tag:posteo.de,2009:/en/blog/feed?format=atom Posteo.de - Aktuelles 2018-01-09T13:00:00+01:00 tag:posteo.de,2009:Post/363 2018-01-09T13:00:00+01:00 2018-01-09T12:57:25+01:00 New security certificates <p>Dear Posteo users,</p> <p>In the coming days we will be updating our security certificates. Security certificates are only valid for a specified time period and need to be renewed from time to time. We will therefore be changing them by 22.01.2018. We continue to use certificates from Geotrust (Digicert) and the Bundesdruckerei (D-Trust).</p> <p>In most cases you will not notice anything when the certificates are changed over. All programs such as Thunderbird or Outlook will find the new certificate automatically. You do not need to do anything. If your program displays a certificate error during the changeover process, please simply restart the program, which should overcome the error.</p> <p>If you check the trustworthiness of certificates manually, you can find the fingerprints for the new certificates that we will shortly begin using, below. You can also find the fingerprints in our <a href="https://posteo.de/en/site/legal_notice">legal notice</a>.</p> <p>New fingerprints for TLS security certificates</p> <p>Geotrust:<br /> SHA256: FB:28:42:1E:23:AD:8A:23:8B:AB:C1:ED:FD:86:FD:F5:30:C6:D9:35:E0:E6:D8:91:CD:F3:77:66:05:C5:75:33<br /> SHA1: AC:9D:4C:F6:36:78:FE:D6:EB:5C:CE:F9:DA:CB:69:CE:0A:93:F4:58<br /> MD5: E9:B3:0A:C5:76:86:0C:FC:15:3D:43:D9:6E:CD:FC:CE</p> <p>D-Trust:<br /> SHA256: 09:63:1B:8C:35:CD:67:0E:AB:60:B3:63:1E:F3:42:DB:9F:43:5E:09:AD:09:A5:90:49:33:26:F2:FD:B4:D7:AA<br /> SHA1: B6:B8:3C:59:23:22:33:07:88:9E:DD:B9:8D:2D:ED:6C:FA:32:E9:04<br /> MD5: 5D:3F:4C:A3:72:7F:8B:3A:54:92:B4:C8:BC:D5:D9:B7</p> <p>Best regards,</p> <p>The Posteo team</p> tag:posteo.de,2009:Post/360 2017-12-21T18:30:00+01:00 2018-01-05T14:59:44+01:00 New: Easy email encryption with Autocrypt and OpenPGP header <p>Dear Posteo users,</p> <p>Starting this week, we are now supporting the new encryption method <a href="https://autocrypt.org" target="_blank">Autocrypt</a>, which will soon simplify real end-to-end encryption in email applications. Posteo customers will be able to use the technology as soon as email applications supporting Autocrypt are available.</p> <p>The trendsetting method is being integrated into popular email applications such as Thunderbird with Enigmail and K-9 Mail for Android. New versions of these email applications (Enigmail 2.0 and K-9 Mail 5.3) will support Autocrypt.</p> <p>When email senders and recipients are using email applications compatible with Autocrypt, they can use end-to-end encrypted communication with no additional effort: the email applications automatically encrypt emails with PGP prior to transmission while exchanging public keys automatically in the background. The manual exchange and management of keys &#8211; which users often perceive as complicated &#8211; is becoming superfluous: Prior to the first encrypted communication, a regular empty email (without content) is sent. With this, the key is transferred in the background. Henceforth, messages can be encrypted automatically.</p> <p>Autocrypt is a free and open standard, works with all email providers and uses real end-to-end encryption with the private key always remaining with the user. That&#8217;s one of the reasons why we support the method.<br /> #more#</p> <p><strong>Why we already support Autocrypt and protect keys additionally</strong></p> <p>A first version of Autocrypt is being integrated into popular email applications. The involvement of email providers in the key exchange has not been intended yet. The provider sided support generates benefits for the end user which we want to showcase with our early implementation.</p> <p>It is very important to us that Posteo customers will be able to use Autocrypt from the very beginning &#8211; as comfortable and secure as possible.</p> <p><strong>Our contribution to comfort:</strong><br /> Thanks to Autocrypt, email applications can soon automatically exchange public keys within the email headers. Our provider sided support makes it possible for an Autocrypt compatible application to receive a public key even if the sender uses an email application without support for Autocrypt. If the sender&#8217;s public key is available to us, we will take over that task: Posteo adds the Autocrypt header prior to every email transmission. Your communication partner is able to reply encrypted &#8211; without a manual key exchange.</p> <p>Your current public key is transmitted inside the Autocrypt header with every sent email. Therefore, there is always a copy of your current key available in the applications of your communication partner &#8211; without manual key management.</p> <p><strong>Our contribution to security:</strong><br /> We provide an additional layer of security with digital signatures (DKIM). For Autocrypt the use of DKIM has not been planned yet. Our provider sided DKIM-signature makes it impossible for a public key to be invisibly manipulated by a third party during transmission. An Autocrypt header attached by your local email application is signed with DKIM by Posteo. DKIM-signatures occur only when the sending address matches with the sending mailbox.</p> <p><strong>How Autocrypt is integrated into Posteo</strong></p> <p>Many Posteo customers have published their public PGP key in <a href="https://posteo.de/en/help/publishing-public-pgp-key-for-posteo-email-address" target="_blank">the Posteo key directory</a>. If these customers send an email, we add the Autocrypt header into the email. This header contains your public key. If your email application adds an Autocrypt header by itself, this header will not be changed and no additional header will be added.</p> <p>- Posteo customers who additonally activated the <a href="https://posteo.de/en/help/how-do-i-activate-inbound-encryption-with-my-public-pgp-key" target="_blank">Posteo inbound encryption</a> using their public PGP key want every incoming email to be encrypted. This information is added to the Autocrypt header as well. That way, email applications compatible with Autocrypt will know that a recipient at Posteo wants an encrypted reply.</p> <p>- In addition to the new Autocrypt header we also add the so called OpenPGP header, which informs the receiving email client on where it can find the public key. With this, the URL for the download from the <a href="https://posteo.de/en/help/publishing-public-pgp-key-for-posteo-email-address" target="_blank">Posteo key directory</a> will be transmitted. The OpenPGP-header will be signed with DKIM, too.</p> <p><strong>What can you do?</strong></p> <p>In day-to-day life, encrypted communication with Autocrypt will work without your involvement. The manual exchange and management of end-to-end encryption keys becomes superfluous. All you need is your personal <a href="https://posteo.de/en/help/how-do-i-encrypt-emails-using-enigmail-in-thunderbird" target="_blank">PGP key pair</a>.</p> <p>- Install the upcoming major versions of Enigmail or K-9 Mail as soon as available.</p> <p>- If you already own a personal PGP key pair for your Posteo email address, we recommend publishing your key in our Posteo public key directory. Then your public key will automatically be added to the header of every email you send. We explain how to publish your public PGP key at Posteo in this <a href="https://posteo.de/en/help/publishing-public-pgp-key-for-posteo-email-address" target="_blank">help article</a>.</p> <p><strong>Security recommendations for implementing Autocrypt:</strong><br /> In our view, the automatic exchange of public keys in the background should always be accompanied by further security measures. We recommend other email providers to sign Autocrypt headers with DKIM. Application developers should consider further measures to secure the key and verify existing DKIM-signatures. Additionally, end users should be notified by their email applications if a public key is replaced with a new one or if a setting, that an email should be encrypted or not, is changed by an Autocrypt header. In this way, a possible manipulation by third parties can be detected.</p> <p>Best regards,</p> <p>The Posteo team</p> tag:posteo.de,2009:Post/359 2017-12-21T15:40:00+01:00 2018-01-05T14:54:25+01:00 Security warning for Thunderbird users and Enigmail users: vulnerabilities threaten confidentiality of communication <p>Dear Posteo users,<br /> dear Thunderbird users and interested parties,</p> <p>We have a security notice for everyone who uses Thunderbird or the encryption add-on Enigmail.</p> <p>It is our goal to make popular open-source solutions more secure. Hence, last autumn we entered into a cooperation with Mozilla&#8217;s SOS Fund to commission a security audit of Thunderbird with Enigmail. This was the first security audit for Enigmail ever.</p> <p>The goal of the audit was to identify vulnerabilities in the tested software and to make the software safer consistently. The current audit showed multiple vulnerabilities. The developers of Enigmail have already fixed all the problems that were discovered. Some of the security issues have already been fixed in Thunderbird, as well &#8211; but most improvements will only be available with future versions of Thunderbird. In addition to these vulnerabilities, there is a problem within the architecture of the Thunderbird add-on system.</p> <p>All Thunderbird users with all providers are affected, including Gmail, Outlook.com or Yahoo.</p> <p>We are asking all Thunderbird and Enigmail users to carefully read our security recommendations in this article. If you follow our security recommendations, you will already communicate more securely.<br /> #more#</p> <p><strong>24 days, 8 security researchers, 22 vulnerabilities</strong></p> <p>The thorough audit of Thunderbird and Enigmail in autumn 2017 was conducted by independent security researchers (Cure53). The audit was financed in equal parts by Posteo and the Mozilla SOS Fund. It took 24 days and a team of 8 researchers to carry out the project.<br /> The test covered the fields &#8220;Incoming Emails with PGP Signature / PGP Encryption&#8221;, &#8220;Incoming html Emails&#8221;, &#8220;Key Generation &amp; Crypto Setup&#8221;, &#8220;Calendar, RSS and other features with Rich-Text Usage&#8221; as well as &#8220;Default Settings&#8221;.</p> <p>In total, 22 security relevant vulnerabilities have been discovered, of which 3 were classified as &#8220;critical&#8221; and 5 as &#8220;high&#8221;. The developers of Thunderbird and Enigmail were involved in the audit and were informed immediately after the security audit.</p> <p>The security researchers summarize the conclusions in their report as follows:</p> <p style="margin-left:50px; margin-right:100px;">&#8220;A detailed look at the implementations of both Thunderbird and Enigmail revealed a high prevalence of design flaws, security issues and bugs. (&#8230;) In short, secure communications may not be considered possible under the current design and setup of this compound.&#8221;</p> <p>Among the critical issues regarding Enigmail was the fact that it was possible to fake signatures as well as identities. Furthermore, the encrypted communication of users can be intercepted by third parties and could be compromised further on under certain conditions.<br /> The Enigmail developers have already fixed all identified vulnerabilities and provided a <a href="https://addons.mozilla.org/de/thunderbird/addon/enigmail/" target="_blank">new Enigmail version (1.9.9)</a>. We would like to thank Enigmail for their work.<br /> However, Enigmail relies on Thunderbird, which will receive many of the improvements only in future versions.</p> <p><strong>Thunderbird add-on architecture puts your data at risk</strong></p> <p>This spring, <a href="https://posteo.de/en/blog/security-warning-for-users-of-mailvelope-in-firefox" target="_blank">architectural vulnerabilities in Firefox were confirmed</a> as part of a Posteo audit. We then presumed these architectural vulnerabilties could also be found in Thunderbird, which is confirmed by the current audit:</p> <p>The add-on architecture of Thunderbird allows an attacker to obtain your email communication through compromised add-ons. The add-ons are insufficiently separated and have access to the user content in Thunderbird. This includes end-to-end encrypted communication: Even a user&#8217;s private PGP key can fall into the hands of an attacker. Here, even Enigmail cannot improve the situation. It is even possible for an attacker to use compromised Thunderbird add-ons to gain access to parts of your device and your sensitive data.</p> <p><strong>The report advises caution:</strong><br /> <p style="margin-left:50px; margin-right:100px;">&#8220;Assuming that a vulnerable or rogue extension is installed, an attacker acquires multiple ways of getting access to private key material and other sensitive data. (&#8230;) Henceforth, users are asked to be aware that extensions in Thunderbird are as powerful as executables, which means that they should be treated with adequate caution and care.&#8221;</p></p> <p>Firefox has rebuilt the architecture in the current version 57. For Thunderbird it is not foreseeable when the add-on architecture will be changed.</p> <p><strong>RSS feeds can act as spies</strong></p> <p>The audit discovered profound security problems in connection with RSS feeds, which are expected to be fixed entirely in Thunderbird version 59. Due to security reasons, the actual attack will not be described in this post. The use of RSS feeds in Thunderbird can endanger and reveal your entire communication and other sensitive data.</p> <p><strong>Please consider the following security recommendations:</strong></p> <p><strong>For all Thunderbird users:</strong></p> <ul style="margin-left:25px; margin-right:25px; margin-top:1em; margin-bottom:1em;"> <li>Update Thunderbird to the latest versions as soon as they are available. The new versions will remove several of the vulnerabilities that were revealed in this audit.</li> <li>Use Thunderbird preferably without or at least with verified add-ons until the architecture of Thunderbird has been rebuilt.</li> <li>Do not use RSS feeds in Thunderbird for now. There are critical security problems threatening your entire communication.</li> <li>Do not accidentally install add-ons through phishing, since rogue add-ons can be used to attack you.</li> </ul> <p>If you follow these security recommendations, your communication will be notedly more secure.</p> <p><strong>For Enigmail users:</strong></p> <ul style="margin-left:25px; margin-right:25px; margin-top:1em; margin-bottom:1em;"> <li>Update Enigmail immediately to the new version 1.9.9. This update removes all vulnerabilities identified in this audit.</li> <li>Update Thunderbird to the latest versions as soon as they are available. The new versions will remove several of the vulnerabilities that were revealed in this audit.</li> <li>Do not install any other add-on except for Enigmail until the add-on architecture of Thunderbird has been rebuilt.</li> <li>Do not use RSS feeds in Thunderbird for now. There are critical security problems threatening your entire communication.</li> <li>Do not accidentally install add-ons through phishing, since rogue add-ons can be used to attack you.</li> </ul> <p>If you follow these security recommendations, your communication is notedly more secure.</p> <p><strong>Audit report to be published after vulnerabilities have been fixed</strong><br /> Due to security considerations we will publish the report after all identified vulnerabilities have been fixed, since the report describes the researchers successful attacks in detail. However, the report was made available to the participating developers, Posteo and Mozilla.</p> <p><strong>Posteo supports open source software</strong><br /> Posteo supports open source software with transparent code for security reasons. We are convinced that transparent code is essential for the security and democratic control of the internet. At any time, independent experts can identify vulnerabilities and backdoors, making software more secure step-by-step. With intransparent code there is a need to trust each provider&#8217;s or developer&#8217;s security statements, which are not reviewable by the public. For us, this is not an option.