Closed MystesofEternity closed 2 years ago
I don't think it should be recommended:
For example, if CTemplar receives a DDOS attack that we are not able to handle, we will switch to using Cloudflare.
I don't think it should be recommended:
For example, if CTemplar receives a DDOS attack that we are not able to handle, we will switch to using Cloudflare.
I think they mean they would temporally use Cloudflare services to stop the attack, I'll send them an e-mail asking for this and other thing I want to ask them, still their service is excellent in almost every sense, I don't think this is reason enough to not recommend them.
Here's a comparison chart that they provide on their website (comparing themselves against Protonmail, Tutanota, Hushmail and Gmail) for more details, I think they totally deserve to be listed.
I don't think it should be recommended:
For example, if CTemplar receives a DDOS attack that we are not able to handle, we will switch to using Cloudflare.
I'm not sure if there should be big worries about this given the fact that this scenario wouldn't be actively happening 24/7 and besides, if one really wants to transmit emails along with the worry of interception then their password encryption of email functionality can be used.
I don't think it should be recommended:
For example, if CTemplar receives a DDOS attack that we are not able to handle, we will switch to using Cloudflare.
I'm not sure if there should be big worries about this given the fact that this scenario wouldn't be actively happening 24/7 and besides, if one really wants to transmit emails along with the worry of interception then their password encryption of email functionality can be used.
Also I doubt you will be able to use their service during a DDOS attack therefore it's not like Cloudflare can have some relevant information about you.
@Mikaela Could you please give specifics about the "research required" label. Is there a criteria being based against in order to judge whether or not this particular email provider passes the standards established by privacytoolsIO?
@MystesofEternity I think most of the important part which is under the PTio criteria is described in their comparative chart here(https://ctemplar.com/ctemplar-comparison-table/). And I'm pretty sure they pass the criteria.
The new (draft) criteria can be found here.
They don't have DANE, and they're not registered EFF's STARTTLS-Everywhere list. They also need to publish a plan to deprecate TLS 1.0 and 1.1 on mail.ctemplar.com; they still accept them and the mail server doesn't enforce cipher suite preferences.
Also, no public-facing leadership or ownership on the website. You need to go to the GitHub repo to see they're a group of Pakistani nationals that own a web dev agency.
Lastly, trust. How much does the community trust them, not just one person, but a consensus.
The new (draft) criteria can be found here.
They don't have DANE, and they're not registered EFF's STARTTLS-Everywhere list. They also need to publish a plan to deprecate TLS 1.0 and 1.1 on mail.ctemplar.com; they still accept them and the mail server doesn't enforce cipher suite preferences.
Fair enough, I think this can be worked out, I'll try to communicate with them to see if it would be too difficult to do this.
Also, no public-facing leadership or ownership on the website. You need to go to the GitHub repo to see they're a group of Pakistani nationals that own a web dev agency.
Ehh, what's the problem with them being Pakistan people? I haven't seen anything on their GH profiles that makes me think that they are nationalists.
Didnāt say Nationalist, I said National.
national - noun: a citizen of a particular country, typically entitled to hold that country's passport. "a German national"
Could you please give specifics about the "research required" label.
I don't know, I hope https://github.com/privacytoolsIO/privacytools.io/issues/977 will enlighten me on it and I guess I will be commenting there.
The whole company just screams untrustworthy. Offshore company in Seychelles talking about Icelandic privacy because they rented (virtual private?) server from Orange Website, while they are actually Pakistanis with address in Islamabad. What's stoping Pakistani authorities from coercing the founders?
I am the owner of CTemplar and I am a white male who resides in the USA. Yes, I hired a developer from Pakistan. I have also hired developers from Africa, Ukraine, France and South America. I pick developers based on the quality of their code, I do not select developers based on the color of their skin or their nationality. I will continue to hire developers based on their skill, without thought of their skin color.
My company was formed in Seychelles and servers in Iceland, exactly like Orangewebsite.com and flokinet.is. These are strong locations.
I made the planning decision to switch to cloudflare during DDOS attacks because I felt people need access to their email at all times. However, after all the booters were taken offline I have not noticed any serious DDOS attacks. Please do not view this statement as a challenge to DDOS my site, I am just sharing this for informational purposes. I would be happy to revise my company's policy to not switch to Cloudflare during heavy attacks.
