Gmail messages 'read by human third parties' - BBC

[AGTDenton]

https://www.bbc.co.uk/news/technology-44699263

Google has confirmed that private emails sent and received by Gmail users can sometimes be read by third-party app developers, not just machines...

I still remember when Gmail launched and you had to be invited to have an account so the race was on to get one. I was young dumb and living off mum at this point. I've yet to shake the dumb part...

I've wanted to leave Gmail for some time. The problem is its so embedded into a massive amount of daily life that it's never going to be a quick task and one which I've shelved time and time again.
Although I don't have any Gmail apps, I think it's really time to go back to the old skool, buy a domain and cheap bit of hosting. While POP3/IMAP are not amazing I at least have some control.
The days of £12/year hosting I'm guessing are over so the hunt is on.

I wouldnt be surprised if this isnt limited to Gmail

[peterb]

Not just limited to Gmail, any plain text e mail that resides on a server outside your control can potentially be read by machine or human.

[jimbouk]

I think more fundamentally, any application which you let read your emails can read your emails...

[Butcher]

I used to have a VPS with https://www.linode.com/ they're pretty cheap ($5/mo), especially given you get full control over your hosted server. You'd need to factor in domain costs on top of course.

[TheAnimus]

I've been saying this for years.

Even the reaction fanboys had to the whole "scroogled" campaign was funny as heck to me.

[Dashers]

Do ISPs still offer email addresses with line rental? There are plenty of forwarders that you could use with these if you didn't want to keep changing email address.

It's a bit of a problem, as the "free" email providers are dodgy like this. And for the average user, running your own mail server is unreasonable. And who wants to change address every couple of years as you switch between bottom of the barrel ISPs.

I guess you could just say, well screw them - if they can't be bothered with investing or shopping around for a quality provider then they deserve to have crappy security. But I don't feel that's fair - and of course, I still have to email people with gmail accounts. Doesn't matter how much security is around my own mail server.

Anybody on here though, definitely run your own mail server. Postfix is easy to set up. I've been meaning to write a tutorial, but there are plenty out there.

[peterb]

Do ISPs still offer email addresses with line rental? There are plenty of forwarders that you could use with these if you didn't want to keep changing email address.

It's a bit of a problem, as the "free" email providers are dodgy like this. And for the average user, running your own mail server is unreasonable. And who wants to change address every couple of years as you switch between bottom of the barrel ISPs.

I guess you could just say, well screw them - if they can't be bothered with investing or shopping around for a quality provider then they deserve to have crappy security. But I don't feel that's fair - and of course, I still have to email people with gmail accounts. Doesn't matter how much security is around my own mail server.

Anybody on here though, definitely run your own mail server. Postfix is easy to set up. I've been meaning to write a tutorial, but there are plenty out there.

Yes, I run a postfix/dovecot mailserver, but of course you still your own domain name, and crucially, a static IP address - and some form of authentication system (like sasl20 and be very careful with the configuration - you don't want to have an open relay!

But even if you don't want to host your own server, there are plenty of hosting services our there, NetscanUK, UKwebsolutionsdirect to name but two I have used for various organisations.

Of course, non of those solutions (except your own server) prevent mail from being read on the servers, and none prevent mail from being intercepted and read in transit, unless you use end to end encryption, and few if any mail clients now provide that facility (Outlook used to support S/Mime natively - not sure of the current version does, and Evolution - Luinux/Gnome - used to support S/Mime and gpgp). The only other option is to encrypt offline and send the encrypted message as a file for the end user to decrypt.

But that's another ball game...

[Dashers]

You can't trust MIME based encryption currently either, as many clients don't process the MIME correctly and can spew out the encrypted text to a remote location. Fun!

I forgot about email only hosting. There are plenty of options out there, but seem quite pricey for what they are. Few quid a month with limited storage - seems a rip off given that a VPS can be rented for a similar price, but most people don't have the ability to set that up.

I think that's the really telling thing though - I doubt most people will care enough about their emails being read to actually pay for email. People are too used to it being free.

Heck, find yourself a free mail forward alias and have it redirect to a random and complex mailbox on one of the temporary email address systems - anonymity through volume.

[Saracen]

I haveca near perfect solution to privacy via email - I rarely use email, and when I do am VERY selective about what I put in them. If you ASSUME anything you say is public knowledge the instant you 'send' it might put you in the right state if mind,

What we need is a total rethink about email, ground up, eith security and privacy embeded from day 1. I'm not holding my breath.

[peterb]

Even with end to end encryption, the ip addresses are still sent in plain text (otherwise the messages couldn't be routed)

However, I found this

https://tutanota.com

which offers end to end encryption if both users are using it. Not used it myself or have any details of how it works.

As an alternative, WhatsApp and Telegram instant messaging apps are end to end encrypted - or at least have the ability to encrypt end to end.

[Zak33]

even if you change to your own mail server/domain etc... i bet half the people who email you, use GMAIL so you're screwed anyway.

We signed away our privacy the moment we agreed to stop hand writing letters, and delivering them in sealed envelopes, and instead typed them onto a machine that we didn't in honesty understand and sent them electronically through a newtowkr we don't in all honesty, understand, and had other people open them in a similar way, and forward them if they desired. As soon as a mobile phone was only usable if it was linked to an email address and utterly wouldn't do anything it was designed too, without being perma-linked to the email company in question.

And most importantly, as soon as we agreed to use things for free.... while having been dragged up by our parents to understand that there's no such thing as a free lunch.

Naivety rules, OK!