</p> <p><strong>Open source projects need your support</strong></p> <p>- Donate to the Thunderbird project to support further development of Thunderbird: <a href="https://donate.mozilla.org/en/thunderbird/" target="_blank">https://donate.mozilla.org/en/thunderbird/</a><br /> - Donate to the Enigmail developers to support further development of Enigmail: <a href="https://www.enigmail.net/index.php/en/home/donations" target="_blank">https://www.enigmail.net/index.php/en/home/donations</a></p> <p><strong>After the audit: what the participants say</strong></p> <p><strong>Enigmail developer Patrick Brunschwig extends his thanks:</strong><br /> <p style="margin-left:50px; margin-right:100px;">&#8220;Enigmail is one of the most widely used tools for OpenPGP email encryption. Yet it took 16(!) years of development until the first security audit was performed. It was more than overdue, and I would like to thank Posteo for taking the initiative and co-financing an audit report together with the Mozilla Foundation. Not very surprising for such an old project, the audit report revealed a number of important issues that were addressed now.&#8221;</p></p> <strong>Mozilla regards the audit as a success:</strong> <p style="margin-left:50px; margin-right:100px;">&#8220;Mozilla&#8217;s Secure Open Source Fund, a MOSS program, provides code-read security audits for key pieces of open source software. We are very pleased to have been able to collaborate with Posteo to audit one of the main software combinations used for secure email, and are glad that users&#8217; data is safer and more secure as a result.&#8221;</p> <p><strong>Dr. Mario Heiderich from Cure53 hopes for a reopening of the bug bounty program of Thunderbird:</strong><br /> <p style="margin-left:50px; margin-right:100px;">&#8220;In closing, once all relevant issues reported here by Cure53 have been fixed, it should be strongly considered to re-establish a bug bounty program for Thunderbird. This approach would help keeping the security level at an acceptable level instead of allowing it to deteriorate and move towards a stale state of datedness.&#8221;</p></p> <p><strong>Patrik Löhr from Posteo asks for changes in the add-on architecture of Thunderbird:</strong><br /> <p style="margin-left:50px; margin-right:100px;">&#8220;We want to make open source software and end-to-end encryption more secure: security audits are the best way to achieve this aim.<br /> It is a success that all discovered vulnerabilities in Enigmail have already been resolved.<br /> The add-on architecture in Thunderbird, on the other hand, requires more work to achieve an up-to-date secure setup. Thunderbird is an essential tool for many people who work with email and communicate with end-to-end encryption. Therefore, the effort pays off.&#8221;</p></p> <p>Best regards,</p> <p>The Posteo team</p> tag:posteo.de,2009:Post/353 2017-09-14T18:15:00+02:00 2017-09-14T18:23:49+02:00 Transparency notice: Our donations for 2016 <p>Dear Posteo users and interested parties,</p> <p>In the name of transparency we have now updated our donation page, where we document the organisations that we financially supported during the previous year (2016).</p> <p>It is important to us to encourage social engagement and to take responsibility as a company. We therefore support selected charitable organisations in the areas of environment and climate protection, internet politics and freedom of opinion, as well as refugee aid.</p> <p>During last year, Posteo donated a total of 29.600,00 EUR. Of this, 28.002,00 EUR constituted voluntary donations by Posteo. The remaining 1.598,00 EUR came from users’ remaining credit. #more#</p> <p>Compared to the year before we were able to increase our donations by 5,250.00 EUR for 2016.</p> <p>As per the previous year, recipients of Posteo donations included Reporters Without Borders, UNO-Flüchtlingshilfe, Friends of the Earth Germany (BUND) and Netzpolitik.org.</p> <p>A new addition is a German Red Cross project in the Amazon, where 1.3 million people are acutely threatened by the increase in extreme weather events due to climate change. The project sees houses set up on raised platforms with secure architecture. In addition, blankets and hygiene kits are distributed and a health service set up. The project sustainably contributes to ensuring the existence of people affected by climate change.</p> <p>In addition, we support the European Centre for Constitutional and Human Rights (ECCHR) since 2016. The ECCHR lawyers&#8217; aim is to hold state and non-state actors legally accountable for grave human rights abuses. Among others, the ECCHR was founded in 2007 by human rights lawyer Wolfgang Kaleck, who represented whistleblower Edward Snowden in Germany.</p> <p>Posteo does business sustainably and is independent. Our service is financed by our customers’ account fees alone. There are no investors or advertising partners at Posteo.</p> <p>You are therefore what makes our engagement possible – you make a difference, for which we thank you very much.</p> <p>All recipients of Posteo donations can be found on our <a href="https://posteo.de/en/site/wedonateto">donations page</a>.</p> <p>Best regards,</p> <p>The Posteo team</p> tag:posteo.de,2009:Post/349 2017-08-23T16:30:00+02:00 2017-11-16T16:18:02+01:00 Help video: How to additionally secure your account with two-factor authentication <p>Dear Posteo users,</p> <p>We are often asked whether Posteo accounts can be additionally secured without requiring specific knowledge of computers. One possibility is to use two-factor authentication, which we have offered for some time now.</p> <p>Two-factor authentication is simple but effective additional protection against unauthorised access. When logging in to the webmail interface, a one-time password is required in addition to the personal password. Two-factor authentication prevents account theft: If criminals or intelligence services capture your access information (username and password), they then have no possibility to access your account settings, change your password and lock you out of your account. Third party access of your account and security settings is effectively prevented.</p> <p>In our experience, people without special knowledge of IT often do not trust themselves to activate two-factor authentication. Optimal online security is important for all, however. For this reason we have today published a video in which our help section editor Tim Vüllers shows you step-by-step how to set up the additional protection. He also explains how the process fundamentally works as well as demonstrating how he uses it on an everyday basis. In addition, he reveals another security trick – if you do not use Posteo with external email programs (such as Outlook and Thunderbird), you can block access for such programs. Thus two factor authentication additionally protects your emails against unauthorised access.</p> <p>In future, we will be making additional help videos available. Our videos can be accessibly viewed with subtitles. There are also versions of the video available in English and French.</p> <video class="video-js vjs-fluid vjs-posteo-skin vjs-big-play-centered" controls preload="auto" poster="https://cdn.posteo.de/0001_posteo-help-video_two-factor-authentication_still.jpg"> <source src="https://cdn.posteo.de/0001_posteo-help-video_two-factor-authentication_720p.mp4?hd" type="video/mp4" label="HD" res="720"> <track kind="subtitles" src="https://cdn.posteo.de/0001_posteo-help-video_two-factor-authentication_720p.vtt" srclang="en" label="English"> <p class="vjs-no-js">To view this video please enable JavaScript</p> <script>window.addEventListener('load', function() {posteo.cmsVideoJS();});</script></video> <script src="/javascripts/bundled/cms-videojs.js" type="text/javascript"></script><p>With two-factor authentication, no additional costs are incurred and you can use it on many different devices (computer, smartphone, tablet, YubiKey). <br /> By the way: Our <a href="https://posteo.de/en/site/contact">customer support</a> is happy to provide further personalised help if you have any questions or problems with two-factor authentication. Detailed step-by-step instructions for setup can alternatively also be found in the <a href="https://posteo.de/en/help/what-is-two-factor-authentication-and-how-do-i-set-it-up">Posteo help section</a>.</p> <p>Best regards,</p> <p>The Posteo team</p> tag:posteo.de,2009:Post/345 2017-06-27T18:15:00+02:00 2017-07-26T11:29:11+02:00 Update: Petya aimed at destroying data <p><strong>Update: July 3, 2017, 12:45:</strong></p> <p><a href="https://arstechnica.com/security/2017/06/petya-outbreak-was-a-chaos-sowing-wiper-not-profit-seeking-ransomware/">Leading security firms now consider that</a> Petya (also known as &#8220;PetrWrap&#8221; and &#8220;NotPetya&#8221;) was aimed at destroying data. Petya apparently disguised itself as ransomware but its aim was not to extort money. Analyses by IT security companies Kaspersky and Comae Technologies show that the malware did not encrypt data on the affected systems but instead deleted it. It appears that Petya overwrites data irreversibly, rendering restoration impossible. For the parties concerned, paying the ransom or contacting the attackers would have been useless.</p> <p>The Posteo address specified in connection with the attack was immediately blocked by Posteo on Tuesday at midday, before the attack spread. The attackers did not replace the blocked address with another one.</p> <p><strong>June 27, 2017, 18:15:</strong></p> <p><strong>Info on the PetrWrap/Petya ransomware: Email account in question already blocked since midday</strong></p> <p>Midway through today (CEST) we became aware that ransomware blackmailers are currently using a Posteo address as a means of contact. Our anti-abuse team checked this immediately – and blocked the account straight away. There was no press coverage at that time. We do not tolerate the misuse of our platform: The immediate blocking of misused email accounts is the necessary approach by providers in such cases.</p> <p>During the afternoon it emerged that the &#8220;PetrWrap/Petya&#8221; malware is currently spreading quickly in many places, including Ukraine.</p> <p>Here are the facts that we can contribute to &#8220;PetrWrap/Petya&#8221;:<br /> – Since midday it is no longer possible for the blackmailers to access the email account or send emails.<br /> – Sending emails to the account is no longer possible either.</p> <p>We are in contact with the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik).</p> <p>What is ransomware?<br /> &#8220;Ransomware&#8221; denotes malicious software, which becomes installed on a device, for example, by clicking a bad link or attachment. This primarily occurs when the device is poorly protected – when software installed there has not been updated for an extended time, for example. The malicious software prevents access to data and systems – and the user affected is requested to pay a ransom for the release of their data. Payment often does not lead to the data being released, however.</p> <p>Best regards,</p> <p>The Posteo team</p> tag:posteo.de,2009:Post/342 2017-06-12T18:00:00+02:00 2017-07-26T11:29:21+02:00 New: Posteo migration service now for calendars too <p>Dear Posteo users,</p> <p>We have extended the Posteo migration service. From now on, you can transfer not only your existing email accounts and address books to Posteo, but also your calendars.</p> <p>The extended migration service allows calendar transfer from providers such as gmx, web.de, Gmail, Aol or iCloud.</p> <p>Here&#8217;s how it works: You can find the new, extended migration service in the settings of your Posteo account under &#8220;My account&#8221;. When you undertake a new migration service there, not only the email folders and address book will now be shown to you, but also the calendars from your previous account. With a click of the mouse you can conveniently select which items you wish to transfer to Posteo. You can decide yourself whether to delete the data from your previous provider after the transfer.</p> <p><a href="https://posteo.de/system/help_images/1801/original/9-posteo-migration-service-import-calendar.jpg" target="_blank"><img src="https://posteo.de/system/help_images/1801/original/9-posteo-migration-service-import-calendar.jpg" width="642" height="360"></a></p> <p><strong>Special characteristics of the Posteo migration service:</strong><br /> It is free of charge, you do not require any special technical knowledge for the transfer – and you retain control of your data. We do not use transfer service providers. For this reason, your sensitive emails, address book and calendar data are never transferred over a third-party service at any point. We developed our migration service ourselves, so that it conforms to our high requirements in terms of security and data economy: Your data is collected by us directly from your previous provider and transferred to your Posteo account over encrypted connections.</p> <p>For reasons of data economy, we also do not save the email addresses from which you have transferred data to your Posteo account, for example.</p> <p>If you have any questions on transferring your calendar data or the <a href="https://posteo.de/en/help/setup-posteo-migration-service">Posteo migration service</a> in general, please feel free to contact Posteo support.</p> <p>Best regards,</p> <p>The Posteo team</p> tag:posteo.de,2009:Post/336 2017-05-04T12:00:00+02:00 2017-07-26T11:29:45+02:00 Security warning for users of Mailvelope in Firefox <p>Dear Mailvelope users,</p> <p>We have a security notice for anyone who uses the encryption add-on Mailvelope with Firefox.</p> <p>We have had a current security audit of Mailvelope undertaken, in which a critical vulnerability was found in the interaction between Mailvelope and Firefox. Under certain circumstances, Firefox’s security architecture allows attackers to access users’ private keys via compromised add-ons. We therefore ask all users of Mailvelope in Firefox to carefully read our security recommendations found in this article, below.</p> <p>This also affects Mailvelope users with all other providers such as Gmail, Outlook.com, Yahoo!Mail, etc.</p> <p>Firefox’s architecture does not sufficiently compartmentalise add-ons from each other – this has been known for years. The fact that a Mailvelope user’s private keys could be compromised via targeted attacks in Firefox was not proven until now, however. The security engineers that we engaged from Cure53 have now proved this. In the past, Cure53 had already audited Mailvelope for Chrome – on our assignment the engineers have now also investigated the plug-in&#8217;s interaction with Firefox. In their investigative report, they conclude that Firefox does not currently constitute a suitable environment for Mailvelope. They write,</p> <p style="margin-left:50px; margin-right:100px;">“At the end of the day, the Cure53 testing team cannot in good conscience recommend the use of Mailvelope on Firefox.”</p> <p><strong>Weakness expected to last until November 2017</strong></p> <p>We informed Thomas Oberndörfer, the developer of Mailvelope, after the security audit. He is unable to fix the weakness, however, as it has to do with Firefox’s architecture. New architecture is already being developed at Firefox. Mozilla is planning to conclude this work with the release of Firefox 57 in November 2017. Oberndörfer is also working on a version of Mailvelope for the new and improved Firefox architecture. We would like to thank him for his development work.</p> <p><strong>Until Mozilla has updated the architecture, the following security recommendations apply:</strong></p> <p><strong>Option 1.)</strong> In the interim, switch to different software. Either use Mailvelope in a different browser, or use PGP with a local email program. You can find various <a href="https://posteo.de/en/help?tag=end-to-end" target="_blank">instructions</a> for these options in the Posteo help section.</p> <p><strong>Option 2.)</strong> Alternatively, using an independent Firefox profile for Mailvelope minimises the risk in the interim. In the Posteo help section, we have published step-by-step instructions for the creation of Firefox profiles on <a href="https://posteo.de/en/help/creating-and-using-a-posteo-firefox-profile-mac-os" target="_blank">Mac</a> and on <a href="https://posteo.de/en/help/creating-and-using-a-posteo-firefox-profile-windows" target="_blank">Windows</a>. Mailvelope users with other providers can also follow these instructions. Please be sure to note the following security recommendations in order to effectively minimise the risk of a fruitful attack:</p> <ul style="margin-left:25px; margin-right:25px; margin-top:1em; margin-bottom:1em;"> <li>Do not install any further add-ons in the newly-created browser profile</li> <li>Use the Firefox profile exclusively for your encrypted Mailvelope communication. Only access your provider’s webmail interface and never visit other websites using this profile.