Countermail

[Unseen]

Greetings.

With the recent increasing amount of subpoenas and requests for personal data from goverments, I've decided to abandon Gmail in favor of a decent and more secure non-US based email provider. I'd like to use it as my primary email address for things like online shopping, banking, official stuff and the like. I came across this swedish provider called Countermail. The website seems nice and they seem to offer a lot of features i.e. extensive use of encryption. I noticed the service is payable, but I'd gladly pay a few bucks for better security.

Does anyone have any experience with countermail? Good/bad thoughts?

Countermail: I noticed you have an account here. Now I don't mean to sound rude or anything, but I am a rather paranoid person (no apparent reason, just my nature), and I like to ask questions.

• Why exactly did you choose to set up your servers in Sweden, not some other european country? I mean I've been keeping an eye on the news, and lately the swedish government has been acting rather suspiciously. Check out what happened to Assange where sweden is seeking his extradition without charge. People suspect the US are behind this. And recently Sweden also played a role in deporting Gottfrid Svartholm from Cambodia back home. All this mumbo jumbo has a strong stench of corruption. What if the US bribes Sweden to do something similar to countermail (remember what happened to megaupload)?
  
  
• I don't like the use of java on your website. I mean java so many vulnerabilities that I can barely count them. Its like swiss cheese, not to mention the potential 0days we don't yet know about. Yes, yes, I know your applet is signed. But what happens, if the law enforcement (court order) forces you to sign an applet that includes a trojan horse or a keylogger, perhaps backdoor, and offer *that* to a specific customer when he checks his mail via the web page? Is the java applet open source? If yes, where can I find the source code? If no, why not?
  
  
• May I suggest you find some other ways to offer equivalent security i.e. why not make a firefox/thunderbird addon/extension to access the advanced countermail services same way you do with java? (*hint*)
  
  
• Is it possible to locally generate pgp keys (with gpg) and upload them to the countermail server to replace the existing ones?
  
  
• Do you inform users when authorities demand access to their data?
  
  
• Somewhere I read that you're prepeared to move your servers off to another state/country, if things get too hot. Which country is this, if I may ask? Why did you choose that country?

There, I hope this wasn't too rough...
See ya,

~Unseen

[Countermail]

Originally Posted by Unseen

[*]Why exactly did you choose to set up your servers in Sweden, not some other european country? I mean I've been keeping an eye on the news, and lately the swedish government has been acting rather suspiciously. Check out what happened to Assange where sweden is seeking his extradition without charge. People suspect the US are behind this. And recently Sweden also played a role in deporting Gottfrid Svartholm from Cambodia back home. All this mumbo jumbo has a strong stench of corruption. What if the US bribes Sweden to do something similar to countermail (remember what happened to megaupload)?

It's very simple, because of the laws. As long as we follow the laws everything is ok. Assange is suspected for breaking the swedish laws, but he is not convicted. Gottfrid was already convicted and internationally wanted by Interpol. There are many countries in EU that have worse privacy laws than Sweden.

[*]I don't like the use of java on your website. I mean java so many vulnerabilities that I can barely count them. Its like swiss cheese, not to mention the potential 0days we don't yet know about. Yes, yes, I know your applet is signed. But what happens, if the law enforcement (court order) forces you to sign an applet that includes a trojan horse or a keylogger, perhaps backdoor, and offer *that* to a specific customer when he checks his mail via the web page?

That's why people should use NoScript add-on, where you can easily activate Java or Flash on sites you trust, and have it disabled by default. Adobe Flash also have a lot of holes.

They can't force us to create special applets, again, they must follow the law. We already had some court orders, so we know how that works.

Is the java applet open source? If yes, where can I find the source code? If no, why not?

90% of it can be downloaded from BouncyCastle. There are some disadvantages by releasing the remaining 10%, one of them is that it's much easier to create a fake one. OpenPGP is an open protocol so it's not to hard to analyze and detect holes, the output of every encrypted mail can also be processed & verified by GPG. You don't even need our applet if you use an email client with GPG-addons, like Thunderbird or Apple mail. Some personal thoughts about trust: http://www.wilderssecurity.com/showpost.php?p=1727613

[*]May I suggest you find some other ways to offer equivalent security i.e. why not make a firefox/thunderbird addon/extension to access the advanced countermail services same way you do with java? (*hint*)

Yes, we have planned to do something like that, maybe with Javascript.

[*]Is it possible to locally generate pgp keys (with gpg) and upload them to the countermail server to replace the existing ones?

