yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] mkasimd:
DANE does not encrypt the email messages the way your comment sounds.

First of all, DANE is barely supported, because it requires both your domain registrar and your DNS server to support DNSSEC. Out of 5 registrars I use, only one supports DNSSEC: Cloudflare (and it's among the reasons I'm transferring my domains over there). So, DANE probably won't be available for most domains out there.

Secondly, DANE does not result in the recipient receiving messages encrypted. It is for instance still possible that your mail is sent encrypted to the recipient's mail server, but the recipient downloads the message over an unencrypted channel. DANE also obviously does not encrypt messages end to end. However, DANE can ensure there is no man in the middle (MITM) between the sending and receiving party which is a huge security benefit in itself.

Assuming your email provider supports DANE, it could increase the security between you and your email server indeed. Because that way, an email client[1] could check whether the received TLS certificate matches the one in the TLSA records.

I looked for TLSA records with gmail.com, outlook.com, yahoo.com, gmx.de and mail.com. None of those five seem to support DANE, 3 out of those 5 support MTA-STS, but that's about MX records (incoming mails others sent to your email server, so nothing for an email app to deal with).

So, has DANE gone anywhere? I kind of doubt it. As shown with the 5 domains / major email providers listed before, it's barely supported.

Does FairEmail check for TLSA records before sending an email message to your provider's SMTP server? I don't think so (Marcel can correct me). But checking it won't really help 99% of the users anyways for as long as major email providers don't provide the required TLSA records.

Hope this helps.

[1] email client doesn't necessarily mean the end-user's email app. When an email server is sending a message to another email server, the sending party is called a client as well.
[Android Apps and Games] M66B:
Version 1.1941 is available on GitHub now.

Changelog/download:

https://github.com/M66B/FairEmail/releases

Besides a series of small improvements and minor bug fixes, VirusTotal Integration was added. Please see this FAQ for more information about configuring and using this new feature:

(181) How do I use VirusTotal?

Note that the app hasn't been restored in the Play store yet. For the latest status updates, please see here:

FairEmail in the Play Store

Status and frequently asked questions

email.faircode.eu
[Android Apps and Games] O_DoC:
ps this could be a little OffT, but :

Hello,

Could you elaborate those 3 specific points and relationship with ''app password'' ?

I not sure to understand and really like to.

Thanks

For example, when reading your comment, I thought,

- the ''app password'' is exactly the opposite of your ''B''

- in "C", I can't figure out the relationship between 2fa process and "trading privacy for security"

- same goes for the "A"
[Android Apps and Games] M66B:
To use an app password you need to enable two factor authentication.

The enable two factor authentication you need to specify a backup method, for example a phone number.

If you don't like to give your phone number to Google, this can be problematic ...
[Android Apps and Games] O_DoC:
Thanks Marcel, I fully understand that,

and one time burner number or virtual number do the job + foss otp app or usb/nfc could complet this scenario.

(and I put aside that 99.99% of gmail users already gave far more than a phone number, so I assume his/her usage is different)

But, again my point of view, I really don't catch his/her word on that particular 3 points in the message for 'app password'.

The relationship between ''mother board account'' etc...

They're 'sounds' like affirmations, and I'm not 'aligned' with,

that's why I really like to have more details and understand...maybe I'll learn something today, so it could be a good day.
[Android Apps and Games] topcaser:
Virustotal Integration: the link of the circled "i" dont leads to the correct faq.

Where can I put in the api key in fairmail?
[Android Apps and Games] M66B:
The referenced FAQ number is correct:

https://github.com/M66B/FairEmail/blob/master/FAQ.md#user-content-faq181
[Android Apps and Games] GalaxyA325G:
I wrote that snippet too hastily off the cuff and therefore I agree with you that it's my fault - not for conflating 'app passwords' with 2SV/2FA (which go together hand in hand in a ripple effect) - but because I included the completely unrelated facts that I'm not rooted and that I have chosen to use Google email servers.

I apologize for the confusion.