</li> <li>In addition, use a password for your PGP key that is as secure as possible</li> <li>Be careful not to accidentally install any add-ons via phishing, through which you could be attacked</li> </ul> <p>Due to the problems with the Firefox architecture, we additionally recommend: </p> <ul style="margin-left:25px; margin-right:25px; margin-top: 1em; margin-bottom:1em;"> <li>Restrict the use of add-ons in the Firefox browser to a minimum, until Mozilla has updated the architecture</li> <li>You can further protect yourself from potential attackers by setting up an additional user on your operating system for end-to-end encrypted communication</li> </ul> <p>Here are the recommendations from the Cure53 report once again, for transparency reasons:</p> <p style="margin-left:50px; margin-right:100px;">“Two paths can be recommended for the users who rely on Mailvelope for encryption and decryption of highly sensitive data. First, they could use Mailvelope on a browser profile that hosts only and exclusively Mailvelope with no other extensions. Secondly, they would need to rely on a different software solution, for instance Thunderbird with Enigmail.”</p> <p style="margin-left:50px; margin-right:100px;">“At present, any users working with Mailvelope on Firefox are encouraged to export their settings, delete the extension and migrate their setup to a Mailvelope installation running on Google Chrome. Alternatively, a separate browser profile running Mailvelope only could be used, with the caveat that one must not have any other extensions installed in order to minimize the risk of key material leakage.”</p> <p><strong>Security engineers engaged by Posteo found the weakness</strong></p> <p>In their daily activities, our customers use various devices, browsers and add-ons in their local environments. Our users’ communication security is very important to us – we therefore also continually have external standard components checked for weaknesses. Among others, we work together to this end with independent IT security experts at Cure53. They have now made a find with Mailvelope in Firefox.</p> <p>Dr Mario Heiderich from Cure53 explains,</p> <p style="margin-left:50px; margin-right:100px;">“the problem is currently located in the architecture. There is therefore no easy fix. Mozilla knows this, but also has to keep a difficult balance between radical changes and ones that are prudent but are often decisions that are slow to take effect. Things are going in the right direction, however, which is definitely something positive for more complex software.”</p> <p>Thomas Oberndörfer of Mailvelope states,</p> <p style="margin-left:50px; margin-right:100px;">“Mailvelope is naturally dependent on the security of the underlying browser. Weaknesses in Firefox’s add-on system have been known of for some time, so Mozilla’s improvement should be welcomed. Security audits such as the one undertaken by Posteo are important indicators for us to see how we can further improve Mailvelope.”</p> <p><strong>Report to be published after weakness is overcome</strong></p> <p>The weakness outlined above is expected to be overcome by Mozilla in November 2017. Out of consideration for security, we will therefore first publish the report at a later point. In it, the method of attack will be described in detail. The report is already available to Mailvelope and the BSI (German Federal Office for Information Security).</p> <p>The security audit has also yielded some positive results for Mailvelope, which we would like to outline here: There was a check made as to whether email providers for which Mailvelope is used could access a Mailvelope user’s private keys saved in the browser – this was not possible. All other attempts made by the security engineers to access private keys saved in Mailvelope, such as operating third party websites or man-in-the-middle attacks, were also unsuccessful.</p> <p><strong>Weakness shows that open source increases security</strong></p> <p>For security reasons, we exclusively support open source components with transparent code – such as the encryption plug-in Mailvelope. In our view, transparent code is essential for the security and democratic control of the internet: Independent experts can at any time identify weaknesses or backdoors via code analysis, as happened here. A provider or developer’s security claims do not need to be trusted. With the security audits that we commission, we want to contribute to further increasing the security of established open source components and genuine end-to-end encryption.</p> <p>Best regards,</p> <p>The Posteo team</p> tag:posteo.de,2009:Post/331 2017-02-03T16:30:00+01:00 2017-02-03T17:00:27+01:00 Transparency report: Requests from authorities to Posteo have markedly decreased <p>Dear Posteo users,<br /> <br /> We would like you to know how often authorities request user information from us. We have therefore released our transparency report for the year 2016. In the report, we detail how often investigative authorities reached out to us in the year 2016 – and how often we actually had to release data. The report contains all requests from authorities that we received in the year 2016. In addition, we also list the number of illegal requests in our statistics, because in practice, grievances exist, which we have for a while now been documenting with <a href="https://posteo.de/en/site/transparency_report#schwerpunkt1" target="_blank">blacked-out examples</a>.<br /> <br /> <strong>Number of requests from authorities to Posteo markedly decreased</strong><br /> <br /> The number of email accounts operated by Posteo increased during 2016 by about 40%, while the number of requests from authorities markedly decreased. Altogether we received 35 requests from authorities in 2016 – in 2015 there were 48.<br /> <br /> For content data, the number of requests decreased by 50%. In 2015, authorities requested content data from us on eight occasions, while in 2016 only four requests reached us. The number of accounts affected by releases also decreased from five to three.<br /> <br /> For traffic data, the number of requests decreased even more. There were six such requests in 2015 and two in 2016.<br /> <br /> Only the number of requests for user information increased slightly, from 27 in 2015 to 28 in 2016. As we do not collect any user or traffic information for email accounts for reasons of data economy, this data does not exist at Posteo – and therefore can not be released. We always quickly inform the authorities making these requests of this fact. All requests that arrived came from German authorities. Among them – as was the case last year – there was one request from an intelligence service. <br /> <br /> <strong>Number of illegal requests unchanged</strong><br /> <br /> Unfortunately, numerous requests continue to arrive with us that are not formally correct. In 2016, this was the case for half of all requests for user information. The proportion of illegal requests for user information has therefore remained practically the same in comparison to last year. In all these cases we made complaints to the respective privacy offers responsible. <br /> <br /> <a href="https://posteo.de/en/site/transparency_report#schwerpunkt1" target="_blank"><img src="https://posteo.de/images/transparency_report/ersuchen201602_en.jpg" width="640" height="479"></a><br /> <br /> <strong>A new format for our transparency report in 2017</strong><br /> <br /> Until now, we always published our transparency reports in the summer. The reason that the publication date occurred later in the year was that we added emphases to the content of the reports, which often involved intensive research. Many of you desired publication of the numbers at the beginning of the year. For this reason, our transparency report for 2017 takes a different form. We now want to always publish numbers on the requests from authorities at the beginning of the year. <br /> <br /> A second change is that we will in future publish thematic emphases spread between our transparency report site and this blog, during the year. These could, for example, be legal opinions that we have obtained, grievances that we identify in practice, or successes that we would like to report. <br /> <br /> We have decided on this new, more flexible format for transparency because it fits better with our practical work. In addition, we are more often experiencing that the particularly privacy-oriented nature of our service is new to some authorities and leads to discussion about content or decisions that set a precedent. We would like to inform you about this outside of pre-specified times.<br /> <br /> <strong>Transparency reports should become more comparable</strong><br /> <br /> Posteo was in 2014 the first German telecommunications provider to publish a transparency report. In the meantime, numerous other providers also publish similar reports. <br /> <br /> We believe that transparency reports strengthen the informational self-determination of users. We are therefore pleased about this development. We would like to note that for users, these reports only have real value if they take a form that is as comparable as possible – and when the numbers provided are complete. <br /> <br /> We therefore insist that two pieces of information are provided in reports on all requests from authorities for different types of data. First, how many requests there were for specific data, e.g. user information or traffic data. And second, how often the data was released in response to the request. In our view, transparency will only be obtained by providing both of these. <br /> <br /> You can find our transparency report <a href="https://posteo.de/en/site/transparency_report" target="_blank">here</a>.<br /> <br /> Best regards,<br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/329 2017-01-17T10:00:00+01:00 2017-01-17T11:40:17+01:00 New security certificates <p>Dear Posteo users,</p> <p>In the coming days we will be updating our security certificates. Security certificates are only valid for a specified time period and need to be renewed from time to time. We will therefore be changing them by 22.01.2017. We continue to use certificates from Geotrust and the Bundesdruckerei (D-Trust).</p> <p>In most cases you will not notice anything when the certificates are changed over. All programs such as Thunderbird or Outlook will find the new certificate automatically. You do not need to do anything. If your program displays a certificate error during the changeover process, please simply restart the program, which should overcome the error.</p> <p>If you check the trustworthiness of certificates manually, you can find the fingerprints for the new certificates that we will shortly begin using, below. You can also find the fingerprints in our <a href="https://posteo.de/en/site/legal_notice">legal notice</a>.</p> <p>New fingerprints for TLS security certificates</p> <p>Geotrust:<br /> SHA256: 30:2A:06:B8:CF:A8:5B:93:66:5A:44:66:E2:BB:84:05:FE:80:95:3F:5A:FE:D1:08:DB:3B:B0:0D:7C:42:B4:39<br /> SHA1: BD:16:71:84:B0:B1:40:D9:0A:65:99:8C:E6:7B:01:D6:AA:5B:8B:67<br /> MD5: 55:F5:81:51:91:CD:88:64:14:D5:AA:E2:D5:2E:2C:AB</p> <p>D-Trust:<br /> SHA256: 06:48:D6:E4:D3:79:42:79:81:77:0F:49:88:43:D7:65:EE:A8:6F:1F:12:6F:72:11:8F:A9:4C:A9:66:34:FE:B5<br /> SHA1: 79:DB:A0:A9:57:D9:30:FA:EF:5F:72:69:FB:1B:EA:06:90:27:9F:4D<br /> MD5: DA:59:74:62:7C:D1:12:4E:15:41:25:37:9B:56:D0:58</p> <p>Best regards,</p> <p>The Posteo team</p> tag:posteo.de,2009:Post/321 2016-12-08T18:40:00+01:00 2016-12-08T18:41:32+01:00 Posteo becomes the first provider to receive a certificate for secure sending of emails <p>Dear Posteo users and interested parties,<br /> <br /> At Posteo it is especially important to us that you can securely send and receive emails. Today there is news on this front: We have become the first provider to receive a certificate for the new &#8220;secure email transport&#8221; technical guidelines by the Federal Office for Information Security (Bundesamt für Sicherheit in der Informationstechnik, henceforth BSI). The goal of the BSI is to promote IT security.<br /> <br /> The certificate was today awarded to us by the certifying authority &#8220;datenschutz cert&#8221;. Representatives of the BSI were also present. Via the certificate on our website, you can now identify that our security measures have been independently checked and proven to conform to BSI requirements.<br /> <br /> <a href="https://posteo.de/images/bsi_tr01.jpg" target="_blank"><img src="https://posteo.de/images/bsi_tr01.jpg" width="642" height="439"></a><br />Thomas Gast (BSI), Thomas Gilles (BSI), Ralf von Rahden (datenschutz cert), Patrik Löhr (Posteo), Florian Bierhoff (BSI)<br /><br /> The new technical guidelines detail the measures that an email service is to undertake in order to actively protect emails from unauthorised third parties during their transport. Email providers need to implement DANE if they wish to receive certification. DANE overcomes various weaknesses in the commonly-used transport route encryption, TLS. Among other things, DANE prevents so-called man-in-the-middle attacks, in which an attacker latches onto a communication process, annulling the encryption. In 2014, Posteo became the first provider to implement DANE. Since then we have committed ourselves to the dissemination of this new technology, which is pioneering in the confidentiality of digital communication. Thus our users can not only securely communicate with one another, but also with the users of other email services. We were therefore especially pleased that the free standard DANE has become necessary for the certification.<br /> <br /> Since 2014 we have been engaged in a working group together with other email providers involved in a dialogue with the BSI that led to the formation of the technical guidelines. We pushed for high security requirements and simple implementation.<br /> <br /> We frequently criticise authorities when things don&#8217;t work in practice, for example, in our transparency reports. On the other hand, we welcome the BSI&#8217;s new guidelines for secure email transport. The BSI was especially interested in working together with the providers to design the guidelines with a practical orientation. The guidelines correlate with the highest security requirements and the certification is also implementable in terms of the time and money involved for smaller providers such as Posteo.<br /> <br /> <strong>New certificate identifies secure email services</strong> <br /> <br /> In our view, the fact that claims made by email providers about their security measures can now be evaluated by independent authorities also constitutes great progress for users. From now on, users can identify whether a service has been proven to fulfil the criteria in the guidelines via the certificates on the providers&#8217; websites. The logo with text &#8220;BSI TR-03108 zertifiziert&#8221; indicates the corresponding guidelines.<br /> <br /> The BSI guidelines do not constitute a legal requirement, but rather recommend security measures to email providers. Providers that wish to receive a corresponding certificate need to prove that they fulfil all requirements set out.<br /> <br /> Certification is undertaken by an independent body – Posteo was certified by datenschutz cert. Certification occurs entirely remotely, checking the email service’s public interfaces. Other email providers and services such as those of companies or universities, for example, can now register to be evaluated according to the technical guidelines. We hope that the guidelines further increase dissemination of the recommended security technology. High common standards also increase the level of security for emails that you send to contacts that use other email providers. Thus communication becomes more secure overall.<br /> <br /> Best regards, <br /> <br /> The Posteo team<br /> <br /> <strong>Additional information for those with technical interests:</strong><br /> <br /> - The technical guidelines can be found <a href="https://www.bsi.bund.de/DE/Publikationen/TechnischeRichtlinien/tr03108/index_htm.html" target="_blank">on the BSI website</a>,<br /> - Posteo has used DANE since May 2014. You can read more <a href="https://posteo.de/en/blog/posteo-supports-danetlsa" target="_blank">about DANE here</a>.<br /> - End-to-end encryption does not render transport route encryption redundant. End-to-end encryption generally only protects the content of your communication, but not metadata such as the subject field and information as to who is communicating with whom. Transport route encryption with TLS protects the content as well as the metadata for emails on their way across the internet. DANE additionally secures this encryption. End-to-end encryption is always in the hands of the users, because no-one else can have access to the private keys. We recommend combining end-to-end encryption with strong transport route encryption on the provider&#8217;s side.