dejan

If gmail did end-to-end encryption, how exactly would they scan your data for their ad purposes?

That would be the end of free gmail.

That's a bad title, email can be encrypted at rest. We just chose not to do it at the very moment due to the very little added benefit we see in our overall setup.

This is really a bad title to our Pro/Cons page, but in principle the takeaway here should be - email is not perfect and we chose some compromises (unless you use hey.com, they "fixed" email ;). That is why you are reading this as a Con to our service, not a Pro.

Indeed, for us, encryption at rest is only meaningful if we cannot access the mails either. However, that is nowhere on the horizon for email. There is a technical way to achieve that, but at a great cost of usability.

Encrypting the disks themselves is trivial and is on our roadmap, but it is nowhere as important as some providers tend to boast. That is why we say "quackery." It is just a "nice-to-have", but in every-day security it matters just as much keeping your car keys in a sealed jar all the time, carrying the jar in your pocket =)

Our data is stripped among multiple disks in RAID10 (obviously), that by itself ensures very little importance to a single disk. Not to mention that if a disk is dead, one would have to find it, identify it belongs to specific user and recover it. This is more likely:

https://xkcd.com/538/

Processes inside of the data center are way more important than an extra layer of encryption for a hollywood heist.

In our so far experience, the biggest threat to users' data are the users themselves. Forgetting passwords, accidentally deleting mails, running malware, choosing weak passwords...

It is interesting that we have never seen this issue raised for Outlook, Gmail, Zoho, Yahoo, AOL and other large providers, who never did or will encrypt at rest.

With hosted services there has to be a chain of trust. We trust our providers (ISP, data centers etc), and our users trust us as a provider.

Furthermore email is generally being observed wrongly today [IMHO]. Email message is a equivalent of an open envelope, a postcard. The only way to security is end-to-end encryption. This way, the need to trust the provider is removed. We could say openly we do have encryption at rest, but that claim cannot be proven by anyone. Same way as Whatsapp says they are E2EE but being a closed protocol, we still have to trust Whatsapp they are telling the truth.

As a provider you have to choose what is worth implementing and what not, what realistically benefits users and what not. Military grade security is silly for email in our opinion. If that is requirement, one should probably not be using email at all. Use Whatsapp :D

Jokes aside, we just try to keep a sane approach to security and not take absolutist stand, all or nothing. It is always a compromise between usability for the user, maintenability for the sys admin and cost. We are not on the expensive side meaning we have to take sane compromises.

If you are willing to pay a premium for absolute security, we can of course do that for you, but we know no one will be willing to pay, and those that do, we probably do not want to have such users, based on our experience from @protonmail users using Migadu. There is tutanota for that purpose btw.

Email was not meant to do many of the things we today try to use it for. It is much more complex than majority will even know and appreciate unless they become providers themselves.

Hi, dejan from Migadu here. Thank you for your comment. We are happy to correct ourselves, but your comment does not prove us wrong to the reader.

I would appreciate to hear the technical reasons why we are wrong on security topics, and less of personal sensibilities. This will contribute to the discussion better and potentially to the email ecosystem :)

email :) contact at migadu dot com

Hi Andrew,

We will gladly sponsor you with email services - migadu.com regardless of your status. No cloud storage though and no documents/spreadsheets. Groups/forums/email lists are coming soon by the end of the year. Calendar is due in a few weeks.

Could get much much worse.

I see. I will take that as a great suggestion. Thank you. We will update our terms to reflect it.

@TheGrumpyBrit - I am sorry, did not meant to imply you did not know about the email internals.

I agree with you, but in the end, if all of those are correct on our side, it simply can be the spam filter on the other side. It is not only the sender who decides the deliverability :)

We do not use any tracking pixels.

Btw. Any suggestion is more than welcome and highly appreciated! Thank you for looking at Migadu!

You live up to you nickname :D

Sending sales emails is not the same as spam, at least not in the lines of business using Migadu. We are not judging what people do for living, but rather try to aid them with a worthy advice if there is a better way. Working hand in hand with users pays off and we both enjoy it. We're tired of being nobody to some wise Google(rs)....

If sales stop, the world would stop. Everyone sells something to somebody.

That's fine with us. Nevertheless, I am not sure you appreciate or fully understand how email works. If outlook is marking as spam a valid, DKIM authenticated email, with a correct SPF from a server with excellent reputation of 99/100 (SenderScore) and good domain reputation...who is to blame?

Everyone is quick to jump and blame the small guy. :) Our reputation score is actually better than some of the largest email providers because of our low volume and individual verification.

