I'm trying to figure out how to run encrypted email. This market segment seems to have more media buzz than others, and deciphering marketing speak and wiki pages is tedious, especially factoring in a few years worth of buzz. I have not come across what I am looking for yet.
Back in the day, many email providers did not support, meaning they did not allow, encrypted email. Today, I keep coming across things like Proton Mail, Hushmail, and Lavabit (discontinued), that do some kind of encryption, but not "the good stuff"; email encrypted at the client, and either passes through or is stored on the providers servers only in encrypted form. Importantly, the provider must not be able to decrypt the emails.
I'm not interested in doing anything illegal; I'm interested in this from a technology and privacy perspective.
- Do modern mail providers (Outlook.com, GMail, Yahoo, etc) allow for encrypted emails?
- Do providers allow for anonymous encrypted email use? Meaning, no additional requirement for a phone number or otherwise identifying information.
- Do providers allow for the caching of encrypted email on their server, such that they become a repository and each client has to decrypt the messages? Basically, webmail of encrypted emails, while also allowing endpoints to download copies of the encrypted emails.
Put another way, I am looking for a mail provider and client server software combination that meets the following criteria:
- Client side encryption: the provider has no way to read the contents and just stores blobs of some kind.
- Service does not offer proprietary in-house encryption for the services users. Or that feature can be turned off. I'd like to stick to well known solutions like PGP or GPG or similar, instead of what ProtonMail and Hushmail are doing.
- Service does not retain emails any longer than I leave it on their server. Meaning if I delete the email, they will remove it from their server. If not immediately, then shortly afterwards(ie minutes).
- Service does not keep unnecessary logs and/or purges what they do keep periodically.
- Supported by popular mail clients like Thunderbird, K-9 Mail, and others.
Nice to haves:
- Service is free
- Service keeps no logs
- Service has a well known history or track record of privacy and security endeavors. For example, PIA, a VPN, funds certain projects, has a no-holds-barred blog, and is currently funding an audit on OpenVPN. PIA puts their money where their mouth is. The founder of Lavabit put his money where his mouth was by shutting down the service. Conversely, HideMyAss and Hushmail make some bold claims, but have marks on their history that belie their marketing to a degree. It's arguable how dark the marks are, but they are still marks against themselves.
Ultimately, I am looking for Windows and Android clients, but Linux support would be nice too.