A. I was trying to point out that I'm just a "regular Android user" who has only available to me the tools EVERYONE has available to them

B. And I was trying to pre-empt the inevitable (but sophomoric) "

don't use Google servers

" chastisement (which is always proffered!).

However, I've since re-written that section so that it's no longer as confusing now as it was when you first read it (please take a look here [post 22,933]).

Nolo contendere.

If you try to use one, you can't do it without the other - and worse - if you turn off one - the other dies concurrently (just in case you thought the big marketing outfits didn't think of that trick that we'd pull to get out of it after the fact).

Suffice to say, at least among friends, that "app passwords" === "2SV/2FA" (even as Google will never tell you that directly).

Between friends, in my humble opinion, this May 30th 2022 deprecation of login/passwd is all about trading away your privacy for security...

As far as I can tell, Google 'app passwords' essentially REQUIRES 2SV/2FA to be set up, and what's worse, is we tested turning 2FA/2SV on and off on the Android, Windows, & Thunderbird Usenet newsgroups. We found that if you TURN OFF your 2SV/2FA setup, your 'app passwords' stop working (comp.mobile.android, alt-comp-os-windows-10, alt.comp.software.thunderbird).

There's that inevitable ripple effect.

The big marketing orgs know this stuff.

They're trying to get us to trade privacy for security.

Kicking and screaming...

As a cross-platform aside, we also tested whether setting up 2SV/2FA is permanent with Google, and (breathe a sigh of relief), it is NOT permanent for Google - but - alas - it's definitely PERMANENT for Apple (i.e., after a short 7-day grace period, you can NEVER turn off 2SV/2FA if you set it up on your Apple device).

In fact Apple was sued for this fact, and the judge threw it out saying "caveat emptor" (where, in this case, the plaintiff pressed the "OK" button, so he agreed to Apple's legal terms that once you set up 2FA, you can NEVER turn it off).
[Android Apps and Games] topcaser:
OK, you are right. I did a Virustotal search in the settings and it points me the right setting. Above that setting an info icon appeared and I thought it belongs to that entry. Sorry.

Another question to the new feature: if I want to scan a document it brings me to a page which says: item not found

Is it my restricted Fennec browser which has this problem? How can I open the scan in another browser?
[Android Apps and Games] M66B:
Uploading files will be in the next version.
[Android Apps and Games] topcaser:
And what is working with this version? If upload isn't working the entire feature is not usable, am I correct?
[Android Apps and Games] M66B:
The current version will look up files in the database of VirusTotal, which means that commonly spread malicious files will be recognized.
[Android Apps and Games] M66B:
@topcaser
[Android Apps and Games] topcaser:
To be honest, Fairmail opens always the Browser. What am I doing wrong?
[Android Apps and Games] M66B:
If you tap on 'Info', the file will be looked up via the website of VirusTotal.

This is useful only if the file is known by VirusTotal. This will be clearer in the next release.
[Android Apps and Games] nubla:
My interpretation of this message is that the document's hash was not found in VirusTotal's database, i.e. that this file is not a known problem.
[Android Apps and Games] M66B:
That will in most cases be a correct conclusion, unless maybe when it is a very new virus.
[Android Apps and Games] nubla:
That's why I said "not a *known* problem".

But I think the issue here is that when people encounter "X not found", it is assumed that there was an error and something is not working.
[Android Apps and Games] GalaxyA325G:
On Usenet, we've been discussing Google's May 30th attack on privacy since early March (when we received the initial nastigrams about the deprecation of privacy for 3rd-party MUAs), where one person dug into a MUA's source code and found this snippet.

