Non-expert tips for private email usage

Published and edited .

I’m no security or privacy expert, and similarly, you don’t have to be one to follow these steps. These tips concern your general mail setup and things to consider when signing up for services on the internet with your mail address. Since your mail address might be the second-best identifier behind your phone number, you really want to consider some things to protect it.

tl;dr

In short, you really should pay your mail service provider so that it’s not you and your data which is being sold. Additionally, you should distribute your mail usage to multiple services and addresses to make it more private, resilience and useful.

I won’t go into detail why the notion of »free« services on the internet is a privacy nightmare. As with all web services that do not cost any money: you pay with your data and privacy1. The most simple step is to leave Microsoft, Yahoo and Gmail (and Google in general) or any other »free« service and choose one that respects your privacy. The good thing is that they (for example Mailbox, Posteo, Tutanota, ProtonMail, Runbox, …) not only bring privacy but also have security2, feature and environmental advantages. Other people wrote about good providers, so I just want to add: if you are not concerned about your own privacy, think about all the people you exchange mails with. Gmail will not only look into your mails but also theirs. (Similar to wearing a mask during a pandemic, think about doing it for others and not just yourself.)

I do recognise that paying for services with money can be a problem for many. Especially since being non-privileged already comes with higher privacy exposure. Usually, an account at the providers listed above will cost you 1 Euro per month, so the advantages don’t come at a high price.

1 As Shoshana Zuboff correctly points out: The saying »If it’s free, then you are the product« is wrong in the sense that you are not even the product but just the sources and material of surveillance capitalism.

2 Please keep in mind that extra security can only be provided within the ecosystem of one of these providers. Additionally, if your thread model consists of getting your account hacked, Google and Co surely have world-class security to prevent that.

Multiple accounts

Besides the mail address I got from the organisation I’m working for, I set up multiple mail accounts. I have an account for personal mails with friends and family, one for my professional (freelance) work and one for services I sign up for on the internet. These could look like this:

The reason behind that is

  • first, that I can separate personal messages, work and things like newsletters more easily. I can turn off push notifications for accounts I currently don’t want to be bothered by.
  • Second, if someone gets access to one of these accounts, they won’t see all communication at once.
  • Third, it makes it easier to migrate to new accounts. I might want to change my professional appearance, which leaves the mail address my friends are using unaffected.

Personally, I also like to have these mail accounts at different providers as it disperses risks a single one might have.

Aliases

Most of the mail services mentioned above allow aliases and I highly recommend to make use of them. They give you an additional mail address which directs emails to the same postbox. So all mails – the ones sent to the mail address you signed up for as well as the alias you created – get delivered to you in the same way. Again, this has multiple advantages:

  • First, while your primary mail address is fixed, aliases can be temporary. You can easily create them and delete them directly after you used them for one service.
  • Second, you change your name but still want to receive mails to the same post box. Use an alias to receive emails to you old and new address.
  • Third, you can get really creative in setting up different aliases for different purposes. Similar to the multiple mail accounts you might want to use one alias for international services and one for domestic. One for more official things and one for the ones you just want to try out quickly. And – of course – you want one that you exclusively use for Facebook. We will get to why you want services to have different mail address in the next point. For now, I recommend setting up two or three aliases as they usually cost extra money. Additionally, I recommend using aliases consisting only of random characters and choosing a domain without country-specific top-level domains. In Posteo, for example, use posteo.org instead of posteo.de.

To get you started, here are instructions for Tutanota, Posteo, Mailbox, Protonmail and Runbox.

Address Tagging

Nowadays, many mail service providers allow you to use the plus sign to basically create unlimited mail addresses. If you have the mail address [email protected], you can simply use [email protected], and the mail will be delivered to you in the same way. This is also called wildcard recognition, subaddressing, plus addressing or mail extensions. The advantages over aliases is that address tags don’t need to be set up and can be used without additional costs. But similar to the aliases, this allows getting really creative in its usage: You can auto-tag, filter, sort and do more with each address. For example, you sign up for a service with [email protected] and set up your mail program to automatically mark every mail to that address as important. You can also sign up with a unique mail address for every service. The reasons why I highly recommend to do that are the following:

  • If one company gets too spammy, you might want to direct all mails to that address to the bin.
  • If one company has a data breach, the mail address you used for their service might end up on some markets. If they also leak your password, the chances are high that people will use your mail address and your password on other websites to test if you used your password multiple times. Besides that you should never use the same password twice, by making your mail addresses unique it is harder to misuse. Just to make things a bit more tricky for an attacker, you might want to »salt« your address by not just adding +service@… but +service25sd@…, where the second part is a random combination.
  • If one company loses (sells) your mail address and all of the sudden you get mails from someone to the mail address you only used at this one website, you know where you mail’s address slipped through. Of course, spammers or anybody can easily use a script to remove the address tagging. But at least you added one obstacle.

More details can be found in the knowledge base of Mailbox, ProtonMail and Runbox.

Own domain

Of course, not everyone is willing to do that, but I really recommend using your own domain in combination with one of the mail providers above. Unfortunately, not all providers allow that. Still, it’s useful in multiple scenarios:

  • You separate the address from the service. You might want to switch from one provider to another, but your mail address stays the same. Similarly, you can switch the domain provider without the mail provider.
  • Some providers might block address tagging as they don’t allow the plus sign. With your own domain, you can create infinity address similarly to using the plus sign. This would look like this: [email protected]. Note: You need to set up catch-all in order to receive all emails send to your address. You need to check if your provider allows that.
  • Let hosting providers be hosting providers and mail providers be mail providers. These all-in-one services usually come at the cost of lower quality.

The disadvantage of using your own domain for every service might be that they also see your »identity« by seeing your website. Posteo currently doesn’t allow custom domains, but Mailbox, ProtonMail and Tutanota and Runbox do.

Next steps

These tips only cover the tip of the iceberg. If you want to find out more, I recommend the Privacy Project by the New York Times, the Data Detox Kit by Tactical Tech, Surveillance Self-Defense by the EFF, services like MySudo, the (a bit older) Crypto Paper, PrivacyTools.io or attend your local CryptoParty.

Conclusion

This guide aims to offer simple alternatives that don’t hurt much in your daily life, don’t come with difficult technical setup or risks (in contrast to setting up your own mail server). The good thing is that you don’t need to follow them all. Just pick the one fitting your needs.

With all these measures taken, please keep in mind that email is fundamentally insecure. These tips might bring some privacy from services, but should not make you feel comfortable sharing sensitive information over mail.

If you have additional recommendation or concerns regarding the article, feel free to contact me via mail, Twitter or anonymously through Constructeev. I also want to thank Cade from the New Design Congress for helpful feedback on this post.

References