Edison Mail Sync Bug Allowing Access to Other Users' Email Accounts [Updated]

[Morien]

I really liked Edison. The way it previewed attachments, the interface, the simplicity (not bundling in the calendar that I won't use over the Apple one).

Now that that is out, what is a good alternative? I don't mind spending a few bucks (one off) if I need to. I don't like how Mail.app downloads the entirety of my 20+ years of emails.

 

[Expos of 1969]

I tried Protonmail Plus but it lacks customer support and I wasn't able to use it with my own domain. "Support" takes 5 days to respond and when they do it's a canned response that has nothing to do with your question.

My experience with Protonmail has been completely different. I use my own domain and customer service has responded promptly with good instructions/advice/assistance. I started with a free account and then moved up to the paid level. Cost is fair, particularly if you take advantage of the two year subscription which is usually at a lower price around Black Friday.

 

[4492865]

It does. But this is a problem with the way Edison handles your email.

It’s actually also Apple’s fault. It affords it’s own mail client the privilege to continuously work and fetch from the background, therefore not requiring a server for push notifications.

This privilege is not afforded to other mail clients - and thus the only way to deliver push notifications is by setting up a server in the middle which, unfortunately, means that server requires access to your email. Either through token or username/password. It is not possible to handle this entirely on the device.

 

[Permanent Sigh]

Do you leave your mail on the server, or do you POP it down? Or are you running your own mail exchange? aren’t you storing everything on the servers belonging to the developer or company when you use IMAP?

I know google trained us to never delete email. I wonder why.

The company I pay to run the servers that my mail sits on doesn't sell data collected from my emails, as per their privacy policy. Edison freely admits they do this unless you specifically opt out, and even then I wouldn't trust them.

 

[macintoshmac]

That's actually not true. There are several ways to implement push email on iOS that do not require storing credentials on the server side:

- Some email providers can send Apple push notifications to the stock Mail app; that obviously includes iCloud email, but also Fastmail and Mailbox.org.
- Some email providers offer their own email apps, and can of course implement push notifications for those. That includes Fastmail, Protonmail, Tutanota and probably others.
- You can use Exchange Activesync (which has its own efficient push mechanism) with the stock Mail app. This is supported by Outlook.com and Google business accounts.

These are all safe methods.

Generally, when choosing an email client, it is safest to pick the stock Apple client, an open source client like Thunderbird, or, if available, the email provider's own app.

But yes, this incident illustrates nicely why storing account credentials on 3rd party servers is a bad idea.

Since you mention FastMail and Tutanota, by any chance, do you happen to have any comparison between the two from personal experience? I am on FastMail and find Tutanota to be a more expensive solution than FastMail, feature-to-feature. However, don't know about encryption and FastMail.

 

[Apple_Robert]

Since you mention FastMail and Tutanota, by any chance, do you happen to have any comparison between the two from personal experience? I am on FastMail and find Tutanota to be a more expensive solution than FastMail, feature-to-feature. However, don't know about encryption and FastMail.

Tutanota is free for personal use, unless you need aliases, add a user, calendar, or search your mail.

 

[macintoshmac]

Tutanota is free for personal use, unless you need aliases, add a user, calendar, or search your mail.

Yes, I need aliases, unfortunately. Furthermore, I need more than 10 GB.

Fastmail is a really cheap solution for me at $50 a year, and works amazingly well. Only thing that might make me move to Tutanota, even if at a greater cost to me, would be better security.

 

[ian87w]

With so many data breaches nowadays, I no longer trust a 3rd party email client. I only use first party ones like Apple's own mail app, Google's GMail, or Microsoft's Outlook. The risk is just not worth it for some random fancy feature. In the 21st century, we should treat email as a critical data like our phone number.

 

[grmlin]

With so many data breaches nowadays, I no longer trust a 3rd party email client. I only use first party ones like Apple's own mail app, Google's GMail, or Microsoft's Outlook. The risk is just not worth it for some random fancy feature. In the 21st century, we should treat email as a critical data like our phone number.

And now that gmail finally went dark on my phone, it’s not the worst app anymore lol

 

[adrianlondon]

I did.

BTW, you should clean up that spam, your CC bill is due next week and you still haven't replied back to that email you received 3 weeks ago...

👹😋🤣

This is great! Now I can fire my PA.

 

[dumastudetto]

This guest mode could catch on as a way to seamlessly browse the World Wide Email.

Innovation at its best.

 

[Apple_Robert]

With so many data breaches nowadays, I no longer trust a 3rd party email client. I only use first party ones like Apple's own mail app, Google's GMail, or Microsoft's Outlook. The risk is just not worth it for some random fancy feature. In the 21st century, we should treat email as a critical data like our phone number.

If you care about security and privacy, you should stop using Gmail and Outlook. Gmail is the worst of the two mentioned.

 

[ian87w]

If you care about security and privacy, you should stop using Gmail and Outlook. Gmail is the worst of the two mentioned.

