GhostMail
Encrypted webmail sitting on the mail server you already have. In development: no public instance.
Last updated:
Where GhostMail stands
In development. There is no public instance, no sign-up, and nothing to open from this page. We write that here rather than letting a button promise otherwise.
This page exists to say what the product will do and what it will not, while it is being built. What follows describes the design we settled on, not a feature you could use today.
What GhostMail does
Your OpenPGP keys are generated and unlocked in your browser. The server never sees them, and therefore cannot read what you seal with them.
GhostMail connects to an existing IMAP/SMTP account rather than forcing a new one on you. You keep your address, your host and your history; it is the reading and the writing that move.
What GhostMail does not do, and why
This is the part that matters, and it is narrower than what an encrypted webmail spontaneously suggests.
What is already in cleartext on your mail server stays that way. GhostMail encrypts what you entrust to it; it does not rewrite the history of your mailbox. Messages received before it, and those that arrive in cleartext, stay as they are where they are.
It holds your mailbox credentials, and sees them in cleartext when it fetches your mail. An IMAP server asks for a password; there is no way to collect mail without giving it one. GhostMail is therefore not zero-knowledge on that point, unlike GhostPass and GhostBit, and we will not present it as such.
A correspondent who does not use OpenPGP receives a cleartext message. End-to-end encryption assumes two ends. GhostMail cannot seal what your recipient will not be able to open.
Where your mail will run
GhostMail is self-hostable, under the Elastic License 2.0: the code is readable, modifiable and deployable on your own server, the only limit being reselling it as a hosted service. That is source available, not open source in the OSI sense.
Getting help
Write to contact@stackops.ch. It is the only support address, and it is read by the people who write the code.
For the answer to be of any use, say in your message:
- the browser and its version;
- what you were doing, what you expected, and what happened instead;
- the exact text of the error message, if there was one;
- the address of the server you connect to, if it is not ours.
Never send your mailbox password, the phrase that unlocks your keys, or the content of a message. We do not need any of that to help you.
We do not advertise a guaranteed response time. There is no support team on rotation, and announcing an hour we would not keep would cost more than writing it this way.
Reporting a problem
A malfunction is reported to the same address, contact@stackops.ch.
A security vulnerability too, and it goes ahead of everything else: we acknowledge receipt within 72 hours, we keep you posted on what follows, and we credit you if you wish.