</p> tag:posteo.de,2009:Post/299 2016-08-18T17:00:00+02:00 2016-08-19T12:21:15+02:00 New: Webmail interface displays servers with the highest sending security <p>Dear Posteo users,<br /> <br /> We have just released a new feature for you: Our webmail interface now shows you which of your contacts you can send to with the optimal security of DANE technology. This can be recognised by a small, green DANE symbol above an email address. <br /> <br /> <a href="https://posteo.de/images/en_dane-anzeige.jpg" target="_blank"><img src="https://posteo.de/images/en_dane-anzeige.jpg" width="642" height="361"></a><br /> <br /> For us, the new DANE display is something very special. When we introduced this new piece of security technology in May 2014, Posteo was according to heise.de the <a href="http://www.heise.de/newsticker/meldung/Verschluesselter-Mail-Transport-Posteo-setzt-als-erster-Provider-DANE-ein-2187144.html"> first provider worldwide</a> to support DANE. Many IT experts were unsure at that time whether the new technology would become established. In the meantime, this has changed – it is now worthwhile displaying whether another server supports DANE: We now transfer emails to many email servers worldwide using DANE as standard, including large email providers such as 1&amp;1 (as well as mail.com, GMX and web.de) and Comcast. <br /> <br /> The technology is becoming widespread for good reason: DANE eliminates various weaknesses in the widely used transport route encryption between servers – STARTTLS, and increases security of the encrypted transport of emails. Without DANE, encryption would not be &#8220;forced&#8221;, for example, but instead newly-negotiated for each connection between the email servers involved. With DANE, email servers communicating with one another must encrypt every connection. If the encryption is disrupted or the communication is subject to an attack, the email will not be sent. Servers that are capable of DANE also undertake a check of their security certificates prior to sending – in a process similar to an ID check. This ensures that the other server is in fact the &#8220;actual target&#8221; of the communication and not a so-called man-in-the-middle placed in between. With DANE, encrypted sending can be ensured in advance, which is why we are providing a DANE status display in the webmail interface. In summary, for you the new display means that if you see the symbol displayed, your email is guaranteed to be transferred to that recipient with DANE. Firstly, it will be sent over an encrypted transport route, and secondly, it will be sent to the actual, legitimate recipient. <br /> <br /> <strong>Tip: The TLS-sending guarantee also protects you for servers without DANE</strong><br /> <br /> If the DANE symbol is not displayed for an address, then the receiving server does not yet support DANE. Examples of large providers that do not yet support DANE include Gmail and Yahoo. <br /> <br /> These do support encrypted connections between email servers. Without DANE, however, in case of interruptions or attacks as described above, unencrypted connections can occur. This the case anew for every single email. Without DANE, therefore, no serious assertion can be made about the security of a connection between two email servers. <br /> <br /> Here is an important tip for you: With Posteo, you can categorically prevent sending without TLS. <br /> <br /> <strong>Activate your personal <a href="https://posteo.de/en/help/activating-tls-sending-guarantee">TLS-sending guarantee</a> in your account settings</strong><br /> <br /> This ensures that the transport route for your emails is guaranteed to be encrypted with TLS, even to servers that do not support DANE. If you activate the TLS-sending guarantee, we will only send your email when the message can be sent with encryption. If secure sending over an encrypted connection is not possible, sending of the email will not occur – and you receive a notification from us. Therefore, if an unauthorised third party attacks a secure connection wanting to force an unencrypted connection, sending will be prevented.<br /> <br /> Best regards, <br /> <br /> The Posteo team<br /> <br /> Related reading: <a href="https://posteo.de/en/help/why-posteo-displays-dane-status-but-not-tls-status">Why does Posteo display the DANE status but not the TLS status?</a></p> tag:posteo.de,2009:Post/286 2016-07-28T17:00:00+02:00 2016-07-28T17:12:01+02:00 Kindle, GOP etc: What to do with insecure email servers <p>Dear Posteo users, <br /></p> <p>In the last few days we have received a lot of positive feedback on our new <a href="https://posteo.de/en/blog/new-tls-sending-guarantee-for-additional-security" target="_blank">TLS-sending guarantee</a>, for which we would like to say thank you. We&#8217;re very pleased about how well the new security feature is being adopted. Within just a few days more than 20% of our users have activated the new feature. With the TLS-sending guarantee activated, your emails are only sent if they can be transferred to the recipient over an encrypted transport route. Because we are currently receiving a lot of queries, we will here look at some insecure email servers and show what options are available when sending is stopped. <br /></p> <p>First, here is an example, which we are receiving many enquiries about: Amazon &#8220;@kindle.com&#8221;. <br /> <br /> <strong>The email servers for the commonly-used domain &#8220;@kindle.com&#8221; are in fact not secure. Even three years after the NSA scandal, the domain still does not support TLS encryption when receiving emails. Our tests confirm this. </strong> We have received numerous queries about the security of &#8220;@kindle.com&#8221; from users with the TLS-sending guarantee activated. In our view, the lacking TLS support presents a large problem, because customers use &#8220;@kindle.com&#8221; addresses to send their own documents to their Kindles. Amazon <a href="https://www.amazon.com/gp/sendtokindle/email" target="_blank">describes this feature</a> as follows: &#8220;Kindle customers can send documents to their registered Kindle devices, free Kindle reading applications, and their Kindle Library in the Amazon Cloud by e-mailing them to their Send-to-Kindle e-mail address name@kindle.com.&#8221; <br /> <a href="https://posteo.de/images/kindle.png"><img src="https://posteo.de/images/kindle.png" width="538" height="123"></a><br />It appears that Amazon domains are not generally affected. <br /></p> <p>#more#</p> <p>The current configuration of &#8220;@kindle.com&#8221; is insecure and presents a security risk. Whether you wish to continue sending sensitive data to &#8220;@kindle.com&#8221; addresses is your own personal decision. If desired, you could temporarily disable the TLS-sending guarantee in order to send. Please note, however, that due to the lacking security of @kindle.com, these communications can be read by unauthorised third parties such as criminals and intelligence services. <strong>For privacy reasons, you should not send other people&#8217;s data to kindle.com addresses – the others should be able to decide this for themselves. </strong> <br /> We have no influence over Amazon&#8217;s IT. You could contact Amazon directly. It is generally not especially difficult for administrators of email services to activate TLS encryption on their servers. We assume that the domain will soon be secured if complaints arrive, as the lacking security constitutes a grave security risk. You would then once again be able to send emails to kindle.com addresses with the TLS-sending guarantee activated. </a> <br /></p> <p><strong>No encryption for GOP (Republican National Committee), the University of Oxford or Ryanair either</strong> <br /> <br /> We are asking all users who have contacted us regarding email servers that are not capable of TLS encryption such as <strong>@gop.com, @kodakpulse.com, @communication.microsoft.com, @ox.ac.uk, @ryanair.com, @unog.ch, @melia.com and other domains (listed below)</strong> to decide in each individual case whether they wish to send an email to the insecure email system. For all servers that are not capable of TLS, communicating with these outdated email systems is insecure. <br/> <a href="https://posteo.de/images/oxford.png"><img src="https://posteo.de/images/oxford.png" width="535" height="124"></a><a href="https://posteo.de/images/melia.png"><img src="https://posteo.de/images/melia.png" width="535" height="124"></a> <br /></p> <p><strong>When sending is stopped, you have the following options: </strong> <br /> - You can inform the recipient (if desired, using an alternative contact method) that securely sending an email to their address is not possible and ask them to provide an alternative email address. <br /> - You can <strong>temporarily deactivate the Posteo TLS-sending guarantee</strong> and send the email securely, by furnishing it with end-to-end encryption. <br /> - You can temporarily deactivate the TLS-sending guarantee and send the email <strong>unencrypted/insecurely</strong>, as an exception. <br /></p> <p><strong>Ask the domain holders for better security</strong> <br /> <br /> If you would like to, you could contact the holder of a domain to ask them to activate TLS encryption on their servers. By doing this, you contribute to achieving an improved overall security of email traffic. <br /> Overall, it can be said that these days, mainly only outdated and poorly-maintained email servers do not support TLS. If you activate the TLS-sending guarantee, it will generally only rarely occur that one of your emails is not sent for security reasons. <br /> <br /> Last of all, we have collated a list of examples of commonly-used email domains that astonishingly do not yet support TLS, about which we have received queries during the last few days:<br /></p> <p>- Amazon Kindle: @kindle.com<br /> - Microsoft: @communication.microsoft.com <br /> - United Nations Office at Geneva: @unog.ch<br /> - University of Oxford: @ox.ac.uk<br /> - Yahoo! Japan: @yahoo.co.jp<br /> - Melia Hotels: @melia.com<br /> - Kodak Pulse &#8220;Email pictures to the display&#8221;: @kodakpulse.com<br /> - Germanwings: @germanwings.com<br /> - eBay: @members.ebay.com<br /> - German American Chamber of Commerce: @gaccny.com<br /> - Pacific National Bank: @pnb.com<br /> - Ryanair: @ryanair.com<br /> - Voyages SNCF: @voyages-sncf.com<br /> - Republican National Committee: @gop.com<br /> <br /></p> <p>Best regards,</p> <p>The Posteo team</p> tag:posteo.de,2009:Post/281 2016-07-13T15:45:00+02:00 2017-07-26T11:29:00+02:00 New: TLS-sending guarantee for additional security <p>Dear Posteo users, <br /> <br /> Today we have made a new, important feature available to you – our <strong>TLS-sending guarantee</strong>. This new security feature protects you from sending emails to insecure systems. You can now activate the new feature in the settings of your account. <br /> <br /> Emails need to be transferred over encrypted connections so that criminals and intelligence services can not read them in an unauthorised manner. Three years after the NSA scandal, transport route encryption (TLS) has as a result become commonplace: All large email providers have now activated it on their systems. But what about the email systems to which you frequently send everyday emails or work-related emails? Prior to sending an email, it is not visible to the user whether the email systems used by business partners, doctors, clubs or schools support secure connections. Our systems, on the other hand, recognise this. Before sending each and every email, Posteo attempts to create an encrypted connection with the other email server in order to achieve secure sending. <br /> <br /> <strong>If secure sending is not possible, the transfer is stopped</strong><br /> This is exactly where our new TLS-sending guarantee comes in: If you activate this security feature, we will only send your emails when the message can be securely delivered to the recipient. If secure sending over an encrypted connection is not possible, transfer of the email will be stopped – and you receive a notification from us. Sending is also stopped if an unauthorised third party attacks a secure connection, wanting to force an unencrypted connection. <br /> <br /> If we notify you that sending was stopped, you can then decide yourself whether you would still like to send your message to the insecure system. To do this you can temporarily deactivate the TLS-sending guarantee and send your message (as an exception) without TLS. We designed the new feature as practically as possible: Whether you access your emails with a smartphone, in the webmail interface or in local email programs such as Outlook or Thunderbird, makes no difference. Each sending of an email undergoes our TLS security test. If you send an email to multiple recipients, sending is only stopped for those recipients to which the email can not be securely transferred. You are then notified by us via email as to which recipients were affected. <br /> <br /> #more#<br /> <strong>New security test before each email is sent</strong><br /> The new feature affords you additional clarity: You always find out about your contacts&#8217; current communication security. For security reasons, a new TLS check occurs before sending every email, even for known recipients. Thus we ensure that your emails are not sent insecurely if a server is temporarily incapable of TLS, for example, due to technical problems or an attack. <br /> <br /> You can now activate the TLS-sending guarantee in the settings of your Posteo account under &#8220;Settings&#8221; &#8594; &#8220;My account&#8221; &#8594; &#8220;Transport route encryption&#8221;. In our help section we have prepared an <a href="https://posteo.de/en/help/activating-tls-sending-guarantee">article on the new TLS-sending guarantee</a>. There you can find out how to activate and deactivate the feature and how to proceed when the sending of an email to an insecure email server is stopped. <br /> <br /> <strong>Additional information for IT pros:</strong><br /> - The TLS-sending guarantee prevents downgrade attacks, whose goal is to revert to unencrypted connections.<br /> - Outdated and insecure encryption protocols such as SSLv3 or RC4 will not be tolerated: These also cause a stop on sending. <br /> - Man-in-the-middle attacks are made more difficult and are always prevented if, like Posteo, the receiving server also uses DANE. <br /> <br /> <strong>More about encryption at Posteo </strong><br /> Transport route encryption is one building block in our innovative encryption model. On our <a href="https://posteo.de/en/site/encryption">Encryption info page</a> you can also learn about our other features: Here you discover, for example, how you can conveniently encrypt all saved data at the click of a button (crypto mail storage, address book and calendar encryption). We also inform about how we encrypt each access and all sensitive data, and present our end-to-end encryption features (key directory, PGP in the webmail interface, and more).