->If you review our technical specs by clicking this link. DANE, TLS-RPT and MTA-STS are implemented and should reflect if this report is refreshed. https://www.hardenize.com/report/ctemplar.com/1581171498
->If you review the two links below you'll see we are at 85% and Protonmail is at 72%. I am not sharing this to slander PM, they are an excellent firm in every regard. I am giving this as a reference point. https://internet.nl/mail/ctemplar.com/320238/ https://internet.nl/mail/protonmail.com/320240/
->We plan on publishing our f-droid android app on March 2nd.
Please contact me with questions or concerns
I recall then when Ctemplar started, it turned out to be a bit of a rough start. That was because its marketing material existed mostly of pieces which were trying to hit on protonmail, and how Ctemplar was better. Then those articles were quickly removed, care to expand a bit on that?
I am the owner of CTemplar and I am a white male who resides in the USA. Yes, I hired a developer from Pakistan. I have also hired developers from Africa, Ukraine, France and South America. I pick developers based on the quality of their code, I do not select developers based on the color of their skin or their nationality. I will continue to hire developers based on their skill, without thought of their skin color.
My company was formed in Seychelles and servers in Iceland, exactly like Orangewebsite.com and flokinet.is. These are strong locations.
I made the planning decision to switch to cloudflare during DDOS attacks because I felt people need access to their email at all times. However, after all the booters were taken offline I have not noticed any serious DDOS attacks. Please do not view this statement as a challenge to DDOS my site, I am just sharing this for informational purposes. I would be happy to revise my company's policy to not switch to Cloudflare during heavy attacks.
->If you review our technical specs by clicking this link. DANE, TLS-RPT and MTA-STS are implemented and should reflect if this report is refreshed. https://www.hardenize.com/report/ctemplar.com/1581171498
->If you review the two links below you'll see we are at 85% and Protonmail is at 72%. I am not sharing this to slander PM, they are an excellent firm in every regard. I am giving this as a reference point. https://internet.nl/mail/ctemplar.com/320238/ https://internet.nl/mail/protonmail.com/320240/
->We plan on publishing our f-droid android app on March 2nd.
Please contact me with questions or concerns
I have sent you an e-mail with more questions and you (or someone from your staff) told me something along the lines of "we will answer you briefly", would you care answering those questions?
I recall then when Ctemplar started, it turned out to be a bit of a rough start. That was because its marketing material existed mostly of pieces which were trying to hit on protonmail, and how Ctemplar was better. Then those articles were quickly removed, care to expand a bit on that?
A company is composed of people who perform different roles. It is my job to find the best person to perform each type of task. I have no experience with marketing so I hired someone to do it for me. I gave that person authority to execute their ideas. After implementing this persons ideaās I realized it was a mistake, I picked the wrong person for the job, so I removed this person and removed their implemented marketing strategy. I had someone message PM an apology on Twitter, they accepted the apology via Twitter (direct message). Since then we have acknowledged Protonmailās contribution to the security and privacy ecosystem. You can read about it on our blog. https://ctemplar.com/ctemplar-recognizes-openpgpjs/ . Personally, I feel they offer a wonderful service and their run by very qualified and capable people. We are not enemies. We are all on the same team trying to fight against the assault to people's freedoms. The past marketing was a mistake, we apologized, and we posted truths about them. I cannot change the past, but I can change how things are in the present, and in the future.
I have sent you an e-mail with more questions and you (or someone from your staff) told me something along the lines of "we will answer you briefly", would you care answering those questions?
Yes of course, thank you for your patience. Please review this and let me know if you have any other questions
Question: Who owns the company/organization? What percentage does each owner hold? (December 31 of prior year and current date)
Response: I have owned 100% of this company since itās creation.
Question: Have you changed how information is processed and shared in the last year?
Response: We have not changed how any information was processed or shared.
Question: Do you share data ā even āfuzzedā or āanonymizedā data ā with any of the owners/shareholders or any other company or organization server?
Response: I am the only shareholder, only owner and control all the voting rights. I donāt retain or share any information whatsoever. The idea of sharing others information, even fuzzed or anonymized, is repulsive to me. Thatās why I created this company.
Question: Which components of your service are not open source? Where can we find the code for the open-source components?
Response: Our front end code resides here - https://github.com/CTemplar/webclient. The back end is not open source. This is what most every other service does I think. If both our front and back end were made available, then someone could create perfect clones of the service. Our back end code has no access to e2ee emails, it is āblind and dumbā to what happens in the users browsers.
Question: Have you had any independent audits in the last three years? Please share the dates of those audits and audit reports.
Response: We have had two independent audits done at launch. Iāll have to look for those.
Question: If you require sign-up or account creation, do consumers have easy access to tools to delete their data? Can they delete everything on the servers or just the local cache?
