Brave as a pseudo-email client

[trawglodyte]

Everyone's privacy/security goals are unique, even the word "security" means different things depending on who's saying it. Using Brave browser as a pseudo-email client has helped me achieve some of my security/privacy objectives and I'll describe how I do it here. Maybe someone can apply part of it to their own approach.

I learned the hard way that associating all my online activity with one e-mail and using third-party logins, while convenient, is not in my interests. Now I like using several e-mails for different purposes. I think, if nothing else, people should consider having ONE email address strictly for banking (if you have to do online banking at all). You may want to use this ONE email for other sites you regularly do financial transactions with, but do not use it for anything else. Do not give it as a backup email, do not use it to send messages to friends and family. Banking and financial transactions only. I use an email w/ tuta.io for this and I like it, the downside is that tuta emails are not POP3, you either use a browser or get their app and you can't forward it. But VERY secure.

The other two I want to mention is proton.me (very secure and offers a selection of services in addition to email, I believe you can forward to/from. Proton is a little pushy about wanting you to upgrade to a paid account.), and zohomail.com (surprisingly secure, I guess they devote their energy to landing business accounts rather than collecting users data and spamming you). A bonus of getting an email with any of those three is you can probably get the address you want without resorting to 765dave_⁷³³@bigsite.com. Like there is a good chance the first name you want will be available on any of them. (zoho is solid e-mail with something like 5G of cloud storage and many features similar to gmail, but I would even say creating an account with them just for a burner if you need to give some website an email to create an account but don't require further communication from them)

So, okay, you have a few secure emails with some control over how your info is shared/accumulated and maybe you like using the apps they offer to access them. But another way that has worked for me is to use Brave browser (it could be some other one, but Brave works nice for this) and basically I log into all the sites and have my inbox on each, then set it to launch to those pages, then go through all the settings and lock it down as much as you can. I do not clear on exit though. I want it to keep the cookies it needs to log in whenever I launch it. For this I also use Brave's password manager (although you can use Bitwarden or some extension if you want).

PROS- you can really lock down this browser, also Brave will show a badge with a number indicating trackers/ads blocked which will help you determine straight-away if one of your e-mail's is garbage. Tuta and Proton are the only two I've experimented with which ALWAYS show a 0. CONS- It will take a bit of work to get setup and a bit of time to break the habit of clicking links, entering searches, and so forth in an open browser. If you want, you can do a bit of that, but in principle it's better to copy links and paste them into your main browser. Keep this one only for e-mail and maintain that seperation.

I experimented with many different e-mail providers coming up with this, and I also want to say stay the heck away from gmx.com and don't get the freebie add-on email w/ a vk.com account. Both horrible, not worth it even for burner email addresses.

[mikewalsh]

@trawglodyte :-

Yeah, browsers are handy things, ain't they?

I frequently use them in this sort of fashion. With the Chromium-based 'clones' all having the ability to create desktop 'apps', running in their own window, out of any website(s) you care to use - and with the 'portables' all being self-contained, easy to move around, AND you can even run 'em from a flash drive - I often set-up instances of a browser specifically for certain groups of 'apps'. I've got one set-up just for video-chat clients (Google 'Meet', JitsiMeet, Skype4Web, and WIRE).....for which I, too, am using an instance of Brave.

Certain websites I have set-up as dedicated desktop clients - NetFlix, for instance - which can be fired-up from their own Menu entry..! With plenty of hardware resources, AND the ability to run a modern, up-to-date browser, the "sky's the limit".

Point being that these days, there's a web-based version of just about anything you care to name. And with websites being totally cross-platform by nature - if you can run a web-browser, you can access the same bunch of websites - it makes using stuff under Linux SO much easier.

(I wouldn't recommend using the Yandex browser - another Chromium 'clone'. As it comes, you cannot save anything 'locally'; it MUST be saved to a 'cloud' account.....for which I've seen it reported that that the modern-day equivalent of the KGB (GRU?) have their own dedicated "backdoor".....so they pick your data over at their leisure! And the settings are a total nightmare to lock-down to any appreciable degree...)

Mike.

[trawglodyte]

(I wouldn't recommend using the Yandex browser - another Chromium 'clone'. As it comes, you cannot save anything 'locally'; it MUST be saved to a 'cloud' account.....for which I've seen it reported that that the modern-day equivalent of the KGB (GRU?) have their own dedicated "backdoor".....so they pick your data over at their leisure! And the settings are a total nightmare to lock-down to any appreciable degree...)