<br /> <br /> <br /> Best regards,</p> <p>The Posteo team</p> tag:posteo.de,2009:Post/274 2016-04-04T14:30:00+02:00 2016-04-04T15:04:12+02:00 New security technology and additional certificate <p>Dear Posteo users and interested parties, <br /> <br /> We would like to inform you about some new pieces of security technology at Posteo. <br /> <br /> We have begun to support “Certificate Transparency” technology. In addition, we started using new technology known as “Certification Authority Authorization (CAA)” and “HTTP Public Key Pinning (HPKP)” a few weeks ago. These further increase the security of Posteo for you. <br /> <br /> <strong>Nothing changes for you – and you do not need to do anything. In this blog article we merely wish to provide an insight into how we are protecting your data at Posteo using these features. </strong><br /> <br /> <strong>Certificate Transparency: No chance for certificate forgers </strong><br /> <br /> With Certificate Transparency, we can automatically monitor worldwide whether an unauthorised third party (criminal or intelligence service) attempts to represent itself as Posteo by falsifying certificates for our Posteo domains. Until now, it was very unlikely that a certifying authority would actually incorrectly authenticate an unauthorised party to be Posteo. The reason for this is that for many years we have used a so-called extended security certificate (EV certificate). These certificates are only issued following presentation of a range of documents. Criminals and intelligence services do, however, attempt to take on another identity using falsified certificates. They do this, for example, to lure customers of internet services to falsified phishing sites and capture their login details there, or to place themselves as the &#8220;Man-in-the-Middle&#8221; of a communications process. <br /> <br /> With the new technology, we can evaluate 24 hours a day in close to real time whether someone attempts to manipulate our certificates and can therefore react immediately – ideally, before an attacker can make an attempt at fraud. You no longer need to trust the diligence of the certification authorities’ (CA) issuing of certificates: With the new technology, online services such as Posteo can check for themselves whether a certifying authority has incorrectly issued a certificate to an unauthorised party. <br /> <br /> <strong>New certificate in the course of the changes </strong><br /> <br /> In order to be able to support the new pieces of security technology, we will in April begin implementing an additional certificate from Geotrust. This certifying authority already supports the new technology. Interested parties can find the fingerprints of all certificates (a series of characters with which a certificate can be verified as “real”) from now on the legal notice page of our website. All programs such as Thunderbird or Outlook will find the new certificate automatically. You do not need to do anything. If your program produces a certificate error during the transition process, please simply restart it, which should overcome the issue.</p> <p>#more#<br /> <br /> <strong>New security technology “Certification Authority Authorization” (CAA) in use for some weeks </strong><br /> <br /> For a few weeks we have been using an additional new piece of security technology in connection with certificates: Certification Authority Authorization (CAA). CAA is very new technology that is not yet widely circulated. With this new technology, we have lodged information in the DNS (the central request registry of the internet) as to which certifying authorities are authorised to issue certificates for our domains. This technology is still very new, which means that there is not yet any requirement for certifying authorities to observe it. We are nonetheless of the opinion that these entries are already very sensible: We want to show what is technically possible today and we hope that many telecommunications providers and certification authorities will soon use CAA. The technology can make internet access more secure overall, and further minimise the risk of falsified certificates. <br /> <br /> <strong>German certifiers with Certificate Transparency are not yet practical </strong><br /> <br /> At the moment, it remains impossible for email services such as Posteo to implement certificates from German certification authorities as a main certificate in practice. Providers such as D-Trust (the Bundesdruckerei) do not (yet) know of some devices and programs that are widely in use. If an email service nonetheless uses a certificate from such an “unknown” certification authority, a large number of users receive constantly repeating error messages. The programs state that the certificates in place are not trusted. The situation does not look good in terms of the support of new technology, either: The Telekom Trust Center (TeleSec), for example, which is the certification authority for Deutsche Telekom AG, has indicated to us that it has no plans to support Certificate Transparency. These existing problems with German certifiers will only improve in the course of the coming years, if at all. A prerequisite for this, for example, is that German certifiers ensure that their so-called root certificates are recognised as trustworthy in all new-generation devices and programs. <br /> <br /> <strong>Additional information for pros: Additional certificate security technology at Posteo </strong><br /> <br /> - For each secured domain, we always use at least two extended validation certificates on an equal basis. In case problems with a certification authority arise, we can immediately switch to the other certificate, without any disturbance to our users. <br /> - We use HPKP (HTTP Public Key Pinning) to force browsers to accept our certificates only. <br /> - We use DANE so that other email servers, browsers and programs can check our certificates with a falsification-proof DNS request. <br /> <br /> Best regards, <br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/271 2016-03-30T16:30:00+02:00 2016-03-30T16:39:18+02:00 Chief privacy officer praises Posteo in yearly report <p>Dear Posteo users and interested parties, <br /> <br /> The new chief privacy officer for Berlin, Maja Smoltczyk, has presented Posteo in her yearly report for 2015 as a positive example of innovative privacy concepts. We are very pleased to receive this mention of praise from such a senior figure. We therefore present a translation for you to read: <br /> <br /> &#8220;Posteo (posteo.de) is a webmail service with all the necessary features. As opposed to other webmail services, the user pays. For this fee, many things are avoided including any data identifying the user, analysis of user behaviour or even the content of messages. This begins with the user creating their account under a pseudonym: Apart from the desired email address and a password, no data is mandatorily collected. Even the prepaid payment can occur completely anonymously in cash. If the user chooses a payment process which involves their personal information, the connection to the email account made via a payment code is immediately deleted after the payment is processed. As well as the implementation of possibilities for transport route encryption when sending and receiving emails and when accessing the webmail interface, optional end-to-end encryption with PGP and S/MIME is also supported. One special characteristic is the feature to encrypt account content and address book: This allows for unencrypted emails to be saved with encryption in a simple manner. As opposed to encryption with PGP and S/MIME, traffic data is also encrypted in the email header. The encryption occurs in the background at the moment that the relevant email is opened. When using this feature, choosing a secure and long password is particularly important.&#8221; (p51)<br /> <br /> &#8220;Data protection is a completely successful selling point, as the example of Posteo shows.&#8221; (p53) <br /> <br /> <br /> The complete report by the Berlin chief privacy officer can be found (in German) at <a href="https://datenschutz-berlin.de//content/veroeffentlichungen/jahresberichte/bericht-15" target=_blank>datenschutz-berlin.de</a>.<br /> <br /> <br /> Best regards,<br /> <br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/269 2016-03-16T18:30:00+01:00 2016-03-16T21:00:39+01:00 New: Who we support with donations <p>Dear Posteo users and interested parties, <br /> <br /> In the name of transparency, we are now openly listing the organisations that we supported with donations last year (2015). We were asked to provide this information as remaining Posteo credit can be donated, if desired. Our new <a href="https://posteo.de/en/site/wedonateto">&#8220;Who we donate to&#8221;</a> page can be found on our website in the &#8220;About us&#8221; section. <br /> <br /> It is important to us to encourage social engagement and to take responsibility as a company. We therefore support selected charitable organisations in the areas of environment, internet politics and freedom of opinion, as well as refugee aid. #more#<br /> <br /> During last year, Posteo donated a total of 24,350.00 EUR. Of this, 22,957.30 EUR constituted voluntary donations by Posteo. <br /> The remaining 1,392.70 EUR came from users&#8217; remaining credit. <br /> <br /> In 2015, recipients of Posteo donations included Friends of the Earth Germany (BUND), Reporters Without Borders, The UN Refugee Agency (UNHCR) and Netzpolitik.org.<br /> <br /> Best regards,<br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/258 2016-02-08T17:15:00+01:00 2016-02-18T11:37:08+01:00 Cryptoparty for women in the Posteo Lab on Feb 24 <p>Dear Posteo users and interested parties,<br /> <br /> On Wednesday 24th February there will be a cryptoparty for women in the Posteo Lab in Berlin (Kreuzberg). Hosting the event are the hacker girls from <a href="http://heartofcode.org" target="_blank">Heart of Code</a>. <!-- Entry is free, and women with no prior knowledge of encryption are also most welcome. --><br /> <br /> The hackers will be our guests from 7pm. The event begins with two short talks on the topic of encryption. After that, workshop participants will be shown how to communicate securely on the internet and how to be protected from spying by intelligence agencies and advertisers. <br /> <!-- <br /> Women who are interested can register by emailing the organisers: <a href="mailto:code@heartofcode.org">code@heartofcode.org</a> <br /> --><br /> Background info:<br /> The &#8220;Heart of Code&#8221; hackers want to facilitate women&#8217;s access to information technology, tools and content, to make the hacking community and tech landscape more diverse in the long term. We support this aim, as women are clearly underrepresented in the field of IT. For this reason we are happy to make the Posteo Lab available to the hackers for their event. <br /> <br /> Best regards,<br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/253 2015-12-22T18:30:00+01:00 2015-12-23T10:50:35+01:00 Second extended certificate <p>Dear Posteo users, <br /> <br /> From now on, we are also deploying a second extended security certificate. <br /> <br /> Such authenticated, &#8220;green security certificates&#8221; are used first and foremost by organisations that deal with sensitive data, such as banks. It can be seen on the left of our web address (https://posteo.de) in your browser (usually a key symbol with green background). In this way you can always recognise that you are actually on the Posteo website – and not some sort of phishing site. If you use a local email program, it will additionally check the security certificate before establishing an encrypted connection with Posteo – confirming the validity of the encryption partner. Email providers use certification authorities for this, who confirm the validity of a security certificate before an encrypted connection is established. OCSP is an additional security measure: An OCSP server confirms that a certificate has not been revoked. <br /> <br /> <strong>We therefore use a second certificate</strong><br /> The reason for additionally deploying a second certificate is that the OCSP servers of the certification authority StartCom were not reliably reachable over the past few days. In some individual cases, this led to restrictions in programs that additionally check OCSP, such as Thunderbird and Firefox. We know that for this reason some of our users experienced an error when opening our website or working in a local email program. At Posteo itself, there was no problem at any time, and the security of your connections was not affected at any time. Because it is completely unacceptable to us that a problem at a single certification authority repeatedly affects our customers, we are from now on using a certificate certified by the Bundesdruckerei, which we had recently already created as a second certificate. #more#<br /> <br /> <strong>What a certification authority does</strong><br /> Email providers use certification authorities to confirm the validity of their certificates before an encrypted connection is established. A certifier in addition certifies the public key of a provider&#8217;s SSL certificate. It&#8217;s similar to a notary: After checking multiple documents, (including company registration, personal identity documents, telephone calls with us and our lawyers, etc) the certification authority confirms that the public key really does belong to the provider, in this case, therefore, to Posteo e.K. The certification authority does not create our certificate and/or key pair – we do this ourselves. They can therefore not manipulate or exchange the keys. <br /> <br /> Our new certificate, certified by the Bundesdruckerei, conforms to current security standards and was signed using the SHA-256 algorithm. <br /> <br /> If your browser, email program, smartphone or tablet happens to produce an error message due to an invalid certificate following our change, this is not due to an attack or an error. It merely means your program has the old certificate saved. In most cases, restarting the program or device should remedy this. <br /> <br /> The &#8220;electronic fingerprints&#8221; for our new security certificate are: <br /> SHA256: 6A:B1:9D:FB:FB:10:2E:D8:89:01:76:8C:B1:6B:61:13:A1:E3:B6:A5:47:D6:85:A3:FD:08:7F:11:DA:35:77:E7<br /> SHA1: 8D:D7:97:B4:45:79:4D:EC:64:AE:D1:90:88:AC:B4:F4:5A:21:EA:6A<br /> MD5: DA:CC:03:04:8C:E8:03:54:4F:6B:B2:2E:C2:ED:94:D8<br /> <br /> You can also find the fingerprints for both certificates in our <a href="https://posteo.de/en/site/legal_notice">legal notice</a> page. This information is only relevant for users who manually check our certificates. <br /> <br /> If a program or system that you use does not have the Bundesdruckerei root certificate pre-installed and therefore does not trust the connection to Posteo, you can simply install it. It can be found for <a href="https://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_EV_2009.crt">download from the Bundesdruckerei website</a>. There, you can also find the fingerprint of the root certificate &#8220;D-TRUST Root Class 3 CA 2 EV 2009&#8221; on the <a href="https://www.bundesdruckerei.de/de/2826-d-trust-roots" target=""_blank>downloads page</a>, which we also publish here for comparison purposes:<br /> SHA-256 EE:C5:49:6B:98:8C:E9:86:25:B9:34:09:2E:EC:29:08:BE:D0:B0:F3:16:C2:D4:73:0C:84:EA:F1:F3:D3:48:81<br /> SHA-1 96:C9:1B:0B:95:B4:10:98:42:FA:D0:D8:22:79:FE:60:FA:B9:16:83<br /> <br /> The Posteo domains that we use with the SSL certificate are in our possession. The entries of our name server in the DNS are also additionally secured with DNSSEC, to prevent manipulation. And using <a href="https://posteo.de/en/help/how-does-dane-technology-increase-security">DANE</a> anyone can check our key&#8217;s fingerprints without doubt. <br /> <br /> Even if we did not have any influence over the disturbances caused by the error at the certification authority, we would still like to apologise if you were affected by this annoying problem. <br /> <br /> Best regards, <br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/251 2015-12-22T14:00:00+01:00 2015-12-22T14:43:40+01:00 New: Posteo webmail interface can find public keys <p>Dear Posteo users, <br /> <br /> We have now made end-to-end encryption in the Posteo webmail interface even easier.<br /> Attachments can now also be conveniently encrypted (with PGP/MIME) in the webmail interface. <br /> <br /> At the same time we have made the first application for our new <a href="https://posteo.de/en/blog/new-posteo-public-key-directory" target="_blank">Posteo key directory </a> available: <br /> <br /> If you use end-to-end encryption with Posteo in the browser, Posteo finds the public keys for your contacts – in many cases, automatically. This is made possible by the Posteo key directory and Posteo key search: Our key search automatically searches worldwide for corresponding public keys for your contacts and displays them to you before you send an email. <br /> <br /> In many cases, therefore, you no longer need to ask a contact for their public key before being able to send them an encrypted email. <br /> #more#<br /> <strong>It occurs in the background:</strong><br /> When you enter a recipient for your email, our innovative key search peforms a search for corresponding keys for the email address. It searches not only the worldwide PGP key servers, but also the DNS – the so-called “internet telephone book”, as well as additional sources of the Posteo key directory. If the key search finds a key for your contact’s email address, this will be displayed. Thus end-to-end encryption becomes convenient and modern, and without losing security: The encryption in the webmail interface occurs with the open source plug-in Mailvelope, which is installed locally. This ensures genuine end-to-end encryption in which your private key always remains locally on your devices. It is not saved on our servers at any point, as this would reduce the principle of end-to-end encryption (between the sender and recipient of an email) to an absurdity. The encryption and key search also work with all email providers that adhere to internationally agreed-upon standards for the field of email. This is no stand-alone or proprietary solution for which both communication partners would need to use the same provider in order to communicate with one another using encryption. <br /> <br /> For security reasons, our philosophy is to exclusively use genuine end-to-end solutions, open-source technologies and free standards. In our view, only thus can maximum security, transparency, comfort and compatibility be obtained. The Mailvelope plug-in is open source and has undergone a security audit (by Cure53). <br /> <br /> <strong>Instructions:</strong><br /> Step-by-step instructions for the setup and use of end-to-end encryption in the Posteo webmail interface can be found in our <a href="https://posteo.de/en/help?tag=mailvelope" target="_blank">help section</a>.