mirror of
https://github.com/privacyguides/i18n.git
synced 2026-06-26 02:24:42 +00:00
New Crowdin translations by GitHub Action
This commit is contained in:
Crowdin Bot
@@ -42,7 +42,7 @@ You will be responsible for managing your login credentials. For added security,
|
||||
|
||||
#### 電子メールのエイリアス
|
||||
|
||||
If you don't want to give your real email address to a service, you have the option to use an alias. We described them in more detail on our email services recommendation page. Essentially, alias services allow you to generate new email addresses that forward all emails to your main address. This can help prevent tracking across services and help you manage the marketing emails that sometimes come with the sign-up process. Those can be filtered automatically based on the alias they are sent to.
|
||||
If you don't want to give your real email address to a service, you have the option to use an alias. We describe them in more detail on our email services recommendation page. Essentially, alias services allow you to generate new email addresses that forward all emails to your main address. This can help prevent tracking across services and help you manage the marketing emails that sometimes come with the sign-up process. Those can be filtered automatically based on the alias they are sent to.
|
||||
|
||||
Should a service get hacked, you might start receiving phishing or spam emails to the address you used to sign up. Using unique aliases for each service can assist in identifying exactly what service was hacked.
|
||||
|
||||
@@ -50,19 +50,19 @@ Should a service get hacked, you might start receiving phishing or spam emails t
|
||||
|
||||
### "Sign in with..." (OAuth)
|
||||
|
||||
OAuth is an authentication protocol that allows you to register for a service without sharing much information with the service provider, if any, by using an existing account you have with another service instead. Whenever you see something along the lines of "Sign in with *provider name*" on a registration form, it's typically using OAuth.
|
||||
[Open Authorization (OAuth)](https://en.wikipedia.org/wiki/OAuth) is an authentication protocol that allows you to register for a service without sharing much information with the service provider, if any, by using an existing account you have with another service instead. Whenever you see something along the lines of "Sign in with *provider name*" on a registration form, it's typically using OAuth.
|
||||
|
||||
When you sign in with OAuth, it will open a login page with the provider you choose, and your existing account and new account will be connected. Your password won't be shared, but some basic information typically will (you can review it during the login request). This process is needed every time you want to log in to the same account.
|
||||
|
||||
主な利点は以下の通りです。
|
||||
|
||||
- **Security**: you don't have to trust the security practices of the service you're logging into when it comes to storing your login credentials, because they are stored with the external OAuth provider, which when it comes to services like Apple and Google typically follow the best security practices, continuously audit their authentication systems, and don't store credentials inappropriately (such as in plain text).
|
||||
- **Ease of use**: multiple accounts are managed by a single login.
|
||||
- **Security**: You don't have to trust the security practices of the service you're logging into when it comes to storing your login credentials because they are stored with the external OAuth provider. Common OAuth providers like Apple and Google typically follow the best security practices, continuously audit their authentication systems, and don't store credentials inappropriately (such as in plain text).
|
||||
- **Ease-of-use**: Multiple accounts are managed by a single login.
|
||||
|
||||
しかし、以下のデメリットもあります。
|
||||
|
||||
- **Privacy**: the OAuth provider you log in with will know the services you use.
|
||||
- **Centralization**: if the account you use for OAuth is compromised, or you aren't able to log in to it, all other accounts connected to it are affected.
|
||||
- **Privacy**: The OAuth provider you log in with will know the services you use.
|
||||
- **Centralization**: If the account you use for OAuth is compromised, or you aren't able to log in to it, all other accounts connected to it are affected.
|
||||
|
||||
OAuth can be especially useful in those situations where you could benefit from deeper integration between services. Our recommendation is to limit using OAuth to only where you need it, and always protect the main account with [MFA](multi-factor-authentication.md).
|
||||
|
||||
|
||||
@@ -5,17 +5,17 @@ icon: material/email
|
||||
description: Email is insecure in many ways, and these are some of the reasons it isn't our top choice for secure communications.
|
||||
---
|
||||
|
||||
Email is an insecure form of communication by default. You can improve your email security with tools such as OpenPGP, which add End-to-End Encryption to your messages, but OpenPGP still has a number of drawbacks compared to encryption in other messaging applications.
|
||||
Email is an insecure form of communication by default. You can improve your email security with tools such as OpenPGP, which add end-to-end encryption to your messages, but OpenPGP still has a number of drawbacks compared to encryption in other messaging applications.
|
||||
|
||||
As a result, email is best used for receiving transactional emails (like notifications, verification emails, password resets, etc.) from the services you sign up for online, not for communicating with others.
|
||||
|
||||
## 電子メールの暗号化の概要
|
||||
|
||||
The standard way to add E2EE to emails between different email providers is by using OpenPGP. There are different implementations of the OpenPGP standard, the most common being [GnuPG](https://en.wikipedia.org/wiki/GNU_Privacy_Guard) and [OpenPGP.js](https://openpgpjs.org).
|
||||
The standard way to add E2EE to emails between different email providers is by using OpenPGP. There are different implementations of the OpenPGP standard, the most common being [GnuPG](../encryption.md#gnu-privacy-guard) and [OpenPGP.js](https://openpgpjs.org).
|
||||
|
||||
Even if you use OpenPGP, it does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if either your or the recipient's private key is ever stolen, all previous messages encrypted with it will be exposed. This is why we recommend [instant messengers](../real-time-communication.md) which implement forward secrecy over email for person-to-person communications whenever possible.
|
||||
Even if you use OpenPGP, it does not support [forward secrecy](https://en.wikipedia.org/wiki/Forward_secrecy), which means if the private key of either you or the message recipient is ever stolen, all previous messages encrypted with it will be exposed. This is why we recommend [instant messengers](../real-time-communication.md) which implement forward secrecy over email for person-to-person communications whenever possible.
|
||||
|
||||
There is another standard which is popular with business called [S/MIME](https://en.wikipedia.org/wiki/S/MIME), however, it requires a certificate issued from a [Certificate Authority](https://en.wikipedia.org/wiki/Certificate_authority) (not all of them issue S/MIME certificates, and often a yearly payment is required). In some cases it is more usable than PGP because it has support in popular/mainstream email applications like Apple Mail, [Google Workplace](https://support.google.com/a/topic/9061730), and [Outlook](https://support.office.com/article/encrypt-messages-by-using-s-mime-in-outlook-on-the-web-878c79fc-7088-4b39-966f-14512658f480). However, S/MIME does not solve the issue of lack of forward secrecy, and isn't particularly more secure than PGP.
|
||||
There is another standard which is popular with business called [S/MIME](https://en.wikipedia.org/wiki/S/MIME), however it requires a certificate issued from a [Certificate Authority](https://en.wikipedia.org/wiki/Certificate_authority) (not all of them issue S/MIME certificates, and often a yearly payment is required). In some cases it is more usable than PGP because it has support in popular/mainstream email applications like Apple Mail, [Google Workplace](https://support.google.com/a/topic/9061730), and [Outlook](https://support.office.com/article/encrypt-messages-by-using-s-mime-in-outlook-on-the-web-878c79fc-7088-4b39-966f-14512658f480). However, S/MIME does not solve the issue of lack of forward secrecy, and isn't particularly more secure than PGP.
|
||||
|
||||
## What is the Web Key Directory standard?
|
||||
|
||||
@@ -23,13 +23,13 @@ The [Web Key Directory (WKD)](https://wiki.gnupg.org/WKD) standard allows email
|
||||
|
||||
In addition to the [email clients we recommend](../email-clients.md) which support WKD, some webmail providers also support WKD. Whether *your own* key is published to WKD for others to use depends on your domain configuration. If you use an [email provider](../email.md#openpgp-compatible-services) which supports WKD, such as Proton Mail or Mailbox.org, they can publish your OpenPGP key on their domain for you.
|
||||
|
||||
If you use your own custom domain, you will need to configure WKD separately. If you control your domain name, you can set up WKD regardless of your email provider. One easy way to do this is to use the "[WKD as a Service](https://keys.openpgp.org/about/usage#wkd-as-a-service)" feature from keys.openpgp.org, by setting a CNAME record on the `openpgpkey` subdomain of your domain pointed to `wkd.keys.openpgp.org`, then uploading your key to [keys.openpgp.org](https://keys.openpgp.org). Alternatively, you can [self-host WKD on your own web server](https://wiki.gnupg.org/WKDHosting).
