FastMail is not required to implement the Australian metadata retention laws
blog.fastmail.com
blog.fastmail.com
As a founder of an Australian startup that facilitates communication it's interesting to hear that using international hosting seems to bypass the requirements. IANAL etc. As the post mentions this is a pretty good way to discourage investment in local tech infrastructure.
Previous discussion : https://news.ycombinator.com/item?id=9345935
And yes, totally agree. It made us put our plans of an Australian datacentre on the shelf for the foreseeable future.
Data in Australia is already crazy expensive (https://blog.cloudflare.com/the-relative-cost-of-bandwidth-a...) and we're working at the latency problem from the other direction (http://jmap.io) as well, so we're focusing more on making the location of the datacentres not matter so much. We're currently in Amsterdam, Los Angeles and New York.
To your credit, I'm in Melbourne too and have always thought Fastmail was really snappy, which I assumed was due to Australian servers. So it looks like I was wrong, and your Jmap strategy is right.
What this means is that in addition to trusting Gmail or FastMail with your data, you now have to trust a third-party as well. And that may be cool for others, but doesn't work for me.
On the plus side, it's open source and seems nice inside, so it shouldn't be hard to add support for regular old IMAP or JMAP if one wants.
Biggest difference between Gmail and FastMail in how they handle email is tags vs classic IMAP folders. This can be a turn off for people, but for my personal email I discovered that I want folders. This is because my personal email also has the role of backing up my work email. I've lost work email in the past when switching jobs and I don't want that to happen again. And with FastMail I can simply download my work email in its own folder, so it doesn't have to pollute my personal email. FastMail is also very flexible in its settings. Setting up filters is easy in Gmail but limited compared with what you can do with those Sieve scripts in FastMail. Speaking of the interface, I now like FastMail's interface more, as it makes it easier to switch between folders, or back and forth between email, calendar, contacts or notes.
SPAM filtering in Gmail is said to be extremely good, however a certain class of spam has been reaching my Gmail Inbox for the past 2 years with me being unable to stop it - I made the mistake of giving away an email address on my blog and now I get emails related to SEO marketing and bullshit. In Gmail I cannot setup a filter that automatically marks an email as spam if it contains the word SEO. But in FastMail I can do just that.
FastMail does CalDAV for the calendar and CardDAV for their contacts. I can sync my Android phone and it works out great. IMAP is also very responsive and standards compliant. And personally I feel good about rewarding a smaller player that plays nice with others because monoculture are bad ;-)
Another thing I did after that was to create 2 Google accounts. I'm using one Google account for Google Play purchases and nothing else. This is because Google Play purchases are not transferable. So for example I have an old phone lying around that I gave to my son for playing. Restricted accounts only work on tablets, don't know why, so my son ended up having access to my email, which is not cool. Plus I'm all for paying for apps, but I should be able to share my purchases with my wife. Like if I buy a GPS device, we can both use it, but if I buy a maps app my wife can't borrow it without borrowing my account, along with my email. And I don't like this kind of lock-in.
There are some downsides. I could not find a good email client that can do IMAP Idle. FastMail's app works on Android but I don't like the UI. On the bright side that app is simply exposing their web interface, so FastMail works very well in a mobile browser, something that Gmail doesn't do and it matters when borrowing other people's devices.
All in all it's been a great transition for me and best of all is that I can now try out other Google services and products without feeling remorse or fear of lock-in ;-)
1: https://f-droid.org/repository/browse/?fdfilter=K9&fdid=com....
How do your employers feel about that? If I tried that with my current employer, I'd be switching jobs straight away.
CalDav is also shoddily implemented; for example, on android using fastmail's recommended 3rd party caldav sync, creating a meeting on your phone (calendar client using caldav to sync to fastmail calendar) will not send meeting invites. Surprise!
FastMail's message compose is also unusable on mobile firefox if there is quoted text in the compose area.
I use it because I'm removing google products from my life; you should just watch for the above bugs.
