This might come out as a bit of a rant, but I just wanted to post it here anyway since it’s the only social media I use.
Recently, I’ve been making some steps to improve my privacy. GrapheneOS, Linux on my PC, open source software, moving away from Google stuff. So, next logical step was for me to switch away from Gmail. I went with Tutanota, since they’re based in EU, their mobile app is on F-Droid and doesn’t require Google Play Services. So I made an account, switched a bunch of my private account e-mails from Gmail to Tuta, and was basically done. Two days later, I wake up to a “invalid credentials” message. I checked the option to remember my password on my PC, so I thought it was weird. I checked my phone, and it turns out I was logged out of the app too. I tried changing my password with recovery code, thinking something went wrong (though unlikely since I used a password manager), but I got an error on that one too. So I contacted Tutanota, almost a week ago. No response.
I tried looking on various sites to check if people had a similar issue. I found a few reports on Reddit. The moderator of Tuta says to contact the e-mail address that I sent a message to already, but people complained that they haven’t gotten a response either. I found out that similar reports were happening for a while now, accounts being flagged for seemingly no reason. I found one post from October, 2024, from a frustrated user. He said he was in the same situation, and when he finally got the reply, Tutanota said they can’t do anything. When I found that post, I was really disheartened. I’ve already went back on a bunch of accounts to @gmail.com account, for safety, but there is still a few that I’m not even able to access because they use e-mail 2fa. Some of them being accounts for various government public services.
So this one gave me a pause on my privacy journey. I never encountered problems like this one before. A service blocking my account without any message or warning. No contact from support. Being locked out of my accounts. I’ve lost a lot of enthusiasm to replace a few proprietary services that I have left.
I think it’s safe to say you went too fast (id always start with email forwarding and slowly moving services over in ascending order of importance, and make sure you avoid email 2fa if at all possible), but that does suck.
Tuta is definitely the least reputable of the privacy email services, I still don’t know why they get recommended. I’ve made and lost several accounts with them and treat them like a burner.
Protons a bit risky to me because they’re very aggressive about immediately locking you out if you don’t pay right away (in this case a trial expired, they charged me with no credit card on the account and threatened to block me from accessing my account if I didn’t pay up even though I immediately contacted them and tried to cancel as soon as I saw the trial expired). To me that level of inflexibility is, while maybe acceptable in Europe, not for me. I keep a few email addresses and as soon as the above happened immediately moved everything out of proton.
But really what I’d recommend is the more traditional services that you pay a small amount for. Posteo has been good for me for several years. I’ve read similar things about similar services which aren’t marketed as “privacy” services but instead they just aren’t Google.
A lot of these “privacy sensitive” service providers are actually quite user-hostile.
Find a middle ground - get your own domain (pick a good registrar) and find a respectable mail host that has a support team with accountability who don’t treat you like a burden on this planet when you attempt to contact them (i.e not Tuta, not Mailbox-org - nope!!!, not Proton etc.). Do not go overboard with DMARC/etc in the beginning. Go about it slowly.
Also - make sure you use a service that lets you connect via an IMAP/POP client. It pains me to say that, but if you start avoiding services based on “five eyes” and “14 eyes” and “195 eyes”, I’m pretty sure we will be looking at pigeons and corked bottles in the sea. So, if you need E2EE over email - please use E2EE in the email using GPG on your own. I’d highly recommend not falling for the privacy theatre of the likes of Proton.
Did we read the same post?
+1 for Proton as a security theatre.
Proton is not safe, the Swiss government can (and did, in fact) ask Proton for users’ IP addresses and metadata.
Plus, Proton forces you to use their client instead of standard IMAP.
What metadata?
Fastmail is what i use for this. $50/year. Not gmail. Catch-all email boxes. So i use a new address for everything. It’s not proton. So not sure if it’s even encrypted at rest. But they are not selling my email to advertisers like gmail. And if I want to move I own my domian so its easy.
I’ve been using tuta for more than 3 years now, paid, and even though it has its drawbacks, it’s a good secure alternative to most providers nowadays.
I’ve had to deal with support a while back and even though they were not the fastest, they replied on a fairly timely manner.
I’m sorry to hear you’ve had a bad experience with them.
Lol ya here’s how I use tuta. It’s 90% of the time just a recovery option for other emails that require another email so nothing gets linked. You don’t want to use their app even if its on fdroid its going to make it easy for them to keep track of what you’re up to. Use rethink or foxyproxy to rotate proxies on a mobile browser or tab and open it there, don’t stay logged in. Set reminders on your organization system to periodically login to free blob datacenter emails and clouds. Euros can suck my eggs im not giving them money bc they used the bourgeois state to present a facade of respecting privacy.
Ive lost several tuta accounts, mostly for being inactive in them for 6 months, I find their service pretty annoying, but i think it’s a good idea to write down a password for these kinds of things, and keep it hidden somewhere physically
i dont like the password manager random character youll never recall it nonsense
also setting up a recovery email for a new secure email is important but i understand that doesnt help you now
having to use an email for govt accounts is really annoying ive just had to recreate everything after using the same account for 10 plus years
best of luck op
i dont like the password manager random character youll never recall it nonsense
Wat?
Thank you first of all OP for actually sharing your experience. I’ve known Tuta was sketchy for a while, yet in every single post anyone talks about switching emails, every other reply is always “Tuta! :)”
And I feel because everyone is so unanimously vouching for Tuta, people who may use other niche services don’t feel as encouraged to share what they may have “Oh, guess everyone likes Tuta.”
Stfu about Tuta. Seriously.