|
||||
If you use your own custom domain, you will need to configure WKD separately. If you control your domain name, you can set up WKD regardless of your email provider. One easy way to do this is to use the "[WKD as a Service](https://keys.openpgp.org/about/usage#wkd-as-a-service)" feature from the `keys.openpgp.org` server: Set a CNAME record on the `openpgpkey` subdomain of your domain pointed to `wkd.keys.openpgp.org`, then upload your key to [keys.openpgp.org](https://keys.openpgp.org). Alternatively, you can [self-host WKD on your own web server](https://wiki.gnupg.org/WKDHosting).
|
||||
|
||||
If you use a shared domain from a provider which doesn't support WKD, like @gmail.com, you won't be able to share your OpenPGP key with others via this method.
|
||||
If you use a shared domain from a provider which doesn't support WKD, like `@gmail.com`, you won't be able to share your OpenPGP key with others via this method.
|
||||
|
||||
### What Email Clients Support E2EE?
|
||||
|
||||
Email providers which allow you to use standard access protocols like IMAP and SMTP can be used with any of the [email clients we recommend](../email-clients.md). Depending on the authentication method, this may lead to the decrease security if either the provider or the email client does not support OATH or a bridge application as [multifactor authentication](multi-factor-authentication.md) is not possible with plain password authentication.
|
||||
Email providers which allow you to use standard access protocols like IMAP and SMTP can be used with any of the [email clients we recommend](../email-clients.md). Depending on the authentication method, this may lead to decreased security if either the provider or the email client does not support [OAuth](account-creation.md#sign-in-with-oauth) or a bridge application as [multifactor authentication](multi-factor-authentication.md) is not possible with plain password authentication.
|
||||
|
||||
### How Do I Protect My Private Keys?
|
||||
|
||||
@@ -39,14 +39,14 @@ It is advantageous for the decryption to occur on the smart card to avoid possib
|
||||
|
||||
## 電子メールのメタデータの概要
|
||||
|
||||
Email metadata is stored in the [message header](https://en.wikipedia.org/wiki/Email#Message_header) of the email message and includes some visible headers that you may have seen such as: `To`, `From`, `Cc`, `Date`, `Subject`. There are also a number of hidden headers included by many email clients and providers that can reveal information about your account.
|
||||
Email metadata is stored in the [message header](https://en.wikipedia.org/wiki/Email#Message_header) of the email message and includes some visible headers that you may have seen such as `To`, `From`, `Cc`, `Date`, and `Subject`. There are also a number of hidden headers included by many email clients and providers that can reveal information about your account.
|
||||
|
||||
Client software may use email metadata to show who a message is from and what time it was received. Servers may use it to determine where an email message must be sent, among [other purposes](https://en.wikipedia.org/wiki/Email#Message_header) which are not always transparent.
|
||||
|
||||
### 誰が電子メールのメタデータを見ることができますか？
|
||||
|
||||
Email metadata is protected from outside observers with [Opportunistic TLS](https://en.wikipedia.org/wiki/Opportunistic_TLS) protecting it from outside observers, but it is still able to be seen by your email client software (or webmail) and any servers relaying the message from you to any recipients including your email provider. Sometimes email servers will also use third-party services to protect against spam, which generally also have access to your messages.
|
||||
Email metadata is protected from outside observers with [opportunistic TLS](https://en.wikipedia.org/wiki/Opportunistic_TLS), but it is still able to be seen by your email client software (or webmail) and any servers relaying the message from you to any recipients including your email provider. Sometimes email servers will also use third-party services to protect against spam, which generally also have access to your messages.
|
||||
|
||||
### メタデータをE2EEにできない理由
|
||||
|
||||
Email metadata is crucial to the most basic functionality of email (where it came from, and where it has to go). E2EE was not built into the email protocols originally, instead requiring add-on software like OpenPGP. Because OpenPGP messages still have to work with traditional email providers, it cannot encrypt some of this email metadata required for identifying the parties communicating. That means that even when using OpenPGP, outside observers can see lots of information about your messages, such as whom you're emailing, when you're emailing, etc.
|
||||
Email metadata is crucial to the most basic functionality of email (where it came from, and where it has to go). E2EE was not built into standard email protocols originally, instead requiring add-on software like OpenPGP. Because OpenPGP messages still have to work with traditional email providers, it cannot encrypt some of this email metadata required for identifying the parties communicating. That means that even when using OpenPGP, outside observers can see lots of information about your messages, such as whom you're emailing, when you're emailing, etc.
|
||||
|
||||
+45
-29
@@ -10,7 +10,34 @@ cover: email-aliasing.webp
|
||||
- [:material-account-cash: Surveillance Capitalism](basics/common-threats.md#surveillance-as-a-business-model){ .pg-brown }
|
||||
- [:material-account-search: Public Exposure](basics/common-threats.md#limiting-public-information){ .pg-green }
|
||||
|
||||
An **email aliasing service** allows you to easily generate a new email address for every website you register for. The email aliases you generate are then forwarded to an email address of your choosing, hiding both your "main" email address and the identity of your [email provider](email.md). True email aliasing is better than plus addressing commonly used and supported by many providers, which allows you to create aliases like `yourname+[anythinghere]@example.com`, because websites, advertisers, and tracking networks can trivially remove anything after the `+` sign. Organizations like the [IAB](https://en.wikipedia.org/wiki/Interactive_Advertising_Bureau) require that advertisers [normalize email addresses](https://shkspr.mobi/blog/2023/01/the-iab-loves-tracking-users-but-it-hates-users-tracking-them) so that they can be correlated and tracked, regardless of users' privacy wishes.
|
||||
An **email aliasing service** allows you to easily generate a new email address for every website you register for. The email aliases you generate are then forwarded to an email address of your choosing, hiding both your "main" email address and the identity of your [email provider](email.md).
|
||||
|
||||
Email aliasing can also act as a safeguard in case your email provider ever ceases operation. In that scenario, you can easily re-route your aliases to a new email address. In turn, however, you are placing trust in the aliasing service to continue functioning.
|
||||
|
||||
## Benefits
|
||||
|
||||
Using a service which allows you to individually manage email aliases has a number of benefits over conventional mailbox management/filtering methods:
|
||||
|
||||
### Over Plus Addressing
|
||||
|
||||
True email aliasing is better than plus addressing commonly used and supported by many providers, which allows you to create aliases like `yourname+[anythinghere]@example.com`, because websites, advertisers, and tracking networks can trivially remove anything after the `+` sign. Organizations like the [IAB](https://en.wikipedia.org/wiki/Interactive_Advertising_Bureau) require that advertisers [normalize email addresses](https://shkspr.mobi/blog/2023/01/the-iab-loves-tracking-users-but-it-hates-users-tracking-them) so that they can be correlated and tracked, regardless of users' privacy wishes.
|
||||
|
||||
### Over Catch-All Aliases
|
||||
|
||||
Using a dedicated email aliasing service has a number of benefits over a catch-all alias on a custom domain:
|
||||
|
||||
- Aliases can be turned on and off individually when you need them, preventing websites from emailing you randomly.
|
||||
- Replies are sent from the alias address, shielding your real email address.
|
||||
|
||||
### Over Temporary Email Services
|
||||
|
||||
Email aliasing services also have a number of benefits over "temporary email" services:
|
||||
|
||||
- Aliases are permanent and can be turned on again if you need to receive something like a password reset.
|
||||
- Emails are sent to your trusted mailbox rather than stored by the alias provider.
|
||||
- Temporary email services typically have public mailboxes which can be accessed by anyone who knows the address, while aliases are private to you.
|
||||
|
||||
## 推奨するサービスプロバイダー
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
@@ -19,20 +46,7 @@ An **email aliasing service** allows you to easily generate a new email address
|
||||
|
||||
</div>
|
||||
|
||||
Email aliasing can also act as a safeguard in case your email provider ever ceases operation. In that scenario, you can easily re-route your aliases to a new email address. In turn, however, you are placing trust in the aliasing service to continue functioning.
|
||||
|
||||
Using a dedicated email aliasing service also has a number of benefits over a catch-all alias on a custom domain:
|
||||
|
||||
- Aliases can be turned on and off individually when you need them, preventing websites from emailing you randomly.
|
||||
- Replies are sent from the alias address, shielding your real email address.