<br /> <br /> Customers who already use end-to-end encryption in the Posteo webmail interface can also find instructions in the <a href="https://posteo.de/en/help/activating-mailvelope-api" target="_blank">Posteo help section</a> on activating the new Posteo key search and encrypting attachments in a few easy steps. <br /> <br /> <strong>For developers:</strong><br /> We have developed an open source plug-in for the Roundcube email client, which is published under the AGPL licence and can be found on <a href="https://github.com/posteo/" target="_blank">Github</a>. <br /> <br /> Best regards and happy holidays, <br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/247 2015-12-04T15:30:00+01:00 2015-12-04T16:05:24+01:00 New: Posteo public key directory <p>Dear Posteo users and interested parties, <br /> <br /> It is our desire to make the exchange of public keys for end-to-end encryption easier and more secure. Today we have taken a first step to this end: You can now <a href="https://posteo.de/en/help?tag=key-directory" target="_blank">publish</a> your public PGP or S/MIME key in our new Posteo key directory and thereby also securely in the DNS, the internet’s so-called telephone book. In the coming weeks we will be progressively activating further options for the new Posteo key directory. <br /> <br /> <strong>Background:</strong><br /> For a while now, various players in the area of internet security have been working on making the exchange of keys for end-to-end encryption easier and more secure. Public keys are to be securely stored and made available in the DNS. To this end, new, free standards will soon be adopted. For a long time, behind the scenes, we have worked on simplifying the key exchange process in multiple steps, to occur in line with the new standards. So far, the standards remain in draft format, but we consider them advanced enough that we have begun to use them. <br /> #more#<br /> The technical designation for the upload of PGP keys was determined some months ago. Over the last few months we engaged ourselves in the responsible working group, such that the DNS parameters for S/MIME keys also be determined by IANA, which is responsible for administration of the DNS in the internet. For us, S/MIME is an equally worthy and just as important encryption standard. <br /> <br /> On Tuesday, the organisation also determined the technical designation for lodging S/MIME keys in the DNS. <br /> <br /> Your public S/MIME or PGP key used to encrypt emails can therefore now be securely added by us to the DNS. There, others can find your key and use it to encrypt emails to you. Your key is stored in the key directory secure against falsification with standards OPENPGPKEY and SMIMEA, which are soon to arrive. This process corresponds to DANE technology: DANE secures TLS server certificates in the DNS, while OPENPGPKEY and SMIMEA secure (against falsification) public keys used for email communication, in the DNS. Keys for end-to-end encryption that are published in the DNS are also secured with DNSSEC, as for DANE. <br /> <br /> Through the use of security technologies such as NSEC3, we also prevent the mass-collection of email addresses and keys from the DNS: A key can only be retrieved for a specific email address known to the person searching. This actively prevents the misuse of the DNS as a source of email addresses for spammers. <br /> <br /> <strong>OPENPGPKEY and SMIMEA are to constitute an alternative to previously widespread key servers, which exhibit multiple problems: </strong><br /> Until now, anyone can upload your public key to worldwide key servers, even if you personally do not want this. In addition, anyone can upload a falsified key for you. Keys that are uploaded there can no longer be deleted. This results in multiple as well as outdated or incorrect keys for an email address being found in key searches on the worldwide key servers. On the key servers, a multitude of valid email addresses are saved, and can be found by spammers who request email addresses from key servers on a mass scale in order to send spam to these addresses. Anonymity is also affected by the key servers: With OpenPGP, anyone can see who has declared their “trust”, similar to a social network. Thus social connections can be openly viewed for each person. The new process at Posteo is implemented without exhibiting any of these weaknesses. <br /> <br /> The Posteo key directory is found in the settings of your Posteo account, under “PGP and S/MIME encryption”. <br /> <br /> Before uploading your key to the Posteo key directory, please check whether it conforms to the Posteo guidelines. To protect your privacy, you can only upload a key that contains your Posteo email address or one of your aliases, among other things. <br /> <br /> The new OPENPGPKEY technology is already implemented in the standard software GnuPG, and Verisign is working on an SMIMEA plugin for Thunderbird. We hope that the dissemination of OPENPGPKEY and SMIMEA proceeds quickly, so that the exchange of public keys becomes easier and more secure. <br /> <br /> Best regards,<br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/244 2015-11-16T18:00:00+01:00 2015-11-17T18:39:28+01:00 Migration service now includes address book <p>Dear Posteo users and interested parties, <br /> <br /> Moving to Posteo just became even easier. With the Posteo migration service, you can now transfer more than just your existing email accounts (including folder structures) to Posteo at the click of a button. <br /> <br /> From now on, the migration service also transfers your previous address book from most large providers to Posteo. You can conveniently transfer your contacts to Posteo without requiring any special technical knowledge. <br /> #more#<br /> Because we do not use any third-party solutions at Posteo for the transfer of your personal data, we have developed individual solutions for the secure transfer of your data from each of the providers listed. In particular, your contacts’ sensitive data (e.g. name, address and phone numbers) are not transferred via a third party at any point. The data is collected by Posteo directly from your previous provider and transferred to your Posteo address book via an encrypted connection. <br /> <br /> <strong>Posteo address book migration is available for the following providers: </strong><br /> <br /> AOL<br /> Gmail<br /> GMX<br /> iCloud<br /> Microsoft services such as Outlook.com, Hotmail, Office 365<br /> Yahoo!<br /> WEB.DE<br /> <br /> The migration service is found in the settings of your Posteo account under “My account”. <br /> <br /> You can decide yourself whether you would like to permanently delete your email and address book data from your previous provider. <br /> <br /> The Posteo migration service is free of charge. It was developed in line with our principle of maximum data economy. Thus, for example, we do not save the email address from which you have transferred data to Posteo.<br /> <br /> Tip: After migration you can individually encrypt all data you have saved with Posteo. Available for this purpose are Posteo’s <a href="https://posteo.de/en/site/encryption#adressbuchverschluesselung">address book and calendar encryption</a> and <a href="https://posteo.de/en/site/encryption#kryptomailspeicher">Posteo crypto mail storage</a> (for your email data). For both features you do not require any special technical knowledge; the encryption occurs at the click of a button. These encryption features are found in the settings of your account under “Encryption”. <br /> <br /> Best regards, <br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/231 2015-08-25T17:00:00+02:00 2015-08-25T17:43:16+02:00 Transparency report: German authorities mess up <p>Dear Posteo users, <br /> <br /> We would like you to know how often authorities request user information from Posteo. We have therefore today published our transparency report for the year 2014. In the report, we lay out how often German investigative authorities approached us in 2014 – and how often Posteo actually had to release data. The report covers all requests from authorities that Posteo received in the year 2014. Posteo operates more than 100,000 paid email accounts. In 2014, we received 22 requests from authorities. In Germany, there is no such thing as secret requests that are not allowed to be mentioned. You will also find out how often these requests were formally correct and how many of the requests were illegal. #more#<br /> <br /> Because almost all requests from authorities that reached Posteo until now were illegal, we devote emphasis to the information process in our report this year. We critique the chaotic circumstances that rule, in particular in requests for user information under § 113 TKG (German telecommunications law). We reveal that grave deficiencies exist in practice, there are regularly breaches of the law and the deficiencies in controls of the situation are becoming even worse. Germany might be known for its exactness, but German authorities have failed miserably at abiding by the legal requirements. Posteo has not yet received any requests from foreign authorities. <br /> <br /> To document our critique of the information and surveillance processes, we have today published numerous examples of illegal requests from authorities on our website. In addition, we present our exchanges of correspondence with public positions such as the state privacy officers, the privacy officers of the respective German federal states as well as the respective ministries of justice of the German federal states. <br /> <br /> Thus you will obtain an insight into our privacy-oriented work that takes place at Posteo all year round. In addition, we occupy ourselves in the report with the control instrument of the judicial reservation, which is in our view no longer equitable in respect of its intended purpose: in practice, clearly all applications for surveillance in Germany were granted. Although statistics are not even kept to determine the effectiveness of the judicial reservation, we have found numbers that prove this. <br /> <br /> The German government meanwhile remains idle, even though it has been informed of some of the grievances for many years and continues to be questioned, as we show in the first part of our report. We demonstrate this with a reply from the Federal Ministry of the Interior that was published last Wednesday (19th August), among other things. <br /> <br /> The complete transparency report can now be found on the <a href="https://posteo.de/en/site/transparency_report_2014">Posteo website</a>.<br /> <br /> We call on Justice Minister Heiko Maas to stop the draft law for the reintroduction of data retention. If the possibilities for surveillance in Germany continue to be enlarged while the deficiencies shown in our transparency report still exist and clearly every application for surveillance is approved, this would be a development that can not be beneficial to democracy. <br /> <br /> Note: The German government&#8217;s draft law for the planned reintroduction of data retention (&#8220;Gesetz zur Einführung einer Speicherpflicht und einer Höchstspeicherfrist für Verkehrsdaten&#8221;) currently stipulates that the entire area of email should be exempt from retention. This means that Posteo does not belong to the group of obligated parties. We assume, however, that the introduction of the law would further increase the number of illegal requests for user information made to us. <br /> <br /> If you would like to support our work, we would be very pleased if you would circulate our transparency report and the information contained within it, as well as making enquiries with the parties responsible. Last May, Posteo became the first German telecommunications provider to publish a transparency report. With our move, we induced other German providers to in the meantime also publish transparency reports – including, among others, Deutsche Telekom. With our transparency report this year, we would like to contribute to making existing grievances and legal realities public and allowing them to be debated. We want change: the grievances must be eliminated and democratic control of state information processes in Germany must be strengthened. <br /> <br /> Best regards, <br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/226 2015-05-29T16:00:00+02:00 2015-05-29T16:47:43+02:00 Crypto mail storage available for all users <p>Dear Posteo users,<br /> <br /> Introduction of the new crypto mail storage is complete: all Posteo users can now encrypt the email data they have saved with us at the click of a button. We make this new encryption feature available to you at no extra charge. <br /> <br /> You don’t require any special technical knowledge: the encryption is activated at the click of a button and occurs in the background without you needing to do anything. You can find the new encryption option in the settings of your account via “Encryption” &gt; “Posteo crypto mail storage”. Step-by-step instructions are found in the Posteo <a href="https://posteo.de/en/help/how-do-i-activate-posteo-crypto-mail-storage">help section</a>. If you have additional questions, our support team is available to you at no extra charge. #more#<br /> <br /> When you activate crypto mail storage, all email data saved with Posteo is encrypted at the click of a button – with the help of your password. The encryption encompasses the content and attachments of all emails saved with Posteo as well as their corresponding metadata (e.g. subject and header). As well as your existing email archive, all newly-arriving emails are also encrypted. The encrypted data within crypto mail storage are no longer readable by us. Posteo can not deactivate the encryption; only you can do this yourself. If you are interested, you can find out concretely how the data is encrypted and where the technical data for encryption is viewable on our <a href="https://posteo.de/en/site/encryption">encryption info page</a>.<br /> <br /> <strong>Password must be taken special care of</strong><br /> <br /> When you have activated crypto mail storage, you need to take special care with your password. The password is the key to your data. If crypto mail storage is activated and you forget your password, you will lose access to your encrypted email storage. The password reset function is no longer available to you, as your data is encrypted using your forgotten password. Posteo support can no longer reset your password or deactivate the encryption. Please therefore consider carefully whether you would like to use this password-based encryption function before activating it. <br /> <br /> <strong>Can be combined with all other encryption options</strong><br /> <br /> Posteo crypto mail storage constitutes an additional layer of encryption in our <a href="https://posteo.de/en/site/encryption#ueberblick">security model</a>, with which you can protect the data you have saved with us. It can be combined with all other Posteo encryption features, for example, inbound encryption, without issue. Please note that each layer of encryption fulfills different protective purposes: crypto mail storage protects your saved email data and their corresponding metadata. By combining it with end-to-end encryption, which protects your emails during the communication process (when sending and receiving emails via the internet), you can further increase the security level of your communication. <br /> <br /> <strong>The most frequently asked questions on crypto mail storage</strong><br /> <br /> Following our <a href="https://posteo.de/en/blog/new-posteo-introduces-crypto-mail-storage">first blog entry</a> we received many questions from users. We would like to respond to the most frequent ones again here. <br /> <br /> – You can continue to use your account in the webmail interface as usual, though the search function could take a little longer. <br /> – You can continue to access emails via IMAP and POP3 as usual. <br /> – You can continue to manage your emails in local email programs. <br /> – You can continue to access your emails on a smartphone, tablet or other device. <br /> – Posteo crypto mail storage encrypts all email data saved on our servers. If local, insecure copies of your email data are created by a program, we recommend securing all devices used for this or deactivating creation of local copies. <br /> – Legal: we had the legal situation checked by our lawyers. In Germany, email providers can not be compelled to &#8220;break&#8221; encryption. We designed crypto mail storage such that technically, Posteo can not remove the encryption of all saved email data applied by the users. <br /> – Because incoming emails are first encrypted when they reach our server, crypto mail storage does not protect against lawful interception (TKÜ) of an account. <br /> – Our encryption plug-in underwent an external, multi-level security audit (by Cure53). For reasons of transparency, the code for the encryption is also openly viewable. This conforms to our open-source strategy and is an essential trust-building measure in the post-Snowden era.