buildConfigField "String", "OAUTH_GMAIL_CLIENT_ID", "\"262622259280-hhmh92rhklkg2k1tjil69epo0o9a12jm.apps.googleusercontent.com\""
buildConfigField "String", "OAUTH_YAHOO_CLIENT_ID", "\"dj0yJmk9aHNUb3d2MW5TQnpRJmQ9WVdrOWVYbHpaRWM0YkdnbWNHbzlNQT09JnM9Y29uc3VtZXJzZWNyZXQmc3Y9MCZ4PWIz\""
buildConfigField "String", "OAUTH_AOL_CLIENT_ID", "\"dj0yJmk9dUNqYXZhYWxOYkdRJmQ9WVdrOU1YQnZVRFZoY1ZrbWNHbzlNQT09JnM9Y29uc3VtZXJzZWNyZXQmc3Y9MCZ4PWIw\""
buildConfigField "String", "OAUTH_MICROSOFT_CLIENT_ID", "\"e647013a-ada4-4114-b419-e43d250f99c5\""
buildConfigField "String", "OAUTH_MICROSOFT_REDIRECT_URI", "\"msauth://com.fsck.k9/Dx8yUsuhyU3dYYba1aA16Wxu5eM%3D\""

After digging into that code, he concluded earlier today...

Is that assumption correct and is there any insight this provides the rest of us that may be useful for understanding what additional seemingly nonsensical hoops Google is making 3rd-party MUA developers jump through?
[Android Apps and Games] M66B:
In fact this goes even further: those magic numbers require a signed contract with most providers.
[Android Apps and Games] M66B:
I got this response from Google:

My reply:

Note that I want this, but the future of the project depends on this. An email app which can't be used for Gmail is not an email app given the dominance of Gmail.
[Android Apps and Games] M66B:
Despite trouble with Google, version 1.1942 is available on GitHub now.

Changelog/download:

https://github.com/M66B/FairEmail/releases

VirusTotal integration has been improved. Files can be uploaded for analysis too now. An API key is required now.

Example:
[Android Apps and Games] M66B:
VirusTotal integration has been completed now, maybe except for some fine-tuning based on your feedback. New features and improvements will be paused until new Gmail accounts can be configured again. Bugs will keep being fixed, though.

As I also expressed in the reply to Google (see before), holding back on the number of tokens that can be issued is pretty frustrating and probably also in violation of EU laws, in particular article 102, which prohibits abusive behavior. I will wait for the answer to my reply, and if this isn't favorable, I will file a complaint with the EU, which is already waiting in my drafts folder.
[Android Apps and Games] mkasimd:
If you need assistance with the complaint, feel free to email me. I'm no lawyer, but receiving from & writing letters to lawyers and courts isn't new to me. No experience I voluntarily gained, but an experience nevertheless. If it somehow helps you, I'll gladly help however I can.
[Android Apps and Games] O_DoC:
Hello,

Never looks for ''right'' nor ''wrong'', even less for apologize ; but thanks for your precision which led to a better understanding of your point-of-view.

Good week'all
[Android Apps and Games] topcaser:
Hm the Virustotal Integration is gone now completely with the new version although it's still activated in settings. Any ideas what's going wrong?
[Android Apps and Games] M66B:
"Looks like you already have sufficient OAuth token"

Not really because thousands attempts to configure a Gmail account failed today.

It might take another 5 business days until Google will respond again, and based on my previous experience this will go back and forth for a month, until they do a small increase only.
[Android Apps and Games] topcaser:
And where do I have to enter the api key? In settings, there is only the switch. But the icon to scan it with Virustotal is mis completely
[Android Apps and Games] topcaser:
Ah, I got it. Below the setting, but below the information icon. Marcel, could you please move api enter field above the information icon and please rename api key to api key VirusTotal?
[Android Apps and Games] M66B:
I will move the API key field up, so that's clearer it belongs to the on/off switch.
[Android Apps and Games] M66B:
There was as expected no message from Google today.

I think one week unpublished in the Play store is already rather long, which is after today. The huge number of messages I get from people asking "Where is the app?" also tells this.

Since already thousands of people couldn't configure a Gmail account, I am planning a special update disabling all Gmail accounts referring to:

FairEmail in the Play Store

Status and frequently asked questions

email.faircode.eu

Critical situations require drastic measures after all.

Note that before you say that this isn't a good idea, the other option is that I terminate the project. Like said before an email app which can't be used for Gmail isn't an email app given the dominance of Gmail.

