Market Research - Offshore, secured webmail

mpkossen

GnuPG, it's free!

iSidle

@William said:
I don't want to burst your bubble, but Czech security law allows of confiscation of any equipment with a short order and no notice - As it is EU you also have to consider ALL other EU countries laws as they can produce an order based in their own laws that HAS to be accepted in CZ after evulation.

I have a video of a Europol agent walking into my Czech provider (along with a hoarde of specialists they brought in from Prague) and pulling 2 HDDs on a RAID set of a VPS node - I never got any order for this, and this is fully legal in CZ.

No, this is bound to fail, hard.

Turkey. Fail hard. Security state, Internet censorship implemented, single upstream law (Though there are exceptions with L2 links, Vodafone i.e.)

Russia. Fail hard. Dictatorship, unknown and impossible to predict lawset from 1930-2013 used as required by the the Gov.

Realistically, if you want to pull something like this you HAVE to live in this country, know it's law and HAVE a local lawyer on standby, because you WILL get court orders (and/or raided) - That is entirely out of question.

By business freedom and global security (either by guarantee, colonial power or a superpower) this is a usual job for Hongkong (de-facto and de-jure, even with growing Chinese influence) or other large economies that can deter EU/US pressure as Brasil (de-jure - de-facto rather not) or South Africa also.

It's always a question of userbase, if you have mainly US/EU users and want to piss off them there, host in Iran or Syria (which does still work)

Regardless you always either sacrifice physical and upstream security for judicial security or judicial security for physical and upstream security - You cannot have all of that in one package, and if you do (or someone claims to) you work with a 3 letter organization secretly.

I'm always amazed at the german police - They automatically run IPs against a Tor exit check function and log this, most others in EU do also, i'm not sure why no one here thought about such simple tasks...

Thanks, I didn't know that about Czech, I always thought it was a pretty secure location, and I'm glad you mentioned these things. I was just looking into the Possibility's that there are, If everyone would have gave me a green light, I'd have invested in this but since this world is so corrupted/bitter there's no chance of this even working.

edit:
although if HavenCo would start providing dedi's etc. this would be the ideal place.

*little info: http://en.wikipedia.org/wiki/HavenCo

typh0n

@skagerrak said:

I know that Turkey is an associate member of the EU but in my opinion they will not join the EU in the next months/years. They are already connected to the EU with the free trade agreement.

@William

I also know that Turkish internet is censored (Porn etc.) but the internet in Germany is censored as well (e.g.: YouTube).

@iSidle

HavenCo is not in international waters. It belongs to the UK because it's inside the 12 miles zone but William already said that before.

William

No, Youtube censors by law - They do it because Google has and wants a company in Germany for ads and alike.

Other sites in other EU countries or companies with no German subcompany do NOT need to follow Nazi and age censor laws in Germany. See Dailymotion (French company, German interface available) as example, lots of nude, porn and some nazi content (similar laws that ban similar things in France, thus not much difference in this point). If you want an extreme example - Liveleak is accesible in Germany obviously.

You get this entirely wrong, the German internet ACCESS is in no way censored at this time, this will not happen either - The Germans got very paranoid about such things (and thats quite fair even) and would vote down anything, the data retention is not in place either and Germany is on the EU courts to get it declared uncostitutional...

abravo

Russia. Fail hard. Dictatorship, unknown and impossible to predict lawset from 1930-2013 used as required by the the Gov.

a clarification here: Russia isn't really much a dictatorship. Sure there's an authocratic aspect but it's far from being a dictature. That's a quite distorted cliché. But anyway to the point: "dictatorship" is a laughable argument in the topic, because what are self-claimed nice "democracyships" implement a level of internet screening which has no counterpart anywhere else excepted China and middle-aged arab monarchies plus a couple more. As for democracy, USA for instance is very strange, there's always one party in charge, the Republicans, with some times in between the Democrats. It's immuable. Sure other parties are many, and they can never get more than some marginal votes. Relatively to that: the necessity of diverse parties life in a democracy, USA is quite bad, and Russia is more liberal.

