Mail

@mochela.it mailboxes on a self-managed server: no ads, no profiling, no reading your messages to "improve the service".

You read and send mail with a program on your own device (Thunderbird, on Android too, Apple Mail, …). There is no webmail, by choice: it is one less page exposed on the Internet, and messages stay where you can encrypt them.

Who has a mailbox

Mailboxes are reserved for people taking part in the mochela.it experiment, by invitation. They are not open to the public: people who are invited receive a participation form to fill in.

Setting up your mail program

Usually entering your name, address and password is enough: the program finds the servers by itself, because mochela.it publishes the right settings. If you need to enter them by hand:

User name: the full address. Password: your normal one, or an app password (recommended on your phone).

Your account

From the Log in page (that is, posta.mochela.it/account) you change your password, turn on two-factor authentication (a code from an app on your phone), create passwords for individual apps and upload your OpenPGP key.

• Two-factor authentication: turn it on. With a password alone, whoever finds it out gets in.
• App passwords: one per device. If you lose your phone, you delete only its password.

OpenPGP encryption

OpenPGP locks the content of a mail so that only whoever has the right key can open it. You create the secret key and keep it yourself, on your own devices: it never reaches the server.

1. Create your key

In Thunderbird: Account Settings → End-To-End Encryption → Add Key. Or with GnuPG, from a terminal. Keep the passphrase that protects it and a copy of the key safe: if you lose it, messages encrypted with that key can no longer be opened.

2. Make it findable

Send your public key to info@mochela.it from your mochela mailbox: that way we know it is really yours, and we publish it in the mochela.it key directory (the Web Key Directory). From there Thunderbird, GnuPG and many other programs find it by themselves when someone writes to you, and encrypt without you having to send it to anyone.

You can also send it on SimpleX: in that case, before publishing it, we ask you to confirm with a mail to your mailbox. The servers check every five minutes that the published keys are still the right ones.

If you like, put it on keys.openpgp.org too, which first checks by mail that the address is yours.

3. Encrypt the mail you receive as well (optional)

In /account you can upload your public key: from then on every incoming mail is encrypted before it is stored, including those that reach you in clear, and not even whoever runs the server can read them anymore. The price: you can read them only where you have your secret key. Messages that arrived before stay as they are.

Chat with SimpleX

With your mailbox you also get access to the two mochela.it SimpleX servers. SimpleX Chat is an app for messaging with no phone number and no user name: the servers pass on encrypted messages and do not know who is talking to whom.

In the welcome mail you will find the addresses of the two servers (also as QR codes) and how to add them in the app. Keep them to yourself: they contain a password. People who write to you do not need them, and can use any servers they like.

Rules

Anyone using mochela.it mail accepts the solidarity pact: few rules, but clear ones. The pact also says what we know about you: which data the server keeps, where and for how long.