Feel free to suggest other options to solve the issue, but I don't see them anymore. Basically, Google already said "no", which is also why I started mentioning "antitrust" in my reply right away. The developer help desk said that this is not Play Store related and that they therefore can't help me. So, all operational options have already been used. Things like complaining with the EU or sueing Google won't solve the problem today or this week.

Note that my personal situation doesn't help either here. Family comes first and I like to keep stress resulting from a project like this far from my family.

It is sad, but it is what it is. I would like to go this differently too.
[Android Apps and Games] topcaser:
Marcel, I don't understand why you aren't rolling back to the code without oAuth
[Android Apps and Games] M66B:
Because that's not the cause of the problem and therefore won't help. The real cause is "just" more users. The "old" OAuth method via the Android account manager uses no more and no less tokens.

Moreover, the problem was there before the new OAuth method was available for Play store users, about 98-99% of all users.
[Android Apps and Games] La_Globule:
IMHO, I'll keep the app available in the Play Store thus allowing people to install and use it until Google solves the issue.
[Android Apps and Games] M66B:
Okay, and how about all the people leaving a 1 star rating because they can't configure a Gmail account? Also, allowing more users by publishing the app again will prevent you from re-configuring a new Gmail account too, which is currently already a problem, see the graph above.

So, the options are not to publish the app in the Play store or to drop support for OAuth altogether, effectively removing Gmail for most people because an app password is too difficult for a lot of people.
[Android Apps and Games] M66B:
This is the current situation:

Currently it is okay, but that might be different tonight again.

The things is that I can't guarantee "service" this way. Since car comparison are popular: this morning your car works, tonight you might be stranded.
[Android Apps and Games] nadir husain:
A well maintained Ferrari never leaves you stranded. :)
[Android Apps and Games] M66B:
Unless it is a Google branded Ferrari.
[Android Apps and Games] M66B:
Okay, I seem to have no other choice than to terminate the project, I just received the exact same message as yesterday:

"Thank you for reaching out. Looks like you already have sufficient OAuth tokens for the project requested as shown here [link to Google cloud console]."
[Android Apps and Games] M66B:
I have really no idea how to respond to this because this look like a dead end.
[Android Apps and Games] nadir husain:
Can't you contact the person with whom you had a telephone chat some weeks ago?
[Android Apps and Games] M66B:
That's the Google Play team and this is the OAuth team.

I will try, but the Play help desk also said that they couldn't help me.
[Android Apps and Games] M66B:
I would like help with this reply to Google:

Any suggestions?
[Android Apps and Games] M66B:
{Mod edit: Quoted post has been deleted - Oswald Boelcke}

Okay, I will make an end to the howling and confusing. The project is terminated as of right now. This applies to all my public projects.

Edit: NetGuard has been removed from the Play store too.
[Android Apps and Games] :
I would but:

I do use F-Droid without GAPPS at the moment. I suppose I could install it through Yalp Store.

That being said, I don't feel that a security feature should be something that is only in the pro version. It would be a bit like only allowing TLS connections in the pro version and un-encrypted connections in the open source free version.

Ultimately pro users benefit from non-pro users having this feature, as they might be sending mail to those people, both have to have it in order for it to work. It also maintains your product slogan:
[Android Apps and Games] Danmann:
Come on. 10euro... Just buy less beer this weekend and spend this small amount.
[Android Apps and Games] M66B:
I don't see why a security feature which would be implemented for just a few people cannot be a pro feature. You cannot compare email encryption with TLS because the latter has lots of users and the first almost none.

Open source also means that anyone can contribute new features. Maybe you can contribute encryption support.
[Android Apps and Games] :
A feature for pro users is pretty useless if they are communicating with non-pro users that lack the feature. You can't have end-to-end encryption if only one end can encrypt.

As a pro user I'd like to see this in both versions otherwise I'd be unlikely to recommend it to new users over K-9 as I wouldn't know for certain they would buy the pro version.

10€ isn't a lot of money to me, but maybe to some in poorer countries it is. I recently donated 60€ to Tails 2018 fundraiser. I did this because:

I suppose if this were a pro-feature then the code for it would not be in M66B/open-source-email which I believe would also contradict the other part of your slogan ie "is closed source, potentially violating your privacy".

