[tor-talk] Private mail server (Was: i saw your response on the Tor talk list)

[Jérémy Bobbio]

On Sat, Nov 17, 2012 at 05:41:12PM +0000, Julian Yon wrote:
> Would I recommend it? No. Unless you want to do so for the learning
> experience. SMTP is insecure by design; running your own server doesn't
> do anything to prevent interception of messages, it merely gives you
> another system to administer. For security purposes you will achieve
> more by learning how to use GnuPG to encrypt your mail. You can use
> this with any email provider, either with tools built into (or added
> onto) your mail client, or using the standalone tools and C&P. It
> doesn't solve every problem (e.g. mail headers are plaintext) but it
> does mean that the body of encrypted messages is not revealed if
> communication is intercepted, or the server is seized.

There are some clear advantages of running your own email server
regarding surveillance and overall control.

If you have your own email server, you can decide of your logging
policy; and not necessarily keep a trace of all your exchanges.

You can encrypt the server hard drives. For many server seizures
this will prevent the data to be accessed right away.

You are free to decide about your backup policy. When you click
"delete", how do you know if there's not a copy that will stay
available for a year?

With Postfix and probably other mail servers, you can configure a
per server TLS policy. You can make sure that the communication with
SMTP servers used by your peers is properly encrypted (and not MITM'ed).
It makes interception a lot harder.

And you can be sure that what you receive in your mailbox will not be
harvested for data collection. Unfortunately, you are never alone: this
also depends on the server used to send the email...

-- 
Jérémy Bobbio                        .''`. 
lunar at debian.org                    : :Ⓐ  :  # apt-get install anarchism
                                    `. `'` 
                                      `-   
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 836 bytes
Desc: Digital signature
URL: <http://lists.torproject.org/pipermail/tor-talk/attachments/20121118/1d9f6bec/attachment-0001.pgp>