And ftr, no OP you’re not alone. I’ve seen countless other domains engage in the same draconian 2FA shit where they do a better job of locking you out of your own accounts than actually protecting your privacy. It’s unfortunately becoming an industry standard model from the looks of it.
Tuta is very suspect
No clue what you’re talking about at the end with 2fa, though. it sounds very yelling at clouds.
Yeah, my fist step was tuta as well, I ditched them after a month for malbox.org. never looked back
Tuta deleted my account after six months if inactivity.
Lord forbid I don’t care to check my email gasp full of spam
I’m really sorry this happened to you OP.
I would really recommend that you consider getting a custom domain for your email. many are not that expensive and if you do, then you can just point that domain at whatever email provider you want without changing your email on the services.
in this scenario, it would let you setup that domain on another provider and at least get access to any emails going forward.
A good and super cheap hosting provider for emails is PurelyMail, albeit it’s based in the US
they are active on mastodon. message them publicly there and tag them
If they “can’t do anything” on their own service then how can they be trusted at all?
They’re either lying outright, or are so deeply incompetent that they don’t know how their own software works and can’t touch it to try to resolve a problem for fear of breaking something.
To be fair though, the exact same thing can happen to you on gmail too. They are not unknown to immediately block your account if something flags it to them and getting a quick response there is not a given either.
I guess that’s true. This might make me question using some online services and providers altogether if I can avoid it. For example, I don’t think I’ll ever use an online password manager and just stick with local one. Having a situation like this with Bitwarden/Proton Pass would be a nightmare.
Regarding email, consider buying a personal domain for your email address. You specify the ip addresses of the email provider in the domain’s DNS, and on the provider’s side specify that the domain is for your email box. This way, if the email provider doesn’t work out, you only need to change the DNS records to another provider, instead of changing the email address on accounts (which is often impossible).
However, not all email providers support custom domains, and some only do that on paid tiers.
If you do this, make sure to have a backup email on a different provider for all of your domain and DNS services in case something goes wrong you can still fix it. I’ve heard horror stories…
Or use an online password manager and take scheduled exports of the data as a backup.
Search selfhosted on Lemmy and reddit. Take control of your own data and also lean why so many choose not to.
E-mail seems a divisive topic on that though. You find either people who say, selfhosted my mail for 4 decades already, never ran into issues! While the other end of the spectrum is not to ever ever eeever try selfhosting e-mail, it is not worth it.
It heavily depend on you internet provider too. In France if you use orange you will have many trouble self hosting, they split IP to multiple users, and your livebox disconnect your IP and port range you were on change. For some time I have to pay for a tiny vps to manage orange port redirections. And emails need some specific DNS configuration which they never did for me. My actual provider is great for self hosting, I sent them an email and the created all the required DNS entry to make hosting email possible.
Yeah it certainly is. I do feel that the people who claim to have had no problems don’t send much email. It’s easy to receive email.
I pay purely mail 10usd to host mine but it’s my work email so I can’t afford any fuck ups (more than I already make)
I self-hosted my email for several years. It was fairly easy, asides from some HTTPS cert issues that I had to correct (and took ages to propagate). But I switched away - I don’t have the expertise to ensure it was safe and secure.
Just curious was this a Tuta paid account, or a free one?
Tuta is very strict with the free accounts and flag them for all sorts of reasons. They take their time to “approve” free accounts just to be able to use them. And on top of that they might nuke your account anyway if they think it is being used for spam/illegal activity/whatever or they think it’s not being used.
But I thought those are just issues with their free accounts, presumably their paid accounts don’t get flagged for those things… or so I thought.
Also to echo the other comments - best to buy and own your own domain for your email, that way it doesn’t matter where the email is being hosted in case you need to switch email providers.
my new Tuta account got “frozen” for 48h after creating it. Tuta said to prevent mass-sign-ups of bots and prevent spam…
Instead of having your online accounts registered directly to your @tuta.io address (or your gmail address, or any webmail address), buy a domain name and have the accounts registered to that and then set the DNS to forward all mail from that domain to your webmail account of choice. That way, if the webmail service fucks up, the worst-case scenario is that you change the forwarding again and you’ve only lost the contents of the previous emails sent, not access to receive future ones.
(Caveat: when you send an email it’ll by default be coming from your webmail provider address, not your custom domain address, and I’m not sure how to fix that – I’ve only recently started switching to the scheme myself – but if your main issue is receiving 2FA emails and such that’s not a big deal.)
I agree with your solution but please note that if you go down that road, you’ll need to renew your domain from now to forever.
That’s mostly just a setting in the provider to verify your domain. Most out it behind a paywall though.
You’ll need to set a few DNS entries so that places know that server is allowed to send email from those servers.
I had the exact same issue when I created a Tuta email, thankfully they solved my problem in less than 24h after I emailed them about this.
Just send an e-mail. your account was flagged as bot.
Why would they flag a human as a bot?
I have been disappointed in tuta myself as well. They seem to be too privacy and security focused at the cost of being hard to use.
It seems OP was attempting to move several addresses. Several sign ups from one source is probably an uncommon practice for typical users.
Try posteo. They at least allow third party clients and they have some cool features.
I wished posteo allowed custom domains… They would be perfect then!
Their reasoning seems to be because of potential privacy issues: https://posteo.de/en/site/faq
I tried Tudor and proton’s free tier, and I couldn’t deal with how they can’t use a normal email client.
On the other hand, I’ve been trying to use Thunderbird with my next cloud calendar and it keeps hanging for me on Ubuntu. So maybe trying to use Thunderbird is a recipe for disaster as well. I don’t know what to do.