Response: Yes. Users can delete everything instantly; no backups are kept of anything thatās deleted. If a user deletes their account, it is deleted instantly.
Question: Is there a way for consumers to view any information you have collected about them?
Response: We collect nothing and when a person signs out of their inbox, all records and data of their visit are purged from our system. They are shown a screen telling them all their usage data is deleted every time they exit their inbox.
Question: What is your business model? How do you fund operations and make money?
Response: CTemplarās business model is offering paid accounts. We will never accept any donations, grants or investment from any outside source. I can prove this by making my companies shareholder corporate data available. But I won't be posting that publicly and I will require a signed NDA.
Question: Do you offer a transparency report?
Response: Yes itās here: https://ctemplar.com/transparency-report-ctemplar/
Question: How is data secured (in transit and at rest)?
Response: In transit we use the latest encryption methods with a reasonable balance between security and compatibility. For CT to CT we apply PGP encryption on top.
Question: Who has access to customer data?
Response: The CC payment processor has access to user's payment information. Necessary developers have access to customers encrypted data so they can do their job.
Question: What 3rd parties have access to customer data?
Response: Our payment processor has access to peopleās payment information if they pay with a credit/debit card. No other 3rd parties have access to any customer data whatsoever.
Question: What processes do you have in place if there is unauthorized access to data?
Response: Users data is encrypted when sent/recorded on the server. If there is unauthorized access they will only be able to obtain encrypted content. We will be supporting E2EE encrypted metadata within the next few months also.
Question: What customer data is collected, how often, and in what level of identification?
Response: When you visit our website, your browser sends us your user-agent and IP address. When you leave our site, no records are kept of your IP address with an association with your account. The IPās might be stored anonymously for up to 7 seven days if it is required to defend against attacks. If you visit using our Onion site, then your real IP address is not seen.
Question: Will changes to your Terms & Conditions and privacy policies be communicated to end users at least 30 days in advance of any changes? How will these changes be communicated?
Response: We will announce changes to our PP and ToS by posting it on Reddit/Twitter/Facebook. I am happy to do it in other ways also.
Question: Do you plan on making your software available on F-droid? If not, why?
Response: Yes, we will make it available on F-droid on March 2nd. We will be officially launching both the iOS and Android apps at the same time. Both the Android and iOS apps will be open source on github.
Question: Another user commented on the issue about this entry from your blog (https://ctemplar.com/ddos-cdns-sri/) where you state that you will end up using Cloudfare services if you canāt handle a DDoS attack. Will you be using your regular service after the attack finishes? Are you planning on implementing something to not depend on Cloudflare?
Response: We decided to remove that policy today; we will handle all DDOS attacks by our self. We will never use Cloudflare or any CDNās in any situation.
Yes of course, thank you for your patience. Please review this and let me know if you have any other questions
Don't worry, I understand you have a lot of other things to attend. By the way, is it better if I fill an issue on GH or send you an e-mail about troubleshooting? I have had a weird problem with your service lately.
Question: Do you share data ā even āfuzzedā or āanonymizedā data ā with any of the owners/shareholders or any other company or organization server? Response: I am the only shareholder, only owner and control all the voting rights. I donāt retain or share any information whatsoever. The idea of sharing others information, even fuzzed or anonymized, is repulsive to me. Thatās why I created this company.
You do use ajax.googleapis, fonts.googleapis and gstatic. Do they not collect any kind of information? Would you be willing to change their services for an open-source alternative (awesome fork or awesome fonts) or even better hosting all your icons and/or fonts on your own?
Question: Which components of your service are not open source? Where can we find the code for the open-source components? Response: Our front end code resides here - https://github.com/CTemplar/webclient. The back end is not open source. This is what most every other service does I think.
Yeah, it's pretty much and anyway it can't be proven that what's hosted it's the same as what's on GitHub.
Question: Have you had any independent audits in the last three years? Please share the dates of those audits and audit reports. Response: We have had two independent audits done at launch. Iāll have to look for those.
Please provide URLs to these when you have time, it would be great to see them!
Question: What is your business model? How do you fund operations and make money? Response: CTemplarās business model is offering paid accounts. We will never accept any donations, grants or investment from any outside source. I can prove this by making my companies shareholder corporate data available. But I won't be posting that publicly and I will require a signed NDA.
I don't think this is necessary, and if anything, the staff are the ones who may be interested in seeing it, but I don't know.
Question: Who has access to customer data? Response: The CC payment processor has access to user's payment information. Necessary developers have access to customers encrypted data so they can do their job.
