, and cheaper. Even you can do a cash payment sending the money in an anonymous letter. You cand find on the link a huge comparative with many providers: E-mail providers - which one to choose?


As an email client, I personally like Betterbird.
now we are talking about a good solution that could work well. Sweet list btw.
 
  • Like
Reactions: churumbelo
Now that we've discussed how to best secure a laptop in another thread and many excellent solutions with an incredible level of expert knowledge have emerged here, I'm still missing one last piece of the puzzle.

Today, I use ProtonMail via Bridge and Outlook. It works reasonably well, but it becomes incredibly slow over time. The smart part is that you can share emails this way while ensuring that all mail is encrypted. I know you say that ProtonMail is a big lie and that it’s not more secure than other email systems when it comes to handing over information to authorities and for surveillance.

But what is the best alternative then? And above all, a stable and fast system that can still work with Outlook and remains secure?

Ubuntu 22.04 LTS as an O/S base image installed in VM with secure boot and LUKS CDE (complete disk encryption - FDE) at an IaaS provider that doesn't block - or will unblock - the mail ports tcp/{25,110,143,465,587,993,995}. A good provider would be Clouvider.

As for mail server, a Modoboa

https://github.com/modoboa/modoboa
will perfectly fit your needs fin4774" It has intuitive interface and provisioning it would be simple for you - even with several domains.

I'm not a fan of Docker - using podman where non-persistent storage is required - but Mailcow and Mailu, while optimaly packed are Docker containers. iRedMail is simply not serious solution and Mail-in-a-box is sub-optimal - even though those solutions are installed as shell scripts.
 
Last edited:
As for mail server, a
HTML:
<a href=https://github.com/modoboa/modoboa">Modoboa</a>
will perfectly fit your needs fin4774" It has intuitive interface and provisioning it would be simple for you - even with several domains.
do you have any experience with Axigen? if so, would you recommend Modoboa over it?
 
  • Like
Reactions: mraleph