Secure Mail Takes Professionalism

Jeremy Brown opens with the problem of choosing a new email host when a mailbox underpins so much of a person's digital life. He wanted to judge operational competence, meaning infrastructure quality and mature processes, but found little public evidence of it. He therefore measured proxies instead: legal jurisdiction, security-related features, security-adjacent features, legal resilience, and price. The providers compared were Google, Microsoft, Proton Mail, Tutanota, Hushmail, and self-hosting.

In the middle section, he explains that data stored in the United States can be reached under the CLOUD Act, while Switzerland, Germany and Canada bring different privacy regimes. Google and Microsoft scored strongly on two-factor options and account recovery, and Microsoft's add-on scanning and cloud office tools stood out. The privacy-focused providers offered more basic 2FA, fewer aliases, and little visible evidence of court challenges. Hushmail's past disclosure case still shaped its reputation. Self-hosting moves legal exposure onto the operator, and he argued that the real time and hardware costs often exceed a commercial plan.

He concludes that features are weaker signals than operational competence, and that the size of a dedicated security team may be the best available indicator. In the Q&A he discussed how encryption limits full-text search and suggested that providers adopt password-authenticated key exchange and the DIME protocol.