So you do share some data with 3rd parties? Please don't take it bad, I'm just trying to provide some honest feedback, I really love your service!
Question: What customer data is collected, how often, and in what level of identification? The IPās might be stored anonymously for up to 7 seven days if it is required to defend against attacks.
What does it mean that the IPs are stored anonymously? How do you anonymized them? Will you log the IPs of all your customers under such circumstances or just the ones of suspected attackers?
Question: Do you plan on making your software available on F-droid? If not, why? Response: Yes, we will make it available on F-droid on March 2nd. We will be officially launching both the iOS and Android apps at the same time. Both the Android and iOS apps will be open source on github.
Really good to hear this, cheers!
I think the only thing you still need to meet PTio criteria is to be registered under EFF's STARTTLS-Everywhere list, if you have already deprecated TLS 1.0 and 1.1. Then I guess it's just a bit of time until they can modify the website.
Here you will find the criteria to list e-mail providers in case you want to check it with your team:
https://deploy-preview-1672--privacytools-io.netlify.com/providers/email/
->If you review our technical specs by clicking this link. DANE, TLS-RPT and MTA-STS are implemented and should reflect if this report is refreshed. https://www.hardenize.com/report/ctemplar.com/1581171498
I've refreshed it now as I have an account with Hardenize.
@Godfry what's the likelihood of Subresource Integrity on that google fonts usage?
@dngray We will be getting rid of the google fonts expeditiously.
@5a384507-18ce-417c-bb55-d4dfcc8883fe
You do use ajax.googleapis, fonts.googleapis and gstatic. Do they not collect any kind of information? Would you be willing to change their services for an open-source alternative (awesome fork or awesome fonts) or even better hosting all your icons and/or fonts on your own?
Those will all be removed immediately. Thanks for bringing that to my attention.
So you do share some data with 3rd parties?
We share anonymous order numbers with our payment processor when needed to process refunds. We share no other information with any 3rd parties. We allow BTC and XMR also.
What does it mean that the IPs are stored anonymously? How do you anonymized them? Will you log the IPs of all your customers under such circumstances or just the ones of suspected attackers?
Never at any time do we link any account to any IP address. There isn't a possibility for correlation. The IPs are stored in our logs for the minimum period of time we need to provide a stable service. These logs help to find harmful attack patterns and temporarily block the service. There is an automatic pruning and without manual intervention under normal circumstances. If we are attacked by someone who also uses our service we would have no way to know. And to be honest I don't care. My only goal is to maintain steady service.
We are waiting to be registered under EFF's STARTTLS-Everywhere list, And we have depreciated TLS 1.0 and 1.1.
Thank you for your comments and questions. Kind regards to you all,
Hi,
Thanks for your in depth reply @Godfry. I am glad to see a provider striving to meet as many good practices as possible.
There were a few things that irked me though (marketing related):
We use 4096 bit encryption. This protects users from current cryptography cracking techniques and future hypothetical attacks.
This implies RSA, public/private keypairs. We know that quantum computing at some point in the future make public/private key cryptography not built to be post quantum proof crackable.
Current literature on that topic suggests cracking this kind of encryption could be as early as 5 years away, but more conservative guesses put this at 10-15 years away.
The "and future hypothetical attacks" is not something you can realistically offer with your service.
Do you plan to support AutoCrypt? I think this kind of out of band key sharing can be useful.
Ed25519 keys are becoming much more popular these days for OpenPGP due to their size. Some evidence of this being:
future-default
keyword ie
gpg --quick-gen-key address@domain.example future-default
100% Anonymous
This is another assurance you can't really offer either. 100% means certainty without failure. The customer may very well compromise their own anonymity. Yes I know that wouldn't be your fault, but I would steer clear of making statements of certainty like that.
We never track your IP address, keep logs on your usage or record any identifying information at any time. We prove this by making our code readily available
I think what you mean to say is that you don't personally collect the data and therefore cannot reveal it/be made to reveal it. I think it would be better to say that you allow anonymous usage.
Encrypted subject
I found it rather strange that "encrypted subject" would be a paid feature. I assume as you use PGP, this would be compatible with Engimail or neomutt. What I have noticed in this there's a new standard being developed Protected Headers for Cryptographic E-mail.
4.2. Confidential Subject
When a message is encrypted, the Subject should be obscured by replacing the Exposed Subject with three periods: "..."
This value ("...") was chosen because it is believed to be language agnostic and avoids communicating any potentially misleading information to the recipient (see Section 7.1 for a more detailed discussion).
