Dear Posteo customers,

We are releasing a new feature for you: the Posteo attachment browser with integrated photo stream.
The new feature makes your account noticeably more modern and easier to use.
As of this morning, the attachment browser has already been made available to some of you.

In the coming weeks we will gradually make it available for all accounts.
You can then find it in the menu under “Attachments”.

All attachments in a convenient overview

#more#
Viewing photos in privacy with the photo stream

The new photo stream provides a modern appearance for your account. Photo attachments are visually displayed in a way that might be familiar to you from social media platforms, but remain within the privacy of your email account. The stream can be filtered at your convenience — the photos from your recent vacation can be found as quickly as the photos from the family reunion. Additionally, you can quickly identify which photos you no longer need: a photo can be downloaded or deleted with two clicks.

Delete attachments, save storage space and protect the climate

Many of you requested a separate feature for deleting attachments.
This is now conveniently made possible with the attachment browser at the touch of a button. Attachments that are no longer needed can be deleted while keeping the corresponding email. This frees up storage space and saves resources. Because data saved online continually uses energy. So that you can remember that the deletion occurred, a note summarising which file was deleted as well as the time of deletion is added to the email. This will also be reflected in local email clients and apps.

With the filter option “size” you can quickly obtain an overview of which files and images are taking up a considerable amount of storage space.
You can load the photo stream in the attachment browser via “Images”. In our help section you can find information as well as step-by-step guides for the new feature.

Comprehensive tests and external security check

Encryption at the touch of a button

The attachment browser and photo stream are also compatible with our crypto mail storage. If it has been activated, all data saved within the account is encrypted with your password. The new feature is then accessed within the privacy of your own encrypted account. Even we, as the provider, do not have access to your data. This principle can be compared with device encryption on smartphones.

Email attachments that have been sent with end-to-end-encryption (PGP/S/MIME) can not be displayed in the attachment browser.

More updates coming soon

Already in the near future we will be making additional improvements available to you — an optimised version of Posteo webmail for smartphones will also be made available soon. The attachment browser and photo stream have already been customised for mobile use.

Best Regards
The Posteo Team

Dear Posteo customers,

Over the next few days we will update our main security certificate. Security certificates are only valid for a specified time period and need to be renewed from time to time. Because of this, we will be changing this certificate before January 21, 2020.

In most cases, you will not notice any change.
All clients like Thunderbird or Outlook will automatically find the new certificate. You do not need to do anything. However, should your client display a certificate error during this changeover process, please restart your client. This should fix the error.
#more#
If you manage the trustworthiness of certificates manually, you can find the fingerprint for the new main certificate that we will shortly begin using below. You can also find complete fingerprints for all certificates in our legal notice.

New fingerprint for the TLS security certificate for posteo.de:

Geotrust:
SHA256: 0D:E9:93:36:62:E6:B7:39:F3:35:A8:AC:14:70:37:29:5F:E7:C4:B5:DB:3E:6C:55:AC:21:62:F6:82:CA:63:05
SHA1: AB:5F:22:76:52:78:05:DC:5B:5C:B3:EC:34:B3:C1:1A:FE:58:62:85
MD5: C9:FF:8D:19:7C:F7:FF:40:32:9B:FB:07:01:1C:5C:6F

Best regards,
The Posteo Team

Dear Posteo customers,

Over the next few days we will update our main security certificate. Security certificates are only valid for a specified time period and need to be renewed from time to time. Because of this, we will be changing this certificate before January 21, 2019.

In most cases, you will not notice any change.
All clients like Thunderbird or Outlook will automatically find the new certificate. You do not need to do anything. However, should your client display a certificate error during this changeover process, please restart your client. This should fix the error.
#more#
If you manage the trustworthiness of certificates manually, you can find the fingerprint for the new main certificate that we will shortly begin using below. You can also find complete fingerprints for all certificates in our legal notice.

New fingerprint for the TLS security certificate for posteo.de:

Geotrust:
SHA256: 4D:BE:FA:8D:28:6A:D3:73:85:A1:B9:3F:77:D0:5F:E9:70:DD:BF:91:B6:0B:66:3A:1E:4B:C0:3D:4F:71:90:D0
SHA1: 73:4A:26:46:D0:A3:95:1D:52:88:83:F4:12:E9:CA:35:67:8A:6A:07
MD5: BD:6F:47:5C:8E:A9:82:87:E1:DC:A1:7C:07:85:95:A7

Best regards,
The Posteo Team

Dear Posteo users,

In the coming days we will be updating our security certificates. Security certificates are only valid for a specified time period and need to be renewed from time to time. We will therefore be changing them by 22.01.2018. We continue to use certificates from Geotrust (Digicert) and the Bundesdruckerei (D-Trust).

In most cases you will not notice anything when the certificates are changed over. All programs such as Thunderbird or Outlook will find the new certificate automatically. You do not need to do anything. If your program displays a certificate error during the changeover process, please simply restart the program, which should overcome the error.

If you check the trustworthiness of certificates manually, you can find the fingerprints for the new certificates that we will shortly begin using, below. You can also find the fingerprints in our legal notice.