Yes, you have to generate the keypair by yourself (with GPG/Enigmail or some other PGP software), then you can email us the public key.

[*]Do you inform users when authorities demand access to their data?

No, we can't do that, it's against the law. But we may close accounts at a later stage.

[*]Somewhere I read that you're prepeared to move your servers off to another state/country, if things get too hot. Which country is this, if I may ask? Why did you choose that country?

We already have backup servers outside Sweden, but I can't say which countries. But it's all about the laws, selecting a country with decent privacy laws.

I'm surprised how many people who still thinks it's possible to host a good privacy service in countries like UK, US or France...

[Unseen]

Dear Countermail,
Thank you for answering these questions. It clears up a number of things.

Originally Posted by Countermail

That's why people should use NoScript add-on, where you can easily activate Java or Flash on sites you trust, and have it disabled by default. Adobe Flash also have a lot of holes.

I have been using NoScript for a number of years along with some other addons like RequestPolicy, RefControl, Cookie Monster, Better Privacy, etc. At one point I saw a yellow java alert when I tried to login to a trial countermail account. There were two java warning popups - the first applet had an invalid certificate while the second one was fine (green).

Originally Posted by Countermail

They can't force us to create special applets, again, they must follow the law. We already had some court orders, so we know how that works.

They can't? Not even under anti-terrorism laws? Strange. In the US I would expect the intelligence agencies to be able to do pretty much anything in secrecy - those national security letters come to mind. How many court orders on average do you receive per year?

Originally Posted by Countermail

Yes, we have planned to do something like that, maybe with Javascript.

I noticed on your website that you're planning to add support for encrypted chat in the near future. Can you shed more light on this? Are you going to use an XMPP server? Do you plan to support the Off-The-Record protocol?

Why do you charge your premium services in USD currency as opposed to EUR (you're in EU afterall)?

Best regards,
~Unseen

[Countermail]

Originally Posted by Unseen

At one point I saw a yellow java alert when I tried to login to a trial countermail account. There were two java warning popups - the first applet had an invalid certificate while the second one was fine (green).

There have been some browsers that issues a warning when the code signing cert had less then 6 month left, before expiration, this was a bug in the browser, it should only warn if the cert has expired. But I don't know if that was your problem, it's possible to compare the hash sums to make sure that the applet is correct: https://countermail.com/?p=changelog&t=1

They can't? Not even under anti-terrorism laws? Strange. In the US I would expect the intelligence agencies to be able to do pretty much anything in secrecy - those national security letters come to mind. How many court orders on average do you receive per year?

Only if something threatens the whole country, like a nuclear bomb or full scale war. We have not counted the court orders, approx once every other month, so it's not that many per year.

I noticed on your website that you're planning to add support for encrypted chat in the near future. Can you shed more light on this? Are you going to use an XMPP server? Do you plan to support the Off-The-Record protocol?

In the beginning we will only support our own protocol, but we may add other protocols later. The problem with other protocols is that they don't seem to protect against an evil administrator. Even if the message content is encrypted, the administrator can see who is talking to who. A good protocol will not reveal usernames. That's why we had to create our own protocol. If we found a way to use other protocols in a anonymous way, we will add them.

Why do you charge your premium services in USD currency as opposed to EUR (you're in EU afterall)?

Because USD is more widely used and stable, and at the moment it seems like we did the correct choice, EUR is pretty unstable...

[Unseen]

Originally Posted by Countermail

In the beginning we will only support our own protocol, but we may add other protocols later. The problem with other protocols is that they don't seem to protect against an evil administrator. Even if the message content is encrypted, the administrator can see who is talking to who. A good protocol will not reveal usernames. That's why we had to create our own protocol. If we found a way to use other protocols in a anonymous way, we will add them.

I'm not sure I understand.

Does that mean the encrypted chat will only work between Countermail users? I was hoping to see something that works across different servers. Because email has a similar problem i.e. you can encrypt contents, but when talking to other servers, the recipient is fully visible.

[Countermail]

Originally Posted by Unseen

I'm not sure I understand.

Does that mean the encrypted chat will only work between Countermail users? I was hoping to see something that works across different servers. Because email has a similar problem i.e. you can encrypt contents, but when talking to other servers, the recipient is fully visible.

Yes, it will only work between CM users. As I wrote, if we found a way to use other protocols in a anonymous way, we will add them. XMPP could be candidate, and if we open an XMPP server, you can use any XMPP compatible client.

[Unseen]

Alright then.
Well thanks for taking the time to answer my questions. I'll be keeping an eye on your service. It's definitely an option for me.

Best regards,
~Unseen