Currently there's no standard what should be in the subject, for example Thunderbird by default uses "Encrypted Message" while neomutt defaults to "Encrypted subject" (can be changed with :set crypt_protected_headers_subject
). This may reveal information about the language used by the author, and what email software they use, hence why they chose ...
.
Are you using this method or some other method?
I do feel this should be a feature available to all. This would benefit your paid customers too.
Eg. Alice might join your service and become a paying customer. She might tell Bob about it and he joins too. However, Bob has decided to not to become a paying customer.
If Bob sends an email to Alice without encrypted subject (because it's not a feature available on free accounts), that actually isn't good for Alice, who is a paying customer.
Another question I had was do you support WKD/WKS.
@Godfry Greetings! First of all, thank you for offering such a wonderful email service and alternative to Protonmail.
Today, I just realized that CTemplar's 2FA security feature gives no backup codes and that worries me... alot. Thanks to having lost a couple of important accounts to a 2FA disaster before and me not being vigilant enough to keep backup codes.
Because of that, I've strictly kept backup codes for every single 2FA activated account that I have to this day.
Are there any plans to improve this feature so that it provides backup codes just like how other services do?
@MystesofEternity I think this is probably either a bug or maybe the devs implemented wrong something. It is more appropriate to fill in an issue on their GitHub repository rather than asking the owner who is not in charge of programming.
@MystesofEternity please contact them directly for support issues, we want to keep this one about tracking related to privacytools.io
@dngray oh right, thanks for the heads' up about that.
@dngray
There were a few things that irked me
I apologize if my website's marketing upset you. I can't change the past but I can change the wording going forward. I'm sure many people share your same thoughts so this is an opportunity to improve things for everyone.
The "and future hypothetical attacks" is not something you can realistically offer with your service.
This was in reference to supercomputers' current ability to break RSA encryption. 4096 bit encryption gives greater future protection against supercomputer attacks in the future. If you still feel the wording should be changed I would be happy to change it.
We never track your IP address, keep logs on your usage or record any identifying information at any time. We prove this by making our code readily available. I think what you mean to say is that you don't personally collect the data and therefore cannot reveal it/be made to reveal it. I think it would be better to say that you allow anonymous usage.
Point well taken, Iāll update our wording to reflect your comments. Thank you.
I assume as you use PGP, this would be compatible with Engimail or neomutt. What I have noticed in this there's a new standard being developed Protected Headers for Cryptographic E-mail.
Yes we use PGP. Iām not sure if weāre currently compatible with Engimail or neomutt but Iāll start looking into it. Thank you for showing me the development in protected headers, Iāll follow that closely and implement it if it makes sense.
Do you plan to support AutoCrypt? I think this kind of out of band key sharing can be useful.
Yes we do plan to support AutoCrypt but I donāt have any idea when weāll get to it.
100% Anonymous. This is another assurance you can't really offer either. 100% means certainty without failure. The customer may very well compromise their own anonymity. Yes I know that wouldn't be your fault, but I would steer clear of making statements of certainty like that.
Thanks for this suggestion, I agree with your comment and weāll update our wording.
Currently there's no standard what should be in the subject, for example Thunderbird by default uses "Encrypted Message" while neomutt defaults to "Encrypted subject" (can be changed with :set crypt_protected_headers_subject). This may reveal information about the language used by the author, and what email software they use, hence why they chose .... Are you using this method or some other method?
We are currently showing *** for obfuscation because this is what is used for obfuscation for passwords as well. We have no problem switching to using ā¦ if it seems the better decision.
Another question I had was do you support WKD/WKS. We don't currently support WKD/WKS but it's on our development schedule.
I appreciate your comments and you'll see these changes reflected on the website when we do our next website update
Kind Regards, Godfrey
@MystesofEternity I've added your suggestion to our development schedule, it's a good suggestion.
@dngray
One more thing. If my website should be approved by privacytools.io then I request that it be at the bottom of the list of email services.
I think of the secure email services like soldiers in a military unit. Each competitive against each other to better each other but when the real enemy arrives they stand united each holding their shield to protect themselves and the person next to them. For example some secure email services like PM or Tuta fight legal and cultural battles that other services like mine benefit from. To continue the analogy if a soldier is taken down (Like lavabit), there are others who can maintain the defense.
This analogy helps convey why I believe this industry benefits from several capable services who compete but stand together. However I also want to show honor and respect for the other email services and being put at the bottom of the list helps to convey that. Of course this is all contingent on being approved.
Kind Regards, Godfrey
There were a few things that irked me
I apologize if my website's marketing upset you. I can't change the past but I can change the wording going forward. I'm sure many people share your same thoughts so this is an opportunity to improve things for everyone.
