Yeah people affected by this would have to turn on adp (iCloud recovery key) and be vigilant about how precisely Apple chooses to remove that feature assuming the uk government doesn’t back down.
Worst case scenario you’d need to be doing local backups and have iCloud turned off.
Metadata is a bigger worry at that point though.
SMTP is only encrypted if the second server responds correctly to the first servers starttls.
The striptls type of attack, which prevents the servers from getting a valid starttls exchange, was in use over a decade ago by some telcom against its own customers.
Even if you know the person you’re emailing has a correctly configured client you can’t control a man in the middle attack between servers which has been in widespread use for years.
Mullvad us Denver 205.
I’m also using their encrypted dns though that shouldn’t matter. Recording an email might be a regulatory requirement of the intelligence sharing treaties of the eu and broader eurozone.
Try an endpoint outside of the western world and see what happens!
I think I got in before they started doing that.
Actually I don’t think they require that. I just set up a new proton account on a device with a fresh wipe from a vpn endpoint I never used before and they offered to record a phone number or recovery email but didn’t require it.
Of course, I only meant that unlike Gmail and such services like proton don’t actively impede your anonymity and build a profile on you as far as we know.
Here’s hoping Apple sticks to their guns and pulls adp instead of caving.
In case you didn’t see it a few weeks ago, 3.3 million servers are doing unencrypted transport.
The way email delivery is handled also means you’re not safe just because you aren’t talking to those servers.
It has always been like this.
https://lore.kernel.org/lkml/20250108122825.136021-1-abdiel.janulgue@gmail.com/
Here’s the whole thread if you wanna read for yourself.
My take away is that rust people are generally fine and try to abide by the norms of the kernel development process but Martin acts like a jerk and it would be okay if he didn’t come back.
See the comment far, far down in the thread implying that he’s somehow a more serious commenter or developer because he’s funded by donations as opposed to a company.
Anonymity and not being google or one of the other big mail providers.
Email is not an easily selfhostable service either. Modern spam filtering systems require the maintainer to jump through a bunch of hoops intended to defeat their anonymity and establish a recourse in case of problems.
If the op has their information in emails and doesn’t want to move it somewhere else then pgp is a good way to at least secure those emails a little.
I don’t think it’s a panacea, but as methods of encrypting email go it’s widely supported enough that a person whose private information is stored in email will be able to figure something out.