You are right that FastMail doesn't send out invitations when using third-party clients. FastMail is mentioning it on their page [1] promising they'll implement it, however I think this should not be the job of FastMail, but that of the client. For example this works fine in Thunderbird because Thunderbird sends those invites by itself, all you need to do is to specify which email address is linked to which calendar. Thunderbird sends invitations by itself for regular CalDAV accounts, but with a Google Calendar it doesn't do that because it is Google's Calendar that it is special. In this case it is the CalDAV-Sync integration that should send the invite.
Mobile Firefox is new and it doesn't surprise me that FastMail's compose doesn't work in it, because it has weird behavior when I interact with text boxes. I also use Firefox on my Android, but not for mobile web apps. It's currently too unpolished for that. But I'm sure that some bug reports will help.
One thing I'm happy about with FastMail is that things improve. For example they weren't supporting CardDAV for family accounts before August. Now they do and I'm pleased with it, though I wouldn't mind some extra functionality.
But that's the thing we are missing in the consumer / producer relationship, the direct relationship between the parties involved, the feedback. With Google there's nobody I can talk to, because they are too big to listen to individuals like myself. Usage of Google, Apple or Microsoft products leads to much like what happens in agriculture ... the rise of monocultures, the end of diversity and ultimately we end up with disastrous consequences for our own health.
It's really looking pretty nice now - the tricky part is safely processing incoming invitations, which I'm trying out a couple of different architectures to see what is most robust.
PSA: This is why you don't privatise public infrastructure
“If you have a device, you know, a phone or a smartphone, and if I call you
through the mobile phone network there will be a record. Say my phone’s
with Telstra, there’ll be a record with Telstra that I’ve called your
number.
If on the other hand I communicate with you via Skype for a voice call or
Viber, send you a message on WhatsApp or Wickr or Threema or Signal or
Telegrammer — there’s a gazillion of them — or indeed if you make a
FaceTime call, then all that the telco can see, insofar as it can see
anything, is that my device has had a connection with the Skype server
or the WhatsApp server; it doesn’t see anything happening with you.”
Additionally, Scott Ludlam is far more technologically adept than many of the old white law-educated guys in parliament. He's younger, he's very much of the IT era and is much more understanding of technology as a result. That's why he speaks out against this and other technology-related policies so often, because he gets the technological side of things.
The one who explained how to get around that law is our current Prime Minister [1].
1. http://www.businessinsider.com.au/malcolm-turnbulls-sky-news...
If a Swiss company were to pop up with a competitive mail offering, I imagine they'd sweep up a lot of business easily eh? Not that it's much more secure, just harder to imagine Switzerland easily handing over records, whereas with folks like MS, they've shown they'll do it on even non-legal requests.
> Not really quite sure what the benefit is there; email isn't latency sensitive.
tl;dr - We are Australian, so PATRIOT Act doesn't apply.
http://blog.fastmail.com/2013/10/07/fastmails-servers-are-in...
"It has been pointed out to us that since we have our servers in the US, we are under US jurisdiction. We do not believe this to be the case. We do not have a legal presence in the US, no company incorporated in the US, no staff in the US, and no one in the US with login access to any servers located in the US. Even if a US court were to serve us with a court order, subpoena or other instruction to hand over user data, Australian communications and privacy law explicitly forbids us from doing so."
"Australia does not have any equivalent to the US National Security Letter, so we cannot be forced to do something without being allowed to disclose it."
Drive encryption prevents offline data at rest, they keys will be in memory for a running server. If LEA is going to grab your servers, your keys are going to go with them.
That alone is worth paying the slight overhead on modern CPUs for full disk encryption of all user-data partitions (the OS isn't encrypted - it's Debian with some open source packages on it, and we throw it away anytime - http://blog.fastmail.com/2014/12/07/automated-installation/)
Really though, the point of all this isn't to say they can't take our servers - of course they can, via legal and illegal means. The point is more to say that they can't do it _quietly_, which greatly raises the bar, because now you've got a PR shitstorm to deal with.
But really, it's not going to happen, because we have good legal processes in place. There are proper channels from most countries in the world to the appropriate Australian authorities, and from there to us, and once that request comes in we service it and that's that.
