{"id":443,"date":"2018-10-17T11:40:10","date_gmt":"2018-10-17T11:40:10","guid":{"rendered":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/10\/17\/foss-project-spotlight-tutanota-the-first-encrypted-email-service-with-an-app-on-f-droid\/"},"modified":"2018-10-17T11:40:10","modified_gmt":"2018-10-17T11:40:10","slug":"foss-project-spotlight-tutanota-the-first-encrypted-email-service-with-an-app-on-f-droid","status":"publish","type":"post","link":"https:\/\/www.appservgrid.com\/paw92\/index.php\/2018\/10\/17\/foss-project-spotlight-tutanota-the-first-encrypted-email-service-with-an-app-on-f-droid\/","title":{"rendered":"FOSS Project Spotlight: Tutanota, the First Encrypted Email Service with an App on F-Droid"},"content":{"rendered":"

\nSeven years ago, we started building Tutanota<\/a>, an encrypted email service
\nwith a strong focus on security, privacy and open source. Long before the
\nSnowden revelations, we felt there was a need for easy-to-use encryption that
\nwould
\nallow everyone to communicate online without being snooped upon.\n<\/p>\n

\"""\"<\/p>\n

Figure 1. The Tutanota team’s motto: “We fight for privacy with automatic
\nencryption.”<\/em><\/p>\n

\nAs developers, we know how easy it is to spy on email that travels through the
\nweb. Email, with its federated setup is great, and that’s why it has
\nbecome the main form of online communication and still is. However, from a
\nsecurity perspective, the federated setup is troublesome\u2014to say the
\nleast.\n<\/p>\n

\nEnd-to-end encrypted email is difficult to handle on desktops (with key
\ngeneration, key sharing, secure storing of keys and so on), and it’s close to impossible on
\nmobile devices. For the average, not so tech-savvy internet user, there are a
\nlot of pitfalls, and the probability of doing something wrong is, unfortunately,
\nrather high.\n<\/p>\n

\nThat’s why we decided to build Tutanota: a secure email service that
\nis so easy to use, everyone can send confidential email, not only the
\ntech-savvy. The entire encryption process runs locally on users’
\ndevices, and it’s fully automated. The automatic encryption also enabled us to build
\nfully encrypted email apps for Android and iOS.\n<\/p>\n

\nFinally, end-to-end encrypted email is starting to become the standard:
\n58% of all email sent from Tutanota already are end-to-end encrypted, and
\nthe percentage is constantly
\nrising<\/a>.\n<\/p>\n

\"""\"<\/p>\n

\nFigure 2. Easy email encryption on desktops and mobile devices is now possible for
\neveryone.<\/em><\/p>\n

\nThe Open-Source Email Service to Get Rid of Google<\/h3>\n

\nAs open-source enthusiasts, our apps have been open source from the start, but
\nputting them on F-Droid was a challenge. As with all email services, we have used
\nGoogle’s FCM for push notifications. On top of that, our encrypted email
\nservice was based on Cordova, which the F-Droid servers are not able to
\nbuild.\n<\/p>\n

\nNot being able to publish our Android app on F-Droid was one of the main
\nreasons we started to re-build the entire Tutanota web client. We are privacy
\nand open-source enthusiasts; we ourselves use F-Droid. Consequently, we
\nthought that our app must be published there, no matter the effort.\n<\/p>\n

\nWhen rebuilding our email client, we made sure not to use Cordova anymore and
\nto replace Google’s FCM for push notifications.\n<\/p>\n

\nThe Challenge to Replace Google’s FCM<\/h3>\n

\nGCM (or, as it’s now called, FCM, for Firebase Cloud Messaging) is a service
\nowned by Google. Unfortunately, FCM includes Google’s tracking code for
\nanalytics purposes, which we didn’t want to use. And, even more
\nimportant: to use FCM, you have to send all your notification data to Google.
\nYou also have to use Google’s proprietary libraries.\n<\/p>\n

\nBecause of privacy and security concerns, we didn’t send any info in
\nthe notification messages. Therefore, the push notification
\nmentioned only that you received a new message without a reference to the mailbox
\nin which that message has been placed.\n<\/p>\n

\nWe wanted our users to be able to use Tutanota on every ROM and every device,
\nwithout the control of a third-party. That’s why we decided to take on the
\nchallenge and to build a push notification service ourselves.\n<\/p>\n

\nWhen we started designing our push system, we set the following goals:\n<\/p>\n