Tutanota aknowledge being under attack | Hacker News Reader

Tutanota aknowledge being under attack

facebook.com

69 points8jef31 comments

I'm actually a customer of Tutanota, and their product has been pretty good in the last ~2 years I've used it.

Short of hosting your own email, I can't think of other email providers as secure as tutanota. They tick off a lot of boxes: open source, hosted in Germany, encrypted mailboxes, DKIM/DMARC support...

The only feature that might give people pause is that their search functionality isn't great. I have pretty low volume of emails to my personal inbox so it doesn't matter, but it might be frustrating to use as a work inbox.

Also a customer since a few years. Working with domains is a breeze. I also think the calendar and contact list are perfect features to place behind encryption.

This recent downtime issue is basically the only reliability problem I can even recall having experienced with Tutanota, so they seem to be getting more and more attention.

Seldom need search, but it is very basic and slow. I tend to work around that by using folders for e.g. senders, topics. Most (all?) collab functions are available within a single account between subusers (like an organization). Collaboration between independent Tutanota customers would be a nice addition.

Just playing with the thought of improving or implementing these _few_ features I've mentioned quickly turns into a pit of snakes. A cryptographic and engineering challenge.

So instead, I trust Tutanota to work on what's important, thoughtfully paced. Not too fast like my chaotic mind.

That's why I'm their customer.

How does it compare to ProtonMail?

I use and like both. I don't do anything fancy with my email, though, so YMMV. For my use case they are equal.

I like Tutanota much more (except for the last week) for a few reasons. The ones that come to mind include email search, more affordable pricing, and more flexible domain allowances. Also, they tend to roll out new features on a faster timeline, such as the recent addition of a new domain verification method that few providers currently support (that I forgot the name of?) and an in-app calendar.

Their blog post contains this interesting note: https://tutanota.com/blog/posts/ddos-attack-tutanota/

> We have long wanted to publish a status page. However, as a privacy-first email service, we cannot use Google services to host a status page (like most services do).

I guess Facebook doesn't count though.

I can’t get to their status page, which would seem to defeat the purpose of a status page.

I wonder if a static page on Netlify would comply with their privacy stance.

The fact that a status page is not reachable would itself imply the status of the service whose status it reports, no? Especially since visiting the status page is not normally done unless someone is having problems with the service.

Not really; part of the point of a status page is that it lets you distinguish between "their service is down" and "the route between me and their service is down".

If you prefer something that’s not Facebook:

https://twitter.com/TutanotaTeam/status/1306344728745644033

I don’t know if we will get a report as to what happened, but Tutanota is frequently used for…perhaps not entirely legal transactions. (Not that I would ever do such a thing, perish the thought.) I wonder if they made the wrong person/drug syndicate angry…

They supply a steady stream of spammers and phishing gangs with email addresses to use when signing up for email sending services. We blocked their domains entirely because it is all garbage.

Huh, the email service that everyone uses to buy “research chemicals” via Bitcoin attracts a shady audience? Shocking.

FWIW, I find those types tend to recommend ProtonMail more than Tutonota

>Tutanota

>3:09 PM (Sep 20 2020)

>We are very sorry about this ongoing outage. We are working on fixing this. While someone wants to stop you from using encrypted emails, we are committed to not let that happen. Thank you very much for your patience and for weathering this storm with us.

Weird fb quirk that I never noticed, if you click on the link it goes to the post. Then if I click ‘go back’ it doesn’t go back here, it opens the fb front page. Then I click ‘go back’ again and I’m here. They somehow Load the front page and then direct me to the post so quickly I don’t notice it when I’m going to the post. I’m on iOS Safari...

Might be a mobile quirk? I tried it on Mac Safari and it went back like normal.

Given how spotty it is, it might be some weird A/B testing. I’m also logged in to Facebook which might make a difference.

Same thing on Android Firefox, they wouldn't miss an opportunity to suck you into their endless feed...

I’m on iOS Safari and don’t have this problem. Do you have FB mobile app installed?

could it not just be facebook messing with the browser history via javascript?

If like me you never heard of them before:

Tutanota is an end-to-end encrypted email software and freemium hosted secure email service.

They've been down most of the day in North America. I've been using the service for about a year or so, without any problems but they have had at least some down time almost every day for the last few weeks. How common is it for botnet attacks like this to last so long?

"You must log in to continue."

One would hope encrypted email providers would know better than to force logging in to facebook to read their posts.

Maybe it's an a/b test? It works for me without signing in. You can also check their twitter page https://twitter.com/TutanotaTeam

I don't think that's up to the page owner. And you still have the option of selecting [Not Now] and reading the post

> I don't think that's up to the page owner.

Not if they choose to use facebook, no.

I have often found that organizations (government or private) have no idea how to configure privacy for their FB announcements so there is no way to view public content without logging in, even if it is ordinarily available to anyone with a FB account.

The same message is on Reddit, Twitter and other places.

Here is the twitter: https://twitter.com/TutanotaTeam/status/1306344728745644033

They don’t use DNSSEC, which means they can’t support DKIM.

They’ve given control of their DNS to NSA linked Amazon.

They’ll probably move their webmail to FBI linked Cloudflare next.

Virtually no DKIM zones are DNSSEC signed.

DNSSEC itself is linked to the NSA.

I tried their service 3 years ago, i couldn't receive emails and had to contact them through reddit... at least i got a refund.

Reply on news.ycombinator.com