yashsingh1/xdaforums huggingface dataset:
[Android Apps and Games] jow1234:
Thank you for the fast reply. It is reassuring to know that FairEmail will use encryption in a best-effort way even in that case. However, you left the second part of my question open. Let me re-phrase it a bit...

When using enryption with invalid / untrusted server certificates, there are two major windows of opportunity for a potential attacker.

1) initial configuration... the first handshake ever. If a man-in-the-middle catches this moment, he could inject his own server certificate and potentially listen "forever". Solution: FairEmail should show the certificate and/or its fingerprint to the user to allow manual verification. That would be an important security enhancement, please consider it for future versions... pretty please?

2) IMAP connections through open, untrusted networks, such as hotel WLANs and public hot spots. Again, a potential attacker could inject himself as man-in-the-middle. However, if(!) the proper certificate was received in step 1 (see above), the attacker would have to present a different server certificate. So FairEmail could, at least in theory, warn the user that the (invalid, but accepted) server certificate has changed. That was also the second part of my original question - will FairEmail issue such a warning?

If both attack windows were covered, invalid (or, for example, self-signed) server certificates could be used without major security impact. Yes, using proper certificates issued by one of the major CAs should be the preferred solution... however that's sometimes difficult or even entirely impractical.

Thanks for your patience...

Edit: just noticed your addendum. Thanks again... good to know it's already on the list.
[Android Apps and Games] M66B:
I just updated my prior comment: I am not going to support certificate pinning, since it is easy to fix this with a proper certificate, even for free. Besides that, JavaMail does not support certificate pinning other than on host name, which will not solve the insecurity.

Edit: you can also fix this problem by importing the CA certificate you signed the certificate with into Android.
[Android Apps and Games] M66B:
[MENTION=10383821]jow1234[/MENTION] is this your 3 star review on the Play store?

I think this is rather disappointing since I explained why it is a bad idea to use insecure certificates. IMHO there is nothing dogmatic about this. 5 or 10 years ago you would have been right, but these days an insecure certificate is simply not acceptable anymore.

Anyway, "thanks" for motivating me this way :(
[Android Apps and Games] mirhl:
It's authentication (and what you could call "feedback") for fiscal/legal purposes, not ICT security.

Thank you.

Would be also super if inlining could also work.
[Android Apps and Games] M66B:
I think it is time to reduce my involvement here too, similar to the NetGuard and XPrivacyLua XDA threads. I think it is also time to stop adding new features to FairEmail. I can't seem to make people happy anyway and replying often feels like a waste of time and even results in disappointing Play store reviews in the end. I think there are better, more fulfilling ways to spend my time.
[Android Apps and Games] :
I installed fairemail recently and I've been quite happy with it. I appreciate your work on the app.
[Android Apps and Games] heisert:
Can't understand why you're still doing this to yourself. Don't read the crap. We have told you so many times. I feel similar but that junk just pulls you down. You won't find the recognition you want in Google ratings. It prevents your work and psychologically breaks you down.

Over 90% of users think your app is great. And that constantly new wishes come up is completely clear. Have a look over in the Mixplorer thread what is constantly being asked and asked. Its normal if a App is big and has many User.

That is actually the greatest praise for you!

Do your thing. It's perfectly fine how you do it.

(... criticism tends to have more impact and stay with you a lot longer than similarly delivered praise... )
[Android Apps and Games] nadir husain:
I absolutely and totally agree! M66B stop paying attention to these reviews. People of borderline intellect are allowed to pass judgement! That is unfortunate but that's the way it is. Do what drives you and makes you happy. Forget about what the naysayers think! Personally I think you are fantastic! If the negative reviews matter then the positive reviews should also matter and I think there are a lot more of those! Stay blessed Marcel!
[Android Apps and Games] M66B:
I think XDA members leaving a disappointing Play store review after a discussion here is a new low. I think the only thing that can be done to reduce disappointment is stepping back.
[Android Apps and Games] nadir husain:
People are insensitive and selfish and that is what you are seeing. For Gods sake ignore them! Please!
[Android Apps and Games] M66B:
That's even more reason to spend less time on this project. In fact I will lookout for a new challenge, which will not be public and not open source. There will be no new features anymore, unless they will be useful to a majority of the people using FairEmail. Basically this means that there will be stability updates only because FairEmail is pretty feature complete.
[Android Apps and Games] nadir husain:
Sorry to hear that! Didnt mean to upset you. I am sorry
[Android Apps and Games] M66B:
You didn't upset me, don't worry, somebody else did.