|
||||
|
||||
They also have a number of benefits over "temporary email" services:
|
||||
|
||||
- Aliases are permanent and can be turned on again if you need to receive something like a password reset.
|
||||
- Emails are sent to your trusted mailbox rather than stored by the alias provider.
|
||||
- Temporary email services typically have public mailboxes which can be accessed by anyone who knows the address, while aliases are private to you.
|
||||
|
||||
Our email aliasing recommendations are providers that allow you to create aliases on domains they control, as well as on your own custom domain(s) for a modest yearly fee. They can also be self-hosted if you want maximum control. However, using a custom domain can have privacy-related drawbacks: If you are the only person using your custom domain, your actions can be easily tracked across websites simply by looking at the domain name in the email address and ignoring everything before the at (@) sign.
|
||||
Our email aliasing recommendations are providers that allow you to create aliases on domains they control, as well as on your own custom domain(s) for a modest yearly fee. They can also be self-hosted if you want maximum control. However, using a custom domain can have privacy-related drawbacks: If you are the only person using your custom domain, your actions can be easily tracked across websites simply by looking at the domain name in the email address and ignoring everything before the `@` symbol.
|
||||
|
||||
Using an aliasing service requires trusting both your email provider and your aliasing provider with your unencrypted messages. Some providers mitigate this slightly with automatic PGP encryption[^1], which reduces the number of parties you need to trust from two to one by encrypting incoming emails before they are delivered to your final mailbox provider.
|
||||
|
||||
@@ -42,29 +56,31 @@ Using an aliasing service requires trusting both your email provider and your al
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Addy.io** lets you create 10 domain aliases on a shared domain for free, or unlimited "standard" aliases.
|
||||
**Addy.io** lets you create 10 domain aliases on a shared domain for free, or unlimited ["standard" aliases](https://addy.io/faq/#what-is-a-standard-alias).
|
||||
|
||||
[:octicons-home-16: Homepage](https://addy.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://addy.io/privacy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://addy.io/faq){ .card-link title=Documentation}
|
||||
[:octicons-info-16:](https://addy.io/faq){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/anonaddy){ .card-link title="Source Code" }
|
||||
[:octicons-heart-16:](https://addy.io/donate){ .card-link title=Contribute }
|
||||
[:octicons-heart-16:](https://addy.io/donate){ .card-link title="Contribute" }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
<summary>Downloads</summary>
|
||||
|
||||
- [:simple-android: Android](https://addy.io/faq/#is-there-an-android-app)
|
||||
- [:material-apple-ios: iOS](https://addy.io/faq/#is-there-an-ios-app)
|
||||
- [:simple-googleplay: Google Play](https://addy.io/faq/#is-there-an-android-app)
|
||||
- [:simple-appstore: App Store](https://addy.io/faq/#is-there-an-ios-app)
|
||||
- [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/addy_io)
|
||||
- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/addyio-anonymous-email-fo/iadbdpnoknmbdeolbapdackdcogdmjpe)
|
||||
- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/iadbdpnoknmbdeolbapdackdcogdmjpe)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
The number of shared aliases (which end in a shared domain like @addy.io) that you can create is limited to 10 on Addy.io's free plan, 50 on their $1/month plan and unlimited on the $4/month plan (billed $3 for a year). You can pay for these plans using [cryptocurrency](https://addy.io/help/subscribing-with-cryptocurrency) or purchase a voucher code from [ProxyStore](https://addy.io/help/voucher-codes), Addy.io's official reseller.
|
||||
The number of shared aliases (which end in a shared domain like `@addy.io`) that you can create depends on the [plan](https://addy.io/#pricing) you are subscribed to. You can pay for these plans using [cryptocurrency](https://addy.io/help/subscribing-with-cryptocurrency) or purchase a voucher code from [ProxyStore](https://addy.io/help/voucher-codes), Addy.io's official reseller.
|
||||
|
||||
You can create unlimited standard aliases which end in a domain like @[username].addy.io or a custom domain on paid plans. However, as previously mentioned, this can be detrimental to privacy because people can trivially tie your standard aliases together based on the domain name alone. They are useful where a shared domain might be blocked by a service. Securitum [audited](https://addy.io/blog/addy-io-passes-independent-security-audit) Addy.io in September 2023 and no significant vulnerabilities [were identified](https://addy.io/addy-io-security-audit.pdf).
|
||||
You can create unlimited standard aliases which end in a domain like `@[username].addy.io` or a custom domain on paid plans. However, as previously mentioned, this can be detrimental to privacy because people can trivially tie your standard aliases together based on the domain name alone. They are useful where a shared domain might be blocked by a service.
|
||||
|
||||
Securitum [audited](https://addy.io/blog/addy-io-passes-independent-security-audit) Addy.io in September 2023 and no significant vulnerabilities [were identified](https://addy.io/addy-io-security-audit.pdf).
|
||||
|
||||
Notable free features:
|
||||
|
||||
@@ -86,7 +102,7 @@ If you cancel your subscription, you will still enjoy the features of your paid
|
||||
|
||||
[:octicons-home-16: Homepage](https://simplelogin.io){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://simplelogin.io/privacy){ .card-link title="Privacy Policy" }
|
||||
[:octicons-info-16:](https://simplelogin.io/docs){ .card-link title=Documentation}
|
||||
[:octicons-info-16:](https://simplelogin.io/docs){ .card-link title="Documentation" }
|
||||
[:octicons-code-16:](https://github.com/simple-login){ .card-link title="Source Code" }
|
||||
|
||||
<details class="downloads" markdown>
|
||||
@@ -97,18 +113,18 @@ If you cancel your subscription, you will still enjoy the features of your paid
|
||||
- [:simple-github: GitHub](https://github.com/simple-login/Simple-Login-Android/releases)
|
||||
- [:simple-firefoxbrowser: Firefox](https://addons.mozilla.org/firefox/addon/simplelogin)
|
||||
- [:simple-googlechrome: Chrome](https://chrome.google.com/webstore/detail/dphilobhebphkdjbpfohgikllaljmgbn)
|
||||
- [:fontawesome-brands-edge: Edge](https://microsoftedge.microsoft.com/addons/detail/simpleloginreceive-sen/diacfpipniklenphgljfkmhinphjlfff)
|
||||
- [:fontawesome-brands-edge: Edge](https://microsoftedge.microsoft.com/addons/detail/diacfpipniklenphgljfkmhinphjlfff)
|
||||
- [:simple-safari: Safari](https://apps.apple.com/app/id6475835429)
|
||||
|
||||
</details>
|
||||
|
||||
</div>
|
||||
|
||||
SimpleLogin was [acquired by Proton AG](https://proton.me/news/proton-and-simplelogin-join-forces) as of April 8, 2022. If you use Proton Mail for your primary mailbox, SimpleLogin is a great choice. As both products are now owned by the same company you now only have to trust a single entity. We also expect that SimpleLogin will be more tightly integrated with Proton's offerings in the future. SimpleLogin continues to support forwarding to any email provider of your choosing. Securitum [audited](https://simplelogin.io/blog/security-audit) SimpleLogin in early 2022 and all issues [were addressed](https://simplelogin.io/audit2022/web.pdf).
|
||||
SimpleLogin was [acquired by Proton AG](https://proton.me/news/proton-and-simplelogin-join-forces) as of April 8, 2022. If you use Proton Mail for your primary mailbox, SimpleLogin is a great choice. As both products are now owned by the same company you now only have to trust a single entity. We also expect that SimpleLogin will be more tightly integrated with Proton's offerings in the future. SimpleLogin continues to support forwarding to any email provider of your choosing.
|
||||
|
||||
You can link your SimpleLogin account in the settings with your Proton account. If you have Proton Pass Plus, Proton Unlimited, or any multi-user Proton plan, you will have SimpleLogin Premium for free.
|
||||
You can link your SimpleLogin account in the settings with your Proton account. If you have Proton Pass Plus, Proton Unlimited, or any multi-user Proton plan, you will have SimpleLogin Premium for free. You can also purchase a voucher code for SimpleLogin Premium anonymously via their official reseller [ProxyStore](https://simplelogin.io/faq).
|
||||
|
||||
You can also purchase a voucher code for SimpleLogin Premium anonymously via their official reseller, [ProxyStore](https://simplelogin.io/faq).