<br /> – We recommend that you further secure your account with two-factor authentication, to additionally increase your level of security. <br /> <br /> Best regards,<br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/224 2015-05-22T16:00:00+02:00 2015-05-22T16:35:35+02:00 Posteo users safe from Logjam attack <p>Dear Posteo users, <br /> <br /> For the last couple of days a so-called Logjam security flaw has been reported in the media. This was discovered by US scientists and can provide attackers with access to individual encrypted connections, which, for example, are used for secure access to websites, email traffic and online banking. <br /> <br /> We wish to inform that as a user accessing Posteo, you are not affected by Logjam: our team observes developments in cryptography and security very intently and we always employ the newest encryption technologies. This means that when you access Posteo via your browser or a local email program, you are not vulnerable to Logjam as we do not offer the target over which this attack occurs. #more#<br /> <br /> In your communications with other email providers, please be aware that for the moment, not all of them have secured their systems against Logjam. <br /> <br /> Meantime, independent server test websites have extended their tests to include Logjam. You can confirm that Posteo is not affected by Logjam on these independent sites: on the <a href="https://www.ssllabs.com/ssltest/analyze.html?d=posteo.de">Qualys</a> test site we still obtain the best mark of A+ for web access, for example. Any vulnerability leads to a lower score. <br /> <br /> Independent of Posteo, your browsers as well as local programs could still be vulnerable when using other services. In the coming days, please pay special attention as to whether updates are offered for your browser (e.g. Firefox, Safari or Chrome) or programs. You should install these important updates in order to increase the security of your online activities in this regard. In terms of security when accessing Posteo, no updates are necessary on your part. <br /> <br /> Best regards, <br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/222 2015-05-21T17:00:00+02:00 2015-05-21T20:59:16+02:00 New Posteo migration service <p>Dear Posteo users and interested parties,<br /> <br /> Migrating your previous email accounts to Posteo just got easier: as of today, the new Posteo migration service is available to you, with which you can bring your previous accounts (including their folder structures) across to your Posteo account.<br /> <br /> Many of you desired an ability to transfer folder structures without needing any particular technical knowledge. <br /> <br /> For security reasons, we did not want to employ or recommend any third parties to transfer your sensitive email data; we therefore developed our own solution for secure and convenient migration to Posteo. #more#<br /> <br /> The new migration service can now be found in the settings of your Posteo account (via “My account”).<br /> <br /> You can now completely copy up to three external email accounts across to Posteo. <br /> <br /> You do not require any special technical knowledge: when you set up a new migration service in the settings of your Posteo account, it will display the folders in your previous account. Conveniently, you can then decide which folders you would like to copy to Posteo with a click of the mouse. Our migration service will then transfer all selected folders across to your Posteo account. <br /> <br /> You can decide yourself whether you would like to permanently delete the emails from your previous provider. The Posteo migration service is free of charge – and you retain control over your data:<br /> At no point are your emails transferred via a third party. <br /> The selected folders are collected from your previous provider by Posteo and transferred directly to your Posteo account over an encrypted connection. <br /> We have designed the Posteo migration service in line with our policy of maximum data economy: we do not, for example, save information such as which email address the data is copied to your Posteo account from.<br /> <br /> Best regards, <br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/212 2015-04-09T16:15:00+02:00 2015-04-09T17:24:49+02:00 New: Posteo introduces crypto mail storage <p>New: Posteo introduces crypto mail storage <br /> <br /> Dear Posteo users, <br /> <br /> We have news: <br /> Today we have introduced a new encryption option for you: Posteo crypto mail storage. The new function was already made available to users this morning. In the coming weeks, we will progressively make crypto mail storage available for all accounts. With crypto mail storage you have the ability to personally encrypt all email data you have saved with Posteo at the click of a button. The encryption is comprehensive. It encompasses the content and attachments of all emails saved at Posteo as well as their corresponding metadata (for example, the subject and email header). As well as your existing email storage, all newly-arriving emails will be encrypted. <br /> <br /> We are making this new encryption feature available to you at no additional charge. It is important to us that all Posteo users obtain maximum security. You don’t need any special technical knowledge, either: the encryption is activated at the click of a button. It occurs in the background without you needing to do anything. #more#<br /> <br /> The data within the crypto mail storage is no longer readable by us. We can not deactivate the encryption; only you can do this yourself. You can see whether this new encryption option is already available for your account via “Encryption” &gt; “Posteo crypto mail storage”. If it is not yet available, we ask for your patience. Crypto mail storage will be made available to all users in the coming weeks. <br /> <br /> <strong>Encryption at the click of a button &#8211; with the help of your password: </strong><br /> <br /> As soon as you have activated crypto mail storage in the settings of your account, Posteo creates a personalised key pair for you. Using this, we encrypt all the email data (content, attachments and metadata). This occurs with the part of your key that is responsible for “encrypting”. Each email is encrypted individually. The key that can make an email “readable” again is stored in the Posteo database, protected by your password. Thus, only you can access your encrypted email storage. Nothing changes in the workflow in your account: if you click on an email when crypto mail storage is activated, it is made readable for you in the background – and only for the moment of access. You manage your emails just as simply and conveniently as before. <br /> <br /> <strong>Password must be taken special care of </strong><br /> When you have activated crypto mail storage, you need to take special care with your password. The password is the key to your data. If crypto mail storage is activated and you forget your password, you will lose access to your encrypted email storage. The password reset function is no longer available to you, as your data is encrypted using your forgotten password. Posteo support can no longer reset your password or deactivate the encryption. <br /> <br /> Crypto mail storage is a plug-in we developed for the open-source email server Dovecot. Asymmetrical encryption occurs with the help of RSA; symmetrical encryption and authentication happens with AES and HMAC. Hashing occurs with bcrypt. <br /> <br /> <strong>Further information can be found on our encryption info page. </strong><br /> <br /> Comprehensive tests and external security audit <br /> Your personal email data is a sensitive commodity and worthy of protection. For this reason, extensive preparation work has been done prior to making crypto mail storage available. We not only comprehensively tested our encryption plug-in internally: the feature was also submitted to an external, multi-level security audit (by Cure53). <br /> <br /> <strong>Transparent code and legal check </strong><br /> In addition, we had the legal situation clarified in advance. The result was that in Germany, email providers can not be compelled to “break” encryption. <br /> <br /> We have implemented the crypto mail storage such that from a technical standpoint, the encryption initiated by Posteo users can not be removed by Posteo. In addition, the code for the encryption is openly viewable for reasons of transparency. This conforms to our open-source strategy and is an essential trust-building measure in the post-Snowden era.<br /> <br /> <strong>Can be combined with all other encryption options </strong><br /> Posteo crypto mail storage can be combined with all other Posteo encryption features without issue. Thus, you can encrypt all your calendar and address book data at the click of a button. Posteo inbound encryption, which encrypts all newly-arriving emails with OpenPGP or S/MIME, can also be combined with crypto mail storage without issue. <br /> <br /> If you already use inbound encryption, we recommend also activating crypto mail storage, as crypto mail storage encrypts not only newly-arriving emails but also all emails in all folders of the account as well as their corresponding metadata. <br /> <br /> If you already use end-to-end encryption, you will also profit from crypto mail storage. The end-to-end process such as OpenPGP will generally only encrypt the content of individual emails, and not your saved emails or the emails’ metadata. Our password-based crypto mail storage constitutes comprehensive encryption, which distinctly increases the security level at Posteo. For maximum security, we recommend securing access to your crypto mail storage with Posteo two-factor authentication. Then, at login, not only your regular password will be required, but also a current one-time password. Such is the overall security level further increased. If you create local, insecure copies of your email data, we recommend securing all devices used for this. <br /> <br /> We have made numerous pages with information and <a href="https://posteo.de/en/help/how-do-i-activate-posteo-crypto-mail-storage">help instructions</a> on Posteo crypto mail storage and our other encryption options available on our website. <br /> <br /> Best regards, <br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/210 2015-04-07T14:30:00+02:00 2015-04-07T15:47:45+02:00 Posteo webmail: New "Gentle Grey" theme available <p><br /> Dear Posteo users,<br /> <br /> As of today, a new “Gentle Grey” theme for our webmail interface is available. This is a reduced-colour version of our new standard design for those who prefer a more discreet colour scheme. <br /> <br /> You can now activate the “Gentle Grey” theme in your account settings via “Settings” &#8594; “Preferences” &#8594; “User Interface”. To use the theme, simply select “Gentle Grey” and confirm by clicking “Save”. <br /> <br /> We will soon be making additional versions of the webmail interface available to choose from.<br /> <br /> Best regards, <br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/204 2015-03-13T16:15:00+01:00 2015-03-13T16:27:28+01:00 German Bundestag: Posteo statement on privacy <p>Dear Posteo users, 

<br /> <br /> As of today you can find a statement from Posteo on the topic of “Privacy in the digital world” at bundestag.de. Our vice president of communications, Dean Ceulic, was a guest expert on the committee for the German parliament’s digital agenda. The topic of the discussion was “Startups, small to medium-sized businesses and privacy in the digital world”. In addition, we were asked to provide written replies to a list of questions that the various fractions prepared prior to the discussion. Our <a href="http://bundestag.de/blob/364472/00cf3556e0f5b702e45971936ba96d43/a-drs-18-24-55-data.pdf">statement</a> is now available on the Bundestag website (in German). 
The discussion itself is available as a video at <a href="http://dbtg.tv/cvid/4644590">bundestag.de</a> (in German).<br /> <br /> <strong>An overview of the most important points for us</strong><br /> <br /> <strong>On German and European privacy standards:</strong> <br /> <br /> We emphasised that strict German and European privacy regulations do not stand in the way of the economy. The opposite is true: European companies can use stricter privacy regulations to their advantage, protecting themselves (for example, from American competitors) using sophisticated privacy measures. Stricter privacy standards do not inhibit innovation; they actually constitute a competitive advantage for European companies. This view is shared by an overwhelming majority of the experts who took part in the discussion. #more#<br /> <br /> <strong>We criticise the German government’s current plans to weaken the high German and European privacy standards: </strong><br /> <br /> “Germany’s high standards for privacy have become a relevant factor for a company’s location, and should not be given up lightly. The principles of data reduction and purposeful use strengthen consumers’ trust in German companies and help strengthen citizens’ fundamental right to informational self-determination.” <br /> <br /> We therefore demanded that the law stipulates that personal information can only be processed if allowed by law and with the affected party’s consent. <br /> <br /> On data preservation, we stated the following: 
“Sensitive metadata such as IP addresses, for example, are currently under special protection in Germany. Connection and traffic data (such as IP addresses) must also be under special protection on a European level, as their evaluation enables compilation of extensive personality profiles. In particular, the retention of data should be opposed, as this severely impairs citizens’ fundamental rights according to several of the highest law courts.” 

On data economy and purposeful use:

 The German government will in future consider the principles of data reduction and purposeful use when handling data. <br /> <br /> <strong>We engaged ourselves with maintaining both of these fundamental privacy principles, stating: </strong><br /> <br /> “When handling data, the principles of data reduction and purposeful use strengthen not only the citizens’ fundamental right to informational determination. Both factors also give companies a clear course of action and minimise uncertainties as to how they collect and process data – in particular also amongst one another.” <br /> <br /> <strong>On the relationship between fundamental rights and security interests: </strong><br /> <br /> We emphasised that there is no conflict between objectives in security interests and the effective protection of citizens’ privacy. In a constitutional state, both poles should be in a far more balanced relationship with each other: <br /> <br /> “To further strengthen democracy in the digital world, it is essential to restore a more balanced relationship between both poles. International, comprehensive surveillance activities by intelligence agencies can only be countered with measures for encryption, data economy and anonymisation. This is in the interest of citizens – as well as in the interest of companies and authorities.” 