I have already explained before that commitment and sensitivity cannot really be decoupled. So, given that I cannot make everybody happy, the only way out is less commitment. The easiest way is just to go do something else, which is just one choice away.
[Android Apps and Games] nadir husain:
There are thousands of us who love your work so is it not reasonable to expect that there will be a handful who don't?
[Android Apps and Games] M66B:
Just for the record, your request is still on my to do list. I also didn't say "go away". I explained it is not a good idea and suggested another much safer solution instead: import the CA certificate into Android. Problem solved, in a secure way.

Edit: I accept your 3 star Play store review, but understand that it does not motivate me to work on this, also because it would be just for a few people. Moreover, JavaMail does not support this scenario as said earlier, which should say something too. Anyway, choices have to be made.
[Android Apps and Games] Dark_Eyes_:
I've written exactly one play store review, and I don't intend to write any other ones. I did it for your app because what you achieve is truly exceptional. I meant every word, and I sure hope it will help you see the brighter side. For every people that don't appreciate your work, I'm sure there are 20 who appreciate it.
[Android Apps and Games] M66B:
Unfortunately, that isn't true. More people with complaints write reviews than people without.
[Android Apps and Games] Dark_Eyes_:
That's exactly true. Unfortunately, upset/stupid users will go to the play store to complain, while happy users tend to not post reviews. It's very often like this. You have 10k+ downloads and less than 600 reviews (that I see). I would bet most of the 9k+ other users that didn't post a review are happy users. It's sad but it doesn't reflect the real-life proportion.
[Android Apps and Games] jow1234:
That's good to know - thanks. The following said something different:

Also, let me explain why that ...

... is not a viable solution for my problem.

I'm not using one of the major webmail services. For me, e-mail comes as part of a web hosting package. I have multiple domains hosted there, but the mail server is NOT under my own control. Currently the mail server uses a properly signed certificate for the web hosting service and for its official, canonical domain name.

Now I MIGHT be able to get a certificate for my main (primary) domain installed into the mail server (not even sure about that, frankly) ... but there's no chance to get a second (third... etc) certificate for the rest of the domains installed.

It's NOT the certificate as such that's invalid; the certificate is NOT even issued by an invalid CA (I only mentioned self-signed certificates as another possible use case for my suggestion); it's the (mail) domain name that doesn't match the mail server's canonical name, as specified in the certificate. K9, to give an example, grumbles a bit about the name mismatch, but then allows me to "accept" and be done with it.
[Android Apps and Games] M66B:
What made me rethink my decision was your remark that enabling 'insecure connections' makes it even more insecure, which is basically true. I can't remove the setting anymore because it is being used by people, so it needs to be either explained better (although the FAQ is pretty clear about the risks already) or it needs to be fixed in another way. Unfortunately, the JavaMail library does not directly support this, so this won't be trivial. Edit: JavaMail appears to support a trust manager after all. Checking the host name would be easy, but this is not enough for a secure connection because somebody could easily issue a certificate with the same host name.

Still, I think what your webmail service is doing is bad. It shouldn't be so hard to provide the CA certificate with instructions and to make thing secure.

Can you lend me an account for testing purposes?
[Android Apps and Games] jow1234:
Agreed. The entire certificate framework itself, BTW, is not a guarantee for absolute security. There have been cases where even certificates signed by properly accredited certificate authorities were mis-used. The whole thing is about levels of trust and levels of security... there are no absolutes in the real world, outside of religion.

A connection based on an untrusted (for example self-signed) certificate is not automatically unsecure, by the way. The digital signature from one of the well-known CAs simply says, "we proclaim that this certificate is genuine". (A), there are other ways to verify the validity of a certificate, if the recipient of such a certificate knows what he's doing, and (B), as mentioned above, even official CA companies can be fooled into doing unsafe things.