I meant more about the security of the account itself, meaning if I have a GMail account, I'd rather just use Google's own GMail app vs giving my password to a 3rd party email app. Anything has risk, but I believe companies as big as Google or Microsoft will have more precautions against data breaches as they have their reputation and brand to protect. Smaller app dev might not have as much resources to protect their data.

 

[twistedpixel8]

This is why I would never use a client that isn't from one of the big three (Apple/Microsoft/Google). Not worth little surprises like this.

Oh come on, you’re giving Apple/MS/Google a bit too much credit here. Apple have never introduced a major security bug into any of their products? Off the top of my head I can recall about 5 over the last 2 years.

The big guys are not immune from screwing up.

 

[ian87w]

Oh come on, you’re giving Apple/MS/Google a bit too much credit here. Apple have never introduced a major security bug into any of their products? Off the top of my head I can recall about 5 over the last 2 years.

The big guys are not immune from screwing up.

Obviously nobody is immune to it. However, by simply sticking with first party email app from the email provider themselves, imo I am reducing my risk. Instead of risking two companies being breached (the email provider AND the 3rd party email developer), my only risk is with the email provider (which is imo is less likely. Not impossible, but much less likely).

 

[Morgenland]

I really liked Edison. The way it previewed attachments, the interface, the simplicity (not bundling in the calendar that I won't use over the Apple one).

Now that that is out, what is a good alternative? I don't mind spending a few bucks (one off) if I need to. I don't like how Mail.app downloads the entirety of my 20+ years of emails.

If you confuse Mail with Outlook ('bundling in the calendar') and don't know how to take out irrelevant old emails as a local backup (that can be reloaded at any time), you should start getting to know Apple's Mail before talking.
[automerge]1589722989[/automerge]
I have spoken to some programmers who are involved in DB management.
Most supose that this "bug" might be designed systematic and not accidental.
They suspect complicity with the Big.
Possibly a E.J.Snoden-like person gave the wrong compilation to the outside world.

They find Edison's apology whining embarrassing.

 

[Rigby]

Since you mention FastMail and Tutanota, by any chance, do you happen to have any comparison between the two from personal experience? I am on FastMail and find Tutanota to be a more expensive solution than FastMail, feature-to-feature. However, don't know about encryption and FastMail.

I've had both (and still have a Tutanota account). They are quite different. The main advantage of Tutanota is that is has zero-knowledge encryption (i.e. once the mails are stored even Tuta can't read or scan them, and even if others got access e.g. by hacking, law enforcement request or a bug, your emails would still be safe), as well as end-to-end encryption when communicating with other Tuta users.

Fastmail has no such thing, so you have to rely on their promises when it comes to privacy, and in case of a breach your emails could be exposed. Otherwise they are a very good email provider IMO, and one of the few that support push email with the stock iOS Mail app.

This comes with some disadvantages too: Tuta cannot be used with standard mail clients. Their mobile app isn't all that great (it's basically a web app and some things are quite slow), and you cannot use it with a standard desktop client (they have no equivalent to Protonmail's Bridge). They also currently don't have a way to import/export mails in bulk, so migration to/from Tuta is an issue (but they are supposedly working on that).

But their prices are actually really good. For $1/month you get aliases, custom domain support and 1GB of storage. Fastmail starts at, what, $3/month?

 

[SuperMatt]

It’s actually also Apple’s fault. It affords it’s own mail client the privilege to continuously work and fetch from the background, therefore not requiring a server for push notifications.

This privilege is not afforded to other mail clients - and thus the only way to deliver push notifications is by setting up a server in the middle which, unfortunately, means that server requires access to your email. Either through token or username/password. It is not possible to handle this entirely on the device.

This isn’t true. Push notifications are not limited to Apple’s Mail app. Most email servers support push notification. I use outlook for iOS and it doesn’t require setting up a special server to do the push notifications.

 

[Apple_Robert]

I've had both (and still have a Tutanota account). They are quite different. The main advantage of Tutanota is that is has zero-knowledge encryption (i.e. once the mails are stored even Tuta can't read or scan them, and even if others got access e.g. by hacking, law enforcement request or a bug, your emails would still be safe), as well as end-to-end encryption when communicating with other Tuta users.

Fastmail has no such thing, so you have to rely on their promises when it comes to privacy, and in case of a breach your emails could be exposed. Otherwise they are a very good email provider IMO, and one of the few that support push email with the stock iOS Mail app.

This comes with some disadvantages too: Tuta cannot be used with standard mail clients. Their mobile app isn't all that great (it's basically a web app and some things are quite slow), and you cannot use it with a standard desktop client (they have no equivalent to Protonmail's Bridge). They also currently don't have a way to import/export mails in bulk, so migration to/from Tuta is an issue (but they are supposedly working on that).

But their prices are actually really good. For $1/month you get aliases, custom domain support and 1GB of storage. Fastmail starts at, what, $3/month?

Have you updated the Tutanota app recently? I have found it to be easier to use than the older model. It also seems to be fairly fast. I haven’t had any problems with it.

