A few weeks ago I realized I can no longer stomach the NSA revelations and that I have to do something about it.
The first thing I wanted to fix was email.
The Premise
I can’t do anything to stop the governments from spying, but surely, I thought, there had to be something I could do to make things better.
So I started a personal, ongoing project to categorically re-evaluate my IT consuming habits and fix what’s easily fixable. The goal of the project is to improve privacy, not fall off the grid and start wearing tinfoil.
As the central backbone of all of my communication, email was poised to be the first item on the agenda.
I’ve been using Google as my go-to email host since 2005, first with the garden variety Gmail and later as a paid subscription to Google Apps. I absolutely love both services, and from a technical point of view they are the best, bar none.
Google has, however, become the de-facto arch-enemy of online privacy, and there was absolutely no way I could see myself going forward with Google.
On top of the email services, I’ve also used Google Apps for casual spread sheeting and other office activities. While it’s shame to lose this functionality, they aren’t of great enough importance for me to be part of the following consideration.
With this in mind I set out to find a new email hosting provider for myself.
The Contenders
I expected the email hosting scene to be kind of dead by now, but turns out the opposite is true. The criteria I had in mind for my new email host was:
- The service must be paid for. I’d rather be the customer than the product.
- The company and its infrastructure should be sufficiently far away US jurisdiction.
I’m not a shady guy doing shady things, so I’m not sold on any hyper-security measures, like client-side encryption. So as long all the proceedings are legal, it’s OK for police to violate my privacy to police.
I’d just rather not take part in any unlawful spying, if at all possible.
After some investigation I concluded the most prominent contenders were:
- Fantastic feature set…
- … but a US-based company
- Fantastic feature set
- Owned by Opera, so I guess technically a Norwegian company…
- … but with servers in New York
- … and a massive privacy fail under their belt
- Canadian company with pro privacy reputation
- … with clearly laid out policies
I wound up giving Hushmail a trial run, but it didn’t take long for me to come around and cancel my subscription. Everything felt way too 1990s for my taste.
In retrospect, I probably acted too hastily; I subscribed just ahead of weekend and couldn’t complete the setup without the help of their customer support. I had too much time to reconsider. To Hushmail’s credit, they acted immediately on my request to cancel the service and refunded the setup fees, no questions asked.
Pro tip: when switching email hosts, do so on a Monday.
MyKolab
Anyway, at this point I had all but given up and decided to just host my own email server.
I have some experience in email hosting, so I sort of knew what to expect, but it was really Drew Crawford’s excellent guide for NSA-proofing your email in 2 hours that made the entire ordeal seem manageable.
Luckily, however, before I had any real time invested in my own server, my significant other pointed me towards PRISM Break, which led me to MyKolab.
MyKolab is the hosted version of Kolab.org Community, an open source “communications and collaboration system”. The revenue from MyKolab funds the further development of the system. Sounds perfect to me.
This also means that as a fallback you can always download and host the community version yourself.
And what’s even better, KolabSystems (the company running MyKolab) is based in Switzerland, a country with a long and intimate relationship with privacy. This is reflected in the privacy statement and the terms of service; worth a read if you are considering this service.
The service runs on physical servers, which reside within Swiss borders. To me this constitutes sufficient distance from US jurisdiction.
From a purely technical point of view, MyKolab is no match for Google Apps, but apart from Google Docs it does everything I need.
The biggest differentiating factor is of course the web interface. Let’s just say that MyKolab has one and leave it at that. I mostly use Thunderbird anyway, so this isn’t a deal breaker.
For a small extra fee you can enable “Mobile Synchronization” (read: ActiveSync). This makes it super easy to get everything synchronised on a compatible mobile device.
Alternatively you can just stick to the run-of-the-mill IMAP, CalDAV and CardDAV. After years of Google, the vanilla interpretation of IMAP folders feels pretty refreshing.
Study the super confusing price chart carefully, and you’ll see that MyKolab is also a bit more expensive than Google Apps.
I’m set up with a custom domain, two gigs of storage and mobile synchronisation, and the monthly bill sets me back approximately 10 GBP. It’s more than the 5 USD I paid for Google Apps, but still considerably less than the total cost of hosting your own email.
The Migration
The last hurdle on the list was migrating my email to MyKolab. I couldn’t tell how much of my email archive of ~20k emails was actually pertinent, so I just decided to take them all with me. (If you are coming from Google Apps this probably sounds like a no-brainer, but remember that disk quotas are priced on MyKolab.)
In theory IMAP makes migrating emails a breeze, but as it turns out, you can’t just drag and drop twenty thousand emails in Thunderbird.
Instead, I had to resort to a staggered approach of carefully selecting a subset of few thousand emails at a go, and then copying them over.
The Aftermath
After I had carefully reconciled the amount of I email I had migrated and done some spot checking to make sure everything looked right, I pointed the DNS to MyKolab and I’ve been with them since.
Zero issues so far.
As an interesting side-note: my Google Apps subscription is still active, and for some reason some email still occasionally routes through there. Couldn’t tell why, but it would be interesting to know if it’s just echoes of expiring DNS caches, or if Google is performing some unorthodox optimisation within its service’s boundaries.
In Summary
Despite NSA and the related alphabet-agencies, privacy on the Internet is not dead (yet).
I didn’t expect the email hosting scene to be a vibrant one, but much to my surprise a number of viable alternatives to the obvious US-based options do exist.
Ultimately I migrated my email to MyKolab.
- Niko