IMO Yandex is basically Russian Google. They are nosey and want a phone number in addition to password, all the stuff I don't like about Big Tech. But on the other hand the Russian government can't do much to me with data they collect, whereas the US Government can. I also like Yandex-browser for translation. IDK why, but yandex translate is just better than Google translate. Especially for Russian to English. But it's not a very secure browser and I don't recommend it. I've used it out of curiosity and my interest in geopolitics. I do have a paid account for cloud storage, it was way cheaper than any other I could find. But it's iffy, sometimes it uploads like a super-fast server in the nearest city to me and other times it's slow like it is going through a wire under the ocean to Moscow! Sometimes there are problems like emails I send from yandex email won't go through to protonmail and some other services, or I sign up somewhere and they freak out over Russian e-mail. I may be the only dude from IL who's been the victim of Russiaphobia! haha. I think most people would not like to deal with all those issues, but to me it's interesting. There is a yandex.com and a yandex.ru. yandex.com is technically outside Russia and I think that's how they are not sanctioned into oblivion already. Oh, and I don't know what you're talking about as far as saving locally, that works like any other browser. I do use yandex.disk, that's by choice and it's similar to Google Drive.

Oh, I should say too that it's pretty easy to hack in a Yandex-translate as a search engine on Opera or a Bookmark on Firefox or something so you can just enter a letter to translate websites into English using yandex-translate. You don't need Yandex browser for that.

I don't know what to make of webapps yet. I messed with vscode.dev for a bit, and I can see how using it in chromium with settings how you like is a good option. By the time I got it set up I thought it was easier for me to get the real app and I'm still not sure if I can make the webapp my default text editor. Extensions, on the other hand, I like. I have a .json display and editor extension, then I just have to open .json files with that browser and it works slick.

[williwaw]

if you were concerned about email security, wouldnt you want to save your mail locally?
use a client on your machine rather than a webapp for viewing/composing? and negate the need for a dedicated locked down browser?

[trawglodyte]

if you were concerned about email security, wouldnt you want to save your mail locally?
use a client on your machine rather than a webapp for viewing/composing? and negate the need for a dedicated locked down browser?

Without my own domain and server, this would just make another copy on my machine, right? How does that add security?

[geo_c]

Without my own domain and server, this would just make another copy on my machine, right? How does that add security?

Well you wouldn't be typing your email password in a browser that might have picked up some kind of tracker, or be concerned with the trackers from the webmail site.

So a local client separates email from the browser. I use thunderbird, and of course that's mozilla, so who knows what their email client does? Not me anyway.

I have often used neomutt. But it has always runs pretty slow for me on various OS's, even with a cache manager installed.

And I suppose with a local client to pick up mail you can have as many different account providers as you'd like and only give out the one's you want for web logins and such.

[williwaw]

Without my own domain and server, this would just make another copy on my machine, right? How does that add security?

domains are easy enough, running your own server not so much. one of the few services I find worth paying for is to host my domains email with someone who does email right. With any hosting solution, it's who do you trust to not hack or snoop your emails, and although there are no garuntees with any service providers, one who provides a fair service for a fair price is more likely to provide the advertised service without compromising their customers

if you only keep a few emails on the server, there is less available to compromise.

[trawglodyte]

Well you wouldn't be typing your email password in a browser that might have picked up some kind of tracker, or be concerned with the trackers from the webmail site.

You store your e-mail and password in Thunderbird or whatever e-mail client, how is this fundamentally different than putting it in Brave's password manager or a Bitwarden extension? I don't mean to put words in your mouth, but are you telling me you think there's inherent security in an e-mail client going to the mail-server vs a web-server?

[geo_c]

Well you wouldn't be typing your email password in a browser that might have picked up some kind of tracker, or be concerned with the trackers from the webmail site.

You store your e-mail and password in Thunderbird or whatever e-mail client, how is this fundamentally different than putting it in Brave's password manager or a Bitwarden extension? I don't mean to put words in your mouth, but are you telling me you think there's inherent security in an e-mail client going to the mail-server vs a web-server?

Well I'm just saying you wouldn't be browsing with the email client, and isn't that why you are using a dedicated browser? So you don't mix accessing webmail with general browsing?

Not that I think any of those methods are "secure." Let's face it, people with the right tools can get into most networks I think.

[trawglodyte]

one of the few services I find worth paying for is to host my domains email with someone who does email right. With any hosting solution, it's who do you trust to not hack or snoop your emails

I think this is true. I had Hostgator back when I had a business website and I didn't get the impression they had any interest in mining my data. I mean their business model was just hosting and building trust with clients. There would be little reason for them to put that at risk. I don't know if they're the best, but I was satisfied with their service and would probably use again if needed. But I do doubt they secure their servers to the level of tuta.io or proton.me, and encryption options are probably up to you.

Not that I think any of those methods are "secure." Let's face it, people with the right tools can get into most networks I think.

I don't think there's too many (if any) that can break 256-bit AES-GCM, AES 128-bit, or RSA 2048-bit encryption. If you're doing something to warrant the attention of the select few who might be able to, then........ well, good luck to you!

[williwaw]

Hostgator back when...... But I do doubt they secure their servers to the level of tuta.io or proton.me, and encryption options are probably up to you.

some web hosts don't put much into their email operations, and some have dropped their service or have had to charge more recently,that said,
there are dedicated email hosting solutions that probally offer as good a service as the encrypted ones you mentioned above. google email providers site:lowendtalk.com