|
||||
Securitum [audited](https://simplelogin.io/blog/security-audit) SimpleLogin in early 2022 and all issues [were addressed](https://simplelogin.io/audit2022/web.pdf).
|
||||
|
||||
Notable free features:
|
||||
|
||||
@@ -121,6 +137,6 @@ When your subscription ends, all aliases you created will still be able to recei
|
||||
|
||||
## 規準
|
||||
|
||||
**Please note we are not affiliated with any of the providers we recommend.** In addition to [our standard criteria](about/criteria.md), we evaluate email aliasing providers to the same standard as our regular [email provider criteria](email.md#criteria) where applicable. We suggest you familiarize yourself with this list before choosing an email service, and conduct your own research to ensure the provider you choose is the right choice for you.
|
||||
**Please note we are not affiliated with any of the providers we recommend.** In addition to [our standard criteria](about/criteria.md), we evaluate email aliasing providers to the same standard as our regular [email provider criteria](email.md#criteria) where applicable. We suggest you familiarize yourself with this list before choosing an email aliasing service, and conduct your own research to ensure the provider you choose is the right choice for you.
|
||||
|
||||
[^1]: Automatic PGP encryption allows you to encrypt non-encrypted incoming emails before they are forwarded to your mailbox, making sure your primary mailbox provider never sees unencrypted email content.
|
||||
|
||||
@@ -10,7 +10,7 @@ cover: email-clients.webp
|
||||
- [:material-server-network: Service Providers](basics/common-threats.md#privacy-from-service-providers ""){.pg-teal}
|
||||
- [:material-target-account: Targeted Attacks](basics/common-threats.md#attacks-against-specific-individuals ""){.pg-red}
|
||||
|
||||
The **email clients** we recommend support both [OpenPGP](encryption.md#openpgp) and strong authentication such as [Open Authorization (OAuth)](https://en.wikipedia.org/wiki/OAuth). OAuth allows you to use [Multi-Factor Authentication](basics/multi-factor-authentication.md) to prevent account theft.
|
||||
The **email clients** we recommend support both [OpenPGP](encryption.md#openpgp) and strong authentication such as [Open Authorization (OAuth)](basics/account-creation.md#sign-in-with-oauth). OAuth allows you to use [Multi-Factor Authentication](basics/multi-factor-authentication.md) to prevent account theft.
|
||||
|
||||
<details class="warning" markdown>
|
||||
<summary>Email does not provide forward secrecy</summary>
|
||||
|
||||
+66
-64
@@ -22,19 +22,19 @@ global:
|
||||
|
||||
それ以外にも、持続可能なビジネスモデル、組み込まれたセキュリティーとプライバシー機能に基づき、様々な電子メールプロバイダーを推奨します。 詳細については、[基準の完全なリスト](#criteria)をお読みください。
|
||||
|
||||
| プロバイダー | OpenPGP / WKD | IMAP / SMTP | ゼロアクセス暗号化 | 匿名での支払い |
|
||||
| --------------------------- | -------------------------------------- | -------------------------------------------------- | ------------------------------------------------ | ---------------------- |
|
||||
| [Proton Mail](#proton-mail) | :material-check:{ .pg-green } | :material-information-outline:{ .pg-blue } 有料プランのみ | :material-check:{ .pg-green } | 現金 |
|
||||
| [Mailbox.org](#mailboxorg) | :material-check:{ .pg-green } | :material-check:{ .pg-green } | :material-information-outline:{ .pg-blue } メールのみ | 現金 |
|
||||
| [Tuta](#tuta) | :material-alert-outline:{ .pg-orange } | :material-alert-outline:{ .pg-orange } | :material-check:{ .pg-green } | サードバーティ経由でのMonero & 現金 |
|
||||
| プロバイダー | OpenPGP / WKD | IMAP / SMTP | Zero-Access Encryption | Anonymous Payment Methods |
|
||||
| --------------------------- | -------------------------------------- | -------------------------------------------------- | ------------------------------------------------ | ------------------------------------- |
|
||||
| [Proton Mail](#proton-mail) | :material-check:{ .pg-green } | :material-information-outline:{ .pg-blue } 有料プランのみ | :material-check:{ .pg-green } | 現金 |
|
||||
| [Mailbox.org](#mailboxorg) | :material-check:{ .pg-green } | :material-check:{ .pg-green } | :material-information-outline:{ .pg-blue } メールのみ | 現金 |
|
||||
| [Tuta](#tuta) | :material-alert-outline:{ .pg-orange } | :material-alert-outline:{ .pg-orange } | :material-check:{ .pg-green } | Monero <br>Cash via third party |
|
||||
|
||||
上記の推奨するEメールプロバイダーに加え（もしくは代わりに）、プライバシー保護のために[Eメールエイリアスサービス](email-aliasing.md)を検討してください。 特に、スパムから実際の受信トレイを保護し、企業のマーケティング活動によるアカウントの関連付けを防ぎ、すべての受信メールをPGPで暗号化することができます。
|
||||
In addition to (or instead of) an email provider recommended here, you may wish to consider a dedicated [email aliasing service](email-aliasing.md#recommended-providers) to protect your privacy. 特に、スパムから実際の受信トレイを保護し、企業のマーケティング活動によるアカウントの関連付けを防ぎ、すべての受信メールをPGPで暗号化することができます。
|
||||
|
||||
- [詳細 :material-arrow-right-drop-circle:](email-aliasing.md)
|
||||
|
||||
## OpenPGP対応サービス
|
||||
|
||||
OpenPGPによる暗号化・復号化や[Web Key Directory(WKD)規格](basics/email-security.md#what-is-the-web-key-directory-standard)をネイティブサポートしているプロバイダーでは、プロバイダーに依存しないエンドツーエンド暗号化メールが利用可能です。 例えば、Proton MailのユーザはMailbox.orgのユーザにE2EEメッセージを送れますし、OpenPGPで暗号化された通知を、それをサポートするインターネットサービスから受け取ることができます。
|
||||
These providers natively support OpenPGP encryption/decryption and the [Web Key Directory (WKD) standard](basics/email-security.md#what-is-the-web-key-directory-standard), allowing for provider-agnostic end-to-end encrypted emails. 例えば、Proton MailのユーザはMailbox.orgのユーザにE2EEメッセージを送れますし、OpenPGPで暗号化された通知を、それをサポートするインターネットサービスから受け取ることができます。
|
||||
|
||||
<div class="grid cards" markdown>
|
||||
|
||||
@@ -48,7 +48,9 @@ OpenPGPによる暗号化・復号化や[Web Key Directory(WKD)規格](basics/em
|
||||
|
||||
OpenPGPのようなE2EE（エンドツーエンド暗号化）を利用しても、件名などを含むメールのヘッダーには暗号化されていないメタデータが残ります！ 詳細は [電子メールのメタデータ](basics/email-security.md#email-metadata-overview)のページにあります。
|
||||
|
||||
OpenPGPは前方秘匿性に対応していないため、送信者であるあなたか受信者の秘密鍵が盗まれた場合、その秘密鍵で暗号化した過去を含めたすべてのメッセージが暗号化解除可能な状態となります。 [秘密鍵を保護するには？](basics/email-security.md#how-do-i-protect-my-private-keys)
|
||||
OpenPGP also does not support forward secrecy, which means if the private key of either you or the message recipient is ever stolen, all previous messages encrypted with it will be exposed.
|
||||
|
||||
- [How do I protect my private keys?](basics/email-security.md#how-do-i-protect-my-private-keys)
|
||||
|
||||
</div>
|
||||
|
||||
@@ -58,7 +60,9 @@ OpenPGPは前方秘匿性に対応していないため、送信者であるあ
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Proton Mail** は、プライバシー、暗号化、セキュリティ、使いやすさを重視したメールサービスです。 2013年からサービスが稼働しました。 Proton AGはスイスのジュネーブを拠点としています。 Proton Mailの無料プランのメールストレージは500MBから始まり、無料で1GBまで増やすことができます。
|
||||
**Proton Mail** は、プライバシー、暗号化、セキュリティ、使いやすさを重視したメールサービスです。 2013年からサービスが稼働しました。 Proton AGはスイスのジュネーブを拠点としています。
|
||||
|
||||
The Proton Free plan comes with 500 MB of Mail storage, which you can increase up to 1 GB for free.