No problem. Sometimes missfires happen that we can reflect on later.
The "and future hypothetical attacks" is not something you can realistically offer with your service.
This was in reference to supercomputers' current ability to break RSA encryption. 4096 bit encryption gives greater future protection against supercomputer attacks in the future. If you still feel the wording should be changed I would be happy to change it.
I figured as much that was referring to a classical computing context. Personally I'd just omit the "and future hypothetical attacks". It's impossible to really know what the future will be and whether or not such current cryptography will be entirely useful if some major breakthrough occurs.
The statement in itself infers certainty that you know that it will be sufficient in all cases. I'd probably word it like this sidestepping the whole thing about current vs future.
"We use 4096 bit RSA encryption. This ensures the confidentiality of your messages."
I assume as you use PGP, this would be compatible with Engimail or neomutt. What I have noticed in this there's a new standard being developed Protected Headers for Cryptographic E-mail.
Yes we use PGP. Iām not sure if weāre currently compatible with Engimail or neomutt but Iāll start looking into it. Thank you for showing me the development in protected headers, Iāll follow that closely and implement it if it makes sense.
The method that Enigmail/Neomutt uses seems to be the same. It seems it was not part of the AutoCrypt spec, however the RFC Protected Headers for Cryptographic E-mail does seem to be drafted by AutoCrypt group.
Do you plan to support AutoCrypt? I think this kind of out of band key sharing can be useful.
Yes we do plan to support AutoCrypt but I donāt have any idea when weāll get to it.
I did notice this:
My guess is it would have something to do with the warning that Posteo gave on the bottom of their announcement: "Security recommendations for implementing Autocrypt".
Currently there's no standard what should be in the subject, for example Thunderbird by default uses "Encrypted Message" while neomutt defaults to "Encrypted subject" (can be changed with :set crypt_protected_headers_subject). This may reveal information about the language used by the author, and what email software they use, hence why they chose .... Are you using this method or some other method?
We are currently showing
***
for obfuscation because this is what is used for obfuscation for passwords as well. We have no problem switching to using...
if it seems the better decision.
Yes I'd use ...
as that's what is defined in the specification, though there is more to it than just that. It would also be good to see CTemplar listed on the implementation status page, if/when you get it complete.
Another question I had was do you support WKD/WKS. We don't currently support WKD/WKS but it's on our development schedule.
Excellent!
I appreciate your comments and you'll see these changes reflected on the website when we do our next website update
Awesome.
@dngray One more thing. If my website should be approved by privacytools.io then I request that it be at the bottom of the list of email services.
The initial ordering was based on coverage of the criteria. We had then decided to just add new ones as they come along. That being said, there had been some suggestion of using alphabetical ordering to be more fair.
Of course this is all contingent on being approved.
After the few marketing related things you mentioned above I don't see anything standing in the way.
I was looking at CTemplar and it really seems to be an alternative but let me just get off the subject of this discussion to talk about the free plan. Only three e-mails per hour? Really? Not even for a simple test before you migrate from another server is that enough.
I was looking at CTemplar and it really seems to be an alternative but let me just get off the subject of this discussion to talk about the free plan. Only three e-mails per hour? Really? Not even for a simple test before you migrate from another server is that enough.
This is not the place to discuss this kind of things, the issue should be about if we should or not list the provider based on other things, not on how much the free plan can do. Providers from Silicon Valley make you think you don't have to pay anything but in fact they sell your personal data to keep the service running, almost every e-mail provider out there, that respects your privacy is paid, ProtonMail is an exception since they are the most known one and can afford to do it, CTemplar is a really new project, be considerate.
I am the owner of CTemplar and I am a white male who resides in the USA.
Question: Who owns the company/organization? What percentage does each owner hold? (December 31 of prior year and current date)
Response: I have owned 100% of this company since itās creation.
? "...a white male who resides in the USA" only narrows the ownership down to @ 50% of US residents. "I" could be almost anyone. The question is seeking verifiable owner and company information.
This is true actually and we do have a requirement for all providers:
We do not allow for random .onion e-mail services (often suggested) because nobody really knows who owns them ie. could be your worst adversary.
It does say on their transparency page:
We will provide our Seychelles company incorporation documents and ownership information to media outlets, to demonstrate that we are not owned by any government or corporation. This will be issued under a non-disclosure agreement. Please email legal@ctemplar.com for more information.
I would have like to have been able to verify this from a public source.
