A few days ago, the U.S. government sanctioned A/I for supporting “extreme far-left antifa terrorists”. If you didn’t know, A/I is an antifascist and anticapitalist group based in Italy, and they host a lot of services (like email, website hosting, etc.) run through donations. Their policy states that they are against racism, sexism, militarism, homophobia, and transphobia, and you have to agree to those principles to use their services. Their website and mailing server has been taken down, and unfortunately, that also means my email no longer works. It’s kind of insane how quickly the American government can take down internet services they don’t like. A/I has denied all of the allegations by the Trump admin, and rightfully so, they’re just a digital services provider who respect your privacy and are against fascism and bigotry.
relevant link if you want to read more about this: https://cavallette.noblogs.org/2026/08/10076
I still need to use email, so what’s a good alternative email provider that doesn’t profit off of my data? I have used Disroot in the past and had good experiences with their services, so they are currently my fallback. I have ruled out Proton and Tuta, as neither support IMAP properly.
edit: It appears that it’s only the autistici.org domain that has been blocked (the registrar for the .org TLD is American), the services are still running (though my email is unable to receive mail, I can only read existing mail). A/I is working towards providing users with a new mail address. If that doesn’t pan out, I’ll probably go with Disroot.
No, that’s not how it works. If you set up mailbox encryption (mailbox guard), you set up (or let mailbox.org generate) a pgp keypair. Any time you want to read an email, you have to unlock the key first. This way you can use regular imap, the body of emails will just arrive encrypted (and optionally the subjects as well I believe), you only need a pgp decryption tool to read the mails (which Thunderbird/K9 supports out of the box (with OpenKeychain on Android)).
Right. A user from another server sends you mail. The mail is unencrypted on their side because they don’t know your key yet, or they don’t know how to use OpenPGP, or it’s automated.
Servers talk SMTP between each other, not just a client sending mail.
The round trip time in this protocol is fucking insane, but that’s what the people in the year 1980 thought of. They never thought this would be used outside of universities.
Anyways, inevitably,
mail.mailbox.orggets the message, unencrypted. It can encrypt it later. Though I don’t see how this is any safer than just getting the mail out with POP3.Yes I know how mail encryption works. The point is that mails get encrypted as soon as they enter mailbox’ servers, so mailbox can never know any contents, so they have nothing to hand over to authorities if they come asking. They do have to know the private key used for this though, that is a risk to consider. Of course, if you want fully secure mail, you need both parties agreeing on encrypting/decrypting the mail. Or just don’t use email, use a secure protocol instead.