In view of recent privacy concerns, Vicaro wants to know if I've changed my mind about recommending Gmail, and if there are any more secure alternatives.

Do the recent revelations about privacy issues – eg Google: Gmail users shouldn't expect email privacy – change your recommendation to link one's email account to Gmail?

And if one wanted a more secure arrangement but with similar benefits, could you recommend a solution?

Vicaro



The press has been piling on to Google in the past couple of days using the quote that "a person has no legitimate expectation of privacy in information he voluntarily turns over to third parties". However, this is somewhat misleading without further explanation.

In a lawsuit, Google's attorneys were quoting a court case from 1979, Smith v. Maryland, where the court noted that "persons communicating through a service provided by an intermediary (in the Smith case, a telephone call routed through a telephone company) must necessarily expect that the communication will be subject to the intermediary's systems".

So, Google isn't saying that its staff are free to read your emails, but that all your emails will pass through its systems, and be scanned by its computers as part of the normal process of delivering them. All, or almost all, email providers do this anyway: it's one of the ways they identify spam emails and put them in a junk folder. In Google's case, and some others, your emails are also scanned for keywords that trigger the advertisements shown against them. I assume most Gmail users already know this, and they may agree with Google that it's better to have relevant ads than irrelevant ones.

The wider problem

Unfortunately, the privacy problem is much more serious than reading emails. First, email generates a lot of metadata about which people you email -- and which people they email -- that goes far beyond the contents of email messages, which are mostly harmless. See What your metadata says about you, a Boston Globe interview with MIT Media Lab professor César Hidalgo.

Second, last year, Google changed its privacy policy so now it can cross-reference data across all of its services. This prompted some class-action lawsuits. If Google can tie together what it knows about you from your email and calendar, the directions you get from Google Maps, and so on, then you might as well just use Google Now and forget you ever had any privacy at all.

Several times I've warned against putting all your digital eggs in one basket, and this applies to Google, Microsoft, Yahoo, Apple and any other giant service provider. If you have your email hacked or blocked, you don't want to lose access to your photos, documents, music storage, blog, social network, digital wallet etc etc at the same time. Using different suppliers for different services is now even more important because it helps protect your privacy as well.

A couple of years ago, switching away from Google would have been a bit painful, but now there are products and services that are roughly as good and sometimes better. These include the Firefox 23 browser, DuckDuckGo and StartPage for search, Nokia's maps (at here.com), Dropbox, and the Microsoft Office apps in SkyDrive. The only things I can't manage without are Google's time-based web searches, and "search by image".

I'm still using Gmail (along with Outlook.com and Yahoo Mail), but I use it in a private browsing tab in a separate browser. Also, I've long since deleted all my Google search history (I never log in to Google search), and opted out of Google's DoubleClick advertising tracking and Google Analytics, among other things. It's not perfect, but by today's standards, I think this provides an acceptable level of privacy when using Gmail.

Alternatives to Gmail

If you still want an alternative to Gmail, then Microsoft's Outlook.com does the job, and it will even import all your email from Gmail. This is worth doing if you only use it as a backup. However, Microsoft is just like Google in using a single ID for multiple services, and its privacy policy says: "information collected through one Microsoft service may be combined with information obtained through other Microsoft services". Same problems. (Microsoft has a "data dashboard" for privacy settings.)

Since both Google and Microsoft are based in the US, then as a non-US citizen, your data is vulnerable to American snooping, and I wouldn't expect Microsoft to put up more of a fight than Google. Just the reverse, in fact. However, it's a moot point. Following the Snowden revelations, no data held online by any American company can now be considered private, and this could include any site running in the .com domain. Given the apparent complicity of the British secret services, I'd assume it also applies to data held online by any UK service providers as well.

You could, of course, encrypt all your emails, or use a secure mail service provider. One of the simplest ways to encrypt emails is to use the PGP-based Mailvelope, which uses a Firefox plug-in or Chrome browser extension. It comes preconfigured for popular web-mail services including Gmail, Outlook.com and Yahoo Mail. However, it uses public key cryptography, so you can't send someone an encrypted email unless you know their public key. That limits it rather a lot.

Finding a secure service may be even harder. Last week, Lavabit's owner shut down his email service, saying: "I have been forced to make a difficult decision: to become complicit in crimes against the American people or walk away from nearly ten years of hard work by shutting down Lavabit. After significant soul searching, I have decided to suspend operations." Silent Circle promptly followed suit, saying: "We see the writing the wall, and we have decided that it is best for us to shut down Silent Mail now."

Try FastMail

At the moment, if you want an alternative to Gmail, your best bet is probably FastMail, which is owned by Opera Software (Opera is Norwegian), registered in Micronesia (.fm), and based in Australia. Unfortunately, according to Wikipedia: "Its servers are located in New York City with a backup in Norway." However, I've recommended FastMail numerous times here, since a reader, Frank Jordans, suggested it in 2004.

FastMail is a commercial service, and if you want to use your own domain name, it costs $39.95 a year. This includes 10GB of email storage. There are cheaper options, and you can sign up for a 60-day free trial.

Several people have written about their experiences switching from Gmail to FastMail. Examples include From Gmail to FastMail at ReadWriteWeb, and Switching from Gmail to FastMail by Max Masnick. Though it's US-based, Zoho Mail is also worth a look. Even the free service doesn't have adverts, so your email won't be scanned for keywords.

Presumably, someone will see the commercial attraction of providing a secure, private email service hosted somewhere that makes life harder for America's NSA, CIA and FBI, and Britain's GCHQ. Kim Dotcom – victim of an absurd FBI-inspired raid over his MegaUpload cyberlocker – might do it. (Sorry, Angela Merkel, I wouldn't trust "E-Mail Made in Germany".)

I'm certainly interested in an alternative to Gmail, not because of any privacy concerns but because Google keeps changing it for the worse. The latest downgrades include tabs (still optional) and the awful "compose box" (now obligatory). The Guardian's Oliver Burkeman recently posted some tips for "fellow change-hating old-Gmail aficionados" like me, and we're not alone. Venture capitalist, essayist, philosopher, painter, programmer and Hacker News founder Paul Graham just tweeted: "Gmail's bad redesigns keep pushing me closer to funding a new email co just so I can use it."

Y Combinator's previous investments include Airbnb, Dropbox, Disqus, Justin.tv, Ninite, Posterous, Rap Genius, Reddit, Scribd, and Xobni. I'm sure he could make a go of it.