|
||||
|
||||
[:octicons-home-16: ウェブページ](https://proton.me/mail){ .md-button .md-button--primary }
|
||||
[:simple-torbrowser:](https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion){ .card-link title="Onion Service" }
|
||||
@@ -81,9 +85,9 @@ OpenPGPは前方秘匿性に対応していないため、送信者であるあ
|
||||
|
||||
</div>
|
||||
|
||||
無料アカウントには本文の検索ができないことや、 [推奨されるデスクトップメールクライアント](email-clients.md) (Thunderbirdなど)を使用するために必要な [Proton Mail Bridge](https://proton.me/mail/bridge) を利用できないといった制限があります。 有料アカウントにはProton Mail Bridge、追加ストレージ、カスタムドメインのサポートなどの機能が含まれています。 [Securitum](https://research.securitum.com)により2021年11月9日 [監査証明書](https://proton.me/blog/security-audit-all-proton-apps) がProton Mailアプリにおくられました。
|
||||
Free accounts have some limitations, such as not being able to search body text and not having access to [Proton Mail Bridge](https://proton.me/mail/bridge), which is required to use a [recommended desktop email client](email-clients.md) (e.g., Thunderbird). 有料アカウントにはProton Mail Bridge、追加ストレージ、カスタムドメインのサポートなどの機能が含まれています。 Proton Unlimitedプランや複数ユーザープランの場合、[SimpleLogin](email-aliasing.md#simplelogin)も無料で利用できます。
|
||||
|
||||
Proton Unlimitedプランや複数ユーザープランの場合、[SimpleLogin](email-aliasing.md#simplelogin)も無料で利用できます。
|
||||
[Securitum](https://research.securitum.com)により2021年11月9日 [監査証明書](https://proton.me/blog/security-audit-all-proton-apps) がProton Mailアプリにおくられました。
|
||||
|
||||
Proton Mailのクラッシュレポートは第三者に共有**されません**。 これはウェブアプリで無効にすることができます：:gear: → **すべての設定** → **アカウント** → **セキュリティとプライバシー** → **プライバシーとデータ収集**。
|
||||
|
||||
@@ -93,7 +97,7 @@ Proton Mailの有料会員は独自ドメインでサービスや [キャッチ
|
||||
|
||||
#### :material-check:{ .pg-green } プライベートな支払い方法
|
||||
|
||||
Proton Mailは標準的なクレジット・デビットカード、 [Bitcoin](advanced/payments.md#other-coins-bitcoin-ethereum-etc) 、またPayPalでの支払いに加え、現金の郵送も [受け付けています](https://proton.me/support/payment-options) 。
|
||||
Proton Mail [accepts](https://proton.me/support/payment-options) **cash** by mail in addition to standard credit/debit card, [Bitcoin](advanced/payments.md#other-coins-bitcoin-ethereum-etc), and PayPal payments.
|
||||
|
||||
#### :material-check:{ .pg-green } アカウントのセキュリティ
|
||||
|
||||
@@ -109,7 +113,7 @@ Proton Mailはメールと [カレンダー](https://proton.me/news/protoncalend
|
||||
|
||||
Proton Mailはwebメールに [OpenPGP暗号化を組み込んでいます。](https://proton.me/support/how-to-use-pgp) 他のProton Mailアカウントへのメールは自動的に暗号化され、OpenPGPキーによる非Proton Mailアドレスへの暗号化はアカウント設定から簡単に有効化できます。 ProtonはWKDによる外部の鍵の自動探索にも対応しています。 WKDを使った他のプロバイダーに送信されるEメールは自動的にOpenPGPで暗号化され、PGP公開鍵と連絡先を手動で交換する必要はありません。 また、[Proton Mailではないアドレスに送るメッセージをOpenPGPを使わずに暗号化する](https://proton.me/support/password-protected-emails)こともでき、受信者はProton Mailアカウントへのサインアップが必要ありません。
|
||||
|
||||
Proton MailではProtonアカウントの公開鍵をWKDからHTTP経由で公開します。 これにより、Proton Mailを使っていない人でも、Proton MailアカウントのOpenPGPキーを簡単に見つけることができ、プロバイダをまたいだE2EEが可能になります。 @proton.meのようなProtonが所有するドメインのEメールアドレスのみ対象です。 カスタムドメインを使用する場合、[WKDの設定](./basics/email-security.md#what-is-the-web-key-directory-standard)が必要になります。
|
||||
Proton MailではProtonアカウントの公開鍵をWKDからHTTP経由で公開します。 This allows people who don't use Proton Mail to find the OpenPGP keys of Proton Mail accounts easily for cross-provider E2EE. This only applies to email addresses ending in one of Proton's own domains, like `@proton.me`. If you use a custom domain, you must [configure WKD](basics/email-security.md#what-is-the-web-key-directory-standard) separately.
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } アカウントの停止
|
||||
|
||||
@@ -117,9 +121,7 @@ Proton MailではProtonアカウントの公開鍵をWKDからHTTP経由で公
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } 追加機能
|
||||
|
||||
Proton Mailの[Unlimited](https://proton.me/support/proton-plans#proton-unlimited)プランでは複数のカスタムドメイン、無制限のEメールエイリアスや500GBのストレージに加え、その他のProtonサービスを利用することができます。
|
||||
|
||||
Proton Mailにはデジタル遺産の機能はありません。
|
||||
Proton Mail's [Unlimited](https://proton.me/support/proton-plans#proton-unlimited) plan also enables access to other Proton services in addition to providing multiple custom domains, unlimited hide-my-email aliases, and 500 GB of storage.
|
||||
|
||||
### Mailbox.org
|
||||
|
||||
@@ -127,7 +129,9 @@ Proton Mailにはデジタル遺産の機能はありません。
|
||||
|
||||
{ align=right }
|
||||
|
||||
**Mailbox.org** は安全、広告なし、プライベートでいることを重視した、100%エコエネルギーで運営されているメールサービスです。 2014年から運営をされています。 Mailbox.orgはドイツのベルリンに拠点を置いています。 各アカウントには最大2GBのストレージが割当てられ、必要に応じてアップグレードできます。
|
||||
**Mailbox.org** is an email service with a focus on being secure, ad-free, and powered by 100% eco-friendly energy. 2014年から運営をされています。 Mailbox.orgはドイツのベルリンに拠点を置いています。
|
||||
|
||||
Accounts start with up to 2 GB storage, which can be upgraded as needed.
|
||||
|
||||
[:octicons-home-16: ウェブページ](https://mailbox.org){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://mailbox.org/en/data-protection-privacy-policy){ .card-link title="プライバシーポリシー" }
|
||||
@@ -148,23 +152,23 @@ Mailbox.orgでは独自ドメインを使うことができ、[キャッチオ
|
||||
|
||||
#### :material-check:{ .pg-green } プライベートな支払い方法
|
||||
|
||||
Mailbox.orgは決済プロセッサBitPayがドイツでの業務を停止したために暗号通貨を受け付けていません。 郵送による現金払い、銀行口座への銀金払い、銀行振込、クレジットカード、Paypalとドイツの支払いサービスであるpaydirektとSofortüberweisungに対応しています。
|
||||
Mailbox.orgは決済プロセッサBitPayがドイツでの業務を停止したために暗号通貨を受け付けていません。 However, they do accept **cash** by mail, **cash** payment to bank account, bank transfer, credit card, PayPal, and a couple of German-specific processors: Paydirekt and Sofortüberweisung.
|
||||
|
||||
#### :material-check:{ .pg-green } アカウントのセキュリティ
|
||||
|
||||
Mailbox.orgはウェブメールに限り、[二要素認証](https://kb.mailbox.org/en/private/account-article/how-to-use-two-factor-authentication-2fa)に対応しています。 TOTPもしくは[YubiCloud](https://yubico.com/products/services-software/yubicloud)経由の[YubiKey](https://en.wikipedia.org/wiki/YubiKey)を利用できます。 [WebAuthn](https://en.wikipedia.org/wiki/WebAuthn) などのウェブ標準はまだサポートされていません。
|
||||
Mailbox.orgはウェブメールに限り、[二要素認証](https://kb.mailbox.org/en/private/account-article/how-to-use-two-factor-authentication-2fa)に対応しています。 TOTPもしくは[YubiCloud](https://yubico.com/products/services-software/yubicloud)経由の[YubiKey](https://en.wikipedia.org/wiki/YubiKey)を利用できます。 Web standards such as [WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online) are not yet supported.
