The law has no privacy implications regarding FastMail: They always could, and had to, comply with legal orders for data. This is also true of Gmail and most other email providers. The primary difference here is that FastMail will only hand over your data in that scenario, but will never use your data for ad targeting or other corporate abuses of privacy.

ProtonMail and the like do more to protect you from the government, if that's your threat model, but you're going to lose out on a lot of features as well, because a lot of common expectations in email don't work with end-to-end encryption.

The new legislation does have implications for FastMail and privacy. Being spied on without any ability to review or intercede against the government's action via court is a serious loss to privacy.

Fastmail does offer any services that are affected by this law. Existing laws allow the government to get your data. Email is unencrypted so the government can get it. The law only affects things like proton mail because now the government can request you backdoor the encryption.

Posteo.de, run by a group of treehuggers so they make a big deal about how their data center is run by renewable energy, but they also care about privacy too. One down side is that you can't use your own custom domain.

And another is that I believe mail addresses are recycled. At least they were when I was testing their service a couple of years ago.

In my knowledge, among paid email services, only Runbox doesn't recycle email addresses. Fastmail, Posteo.de and mailbox.org recycle your address within a few months. I don't know what Mailfence's policy is on this. Are there any other paid and privacy focused services that do not recycle email addresses on their domains?

ProtonMail.

I switched from fastmail to migadu last week for my personal domain.

I've been using Migadu too. I have a bunch of other emails that I barely use, and would have been very expensive with other providers.

Yes I would have switched even if not for the new law just for that reason.

It also helps that they are based out of Switzerland, which has better privacy laws than almost every country out there!

ProtonMail? It supposedly has encryption that prevents ProtonMail from reading your email.

As long as they never silently introduce a backdoor in to the js app you are running. These new laws are purely to give the legal power for the government to request that.

If you believe that, yes. But that's not really novel. CounterMail had that a decade ago. Tutanota does too.

Using Thunderbird plus Enigmail for GnuPG, I can use any email provider, and be ~certain that they can't read my stuff.

> Using Thunderbird plus Enigmail for GnuPG, I can use any email provider, and be ~certain that they can't read my stuff.

Yes but no one can either :( In the last 5 years I received 2 encrypted emails, and thousands of non encrypted emails. The problem with PGP is that almost no one is using it.

Maybe the people you email with do use it though.

As I understand it, ProtonMail basically uses PGP. It just does it in Javascript or whatever.

But whatever. The ability to use GnuPG serves as a filter ;)

> As I understand it, ProtonMail basically uses PGP. It just does it in Javascript or whatever.

This means that maybe now the private keys are on your device, at any point in time they can update their frontend javascript code to get your private key and read all your emails.

> The ability to use GnuPG serves as a filter ;)

Yes definitely, I wouldn't get any emails at all anymore. Works great for Inbox Zero I guess.

> This means that maybe now the private keys are on your device, at any point in time they can update their frontend javascript code to get your private key and read all your emails.

That's the risk. By default, the filesystem isn't accessible to Javascript. But here, you've authorized key access for encryption and decryption. I suppose that Thunderbird and Enigmail could be modified to do much the same. But arguably that would be discovered quickly.

The difference is that Enigmail is maintained by an open source community, Thunderbird by Mozilla. Also the protocol your mail client uses to talk with your email server (POP or IMAP) don't really support the flexibility to send the keys over easily. As opposed to your clientside Protonmail client managed by javascript that can AJAX the keys to the mothership.

I looked at FastMail and ProtonMail. I ended up going with ProtonMail because they're in Switzerland.

I have successfully migrated to mailbox.org over Christmas and I am very happy with them so far. Excellent quality applications and web app, very reliable service and they use & support a lot of open source projects. They have a heavy emphasis on encryption and privacy.

Yeah, I was just about to open an account with them as well but I don't think I'm gonna be doing that anymore. It's unfortunate because they seemed to have exactly what I was looking for.

If you pay for GSuite as much as you would for Fastmsil ($5/month) you get the same privacy protections as Fastmail, along with better features (e.g. unlimited IMAP keywords per mailbox instead of just 128, better spam detection, etc.)

We only allow 100 these days... though I'm hoping that limit disappears once Cyrus IMAP internal datastructure changes happen. I bet Google aren't a fan of you having hundreds of keywords on emails either - but their data model at least supports it.

Well, one is a surveillance company that's always trying to get more data on people. One is a privacy-focused company with no stated interest in that. Both are in surveillance states with cooperation agreements. FastMail has the edge here short- and long-term.

Ideal case is one end-to-end protected in a country with stronger, legal protections for customers. ProtonMail fits that bill but lacks maturity. Some of us want our mail to definitely be delivered with a provider that will stick around long time. FastMail has the edge there over ProtonMail.

Why don't you switch to paid Gmail?

Not the person you're asking, but I don't "switch" to paid Gmail because there isn't exactly "paid Gmail". I would pay for the features of G Suite if I could get them to apply to my @gmail.com account - I don't want to set up a new account at a different domain. Said payment would eliminate advertisements from any Google service (exempting YouTube) where I'm logged in with my primary Google account.

i.e. I want paid G Suite to work like Office 365 Personal (which I do pay for), not Office 365 Business.