Forward Email (new features)

[forwardemail]

Hi there @123 – thanks for joining this thread.

@123

You use symmetric encryption (AES) to encrypt the mailbox inside a SQLite database (separate DB per user) and whenever I connect to the server my IMAP password is used to decrypt the mailbox. Is this correct? So while I’m connected to the server 24/7 my mailbox is in decrypted state for the whole time. That’s ok, I understand that there is no solution to this issue.

All SQLite databases (mailboxes) are encrypted using ChaCha20-Poly1305 using your IMAP password. We do not store your IMAP password, only you have it. When you connect over IMAP, your password is encrypted in-memory (currently using AES-256-CBC but we plan to switch entirely to use ChaCha20-Poly1305 everywhere) and used to open your database. For long-lived IMAP connections, we keep your database open in-memory using a JavaScript Map instance so that IMAP commands can quickly operate (e.g. if we close and re-open on every IMAP command, it adds 100-300ms overhead; which quickly adds up). See forwardemail.net/sqlite-server.js at ab4edcbc39578382f9f0d5379e2ddab31586ab49 · forwardemail/forwardemail.net · GitHub, https://github.com/forwardemail/forwardemail.net/blob/ab4edcbc39578382f9f0d5379e2ddab31586ab49/helpers/get-database.js#L478-L493, and https://github.com/forwardemail/forwardemail.net/blob/ab4edcbc39578382f9f0d5379e2ddab31586ab49/helpers/on-auth.js#L576-L577.

@123

But is there also an option to upload my public GPG key to the server so that all incoming emails that were not encrypted by the sender are encrypted on your server? If the server is later compromised this would protect my past emails (only content, not metadata of course) even if I am connected to the server and my mailbox is decrypted. I think this is what Mailbox,org and Posteo do.

Yes, this is mentioned earlier in this thread at https://discuss.privacyguides.net/t/forward-email-email-provider/13370/36 (screenshots included), but there is a FAQ section regarding this at https://forwardemail.net/en/faq#do-you-support-openpgpmime-end-to-end-encryption-e2ee-and-web-key-directory-wkd.

@123

• Also, how is the temporary database encrypted while I’m offline? Symmetric or assymetric?

While you’re offline (no IMAP connection established) we use ChaCha20-Poly1305 using a secret key of ours. Note that if you configure an OpenPGP key (as discussed in previous question) then your inbound email will be encrypted using your key in this temporary database. See https://github.com/forwardemail/forwardemail.net/blob/ab4edcbc39578382f9f0d5379e2ddab31586ab49/helpers/parse-payload.js#L1000-L1013.

@123

What are your thoughts on the JMAP protocol? Will it replace IMAP/SMTP? I know it doesn’t support E2EE by default, by maybe it would simplify encrypting email metadata?

We do not think that JMAP will ever be widely adopted nor will it replace IMAP/SMTP. See the thread at https://github.com/nodemailer/wildduck/issues/2#issuecomment-1765190790. We have no plans to support JMAP.

@123

How do you respond to the court/government requests/orders to handle user data or intercept communications? I fully understand that as a legally operating company you have to comply but there are companies/organisations (e.g. Posteo or RiseUp) that try to challenge the orders with the help of attorneys so if the requests are invalid or too broad they are legally rejected. This is of course a significant financial cost.

See the discussion at https://discuss.privacyguides.net/t/forward-email-email-provider/13370/57 and https://forwardemail.net/en/report-abuse#for-law-enforcement.

@123

Will you accept cryptocurrency payments already this year or it will take a bit longer?

See https://discuss.privacyguides.net/t/forward-email-email-provider/13370/50– perhaps later this year we will start accepting crypto with https://github.com/alexk111/One-Time-Address or something similar.