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } データのセキュリティ
|
||||
|
||||
Mailbox.orgでは[暗号化されたメールボックス](https://kb.mailbox.org/en/private/e-mail-article/your-encrypted-mailbox)により受信メールを暗号化することができます。 新しいメッセージを受信するとすぐにあなたの公開鍵で暗号化されます。
|
||||
|
||||
ただし、Mailbox.orgが利用している[Open-Exchange](https://en.wikipedia.org/wiki/Open-Xchange)はアドレス帳やカレンダーの暗号化は[対応していません](https://kb.mailbox.org/en/private/security-privacy-article/encryption-of-calendar-and-address-book)。 その情報については、 [スタンドアロンオプション](calendar.md) の方が適切であるかもしれません。
|
||||
However, [Open-Xchange](https://en.wikipedia.org/wiki/Open-Xchange), the software platform used by Mailbox.org, [does not support](https://kb.mailbox.org/en/private/security-privacy-article/encryption-of-calendar-and-address-book) the encryption of your address book and calendar. A [standalone option](calendar.md) may be more appropriate for that data.
|
||||
|
||||
#### :material-check:{ .pg-green } メールの暗号化
|
||||
|
||||
Mailbox.orgのウェブメールは[暗号化機能が組みこまれており](https://kb.mailbox.org/en/private/e-mail-article/send-encrypted-e-mails-with-guard)、OpenPGP公開鍵を持つ人へのメッセージの送信が簡単にできます。 Mailbox.orgのサーバー上で[受信者がEメールの復号化をすることもできます](https://kb.mailbox.org/en/private/e-mail-article/my-recipient-does-not-use-pgp)。 この機能はリモートの受信者がOpenPGPを持っておらず、自分のメールボックスにあるメールのコピーを複合できない場合に便利です。
|
||||
|
||||
Mailbox.orgはWKDによりHTTP経由で公開鍵を探索することにも対応しています。 これにより、Mailbox.orgを使っていない人でも、Mailbox.orgアカウントのOpenPGPキーを簡単に見つけることができ、プロバイダをまたいだE2EEが可能になります。 @mailbox.orgのようなMailbox.orgが所有するドメインのEメールアドレスのみ対象です。 カスタムドメインを使用する場合、[WKDの設定](./basics/email-security.md#what-is-the-web-key-directory-standard)が必要になります。
|
||||
Mailbox.orgはWKDによりHTTP経由で公開鍵を探索することにも対応しています。 This allows people outside of Mailbox.org to find the OpenPGP keys of Mailbox.org accounts easily for cross-provider E2EE. This only applies to email addresses ending in one of Mailbox.org's own domains, like `@mailbox.org`. If you use a custom domain, you must [configure WKD](basics/email-security.md#what-is-the-web-key-directory-standard) separately.
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } アカウントの停止
|
||||
|
||||
@@ -176,7 +180,7 @@ Mailbox.orgの[.onionサービス](https://kb.mailbox.org/en/private/faq-article
|
||||
|
||||
すべてのアカウントで[暗号化可能な](https://kb.mailbox.org/en/private/drive-article/encrypt-files-on-your-drive)制限付きクラウドストレージが利用できます。 Mailbox.orgには[@secure.mailbox.org](https://kb.mailbox.org/en/private/e-mail-article/ensuring-e-mails-are-sent-securely)というメールサーバー間の接続にTLS暗号化が必須であるエイリアスもあり、TLS暗号化がなければメッセージは全く送信できません。 Mailbox.orgはIMAPやPOP3のような標準的なアクセスプロトコルに加え、 [Exchange ActiveSync](https://en.wikipedia.org/wiki/Exchange_ActiveSync) もサポートしています。
|
||||
|
||||
Mailbox.orgの全てのプランにはデジタル遺産機能があります。 相続人が申請し、遺言書を提出することを条件に、自分のデータを相続人に渡すかどうかを選択することができます。 または、名前と住所で人を指名することもできます。
|
||||
Mailbox.orgの全てのプランにはデジタル遺産機能があります。 You can choose whether you want any of your data to be passed to heirs, providing that they apply and provide your testament. または、名前と住所で人を指名することもできます。
|
||||
|
||||
## その他のプロバイダ
|
||||
|
||||
@@ -195,7 +199,9 @@ Mailbox.orgの全てのプランにはデジタル遺産機能があります。
|
||||
{ align=right }
|
||||
{ align=right }
|
||||
|
||||
**Tuta** （旧 *Tutanota*）は暗号化によるセキュリティとプライバシーを重視したメールサービスです。 Tutaは2011年に設立され、ドイツのハノーバーに拠点を置いています。 無料アカウントは1GBのストレージが利用できます。
|
||||
**Tuta** （旧 *Tutanota*）は暗号化によるセキュリティとプライバシーを重視したメールサービスです。 Tutaは2011年に設立され、ドイツのハノーバーに拠点を置いています。
|
||||
|
||||
Free accounts start with 1 GB of storage.
|
||||
|
||||
[:octicons-home-16: ウェブページ](https://tuta.com){ .md-button .md-button--primary }
|
||||
[:octicons-eye-16:](https://tuta.com/privacy){ .card-link title="プライバシーポリシー" }
|
||||
@@ -226,7 +232,7 @@ Tutaは[IMAPプロトコル](https://tuta.com/support#imap)やサードパーテ
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } プライベートな支払い方法
|
||||
|
||||
TutaはクレジットカードもしくはPaypalのみ受け付けていますが、ProxyStoreとの[提携](https://tuta.com/support/#cryptocurrency)により、[暗号通貨](cryptocurrency.md)でギフトカードを購入することができます。
|
||||
Tuta only directly accepts credit cards and PayPal, however [**cryptocurrency**](cryptocurrency.md) can be used to purchase gift cards via their [partnership](https://tuta.com/support/#cryptocurrency) with ProxyStore.
|
||||
|
||||
#### :material-check:{ .pg-green } アカウントのセキュリティ
|
||||
|
||||
@@ -234,7 +240,7 @@ TutaはTOTPもしくはU2Fによる[二要素認証](https://tuta.com/support#2f
|
||||
|
||||
#### :material-check:{ .pg-green } データのセキュリティ
|
||||
|
||||
TutaはEメールや[アドレス帳の連絡先](https://tuta.com/support#encrypted-address-book)、[カレンダー](https://tuta.com/support#calendar)の[ゼロアクセス暗号化](https://tuta.com/support#what-encrypted)に対応しています。 アカウントに保存されたメッセージやその他データはあなたにしか読むことができません。
|
||||
Tuta has [zero-access encryption at rest](https://tuta.com/support#what-encrypted) for your emails, [address book contacts](https://tuta.com/support#encrypted-address-book), and [calendars](https://tuta.com/support#calendar). アカウントに保存されたメッセージやその他データはあなたにしか読むことができません。
|
||||
|
||||
#### :material-information-outline:{ .pg-blue } メールの暗号化
|
||||
|
||||
@@ -248,8 +254,6 @@ Tutaは6ヶ月間[アクティブではないフリープランのアカウン
|
||||
|
||||
Tutaは[非営利団体](https://tuta.com/blog/secure-email-for-non-profit)向けに無料もしくは大幅な割引価格でビジネス版Tutaを提供しています。
|
||||
|
||||
Tutaにはデジタルレガシー機能はありません。
|
||||
|
||||
## セルフホストメール
|
||||
|
||||
システム管理に詳しいのであれば、自前のメールサーバーの構築を検討することも一つの手段です。 安全性とメール配信の信頼性を維持するには、メールサーバーへの注意と継続的なメンテンナンスが必要になります。 以下の「オールインワン」な方法に加え、手動で設定するための記事を取り上げました：
|
||||
@@ -315,21 +319,22 @@ Stalwartにはウェブメールが**ない**ため、[専用のEメールクラ
|
||||
|
||||
**最低条件：**
|
||||
|
||||
- ゼロアクセス暗号化によりEメールアカウントのデータを暗号化していること。
|
||||
- [Mbox](https://en.wikipedia.org/wiki/Mbox)もしくは[RFC5322](https://datatracker.ietf.org/doc/rfc5322)に基づいた個別の.EMLファイルとしてエクスポートできること。
|
||||
- 自社所有のインフラで運用されていること。第三者のEメールサービスプロバイダーによるサービス提供ではないこと。
|
||||
- Must encrypt email account data at rest with zero-access encryption.