This is aside from the fact that it's not good practice to do anything which hinders external auditing of encryption related code or that which displays encrypted messages.

Yes you're right there probably aren't too many people using FairEmail and using encryption as it isn't a current feature. How do you know that won't change in the future? Initiatives like Autocrypt which aim to make end to end encryption easier for users who aren't technical will only gain adoption if they are available to use.

That is a possibility but not always a certainty. Remember you have marketed the app on being "open source" and being "privacy friendly" so it probably should encompass features which support that aim.
[Android Apps and Games] M66B:
FairEmail is 100 % open source, including all pro features.

IMO adding encryption would not make FairEmail much more privacy friendly because not many people would use this. There are not many people using FairEmail anyway and I don't think adding encryption support would make much of a difference.

I basically wrote FairEmail for myself because I was tired of K-9 mail not working properly on recent Android versions because of doze mode. FairEmail does everything what I want it to do, so I have no motivation to add encryption.
[Android Apps and Games] beeshyams:
Fair enough reason by itself

But I am not sure of your stance that many users don't use it or are not likely to use it either. It seems a bit lame to me (no disrespect) Fair number of people looks like are willing to even pay for it as can be seen in the last couple of days posts

A thought is to run a poll with a target price and gather potential user base numbers to assess cost viability
[Android Apps and Games] M66B:
I wouldn't call literally a handful of people a fair number of people.
[Android Apps and Games] beeshyams:
"Fair number" in the context of your post and response in two days.

Not objectively, for which one way could be run a poll. It would at worst put a closure to this ask based on numbers and at best (hopefully) make it viable
[Android Apps and Games] m0d:
As dev said, FairEmail is opensource!

Contrubutions are welcome. Open pull request at github.

Not a programmer, no problem.

There are thousands of programmers you can donate to and they will try:

https://www.quora.com/Is-there-a-we...ofessional-programmers-fulfill-those-requests

https://softwareengineering.stackexchange.com/a/28138

Dev has been nothing but outstanding in development.

He also has a right to choose which direction he wants to take.

So instead of picking at details, why not find a solution.

Either work on it yourself, hire someone to do it for you, or start a fund page and if it reaches a certain minimum then dev can agree to take up the challenge.

I see no reason for attacking someone who looks at all discussion and ideas and suggestions.

If you are unhappy you can always go on using whatever client that supports your needs
[Android Apps and Games] M66B:
Even if all the current users of FairEmail, just a few hundred, would say they were interested in encryption, I would not add it, so I don't see what a poll would add.

Adding, maintaining and supporting encryption is a significant amount of work and since I am not interested in this myself, I am not going to put effort into this. Is this enough closure?
[Android Apps and Games] m0d:
Also, I do not see how any of it is relevent.

To be nitty picky, all end to end encryption has backdoors

Tails ToRs and all encryprion have been funded by governments.

So it is unlike;y that it works as you imagine.

It is only a veil of illusion to quieten the radicals.
[Android Apps and Games] beeshyams:
Yes. That's enough closure, of course, not of my liking

Maybe this explanation warrants a mention in the OP?

Thanks
[Android Apps and Games] M66B:
There is already a FAQ about this.
[Android Apps and Games] beeshyams:
I think you misunderstood me

There is no intent to "attack" and my very first comment said that it is a fair call for the developer to exercise his choice. None can or try to force what developer wants to do

I respect [MENTION=2799345]M66B[/MENTION] as much

---------- Post added at 10:59 AM ---------- Previous post was at 10:53 AM ----------

Edit: in an earlier post (edited by OP) they're was a mention of some numbers and that was the conte

context here, which obviously you don't have a view

---------- Post added at 11:12 AM ---------- Previous post was at 10:59 AM ----------

Indeed... Missed that
[Android Apps and Games] m0d:
That was for the other person making statments before veryifying.

I quoted you to point out that all of the people can go for a fund poll, or open PR, or hire someone to do it.

I mean if he is willing to throw money on tails he/she can put some fund to hire someone to work on encryption before making accusations and insinuations on open source and what should stand as security