@fabianski7 Yes our policy is 10 emails per hour to 3 different non-ctemplar recipients. Unlimited CTemplar to CTemplar. We might make this unlimited to any other encrypted email service in the future. The reason for this policy is because people have created hundreds of free accounts and would use them to email countless sextortion emails. Limiting outgoing emails is the best way to reduce that kind of abuse. I believe Protonmail arrived at that same conclusion and have a 10 email per hour limit also. If you have any suggestions about how to prevent abuse while offering a free anonymous service, please let me know.
@LizMcIntyre After it was falsely circulated that I am a Muslim, people flooded our support inbox with insults against Muhammad and statements about how only white people are capable of writing code. I hope that explanation explains why I responded like I did. Our transparency policy states that we will verify ownership and company information to organizations that sign NDA's.
Why dont I want my name/picture all over the website? My developers wrote the code. We used the PGP code Protonmail.com maintains. We were inspired by countless security professionals who never receive any recognition at all. I do not feel I deserve any special honor, glory or reorganization. Someday If I personally make exceptional contributions to the security and privacy industry I might feel I earned putting my name & face all over my website. Then maybe everyone would see that I could have made a fortune as a male model? Maybe everyone would want to have cutting boards made with a picture of my six pack abs on it because my ab's are so rock solid? I am just making a joke. I understand your concern and I will distribute my identity as it is needed.
@dngray I would be more than happy to send yourself or any Privacytools.io admin my incorporation documents along with my passport, drivers license, and any other documents that are desired. I only ask that an NDA is signed beforehand. You can contact myself or the legal team, they have fulfilled several of these requests so far.
I'll be done with the comments you outlined shortly. I am also going through the rest of my website and trying to change/revise anything else that could be viewed negatively. If feel you would be rightly insulted if I made the changes you stated, but did not change similar writing elsewhere. I am just being careful to make sure I treat your time respectfully. I'll be done shortly.
Kind Regards to you all,
@Godfry
You have an insecure connection on the registration page.
See: https://i.imgur.com/US88FCI.png http://api.ctemplar.com/clock-image/6348e926b78d82958d6e2ee5ac3c10e712493c22/ https://developer.mozilla.org/en-US/docs/Web/Security/Mixed_content
If security.mixed_content.block_active_content
is active (which is the default) it won't be possible to see the clock image.
It seems that using user.js from ghacks breaks most of the site.
Accessing https://mail.ctemplar.com/mail/settings/dashboard-and-plans doesn't seem to be an easy task. See the amount of errors in the console: https://i.imgur.com/5bl3kLk.png
They repeat themselves everywhere. Some pages don't even open.
@fabianski7 I have tested using user.js
from ghacks and it worked perfectly, there is already a fix which fixed most of the icons issue using that profile.
If you still face the issue, please feel free to report an issue here https://github.com/CTemplar/webclient/issues
Thank you.
@fabianski7 about the registration page insecure, we are going to remove captcha completely, the fix is already on its way and will be availble soon. If you still have any issue, please report here : https://github.com/CTemplar/webclient/issues
@fabianski7 Your comments are noted and they will be corrected.
I want to discuss something with you Fabiansky7. You were asked by a moderator not to post these sorts of posts to this channel.
This is not the place to discuss this kind of things, the issue should be about if we should or not list the provider
I feel that an unbiased reader of this chain of comments would state that your attitude is aggressive and your goal is to publicly belittle my service and cause distrust. This seems especially true after taking into account your disobedience of the moderator, and disrespect for the Privacytools.io website when you use it as a platform to report/solve bugs.
If your intent is to belittle and discredit my service, I will give you a public platform to do it. I will publish it on my website in the "Zero-Censorship" area. My service has made mistakes and has had bugs. I will not hide from them. Please email my support team if/when your ready to post your content to my website.
The bugs will be tracked and completed with the other tasks we're working on.
Kind Regards to you all,
@fabianski7 registration page insecure issue has been fixed as we have removed captcha for free signup. https://github.com/CTemplar/webclient/releases/tag/v2.1.3
If your intent is to belittle and discredit my service, I will give you a public platform to do it. I will publish it on my website in the "Zero-Censorship" area.
Well, that was not my intention. I enjoyed the space here because since you are the owner of the service, it would be easier to report bugs.
I'm sorry if I left that impression.
[...] You were asked by a moderator not to post these sorts of posts to this channel.
I didn't see any admin complaining about what I posted (though this really isn't the place for it).
My intention was only to help with both sites.