<br /> <br /> Best regards, <br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/192 2015-01-06T18:00:00+01:00 2015-01-06T18:22:06+01:00 New: Anonymous payment system extended <p>Dear Posteo users, 

<br /> <br /> Today our payment process has been superseded by our new, extended single-use code system for anonymised payments. Until now, our code-based payment system was used exclusively to separate payment data from the email accounts. From now on, the single-use codes also contain an encoded country determination, such that we can continue to maintain our concept of data economy despite new legal requirements.#more#<br /> <br /> On January 1st, the so-called “Kroatiengesetz” came into effect. This law is the German implementation of an EU regulation. It specifies that for electronic services, value added tax must be paid in the country in which the user lives. Previously, the service provider’s headquarters determined the tax location. From January 1st we are therefore required for each payment process to determine which country each payment comes to us from, using multiple measures. This can be done, for example, with the help of a Geo-IP determination or an evaluation of the payment information. The lawmakers require at least two attributes to be ascertained, which do not differ. Fulfilling these new legal requirements was a challenge for us as we don’t save any of your personal information and wish to continue not to do so.<br /> <br /> We have therefore extended our anonymous payment process for the event of the new law coming into effect, in order to maintain our consistent concept of data economy. We are now required to conduct a legally-specified country determination. Its result is encoded in a part of our payment codes that only you receive, when you now start a payment process. This part of the code contains the result of a Geo-IP determination and a browser region determination (your IP address is not saved). The part of the code that is in our system is somewhat shorter and does not contain this sensitive information. The encoded part is “outsourced” to you until the payment is completed. This is important, because otherwise we would have personal data connected to your account in our system until completion of the payment, which is something we don’t want.<br /> <br /> You provide us with the complete code, and thereby also the result of the country determination, in the purpose/description field of your payment. When a payment arrives at Posteo via bank transfer or in the post, our payment system automatically evaluates the code and can then allocate the payment to your account. The encoded country determination in the last three characters is also automatically evaluated, to determine the value added tax payable in the relevant EU country. The result is not connected with your account. The evaluation process only takes a fraction of a second. When the code is evaluated, credit is added to your account and the single-use code is deleted from the system. Thus it is no longer possible to tell which account you have transferred funds for. Nor is it possible to tell which country the user of an account lives in.<br /> <br /> PayPal and credit card payments occur directly after starting a payment process. The use of a code system is therefore unnecessary here. Information on the country determination is also immediately evaluated and does not need to be temporarily saved. Neither the PayPal or credit card payment nor the country determination collected is connected with the email account.<br /> <br /> We understand the lawmakers’ intention to block tax loopholes with the new law. It is, however, problematic that companies who want to operate with data reduction can become required to collect and save users’ personal information via this EU regulation. Providers generally do not have complicated code-based systems allowing data reduction available to them – plainly, they must then retrieve and save the information. This is how mounds of data pile up. In addition, a bank account is very secure against manipulation. We doubt whether additional measures such as geolocation would markedly increase reliability.<br /> <br /> Further information on Posteo’s anonymous payment system can be found on the <a href="https://posteo.de/en/site/payment">payment info page</a> that we have set up.<br /> <br /> Kind regards and all the best in the new year,<br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/183 2014-11-12T14:45:00+01:00 2014-11-12T21:17:49+01:00 New two-factor authentication available <p>Dear Posteo users,<br /> <br> We have news: You now have the possibility to enable two-factor authentication for additional security of access to your Posteo account (in the browser). <br /> #more#<br> The technology is comparable with multilevel security processes in the banking industry. At an ATM, you can only withdraw cash if you know something (your PIN) and possess something (your ATM card). With two-factor authentication, the situation is similar. In order to log in, you need something that you know (your Posteo password) as well as something that you possess (e.g. your mobile phone). The Posteo login process only changes slightly with the additional security: After entering your username and password, you will in addition be asked for a current one-time password. The current one-time password will be shown to you on a device (e.g. a mobile phone, tablet or desktop) on which you have activated two-factor authentication.<br /> <br> If criminals or intelligence agencies obtain your access information (username and password), they will have no way to access your account via the webmail interface and, for example, to manipulate your account and security settings. The conventional access details are no longer sufficient for the login process. <br /> <br> We have set up two-factor authentication to be as simple and secure as possible. With Posteo, two-factor authentication technology can be used not only with free apps for all current platforms, but also with special hardware (such as a Yubikey). All users who only access Posteo in the browser (i.e. webmail) can distinctly increase the overall security of their emails and account by enabling two-factor authentication. If you specify in the settings that you use webmail only, access will be blocked for local email programs. This eliminates the possibility of attacks, which don’t happen via the browser but rather via external programs (by IMAP and POP3).<br /> <br> Setting up two-factor authentication is simple. It is also recommended for users without technical knowledge. The technology is based on the open TOTP standard. There are no additional costs – the new function is provided at no extra charge. You can find out how to activate two-factor authentication in our <a href="https://posteo.de/en/help/what-is-two-factor-authentication-and-how-do-i-set-it-up">help section</a>. <br /> <br> Two-factor authentication significantly increases the security of webmail access. Our development team is currently also working on a solution that will also increase security of access via local email programs using a multilevel security process. We hope we can also make this solution available to you soon. <br /> <br> Best regards,<br /> <br> The Posteo team</p> tag:posteo.de,2009:Post/174 2014-10-10T18:47:00+02:00 2014-11-06T17:38:25+01:00 Email encryption in your browser with Mailvelope <p>Dear Posteo users, <br /> <br> A few days ago, a new version of the encryption add-on Mailvelope (available for Firefox and Chrome) was released. The new version is preconfigured to work with Posteo. <br /> #more#<br> Using the add-on, it is now possible to easily encrypt the content of emails using OpenPGP within the Posteo webmail interface. You can also sign your emails, but attachments can not be encrypted using the add-on. Mailvelope is especially interesting for all who prefer to use the Posteo webmail interface and who would like to secure their emails with end-to-end encryption. Mailvelope is open source: The program code for the add-on is visible and based on open standards. <br /> <br> In the Posteo help section &#8220;Webmail&#8221;, you can find <a href="https://posteo.de/en/help/how-do-i-set-up-end-to-end-encryption-in-the-browser">instructions</a> on how to install the add-on in Firefox or Chrome and how encryption using Mailvelope works. Other browsers such as Safari or Internet Explorer do not yet support Mailvelope. If you encounter problems using Mailvelope or have questions about the add-on, please contact Mailvelope support. <br /> <br> Best regards,<br /> <br> The Posteo team</p> tag:posteo.de,2009:Post/175 2014-09-23T18:53:00+02:00 2014-11-06T17:38:40+01:00 New webmail interface available <p>Dear Posteo users,<br /> <br> We have some important information for you: From today, the new standard<br /> design of our webmail interface is available.<br /> #more#<br> You can now activate the new design in the settings of your account via<br /> &#8220;Einstellungen&#8221; &#8594; &#8220;Benutzeroberfläche&#8221; &#8594; &#8220;Oberflächendesign&#8221; (or “Settings”<br /> &#8594; “User Interface” &#8594; “Interface Skin”, if your interface is set to English).<br /> If you would like to use the design, simply choose “Standard” and confirm by<br /> clicking “Save”.<br /> <br> During the last few months, our team has been working on the appearance of the<br /> user interface. The webmail site is now more appealing, and easier to use. We<br /> will continue to support the old design until early 2015. We recommend<br /> switching to the new design now.<br /> <br> We will soon make additional versions of the new standard design available to<br /> choose from. Other parts of the website – for example, the help section – will<br /> be progressively updated to match the new design.<br /> <br> As part of the design update, some technological improvements have been made<br /> in the background. These lay the foundation for various new features, such as<br /> Posteo email account encryption, which we will be introducing this autumn.<br /> <br> Best regards,<br /> <br> The Posteo team</p> tag:posteo.de,2009:Post/176 2014-05-12T08:45:00+02:00 2015-04-17T16:04:33+02:00 Posteo supports DANE/TLSA <p>Dear Posteo users, <br /> <br /> From today onwards, we support the innovative technology DANE/TLSA (DNS-based Authentication of Named Entities). DANE eliminates various weaknesses in the widely-used transport route encryption SSL/TLS – and increases the security of encrypted transport of emails and when accessing websites. <br /> #more#<br /> With DANE, the so-called “digital fingerprints” of an encryption certificate are stored in the internet’s “telephone book” (DNS). There they can be automatically checked by email servers, email programs and browsers before an encrypted connection to a website is established or an email is delivered. The authenticity of a server can thereby be verified before each connection. Until now, most servers sent data over an encrypted connection without first verifying the authenticity of the other server. DANE effectively prevents third parties (such as criminals or intelligence agencies) from pretending to be a particular web or email server in order to obtain login data or content (using a falsified certificate). <br /> <br /> Entries in the internet’s so-called “telephone book” are additionally secured with DNSSEC technology, such that DANE can be trusted. DNSSEC prevents third parties from altering entries and switching the “digital fingerprints” of the encryption certificates. Unfortunately, DNSSEC is not yet supported by most domain providers. Posteo had to change its domain provider in order to introduce DANE. <br /> <br /> DANE also opens possibilities on another level: Email servers can now force a connection to be encrypted with the help of a DANE entry. Previously, email servers would negotiate whether they could support encryption before establishing the connection. Posteo has already configured its server for this: If other email providers also have a DANE entry, then Posteo sends to their servers with encrypted connections. If no encrypted connection can be achieved, then email sending will be cancelled for security reasons. This not only prevents man-in-the-middle attacks, but is also important for the following reason: With DANE, email servers can clearly authenticate themselves worldwide – and mutually guarantee that emails are always exchanged over an encrypted connection. This is not the case, for example, with “Email Made in Germany”, a group of a few German providers that leaves out all other email servers and only promises its users encrypted connections between each other. Posteo rejects such “partitioning” of some German providers: A global network requires global improvements to the security of communication via consistent, open standards. <br /> <br /> Because the technology is not yet widespread, there are currently hardly any other programs or providers who support DANE. Despite this, we want to lead by example, and promote the spread of this important process – DANE will, in the future, make an essential contribution to making the internet safer. <br /> <br /> There are already DANE add-ons for all current browsers, with which internet users can secure their access to Posteo using DANE. Via this link, you can find a <a href="https://www.dnssec-validator.cz/pages/download.html" target="_blank">list of all currently available extensions</a>. <strong>We can not provide any support for add-ons or tools. We appreciate your understanding.</strong><br /> <br /> The technology is, however, not yet directly implemented in any browser. We hope that the developers of DANE and DNSSEC will achieve this as soon as possible. We also encourage other email providers to implement DANE, so that communication between email servers over encrypted connections becomes more secure worldwide. <br /> <br /> Best regards, <br /> <br /> The Posteo team</p> tag:posteo.de,2009:Post/177 2014-01-29T18:00:00+01:00 2015-06-23T11:39:33+02:00 Posteo on the myths of the SINA box <p>Dear Posteo users,<br /> <br /> This blog entry is about a topic that has made many of you anxious, and about which we are currently receiving enquiries. The question concerns <strong>when and how German email providers give out data to investigative authorities</strong> when a judicial ruling exists for the surrender or surveillance of an email account. #more#<br /> <br /> Computer magazine c’t states in its current edition (4/2014):<br /> <br /> &#8220;Email providers with more than 10,000 customers must operate a so-called SINA box, which can channel the email traffic of all users without the provider or the user being aware.&#8221;<br /> <br /> This is incorrect. <strong>It is not possible for German authorities to access users’ emails without the knowledge of the provider. In addition, a SINA box has no access to a provider’s systems.</strong><br /> We asked the editors to issue a correction. They then acknowledged the error and published a <strong>correction on the <a href="http://www.heise.de/ct/artikel/Ergaenzungen-Berichtigungen-Sina-Box-2099152.html" target="_blank">c&#8217;t blog</a></strong>. Because we can not individually answer all the questions we are receiving, we inform here exactly what the situation is with the SINA box:<br /> <br /> <strong>So far, there is no SINA box at Posteo.</strong><br /> The (German) Telecommunications Monitoring Ordinance (Telekommunikations-Überwachungsverordnung, TKÜ) requires telecommunication providers with at least 10,000 users to install a special computer (the SINA box). We can not say exactly how many users our service has, because we don’t collect our users’ personal information. We only know the number of email accounts. <br /> <br /> We will, at some point, have to acquire a SINA box – but we leave estimating when this might be to our experienced lawyers, who have negotiated SINA solutions for various telecommunications organisations with the Federal Network Agency. This is more of a financial nuisance. It will not impair the security of our users’ data. We have become convinced of this following an intensive debate on this topic (with lawyers and authorities, among others), and we can assure you of it. <br /> <br /> A SINA box is a computer that establishes an encrypted connection to authorised authorities – a so-called VPN. We would have no access to the SINA box, but neither would the authorities have any access to our servers or network traffic via the SINA box. The authority would have no access to our servers whatsoever. We would, however, have the possibility to save the content of an email account on an authority’s server via the SINA box, if a judge had ordered the surrender or surveillance of the account. <br /> <br /> We would then have no access to this data – only the authority would. The only data found on that computer would be that which we (Posteo) had deposited there, however. <br /> ————<br /> Please note: c’t magazine writes that the email traffic of all users can be channeled over the SINA box without the provider or user noticing. This is incorrect. <br /> ————<br /> The authority’s computer (behind the SINA box) would, like the SINA box itself, be connected neither with our servers, nor would it allow access to our servers. For the authority, the point is to establish a completely isolated system, such that third parties have no way to intercept data that we are required to provide manually. If a judicial ruling exists, we need to provide copies of the data via this computer, for example, transfer by FTP access (one-way). <br /> <br /> <strong>Even without a SINA box, we are – in the event of a judicial ruling – already required to surrender an email account’s data, which we also point out in our privacy policy. Every email provider in Germany is required to do this, no matter how small.</strong><br /> <br /> The legislator has set the hurdle for surrender of content very high: Your emails are governed by secrecy of telecommunications. Because we never surrender email accounts of our own free will (<a href="http://www.gesetze-im-internet.de/stpo/__94.html" target="_blank">§ 94 Abs. 1 StPO</a>), instead always formally objecting, the lawful seizure of a Posteo account must always be ordered by a judge (<a href="http://www.gesetze-im-internet.de/stpo/__94.html" target="_blank">§ 94 Abs. 2 StPO</a>, <a href="http://www.gesetze-im-internet.de/stpo/__98.html" target="_blank">§ 98 Abs. 1 S. 1 and Abs. 2 S. 1 StPO</a>). The command to lawfully surveil an email account can only be obtained in cases of specific, severe crimes, and not for infringements, among other things. The legal ruling on this can be found, for example <a href="http://dejure.org/gesetze/StPO/100a.html" target="_blank">here</a>. The judicial ruling must be presented to us (the provider) and will be checked by our lawyers for scope and formal correctness before we provide any data. <br /> <br /> <strong>After submission of a judicial ruling, the provider therefore delivers the data itself.</strong> The user must not be informed about the order for lawful interception. This is <a href="http://www.gesetze-im-internet.de/g10_2001/__17.html" target="_blank">prohibited</a>; we would make ourselves liable for <a href="http://www.gesetze-im-internet.de/g10_2001/__18.html" target="_blank">prosecution</a>.<br /> <br /> At present, for example, we would have to send a DVD containing the email account contents to the authority – via the SINA box, the authority would obtain the data more quickly and securely. Otherwise, there is no difference to the previous procedure. In addition, there is no possibility for the authorities to access our users’ data. <br /> <br /> We would like to release a transparency report on the number of requests from authorities as soon as possible. This would certainly counter general uncertainty. Unfortunately, it is not yet fully clear if this is permitted under German law. It is possible that we could make ourselves liable for prosecution by publishing a transparency report. We are currently obtaining a legal opinion on this. We will shortly provide a page with information about common legal questions. <br /> <br /> We hope we have provided some clarity with this piece. <br /> <br /> Best regards,<br /> <br /> The Posteo team</p>