We've been overwhelmed by the interest. Thank you guys for all the interest and great comments! We're re-adjusting our infrastructure to deal with the demand. The site and infrastructure is a bit suffering today, but we're hard at work and get all ready during the day.

You are absolutely right. However, our limits are not really hard limits. If someone occasionally needs to send more emails we do not make a fuss about it. However, a red flag (thanks for mentioning it :) goes up and we check if everything is ok. We never sanction users.

We do have sales teams using Migadu. However, they simply estimated how much they would send and signed up for the higher plan. It's straight forward I believe.

We are planning to release an API soon. Thank you for suggesting it!

We've had our servers blacklisted for "low traffic" and completely legit, authenticated emails marked as Spam. Completely new IPs with 100/100 reputation were blacklisted just because they were not known from before. To get us off from their lists we were in for a web of problems. It is all rigged against the small hosters. If you are a bigger one, you can just get directly in touch. I was personally all for the idea of running own mail servers, but after the experience so far, would say good luck with that. Unfortunate though.

Note taken! Thank you!

Yup, we use Stripe and their subscriptions with their payment method storage.

We do not accept PayPal in the interface, but will accept payments for yearly plans on individual basis. So if you wish to use PayPal, please just get in touch for now.

Would have not expect you to change either. Fastmail is awesome and a lot of respect for them. We're trying to learn from them all the time.

I'd classify Migadu in a different category. If you run multiple projects or just need extra addresses fast at no extra costs, you'd probably not go for FastMail. I can clearly see using them both.

With a single domain, or a single mailbox Zoho is a great alternative. If you run multiple domains though, why not spare yourself the trouble and complexity?

Thank you for giving us a spin. They do (via aliases / catchalls).

Thank you! Very appreciated!

Exactly, we prefer using the right service for the right task at hand. Personal / business mail is not for sending bulk emails. It also carries reputation penalties.

Indeed. Since we started from scratch we were very careful about what goes in and what doesn't. Not trying to be ignorant regarding 2FA, but rather always prefer to hear the actual reasons.

Nevertheless, thank you guys for all the suggestions, we will work to get 2FA in ASAP.

Thank you for your comments. However, Migadu is not intended to be "cheap". That is not the selling point of it.

We used to use Google Apps for multiple domains for our starup projects, ideas etc. Switching between these multiple accounts was becoming ridiculous and complex. Then, they made it $5 per account. We actually had many addresses but only two users. Our total cost of that would be measured in hundreds of $ which def would not be worth it.

What I personally dislike regarding other services is that they claim storage as one of the most important selling points but then do not account for the price drop per GB. Since GMail for work launched (2006?), the cost per GB dropped more than sixty fold: http://www.mkomo.com/cost-per-gigabyte-update

Any update in price? Nope. And then, the price of Google Apps (Gmail) are global. We have clients in Zimbabwe for instance. $5 per month per account is not the same as it would be in the US. Yet if a company from Zimbabwe uses a @gmail address, it won't be taken serious.

Migadu is profitable since a while ago, and real money is relative. We're not after exits and TechCrunch, just doing what we like and hacking at it daily. :) Pays the bills. Ironically, we are also in Switzerland, where living expenses are among the highest in the world.

Thanks for the assertions though! :)

Hi, not at the moment, but we will bring it up for discussion! May I ask why do you consider it a worthy addition? Thank you!

Thanks for the question. Unfortunately, asfik the email push notifications for Apple Mail have to be approved/implemented by the Apple team, so not much we can do there (yet). I believe FastMail was the only one besides iCloud that was approved for it.

Thank you for the input! I see your point and thank you for it! Honestly, we're not trying to play any marketing tricks, but rather give all help possible in order to decide whether it works for the interesting parties. Surely, we've got to trim down and brush off a lot of things.

The mail going to junk is an unfortunate reality, there are never any guarantees with any mail service, and especially with new services. We've already had the big ones play muscles on us several times.

Thank you for reporting the new tab bug, will be fixed!

The webmail / ui demo is coming up too. Thank you for suggesting it!

Thank you! Very appreciated!

Hello, thank you for the question. ProtonMail is a different kind of email for a different kind of audience, so it depends on what your needs are. Honestly, we're ourselves puzzled over benefits of ProtonMail over just using yourself GPG.

Hello, dejan from Migadu here. Sorry about that. It is an oversight on our side. We intended that dropdown as an aid, not a dark pattern. We'll get it rethought. Thank you for bringing it up!