New fingerprints for TLS security certificates

Geotrust:
SHA256: FB:28:42:1E:23:AD:8A:23:8B:AB:C1:ED:FD:86:FD:F5:30:C6:D9:35:E0:E6:D8:91:CD:F3:77:66:05:C5:75:33
SHA1: AC:9D:4C:F6:36:78:FE:D6:EB:5C:CE:F9:DA:CB:69:CE:0A:93:F4:58
MD5: E9:B3:0A:C5:76:86:0C:FC:15:3D:43:D9:6E:CD:FC:CE

D-Trust:
SHA256: 09:63:1B:8C:35:CD:67:0E:AB:60:B3:63:1E:F3:42:DB:9F:43:5E:09:AD:09:A5:90:49:33:26:F2:FD:B4:D7:AA
SHA1: B6:B8:3C:59:23:22:33:07:88:9E:DD:B9:8D:2D:ED:6C:FA:32:E9:04
MD5: 5D:3F:4C:A3:72:7F:8B:3A:54:92:B4:C8:BC:D5:D9:B7

Best regards,

The Posteo team

Dear Posteo users,

Starting this week, we are now supporting the new encryption method Autocrypt, which will soon simplify real end-to-end encryption in email applications. Posteo customers will be able to use the technology as soon as email applications supporting Autocrypt are available.

The trendsetting method is being integrated into popular email applications such as Thunderbird with Enigmail and K-9 Mail for Android. New versions of these email applications (Enigmail 2.0 and K-9 Mail 5.3) will support Autocrypt.

When email senders and recipients are using email applications compatible with Autocrypt, they can use end-to-end encrypted communication with no additional effort: the email applications automatically encrypt emails with PGP prior to transmission while exchanging public keys automatically in the background. The manual exchange and management of keys – which users often perceive as complicated – is becoming superfluous: Prior to the first encrypted communication, a regular empty email (without content) is sent. With this, the key is transferred in the background. Henceforth, messages can be encrypted automatically.

Autocrypt is a free and open standard, works with all email providers and uses real end-to-end encryption with the private key always remaining with the user. That’s one of the reasons why we support the method.
#more#

Why we already support Autocrypt and protect keys additionally

A first version of Autocrypt is being integrated into popular email applications. The involvement of email providers in the key exchange has not been intended yet. The provider sided support generates benefits for the end user which we want to showcase with our early implementation.

It is very important to us that Posteo customers will be able to use Autocrypt from the very beginning – as comfortable and secure as possible.

Our contribution to comfort:
Thanks to Autocrypt, email applications can soon automatically exchange public keys within the email headers. Our provider sided support makes it possible for an Autocrypt compatible application to receive a public key even if the sender uses an email application without support for Autocrypt. If the sender’s public key is available to us, we will take over that task: Posteo adds the Autocrypt header prior to every email transmission. Your communication partner is able to reply encrypted – without a manual key exchange.

Your current public key is transmitted inside the Autocrypt header with every sent email. Therefore, there is always a copy of your current key available in the applications of your communication partner – without manual key management.

Our contribution to security:
We provide an additional layer of security with digital signatures (DKIM). For Autocrypt the use of DKIM has not been planned yet. Our provider sided DKIM-signature makes it impossible for a public key to be invisibly manipulated by a third party during transmission. An Autocrypt header attached by your local email application is signed with DKIM by Posteo. DKIM-signatures occur only when the sending address matches with the sending mailbox.

How Autocrypt is integrated into Posteo

Many Posteo customers have published their public PGP key in the Posteo key directory. If these customers send an email, we add the Autocrypt header into the email. This header contains your public key. If your email application adds an Autocrypt header by itself, this header will not be changed and no additional header will be added.

- Posteo customers who additonally activated the Posteo inbound encryption using their public PGP key want every incoming email to be encrypted. This information is added to the Autocrypt header as well. That way, email applications compatible with Autocrypt will know that a recipient at Posteo wants an encrypted reply.

- In addition to the new Autocrypt header we also add the so called OpenPGP header, which informs the receiving email client on where it can find the public key. With this, the URL for the download from the Posteo key directory will be transmitted. The OpenPGP-header will be signed with DKIM, too.

What can you do?

In day-to-day life, encrypted communication with Autocrypt will work without your involvement. The manual exchange and management of end-to-end encryption keys becomes superfluous. All you need is your personal PGP key pair.

- Install the upcoming major versions of Enigmail or K-9 Mail as soon as available.

- If you already own a personal PGP key pair for your Posteo email address, we recommend publishing your key in our Posteo public key directory. Then your public key will automatically be added to the header of every email you send. We explain how to publish your public PGP key at Posteo in this help article.

Security recommendations for implementing Autocrypt:
In our view, the automatic exchange of public keys in the background should always be accompanied by further security measures. We recommend other email providers to sign Autocrypt headers with DKIM. Application developers should consider further measures to secure the key and verify existing DKIM-signatures. Additionally, end users should be notified by their email applications if a public key is replaced with a new one or if a setting, that an email should be encrypted or not, is changed by an Autocrypt header. In this way, a possible manipulation by third parties can be detected.

Best regards,

The Posteo team