If you want reasonably secure and private email, and you're not doing really dodgy shit, we're probably a safer choice that many. But we're not selling a privacy service, just an email service. If privacy is 100% non-negotiable for you, then you'll need to look elsewhere.
Your Australian honesty, "not doing really dodgy shit" won me over. I'm going to move a few over and check your service out properly.
Nice to see another Australian company doing well :-)
I was recently working with the developer of the ASynK contact synchronisation tool ( http://asynk.io/ ) to track down an issue I was having synchronising contact details from Fastmail using CardDAV.
It turned out to be a Fastmail issue; one of their developers was quickly on the GitHub issue chatting to the ASynK maintainer about it, and they had a fix in a couple of weeks.
Impressively clueful support.
When privacy is non-negotiable, I don't use SMTP email.
Hot damn you should put that on your front page. Ok maybe not but to people like me that is without a doubt the best way to phrase your sell.
Well yeah, of course they aren't going to seize your server if you just give them everything they want. It is far easier and cheaper for them.
I'm glad jurisdictional conflict is being used for good.
But it is a bit nicer to know that there's a harder legal standard in order for a party to snag a whole copy of your mailbox.
We (FastMail) have a far superior product in just about every other way though, so it comes down to what you consider important, and what tradeoffs you're willing to make.
In my opinion there is a very tiny gap between things for which a security agency is willing to take the PR hit of taking our servers out of the datacentre in New York (and dealing with the fact that the disks are encrypted and there are replicas in Amsterdam of all the data anyway) - and where they're willing to bribe/coerce a staff member or datacentre tech in Switzerland (or just quietly do a backroom deal with the government there). You would have to, as robn said - be doing some pretty shady stuff - stuff that's probably against our terms of service anyway - stuff that's probably going to get a lawful intercept done in any country. Speaking of which, Switzerland does lawful intercept too, and don't think that any service there will magically be immune from legal process. https://www.li.admin.ch/en/themes/procedure
tl;dr - we don't place ourselves above the law. We obey the laws of Australia, which has strong privacy protections still - despite this silly metadata retention business (which is totally knee jerk and poorly written and, our legal advice suggests, not relevant to us anyway). It's mostly so a handful agencies (actually fewer than before, it tightened that up) can get their hands on mobile phone tower records faster and with guaranteed timeframes of retention - local ISP email just got caught in the crossfire.
http://www.wired.com/2015/10/mr-robot-uses-protonmail-still-...
Go read: http://blog.fastmail.com/2014/12/15/security-confidentiality...
And then read: http://blog.fastmail.com/2014/12/10/security-availability/
In short - the datacentres in the USA are insanely cheaper than Australia, they speak English (well enough, and you can learn the accent from TV), they have clueful staff, you can buy equipment cheaply in country and have it shipped to your datacentre quickly... lots of little things.
It's why we've moved the European datacentre to Amsterdam as well - it was that or London for price, language, availability of equipment.
Amsterdam may be the safer bet, not safe, but safer.
PP:https://www.fastmail.com/about/privacy.html
Also, I feel they overstate the jurisdiction piece. Being in Australia is important, but it certainly doesn't make you a paragon of privacy or Australia a privacy Eden. Company culture is great, but a five-eyes becoming more surveillance-heavy by the day doesn't make the technical aspects of maintaining private communication any easier. I'd be wary not to oversell.
I don't believe we made any claims that Australia is a "privacy Eden" or that we're "paragon of privacy". Indeed, we frequently say we're _not_ a privacy service, just an email service that cares about privacy among other things.
More specifics on both these points would help us discuss them properly.
It's a very direct, honest policy; it's definitely not the usual CYA bullshit that's kept in legalese to reduce clarity.
First, the meaning of a law can only be settled in the courts, strictly speaking. A legal opinion is a best effort, but it is an opinion, not a judgement.
Second, Parliament can amend any law it passes at will. And it has the power -- rarely but sometimes exercised -- to make its legislation retroactively effective.
https://mako.cc/copyrighteous/google-has-most-of-my-email-be... HN discussion: https://news.ycombinator.com/item?id=10229928