|
||||
- Must be capable of exporting emails as [Mbox](https://en.wikipedia.org/wiki/Mbox) or individual .EML with [RFC5322](https://datatracker.ietf.org/doc/rfc5322) standard.
|
||||
- Allow users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). プロバイダーが悪化したり、プライバシーを重視しない他の会社に買収されたりした場合に備えることができるため、カスタムドメイン名はユーザーにとって非常に重要である。
|
||||
- Must operate on owned infrastructure, i.e. not built upon third-party email service providers.
|
||||
|
||||
**満たされることが望ましい基準：**
|
||||
|
||||
- ゼロアクセス暗号化により、すべてのアカウントのデータ（連絡先、カレンダーなど）が暗号化されていること。
|
||||
- 利便性のため、E2EE/PGP暗号化できるウェブメールがあること。
|
||||
- HTTP経由でのOpenPGP公開鍵の探索をしやすくするため、WKDへ対応していること。 GnuPGでは次のスクリプトで鍵を取得できます： `gpg --locate-key example_user@example.com`
|
||||
- 外部ユーザー用の一時的なメールボックスがあること。 受信者に実際のメールのコピーを送るのではなく、暗号化されたメールを送る際に役立ちます。 通常の場合、一時的なメールボックスのメールには期限があり、自動的に削除されます。 また、受信者はOpenPGPのような暗号化を設定する必要がありません。
|
||||
- [.onionサービス](https://en.wikipedia.org/wiki/.onion)経由でEメールプロバイダーのサービスが利用できること。
|
||||
- [サブアドレス](https://en.wikipedia.org/wiki/Email_address#Sub-addressing)に対応していること。
|
||||
- ユーザーの独自[ドメイン名](https://en.wikipedia.org/wiki/Domain_name)が利用できること。 プロバイダーが悪化したり、プライバシーを重視しない他の会社に買収されたりした場合に備えることができるため、カスタムドメイン名はユーザーにとって非常に重要である。
|
||||
- Should encrypt all account data (contacts, calendars, etc.) at rest with zero-access encryption.
|
||||
- Should provide integrated webmail E2EE/PGP encryption as a convenience.
|
||||
- Should support WKD to allow improved discovery of public OpenPGP keys via HTTP. GnuPG users can get a key with this command: `gpg --locate-key example_user@example.com`.
|
||||
- 外部ユーザー用の一時的なメールボックスがあること。 This is useful when you want to send an encrypted email without sending an actual copy to your recipient. 通常の場合、一時的なメールボックスのメールには期限があり、自動的に削除されます。 また、受信者はOpenPGPのような暗号化を設定する必要がありません。
|
||||
- Should support [sub-addressing](https://en.wikipedia.org/wiki/Email_address#Sub-addressing).
|
||||
- Should allow users to use their own [domain name](https://en.wikipedia.org/wiki/Domain_name). プロバイダーが悪化したり、プライバシーを重視しない他の会社に買収されたりした場合に備えることができるため、カスタムドメイン名はユーザーにとって非常に重要である。
|
||||
- 独自ドメインを利用した際、キャッチオール機能もしくはエイリアス機能があること。
|
||||
- IMAP、SMTPや[JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol)などの標準的なEメールプロトコルを使用していること。 標準的なプロトコルを採用していることで、他のプロバイダーへ変更する際にすべてのメールを簡単にダウンロードすることができます。
|
||||
- Should use standard email access protocols such as IMAP, SMTP, or [JMAP](https://en.wikipedia.org/wiki/JSON_Meta_Application_Protocol). 標準的なプロトコルを採用していることで、他のプロバイダーへ変更する際にすべてのメールを簡単にダウンロードすることができます。
|
||||
- Email provider's services should be available via an [onion service](https://en.wikipedia.org/wiki/.onion).
|
||||
|
||||
### プライバシー
|
||||
|
||||
@@ -337,30 +342,30 @@ Stalwartにはウェブメールが**ない**ため、[専用のEメールクラ
|
||||
|
||||
**最低条件：**
|
||||
|
||||
- 送信者のIPアドレスが保護されていること。`Received`ヘッダーフィールドに表示されないようフィルタリングすることを含む。
|
||||
- ユーザー名とパスワード以外に、個人情報(PII)を必要としない。
|
||||
- プライバシーポリシーがGDPRの要件を満たしている。
|
||||
- Must protect sender's IP address, which can involve filtering it from showing in the `Received` header field.
|
||||
- Must not require personally identifiable information (PII) besides a username and a password.
|
||||
- Privacy policy must meet the requirements defined by the GDPR.
|
||||
|
||||
**満たされることが望ましい基準：**
|
||||
|
||||
- [匿名の支払い方法](advanced/payments.md)（[暗号通貨](cryptocurrency.md)、現金、ギフトカードなど）を受け入れること
|
||||
- 強固な電子メールのプライバシー保護法の管轄区域でホストされていること
|
||||
- Should accept [anonymous payment options](advanced/payments.md) ([cryptocurrency](cryptocurrency.md), cash, gift cards, etc.)
|
||||
- Should be hosted in a jurisdiction with strong email privacy protection laws.
|
||||
|
||||
### セキュリティー
|
||||
|
||||
メールサーバーは、非常に機密性の高いデータを大量に扱います。 プロバイダーが顧客を保護するために業界のベストプラクティスを採用することを期待している。
|
||||
Email servers deal with a lot of very sensitive data. We expect that providers will adopt industry best practices in order to protect their customers.
|
||||
|
||||
**最低条件：**
|
||||
|
||||
- TOTPなどの二要素認証によるウェブメールの保護。
|
||||
- 保存データの暗号化に基づく、ゼロアクセス暗号化。 プロバイダーは保有するデータの復号鍵を持たないこと。 不正を働く従業員がアクセスしたデータを流出させたり、遠隔地の敵対者がサーバーに不正アクセスして盗んだデータを公開したりすることを防ぐことができます。
|
||||
- Protection of webmail with 2FA, such as [TOTP](basics/multi-factor-authentication.md#time-based-one-time-password-totp).
|
||||
- Zero-access encryption, which builds on encryption at rest. プロバイダーは保有するデータの復号鍵を持たないこと。 不正を働く従業員がアクセスしたデータを流出させたり、遠隔地の敵対者がサーバーに不正アクセスして盗んだデータを公開したりすることを防ぐことができます。
|
||||
- [DNSSEC](https://en.wikipedia.org/wiki/Domain_Name_System_Security_Extensions)のサポート。
|
||||
- [Hardenize](https://hardenize.com)や[testssl.sh](https://testssl.sh)、[Qualys SSL Labs](https://ssllabs.com/ssltest)などのツールでプロファイリングした際にTLSエラーや脆弱性がないこと。証明書関連のエラーや[Logjam](https://en.wikipedia.org/wiki/Logjam_(computer_security))の原因となった弱いDHパラメーターを含みます。
|
||||
- サーバーの暗号スイート設定が（TLSv1.3では任意となっている）前方秘匿性と認証付き暗号に対応する強力な暗号スイートを優先していること。
|
||||
- A server suite preference (optional on TLS 1.3) for strong cipher suites which support forward secrecy and authenticated encryption.