That's exactly what happened in the cases mentioned above. Someone basically got a certificate for things like "google.com" issued to themselves because the CA guys didn't check properly... oops.

Also agreed. I suspect the problem comes from the fact that each of their mail servers is hosting mail services for multiple (read: lots and lots) of customer domains - probably even under a single public IP address. I suppose they would have to setup one mail server per customer - possibly even one mail server per domain. Unfortunately I'm unfamiliar with mail server software on that kind of scale...

Yes, I should be able to give you a test account. It may take me a few days... I will contact you in private (now that I've noticed the e-mail address mentioned in the docs).
[Android Apps and Games] M66B:
Your test account might come too late:

https://github.com/M66B/FairEmail/commit/a47e0f99d34fa4def91dc20756e96d0f1cf8c2d3

Is this enough to update/remove your Play store review?
[Android Apps and Games] M66B:
[MENTION=10383821]jow1234[/MENTION]

I have prepared the lower layer for checking the server certificate in different ways and I will likely complete this tomorrow with the corresponding user interface.

Can you please contact me for a test version?
[Android Apps and Games] mrrocketdog:
[emoji817] [emoji93] [emoji93] [emoji93] [emoji93] [emoji93]
[Android Apps and Games] NTOP:
Marcel

I don't agree. You are doing very good job and i love your app. I can't thank enough.

Great apps
[Android Apps and Games] chantoine:
Hi Marcel, sorry but it seems that i can't fire up sync anymore. Something seems broken in the 2 latests builds.

---------- Post added at 07:32 AM ---------- Previous post was at 06:45 AM ----------

Ok. I can't fire up *outside* of the time period defined on the settings. Manual sync only.
[Android Apps and Games] M66B:
Outside the scheduled "on" time you'll need to use manual synchronization. This was always the case.
[Android Apps and Games] chantoine:
Sorry, but no. Before, i could "fire up" sync, even outside time schedule.

Anyway, no problem at all.
[Android Apps and Games] globe79:
Hello Everyone, dear [MENTION=2799345]M66B[/MENTION] I'm a new user of FairEmail :)

I watch closely the HELO/EHLO property of all e-mail clients I use. eg. for Thunderbird (leaking my local IP addresses without this setting) I set mail.smtpserver.smtp1.hello_argument with localhost value to additionally protect my privacy. I have seen previous posts in the thread concerning this topic and can assure that SMTP server will accept literally any message out there (printable characters). I observe that FairEmail sets helo=email.faircode.eu and it is fair enough, whereas most web-based clients simply use localhost.

I'm not here to complaint, because it is not an issue and I see you are not going to add any more options to FairEmail as it is already extremely feature rich product :)
[Android Apps and Games] M66B:
It appeared that 'localhost' is rejected by some providers, which is why it was changed into 'email.faircode.eu'.

Note that you can send the localhost IP address too by enabling the identity option 'Use local IP address instead of host name'.

Edit: "I ... can assure that SMTP server will accept literally any message out there" might be true for the SMTP server(s) you are using, but this is certainly not always the case!
[Android Apps and Games] M66B:
I have just released

beta

version 1.848

Changelog/download:

https://github.com/M66B/FairEmail/releases

This is a new release candidate for the next stable release.

Please report any problem you discover, so it can be fixed.
[Android Apps and Games] NTOP:
Hi marcel

Thanks for update

Nice work
[Android Apps and Games] ouzowtf:
Hey [MENTION=2799345]M66B[/MENTION] Android Police got FairEmail (and others) covered: https://www.androidpolice.com/2019/...open-source-alternatives-to-gmail-on-android/
[Android Apps and Games] M66B:
[MENTION=10383821]jow1234[/MENTION] allowing server certificates by fingerprint is ready for testing ...

You can long press 'Support' in the main navigation menu to contact me for a test version.
[Android Apps and Games] M66B:
Tomorrow morning (MET) I will likely upgrade the latest beta version to a stable version.

Since S/MIME will be included (encrypting/signing are pro features; decrypting/verify signatures are free features) and I don't want to make this a separate purchase to keep things simple, I will increase the price for the pro features from 5.55 to 7 euros. I have read multiple times in reviews that the price for what is being offered is low, so I think this is justified, also considering that Google takes 30% first and the taxes office wants about 50% of the remainder.

