> Nobody, from the lowliest spammer to the grand exulted CEO of a massive company, can remove or change the content of an email message they have sent to you.
No. Unless it is on your own server. And this is an argument against FastMail, and they know it for sure. So why lying so brutally?
> FastMail is a provider you can trust
Rule of thumb: never trust anyone who says you can trust him/her.
If the Fastmail CEO sent me an email through Fastmail, with very little technical knowledge, I could set up a regular desktop client to download all those emails locally - headers and all. Even the iPhone default Mail app setup helps you do it.
The same is not true of Facebook - those messages belong to Facebook.
So FastMail's argument is just logically inconsistent. More, an agency problem is here.
its technically possible to edit the mail body on the server side and serve the modified message under the same mail ID.
I'd wager most clients would invalidate their local copy and trust the new mail from the server, but have to admit that I've never tested such a scenario.
Also: A backup of the mailbox would be unaffected by any server-side change.
You might want to consider POP3.
I think the argument is that you have a way to export and retain emails while there is nothing you can do with messages on FB other than screenshot.
I don't think their point was that you can get text vs images.
Not the SSL certificate for your domain, which Fastmail will acquire with or without your prior knowledge or consent, and to which you have no access or control.
They can't request a certificate unless you already pointed your domain to their servers. So if you're already doing that for HTTP, requesting an ssl cert so they can enable HTTPS on it is a perfectly valid request... especially when browsers are starting to mark all HTTP sites as insecure.
If I've received an email and keep it in the webmail, I cannot change that. A downloaded mail can be edited, unless it's signed with PGP. I can change content, headers, dates. An email in Gmail webmail cannot be changed by me. And while Google can do that, and maybe an excellent hacker can do that, the chance that you're the victim of that as an average Joe is very small.
What is your threat model? Obviously, it does not include google (and by extension, the state actors that can compel it to do things). But what does it include?
When you're in court having having a dispute with a customer or your boss, you can't dispute Gmail timestamps etc. That's all I'm saying.
Most solutions focus on preventing individual e-mails to be read or modified by a 3rd party. Does anyone apply similar techniques to a whole mailbox / account?