Self-hosting has a severe metadata tradeoff. Suppose that you and I each self-host a mail server. Now we e-mail each other to talk about how great decentralization is and how much we both hate wiretapping.
With self-hosting and SMTP, there is now a very clear TCP metadata record showing how my home IP address connected on port 25 to your home IP address. Maybe the next day you write back, and there's another nice clear metadata record showing your address connecting to me. Now any ISP between us, and anyone who can tap the ISPs' cables, knows that you and I are corresponding.
If we were both using Gmail, this metadata pattern would pretty much not appear at all: we would each make an HTTPS connection to Gmail and exchange a bunch of data, and while in principle my upload would be matched in size by your download, it would be extraordinarily noisy in many ways and hard to correlate in practice. On the other hand, Gmail would know everything about us.
Having Gmail know everything about us is clearly terrible and not a good privacy solution. However, having all of the ISPs be able to learn our detailed correspondence patterns and relationships is also clearly terrible and not a good privacy solution. So, self-hosting being a clear privacy win for messaging will require a lot of technical improvements on the metadata front. It isn't a clear win in this respect today; it most likely depends on whether you see ISPs (and people who can compromise or coerce them) or Google (and people who can compromise or coerce them) as a bigger risk overall.
Not really. Google can monetize your information much easier than an ISP.
Self hosting puts you in control, which means you have potentially more safety so long as you manage risk. Physical custody of your data is very valuable. The metadata thing is more of a theoretical risk.
Embrace the fact that email is not ephemeral and can end up in the wrong hands from your perspective. The other party that you're communicating with is a far more likely leak than some rogue ISP or police action.
> Google can monetize your information much easier than an ISP.
More to the point: Google is a more central actor, who gets to see the data of far more users, than your ISP ever will.
Moreover, this moves from giving a third party your data, to giving them your metadata, and while people consistently underestimate the value of metadata, there is still an incremental improvement there.
But in the context of privacy is power, who is your real adversary? Clearly it is the state. And they have shown time and again that they are watching all ISP traffic, with their consent, whereas Google is making a sincere effort to resist.
I feel like using something like TOR would help here: it would create a background noise of other traffic while also providing a way for other users to not have to connect directly to the remote server.
So I ask: is there a way to provide an optional TOR endpoint?
e.g. can I have an MX record with high priority that points to a .onion address, and then have a backup (with lower priority) that points to the normal global IP?
I'm not sure MX records would work without either modifying SMTP servers or using Tor in transparent proxy mode.
Postfix, for instance, has [transport maps](http://www.postfix.org/transport.5.html), but those let you pick a transport based on the email domain, not the MX host.
Currently there is no support for this in MTA software. If it were supported, you could imagine having somewhat better privacy properties for e-mail with other people who also used this particular setup. However, if you simply re-decentralize your e-mail using today's e-mail technology, you won't get those benefits in the short term.
> I think the difficult part is getting outbound MTAs to actually understand that a .onion domain shouldn't be looked up over DNS.
If you're running a local tor-compatible resolver they should be!
However according to RFC 7686 https://tools.ietf.org/html/rfc7686: "Applications that do not implement the Tor protocol SHOULD generate an error upon the use of .onion and SHOULD NOT perform a DNS lookup"
If you want anonymous mails setting up a normal server isn't good enough. You'd need an anonymous remailer like Mixminion to get even a basic level of privacy. But development on anonymous mail software has stalled ten years ago. There doesn't seem to be much interest.
This seems like an argument for argument sake. Our ISPs (not mine anyway) doesn't learn our detailed correspondence patterns. Google does. It reads my email and throws out ads. Seems trivial to decide who respects my privacy more.
Also, if ISPs are "tapped", you have a problem at the government level. IMO, privacy issues and government intrusion are not something technology can beat. Forget home servers and decentralization and usb sticks - If it's in your head, any determined government will waterboard that information out of you.
I actually don't use Gmail for partly the reasons you mention, so I'm not at all unsympathetic to your view!
However, I tend to think of governmental privacy threats as the most important ones, and I assume that many other people in this discussion (and in the community of people who strongly advocate decentralization) share that perspective. Your prioritization is sensible if you're much more concerned with corporate monitoring (especially if you live in a jurisdiction with effective data protection legislation).
You might also want to consider people who live under extremely violent or repressive governments, whose concern with government as a threat actor may be easier to sympathize with. They're probably better off in the short term with something like Google because Google will likely resist data requests from their governments, while the ISPs (being local and sometimes state-owned) will likely not resist those requests. While they can't resist every surveillance or coercion scenario, it's easy to imagine that they can fly under the radar easily by using Gmail if it's popular where they live and they aren't doing other things online that the government finds interesting.
Assuming there are undersea cables to tap, yes. Wouldn't this be a key element (for good or bad) of satellite/dirigible/balloon served internet - the ability to create a separate series of internet services?
How can you safely use a satellite or balloon (over the radio spectrum) if you can't safely use an undersea cable?
(This isn't purely a rhetorical question; maybe the balloon can be more tamper-evident than an undersea cable would be, or maybe the model for where link-layer or network-layer encryption can be applied could be more transparent or more controlled by a user or customer. But overall, it's tricky to explain why using RF, which there are tons of spy facilities worldwide and even in space to intercept, is safer than using an undersea cable.)
With self-hosting and SMTP, there is now a very clear TCP metadata record showing how my home IP address connected on port 25 to your home IP address. Maybe the next day you write back, and there's another nice clear metadata record showing your address connecting to me. Now any ISP between us, and anyone who can tap the ISPs' cables, knows that you and I are corresponding.
If we were both using Gmail, this metadata pattern would pretty much not appear at all: we would each make an HTTPS connection to Gmail and exchange a bunch of data, and while in principle my upload would be matched in size by your download, it would be extraordinarily noisy in many ways and hard to correlate in practice. On the other hand, Gmail would know everything about us.
Having Gmail know everything about us is clearly terrible and not a good privacy solution. However, having all of the ISPs be able to learn our detailed correspondence patterns and relationships is also clearly terrible and not a good privacy solution. So, self-hosting being a clear privacy win for messaging will require a lot of technical improvements on the metadata front. It isn't a clear win in this respect today; it most likely depends on whether you see ISPs (and people who can compromise or coerce them) or Google (and people who can compromise or coerce them) as a bigger risk overall.