So, if you wanted to purchase the pro features in the Play store, either do it soon if you want it cheaper or wait until tomorrow to extra support the project ;)
[Android Apps and Games] M66B:
I just received this:

This means that Gmail accounts that are authorized with a username/password will stop working in the future. Gmail accounts authorized with the Gmail quick setup wizard, which is available in official builds only (notably not in the F-Droid build), will keep working though.
[Android Apps and Games] wget:
This means that deGooglised smartphones or smartphones that do not have GMail installed won't be able to log in, right?
[Android Apps and Games] M66B:
The Gmail app is unrelated and as long as the account manager is present, and maybe some related services, it will work.
[Android Apps and Games] wget:
Ah. I'll need to restest then. Because with Google Calendar, if you don't have the app installed, third party calendars cannot sync events anymore and Davx5 isn't working with GSuite any more. I thought the situation was the same here with Gmail.
[Android Apps and Games] TiTiB:
I particularly like this statement

"Unless you need something that is only offered by K-9 Mail, I would probably go with FairMail instead..." ?
[Android Apps and Games] maybeme2:
You are correct. The read messages becoming 'unread' in the unified inbox is related to the way FairEmail handles threads.

I do not use threading (see screenshot) but FairEmail acts as if I am! Shouldn't FairEmail users who don't use message threading be exempted from threading rules about read/unread display?

Threading read/unread display rules should NOT apply to users who do not want them.
[Android Apps and Games] M66B:
I will double check this tomorrow.
[Android Apps and Games] zoel.fahmi:
Move to this email client

Aqua Mail is broken
[Android Apps and Games] M66B:
Version 1.848 has been upgraded to a

stable

version "Eolambia".
[Android Apps and Games] M66B:
I have just released

beta

version 1.849

Changelog/download:

https://github.com/M66B/FairEmail/releases

This version adds pinning server certificates on fingerprint [MENTION=10383821]jow1234[/MENTION] If you formerly enable 'Insecure connections', you can now disable this, save the account and/or identity and selectively allow the presented server certificate with a checkbox.

[MENTION=6910712]maybeme2[/MENTION] single message will be properly shown read/unread now.

Please report any problem you find, so it can be fixed.
[Android Apps and Games] M66B:
I have just released

beta

version 1.849 1.852

Changelog/download:

https://github.com/M66B/FairEmail/releases

This version adds pinning server certificates by fingerprint [MENTION=10383821]jow1234[/MENTION] If you formerly enable 'Insecure connections', you can now disable this, save/check the account and/or identity again and selectively allow the presented server certificate with a checkbox.

[MENTION=6910712]maybeme2[/MENTION] single messages will be properly shown read/unread now.

Please report any problem you find, so it can be fixed.
[Android Apps and Games] zarere:
By using this version (1.852) I'm getting these errors .The certificate is created from own CA.The option enable insecure connections is not working in this version.However insecure is not correct here since I've created and imported certificate from own CA.

In the latest stable (1.848) everything is working great even without checking insecure connections
[Android Apps and Games] M66B:
Assuming you have version 1.852 installed: is there any chance I can get a test account to look into this?
[Android Apps and Games] zarere:
Let me see if I can create one for you.Any other info needed?I'm having 1.852 installed yes.
[Android Apps and Games] M66B:
Just a host name, port number, username and password will suffice.

I just want to reproduce this problem to see where it exactly occurs and fix it after that, which will be the easiest with a test account.

Edit: I guess I will need the CA certificate too.
[Android Apps and Games] zarere:
Yes I will sent the CA also.Just checking if I can ssh to my mail server from office network here :)

No ssh access to my mail server from here.I will provide you with a test account later today when I'm back home.
[Android Apps and Games] M66B:
Maybe you can send me the debug info in the meantime [MENTION=7496936]zarere[/MENTION]

