15characterslon

It worked perfectly well. It still works. Companies can transfer the data and no one gets sued. Legal enough.

It doesn't support syncing properly, if you use it on desktop + Android + iOS you have to trust three different app vendors, browser integration isn't nearly as good as 1Password, custom fields are badly integrated.

Bitwarden is subscription-based too. Or are you on the free tier with almost no features?

Best not turn it on again at all. Just to be sure ;)

It's funny you say that because kids today don't really have files either, since all the content is confined in apps.

No, they don't do that check, that is the problem.

As others said, DKIM always includes "from". And almost none of the emails I get are S/MIME or PGP signed.

Like you said: SPF and DMARC only authenticate the server. It's up to the server to authenticate the user.

Scenario: imagine your bank uses Mailbox.org to send emails. How would you verify that an email is legit? Any Mailbox user can send emails through Mailbox with your bank as "from" and all of these emails pass SPF and DKIM checks. Your mail server has no way to distinct a legit email from a fake one. This is why it's important that the server does this check (check that sender account and "from" match / are a valid combination).

AFAIK they still refuse to acknowledge the problem. But since they deleted the forum thread, how would I know.

What they said in the forum doesn't make much sense. Yes, anyone in the wold can send emails with any address as "from". The big difference is that those emails won't pass SPF and DMARC checks.

If I wanted to use them, I would need to configure SPF and DMARC for my domain so that their mail servers pass those checks. At this point I would expect their mail servers only to allow sending "from" my domain when my account is used.

Note that just about any major mail provider does this check (e.g. Google). It is industry standard. It is crazy that they even refuse to acknowledge this. I'm working in this field and this is basic knowledge. I just don't get how they can do this professionally and not understand what the problem is. The only explanation I have is that for some reason it would be hard for them to fix and so they try to ignore it / make it disappear by deleting the forum thread.

Also they use the same DMARC key for all customers, which is weird. Usually each customer gets it's own DMARC key.

But what alternatives are there? I just need a solution for the usual stuff: mail, contacts, calendar, notes, tasks, files and meetings. Microsoft? Haha, hell no (they never did free anyway). Also using multiple services (e.g. Fastmail for mail and Dropbox for files) is way more expensive.

Gotta know exactly what is behind those mosaic pixels.