@fabianski7 You responded kindly, and you kept the door open for continued friendly communication. That is a rare approach and I appreciate it. Sometimes in online communication it is difficult to gauge someone's mood and disposition because you can not see their expressions and hear the intonation of their voice. In this instance I feel I misunderstood you, I apologize. And you are correct I have often said that anyone is free to report bugs directly to me. Ultimately nothing matters except protecting people against privacy abuse. I think that's something you understand, thank you for your comments.
Your username reminds me of the football player named Fabianski, and that reminds me of a joke. Long ago I played football. During one game I wore a white uniform. Before the game I ate a chocolate bar to increase my energy. I ran onto the field and realized that I had mistakenly sat on the chocolate bar, I had a big brown stain on the back of my white shorts :) At the time it was embarrassing but I think it is funny now.
FYI - I'm almost done combing through my site removing rough edges.
@dngray I have completed all the wording changes to the website that I feel you indicated as well as other changes I feel needed to be made. If you notice other things, please give me the opportunity to correct them and I mean no disrespect to you or the Privacytools team. We have also started working on implementing autocrypt and we should be done with that within the next few weeks.
Respectfully, I submit my email service to be reviewed so that it can be listed on the email review page
@dngray You may want to look into this https://www.reddit.com/r/ctemplar/comments/flh2hg/website_hosted_on_same_server_as_mail_server/
@zack-95 If you read through the above comments you will see that using Privacytools.io as a platform to report bugs and concerns with our service is not acceptable. This policy has nothing to do with my service, it has to do with protecting the reputation of Privacytools.io and making sure it is never viewed as a support website for other services. If Privacytools.io is viewed as a support platform for services like mine, it reduces their ability to help people protect their privacy across all their needs.
We are preparing a response to your comment on Reddit and will post it shortly. If you have other concerns or questions please direct them to myself or my support team.
If your looking for a platform to make negative comments about my service I would be happy to publish your unedited review to our zero censorship page. In this way, you will benefit from greater visibility.
It is totally related, as it relates to a security risk, and I'm sure PTIO would not want to list a provider with such poor server infrastructure security practices that put their customers at risk.
PS: I'm not the reddit OP
@Godfry This isn't about reporting bugs. It's about the technical competence of the company in general. I am going to be candid here.
If you run nmap ctemplar.com
, you get something like this:
This is of high concern, especially considering that you are a secure email service provider.
Furthermore, if we look for DNS records on your domain, all the domains and subdomains lead to one IP, suggesting there is only one server: the one in the screenshot above.
Your WordPress site (the CTemplar site itself), Jenkins and mail is all hosted on this one server, and WordPress has not had the best history of vulnerabilities to say the least (Kevin Beaumont, Senior Threat Intelligence Analyst for Microsoft Threat Protection went so far as to call it a "really good Emotet distribution tool with an okay content management system bolted on"). If we go to port 3000, we see an exposed Nextcloud instance, SSH is open on port 22 in password auth mode. This is obviously unacceptable for any sort of service, but especially one that claims to offer "armoured email".
I don't know how much you yourself understand about this, but you ought to get some people onboard that have professional knowledge around cyber security. Running a secure email is not a joke and bad cybersecurity is not just a "light inconvenience". This can backfire in your and your users' face so hard, that you won't be able to put your name anywhere near IT anymore. These comments and posts are very well-placed as PTIO (or really anyone) should not be recommending or using insecure providers for the sake of themselves.
@LordNikon2x Your blatantly racist reply is completely unacceptable. You are profiling people based on what other members of their ethnic group are doing. These developers likely commited no crime and yet are being blamed, just because they were born this way. This is a place for civil discussion, not for ad hominems and racism. I may disagree and have objections with the security practices of ctemplar but to be so rude and discriminatory is completely uncalled for and unnessesary.
Please have some decency and debate with facts, not misleading blanket statistics. Furthermore, speak for yourself. You have no right as a racist to speak for any members of this community and clearly do not understand or have knowlege of the community.
I'm so impressed with what was said by @zack-95, @VigilantSwanson and @LordNikon2x.
I am a student at a highly esteemed university. I researched everything they said and agreed to it all because it is the truth.
The email page of PTio should stay the way it is and no new sites should be added.The community and PTio came together and did a great job! Together we can achieve dreams!
Basic Information
Name: CTemplar Category: Email URL: https://ctemplar.com
Description
A highly respectable email service that is hosted in Iceland and has a collection of features that respect privacy, security, and anonymity of users.
Resources
CTemplar comparison table vs Protonmail and Tutanota https://blog.ctemplar.com/ctemplar-comparison-table/ CTemplar open source code of their webclient https://github.com/CTemplar/webclient