Russia so far has recently signed the DMCA-like deal implemented in EU, as a mandatory point in their WTO membership. Which means that before you could go on rutracker.org and download the latest Adobe suite for instance, but now you can't because Adobe lawyers in Moscow have now some lever.
So like in US/EU it isn't political, but big corporations (ie. Hollywood, Adobe, etc).
So far russian politicians don't give a fuck about what people write online. It's amazing all one can find on runet, from main places like VK or LiveJournal to the many more confidential places.
If russian politicians and corporate people get more infuence from the anglosphere then they could fence more and more, because the whole point of the anglospheric system is that everywhere people go, there must be some legalities to force people to consume. So you can't be in a uncharted web, you must be like in a shopping mall and buy stuff. And if there's nothing to buy they will still find a way to fence you and make money on the backstage, like Facebook does.
In Russia a problem is rather corruption and unpredictable/weak rule of law: when some local mob boss or greyzone mayor or governor is annoyed by unpleasant facts spread around. Then they can plant whatever fictive charge and make the local police to arrest the source, or they get servers shut down. It's not general, it depends where/who.

All in all, I rather run boxes in Russia (I actually do) than anywhere else in the Anglosphere.

That said, yes, no place is safe, but for the OP idea of a secure mail server, the key point would be secured connections and encryption. So any place could do, with the right configuration. Something like https://countermail.com/
Anyway, police isn't after political content, but commercial one, so it's more risky to run a torrent tracker than a mail server.
Unless you are Assange or Assange, then the Empire and vassals can unleash a hell of shit.

And oh, btw, besides a wise choice of hosts and registrars, diverse payment gateways. People shoud be able to use Webmoney, YandexMoney, Qiwi, and such, not tied to Visa/Master.

typh0n

@William

Yes I know the story ( short form: GEMA wants money from YouTube).
But discussing about this is too offtopic.

To the OP:
If you really want to, you can do this service in two ways:

1. Open a company, do this fully legal.
2. Don't open a company and operate inside the grey/black area. This is more anonymous but also more risky.

aglodek

@iSidle said: Dutch laws prevent me from getting punished by things that other people would do on my servers. I'd fall under the same laws as an ISP would do, and thus I can't be held liable for things that would be done on my server.

LOL! You are very naïve and uninformed. Your Netherlands residency will not protect you against prosecution in other jurisdiction(s) for what you have allowed other people to do on your server(s) in such other jurisdiction(s). Given your planned service, outlined here (proof of intent!), and assuming some very bad guys actually using your service, to pressure you to cooperate, a case could be made that you have actively assisted in a terrorist act (worst case scenario). This may or may not stick, but good luck with your defense anyway, with no logs/records (intentionally deleted by yourself! LOL

This said, if you are really bored and looking for some excitement in your life and have major coin to pay your upcoming legal fees (forget your law student friend, he won't be much help to you when the shit hits the fan) - then I suggest you take a closer look at Switzerland. Like all of Eastern Europe, the Czech Republic is a very young country/democracy, where Western type rule of law is still under development. Like Poland (where I come from) and the rest of Eastern Europe, they have a very long way to go... yeah, yeah, I know, EU member countries both, but 10 years on, the court system and practice of law - not to mention the government! - haven't caught up with that fact yet!

c0y

@iSlide said:
since this world is so corrupted/bitter not looking for an incompetent kid to risk people's security and data while claiming he knows what he's doing, there's no chance of this even working.

FTFY

Also, you said encrypted to @joepie91.. Have you kept up with ANYTHING about the NSA? How they weaken encryption, how they crack, log, intercept all kinds of traffic maybe?

joepie91

iSidle said: Through a tunnel, from you to our servers.

And instead of burning this down, you could also make Suggestions yourself, how I could improve this.

You cannot offer "secure hosted webmail". It's that simple. It is not possible. Full stop.

If you've found a way to make it secure and everybody else simply missed it, I'd love to know - but your choice is going to be between requiring your users to trust you (not secure) and using client-side crypto that can be hijacked (not secure).

0xdragon

@joepie91 said:
If you've found a way to make it secure and everybody else simply missed it, I'd love to know - but your choice is going to be between requiring your users to trust you (not secure) and using client-side crypto that can be hijacked (not secure).

In the end, nothing is secure. Inherent trust is a part of transmitting/receiving online data, which is annoying :P