|
||||
- 有効な [MTA-STS](https://tools.ietf.org/html/rfc8461) および [TLS-RPT](https://tools.ietf.org/html/rfc8460) ポリシー。
|
||||
- 有効な[DANE](https://en.wikipedia.org/wiki/DNS-based_Authentication_of_Named_Entities)レコード。
|
||||
- 有効な[SPF](https://ja.wikipedia.org/wiki/Sender_Policy_Framework)および[DKIM](https://ja.wikipedia.org/wiki/DKIM)レコード。
|
||||
- 適切な[DMARC](https://en.wikipedia.org/wiki/DMARC)レコード及びポリシーを設定している、もしくは認証に[ARC](https://en.wikipedia.org/wiki/Authenticated_Received_Chain)を使用していること。 DMARC認証を使用している場合、ポリシーは`reject`か`quarantine`に設定していること。
|
||||
- Must have a proper [DMARC](https://en.wikipedia.org/wiki/DMARC) record and policy or use [ARC](https://en.wikipedia.org/wiki/Authenticated_Received_Chain) for authentication. DMARC認証を使用している場合、ポリシーは`reject`か`quarantine`に設定していること。
|
||||
- サーバーの暗号スイートがTLS1.2以降であること、及び[RFC8996](https://datatracker.ietf.org/doc/rfc8996)への対応計画があること。
|
||||
- [SMTPS](https://en.wikipedia.org/wiki/SMTPS)によるメール送信。
|
||||
- 以下のようなウェブサイトのセキュリティ基準：
|
||||
@@ -370,10 +375,10 @@ Stalwartにはウェブメールが**ない**ため、[専用のEメールクラ
|
||||
|
||||
**満たされることが望ましい基準：**
|
||||
|
||||
- ハードウェア認証のサポート、つまり U2Fおよび[WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online)。
|
||||
- Should support hardware authentication, i.e. U2Fおよび[WebAuthn](basics/multi-factor-authentication.md#fido-fast-identity-online)。
|
||||
- DANEへの対応と[DNS Certification Authority Authorization（CAA）リソースレコード](https://tools.ietf.org/html/rfc6844)の設定。
|
||||
- メーリングリストに投稿する際に役立つ[RFC8617](https://tools.ietf.org/html/rfc8617) [Authenticated Received Chain（ARC）](https://en.wikipedia.org/wiki/Authenticated_Received_Chain)が実装されていること。
|
||||
- 信頼できる第三者機関によるセキュリティ監査を公表
|
||||
- Should implement [Authenticated Received Chain (ARC)](https://en.wikipedia.org/wiki/Authenticated_Received_Chain), which is useful for people who post to mailing lists [RFC8617](https://tools.ietf.org/html/rfc8617).
|
||||
- Published security audits from a reputable, third-party firm.
|
||||
- バグ報奨金プログラム、協調的な脆弱性開示プロセス。
|
||||
- 以下のようなウェブサイトのセキュリティ基準：
|
||||
- [コンテンツセキュリティポリシー（CSP）](https://en.wikipedia.org/wiki/Content_Security_Policy)
|
||||
@@ -381,7 +386,7 @@ Stalwartにはウェブメールが**ない**ため、[専用のEメールクラ
|
||||
|
||||
### 信頼
|
||||
|
||||
あなたは偽の身分証を持つ人物に自分の財政を託すことはないでしょう。電子メールに関しても、同じことが言えるはずです。 推奨されるサービスプロバイダーには、自社の所有権やリーダーシップについて公表することが求められます。 また、特に政府からの要請がどのように処理されるかについて、透明性の高い報告が頻繁に行われることを望んでいます。
|
||||
You wouldn't trust your finances to someone with a fake identity, so why trust them with your email? 推奨されるサービスプロバイダーには、自社の所有権やリーダーシップについて公表することが求められます。 また、特に政府からの要請がどのように処理されるかについて、透明性の高い報告が頻繁に行われることを望んでいます。
|
||||
|
||||
**最低条件：**
|
||||
|
||||
@@ -393,24 +398,21 @@ Stalwartにはウェブメールが**ない**ため、[専用のEメールクラ
|
||||
|
||||
### マーケティング
|
||||
|
||||
推奨するEメールプロバイダーには責任あるマーケティングを求めます。
|
||||
With the email providers we recommend, we like to see responsible marketing.
|
||||
|
||||
**最低条件：**
|
||||
|
||||
- アナリティクスをセルフホスティングしていること（Google AnalyticsやAdobe Analyticsを使用していないこと）。
|
||||
|
||||
以下のような無責任なマーケティングは行ってはなりません：
|
||||
|
||||
- 「破れない暗号化」という主張。 暗号化は、その暗号化を破る技術が将来になって現れた際には、それがもはや秘密ではなくなってしまうかもしれないということを念頭に置いて使用されるべきものです。
|
||||
- 匿名性を100％保証するという主張。 誰かが何かを100％だと主張するとき、それは失敗の確実性が全く存在しないということを意味します。 例えば、以下のような匿名化を簡単に解除する様々な方法があります。
|
||||
|
||||
- 匿名化ソフトウェア（Tor、VPNなど）を使わずにアクセスした個人情報（メールアカウント、ハンドルネームなど）を再利用する
|
||||
- [ブラウザーのフィンガープリンティングを行うこと。](https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fingerprint)
|
||||
- Must self-host analytics (no Google Analytics, Adobe Analytics, etc.).
|
||||
- Must not have any irresponsible marketing, which can include the following:
|
||||
- Claims of "unbreakable encryption." Encryption should be used with the intention that it may not be secret in the future when the technology exists to crack it.
|
||||
- Guarantees of protecting anonymity 100%. When someone makes a claim that something is 100%, it means there is no certainty for failure. We know people can quite easily de-anonymize themselves in a number of ways, e.g.:
|
||||
- Reusing personal information e.g. (email accounts, unique pseudonyms, etc.) that they accessed without anonymity software such as Tor
|
||||
- [ブラウザーのフィンガープリンティングを行うこと。](https://en.wikipedia.org/wiki/Device_fingerprint#Browser_fingerprint)
|
||||
|
||||
**満たされることが望ましい基準：**
|
||||
|
||||
- 二要素認証、メールクライアント、OpenPGPなどの設定に関する明確で読みやすいドキュメント。
|
||||
- Clear and easy-to-read documentation for tasks like setting up 2FA, email clients, OpenPGP, etc.
|
||||
|
||||
### 追加機能
|
||||
|
||||
厳密な要件ではありませんが、推奨するサービスプロバイダーを決定する際に考慮した利便性やプライバシーの要素が他にもいくつかあります。
|
||||
While not strictly requirements, there are some other convenience or privacy factors we looked into when determining which providers to recommend.
|
||||
|
||||
@@ -132,7 +132,7 @@ If you have a Google account we suggest enrolling in the [Advanced Protection Pr
|
||||
|
||||
The Advanced Protection Program provides enhanced threat monitoring and enables:
|
||||
|
||||
- Stricter two-factor authentication; e.g. that [FIDO](../basics/multi-factor-authentication.md#fido-fast-identity-online) **must** be used and disallows the use of [SMS OTPs](../basics/multi-factor-authentication.md#sms-or-email-mfa), [TOTP](../basics/multi-factor-authentication.md#time-based-one-time-password-totp) and [OAuth](https://en.wikipedia.org/wiki/OAuth)
|
||||
- Stricter two-factor authentication; e.g. that [FIDO](../basics/multi-factor-authentication.md#fido-fast-identity-online) **must** be used and disallows the use of [SMS OTPs](../basics/multi-factor-authentication.md#sms-or-email-mfa), [TOTP](../basics/multi-factor-authentication.md#time-based-one-time-password-totp) and [OAuth](../basics/account-creation.md#sign-in-with-oauth)
|
||||
- Only Google and verified third-party apps can access account data
|
||||
- Scanning of incoming emails on Gmail accounts for [phishing](https://en.wikipedia.org/wiki/Phishing#Email_phishing) attempts
|
||||
- Stricter [safe browser scanning](https://google.com/chrome/privacy/whitepaper.html#malware) with Google Chrome
|
||||
@@ -154,7 +154,9 @@ If you have an EOL device shipped with Android 10 or above and are unable to run
|
||||
|
||||
Google Play Servicesがインストールされているすべてのデバイスは、ターゲット広告に使用される[広告 ID](https://support.google.com/googleplay/android-developer/answer/6048248)を自動的に生成します。 この機能を無効にすると、あなたについて収集されるデータを制限できます。
|
||||
|
||||
[サンドボックス化されたGoogle Play](https://grapheneos.org/usage#sandboxed-google-play)を備えたAndroid ディストリビューションでは、:gear: **設定** → **アプリ** → **Sandboxed Google Play** → **Google Settings** → **広告**に移動し、*Delete advertising ID*を選択します。
|
||||
On Android distributions with [sandboxed Google Play](https://grapheneos.org/usage#sandboxed-google-play), go to :gear: **Settings** → **Apps** → **Sandboxed Google Play** → **Google Settings** → **All services** → **Ads**.
|
||||
|
||||
- [x] Select **Delete advertising ID**
|
||||
|
||||
On Android distributions with privileged Google Play Services (which includes the stock installation on most devices), the setting may be in one of several locations. Check
|
||||
|
||||
|
||||
Reference in New Issue
Block a user