 

[Rigby]

Have you updated the Tutanota app recently? I have found it to be easier to use than the older model. It also seems to be fairly fast. I haven’t had any problems with it.

Yes, I have the app on my phone. What bugs me the most is that it often shows the spinning wheel for an annoyingly long time before it opens your inbox. The Protonmail app is much snappier. It also can't show sender and subject in notifications if the app isn't open.

 

[Nütztjanix]

From the specs listed in your profile of your iMac... you are running High Sierra. Apparently this issue began in Mojave and has continued over into Catalina. I switched from Sierra to Catalina recently and that is when this issue began for me.

I have Mail running in the background for what seems like forever. At least since 10.4 Tiger. Ever since fullscreen apps in splitscreen were introduced, it's sharing a fullscreen space with Music. I never had this occur to me, not on Mojave and not on Catalina. I do not have a Gmail account, though.

 

[Rigby]

It’s actually also Apple’s fault. It affords it’s own mail client the privilege to continuously work and fetch from the background, therefore not requiring a server for push notifications.

This privilege is not afforded to other mail clients - and thus the only way to deliver push notifications is by setting up a server in the middle which, unfortunately, means that server requires access to your email. Either through token or username/password. It is not possible to handle this entirely on the device.

This is not really true. The stock Mail app does not have any special background fetching privileges (that would eat too much battery life anyway). And it does not support push email with most providers, including e.g. Gmail. Those providers that do support it, have either figured out how to send push notifications to the Mail app, or use Exchange Activesync instead of IMAP.

Also, I suspect push notifications are not the only reason why Edison acts as a man-in-the-middle. It's probably much more efficient for them to run their AI datamining scanner in the cloud, and some other features such as snoozing are also better done on the server side.

 

[chucker23n1]

Why the hell do E-mail accounts EVER cross paths? The E-mail client should be making a direct IMAP connection to your account. There should be nothing stored on the company's server nor should there be any credential saving.

Every E-mail client I've used in the 25 years I've been using E-mail clients has made a direct IMAP connection to the server. In order for you to be seeing someone else's E-mails that means the company must be caching them somewhere that's not your device. Why the hell??

It basically boils down to limited background abilities in iOS. But, two reasons:

• the only way for a third-party e-mail client to implement background e-mail fetch for arbitrary mail servers is to have credentials on a server somewhere, and have that server send messages to Apple's push notification service.
• increasingly, clients like this use processing as a value add, and again, that's something that makes more sense to run in the background.

[automerge]1589729306[/automerge]

I have Mail running in the background for what seems like forever. At least since 10.4 Tiger. Ever since fullscreen apps in splitscreen were introduced, it's sharing a fullscreen space with Music. I never had this occur to me, not on Mojave and not on Catalina. I do not have a Gmail account, though.

This problem started appearing for me a year or two ago. It's definitely real. If I have an app in full-screen while it happens, Mail will suddenly enable Split View. If I don't, Mail will open and focus its main window.

(I do have a Gmail account.)
[automerge]1589729399[/automerge]

This is not really true. The stock Mail app does not have any special background fetching privileges (that would eat too much battery life anyway).

It absolutely does.

And it does not support push email with most providers, including e.g. Gmail. Those providers that do support it, have either figured out how to send push notifications to the Mail app, or use Exchange Activesync instead of IMAP.

Mail doesn't support IMAP-IDLE, but it does support push over Exchange ActiveSync, and it also has a proprietary mechanism for IMAP push. Both of those are implemented in ways third parties cannot emulate.

Also, I suspect push notifications are not the only reason why Edison acts as a man-in-the-middle. It's probably much more efficient for them to run their AI datamining scanner in the cloud, and some other features such as snoozing are also better done on the server side.

Yes.
[automerge]1589729454[/automerge]

This isn’t true. Push notifications are not limited to Apple’s Mail app. Most email servers support push notification. I use outlook for iOS and it doesn’t require setting up a special server to do the push notifications.

If you use Outlook for iOS, you're storing your e-mail credentials on Microsoft's servers, regardless of whether or not your e-mail account is with Microsoft.

 

[Rigby]

It absolutely does.

The Mail app runs constant fetching in the background? I don't think so.

Mail doesn't support IMAP-IDLE, but it does support push over Exchange ActiveSync, and it also has a proprietary mechanism for IMAP push.

As I wrote. And some 3rd party email providers (Fastmail, Mailbox.org) can send APNS notifications to the Mail app.

Both of those are implemented in ways third parties cannot emulate.

Of course they can. Both Spark and Airmail on iOS support Exchange ActiveSync, and the Fastmail, Protonmail and Tuta apps supprot push notifications. The issue is that it requires support by the email provider, but that is true for the stock Mail app as well.

 

[1144557]

If you use Outlook for iOS, you're storing your e-mail credentials on Microsoft's servers, regardless of whether or not your e-mail account is with Microsoft.

True, but MS also hosts how many million 365/Exchange accounts in the cloud which obviously means MS holds credentials to all of those?

That or some indie dev with an already questionable track record? Easy answer.