Please enable/disable flight mode, wait until the connection has been restored, so FairEmail will try to connect again and send me the debug info right after that by long pressing 'Support' in the main navigation menu.
[Android Apps and Games] zarere:
Here you go

https://mega.nz/#!eAI2VQyY!Lnu5kOZ5Miv_6GYgQ2kFINOiinw6gPIhgjoRMe9z5Mo
[Android Apps and Games] M66B:
[MENTION=7496936]zarere[/MENTION] can you please contact me for a test version?
[Android Apps and Games] fraschi51:
In the Privacy tab, the page-up arrows appear again in the header line when scrolling up.
[Android Apps and Games] M66B:
That seems to be how it is supposed to work because this happens in other apps and in the Android settings too.
[Android Apps and Games] fraschi51:
O.k., but where can you see that in the Android settings?
[Android Apps and Games] Piciok93:
Hello,

Thank you for a great app. I have been testing it since yesterday and it looks like the current email client replacement I have been looking for.

Would it be possible to introduce certain improvements for better accessibility with screenreaders, namely:

- to label some of the currently unlabelled buttons such as the folder switcher on the current folder page and the buttons next to individual threads;

- to introduce accessible indicators read by screenreaders of the status for a given message on the messages and threads list i.e. whether a message is unread/flagged/has been replied to or forwarded/has been selected for bath operation, whether a thread is collapsed or expanded and all the properties that are available only by visual cues E.g. colours or icons.

Otherwise, the app is really convenient to use.

Thanks.
[Android Apps and Games] M66B:
I am happy to work with you to add all what is needed for easier accessibility. I have sent you an XDA PM with my email address because I need some explanations. I like to known which unlabeled buttons you exactly mean for example.
[Android Apps and Games] M66B:
I can't find it back :(

Anyway, this is just how Android/AndroidX works.
[Android Apps and Games] DecypherT:
Hi Marcel, could you add the possibility to give the persistent notification via quick settings a dark setting?

I find it a bit of an annoyance that it's white, while the app (and most of my apps) are set to dark mode.
[Android Apps and Games] M66B:
Notifications are managed by Android, so this can't be done as far as I know.
[Android Apps and Games] M66B:
I have just released

beta

version 1.853

Changelog/download:

https://github.com/M66B/FairEmail/releases

The version fixes checking private server certificates. [MENTION=7496936]zarere[/MENTION] thanks for providing a test account for this purpose!

Please report any issue you discover, so it can be fixed.
[Android Apps and Games] DecypherT:
Yes it can :o

Weather app is Geometric Weather, it has a setting to change the notification color.
[Android Apps and Games] M66B:
You are showing a custom notification, which will make this indeed possible. However, using custom notifications is opening a can of worms regarding device compatibility and therefore I am not going to walk that path. There are lots of other more important things to do. I will look into this a bit deeper to see if this can be done in another way though.
[Android Apps and Games] DecypherT:
Ah oke, I did not know it is quite a drag to realize.

Many thanks for looking into it as you see fit!
[Android Apps and Games] M66B:
I can just set the system theme to dark in the Android display settings and all status bar notification will have a dark background (Pixel 3a running the latest Android 10 version).
[Android Apps and Games] DecypherT:
I'm running Android 9 (Nokia 6.1) and have always turned on Dark mode. On Android 9 (or just Nokia phones) this will not change the notification colors.

I should get the Android 10 update in January 2020 though, so maybe this will also work for me then.
[Android Apps and Games] M66B:
I guess this is an Android 10 only feature.

"This means that the system is responsible for ensuring the correct view styling is applied."

https://developer.android.com/guide/topics/ui/look-and-feel/darktheme#notifications_and_widgets

So, I was right that Android should take care of this.
[Android Apps and Games] otiel:
AOD notification icon color

The notification icon for new messages isn't colored (based on the FairEmail account) (it is white instead) on my AOD until I turn on my screen. Is this a FairEmail limitation?

Once I turn on my screen, the icon is correctly colored, even on the AOD.
[Android Apps and Games] M66B:
Like just said before, status bar notifications are managed by Android.

Nevertheless, I like to know what "AOD" is. Edit: I guess Always-On-Display.
[Android Apps and Games] gc01:
I'm using Android 10 / Dec 2019 update - all my notifications are 'dark' as per the Android dark theme setting.

Perhaps this is only happening in older versions of Android?
[Android Apps and Games] M66B:
Most likely.