Posted on the previous submission for this: it’s a good start, but from the article:
If what you need is a guarantee that your data remains only in the EU, we don’t have that, and we’d rather tell you directly than let you assume otherwise.
For me this is already a better value proposition, as less value add happens in the US. With the US being a perpetrator in trade war against the EU, even this matters. Everything counts, in large amounts...
Anyone who cares about security won't accept "reassurance" anyway. They would use end to end encryption like PGP or similar and not worry about the middlemen.
They found a cheap way to please the kind of customers who care much about their activism and not much about reality. A good business decision with little risk and a potential upside.
To believe your data is any better protected here or there is already unrealistic, and the admiration for the European Union for data privacy among hacker circles is unfounded. But if many people believe something false, you as a business should give them what they ask for and not try to educate them.
Yeah this I think captures my initial feelings in my post better than I could have put it.
Any business that has strict guidelines won't touch this. As there's no real guarantee, and more importantly they have given themselves an out.
Whilst I like fastmail as a product, personally I would have waited to get everything in the EU before I launched this, as you've now got to relaunch it once you solve that last mile problem. Which is hard and costly.
To respond to both of you above. Setting up two of these at once would have increased both the up-front cost (hardware for something like this is well north of a million USD) and the complexity and associated risks. Yes, it's partly a "people want it for their own reasons and we should offer it if it's viable" and partly a "it's good to have service in multiple jurisdictions and experience with them in advance of any further balkanization of the internet".
Re-launching might be costly, but dropping millions more on a second location and splitting our systems more would hav been much riskier (note: many of our customers with 'fastmail.com' addresses have chosen the EU region, we can't segment MX records at a tighter boundary than domain level).
So we do what we can - when you login with username and password, the password is only sent to your region's server (based on a lookup from the username which MUST be global, so it works regardless of which of our servers you hit). If you send a username which doesn't exist, we distribute you to a random region in the same percentage, so you can't use it as an existence oracle.
To think that your data is safe in the EU while the EU is actively pursuing ID checks for social media and pushing Chat control every 6 months is delusional. No, your data is not safe here. If the EU wants it, it will get it.
This cult of the EU privacy needs to stop. The EU wants the same access that the US intelligence has but for some reason, some people don't believe it and defend tooth an nail this idea that things are better here.
Just so you are aware, Europol was lobbying to have access to all text messages/emails in the EU at will without a warrant as part of Chat Control V2. Say what you want about the 5 eyes countries, this is no better.
If tomorrow the EU wants access to your data, Fastmail will give it just like it will give it to the US, to the UK or to Australia.
Wow they completely missed the ball on why people want reassurances that their data stays in the EU
I think they just know what they can and can't guarantee.
Agreed. I imagine they’ll announce an EU-only option later once they get more EU infrastructure in place
As long as they are owned by a 5-eyes nation, there's no alternative they can offer.
Instead, look to Exoscale, Proton, Infomaniak, or Scaleway.
Disclaimer: I work for one of 'em.
For me this is already a better value proposition, as less value add happens in the US. With the US being a perpetrator in trade war against the EU, even this matters. Everything counts, in large amounts...
they also said in the article it is dependent on them standing up a second EU region. this is simply an announcement of their first.
Anyone who cares about security won't accept "reassurance" anyway. They would use end to end encryption like PGP or similar and not worry about the middlemen.
They found a cheap way to please the kind of customers who care much about their activism and not much about reality. A good business decision with little risk and a potential upside.
To believe your data is any better protected here or there is already unrealistic, and the admiration for the European Union for data privacy among hacker circles is unfounded. But if many people believe something false, you as a business should give them what they ask for and not try to educate them.
Yeah this I think captures my initial feelings in my post better than I could have put it.
Any business that has strict guidelines won't touch this. As there's no real guarantee, and more importantly they have given themselves an out.
Whilst I like fastmail as a product, personally I would have waited to get everything in the EU before I launched this, as you've now got to relaunch it once you solve that last mile problem. Which is hard and costly.
To respond to both of you above. Setting up two of these at once would have increased both the up-front cost (hardware for something like this is well north of a million USD) and the complexity and associated risks. Yes, it's partly a "people want it for their own reasons and we should offer it if it's viable" and partly a "it's good to have service in multiple jurisdictions and experience with them in advance of any further balkanization of the internet".
Re-launching might be costly, but dropping millions more on a second location and splitting our systems more would hav been much riskier (note: many of our customers with 'fastmail.com' addresses have chosen the EU region, we can't segment MX records at a tighter boundary than domain level).
So we do what we can - when you login with username and password, the password is only sent to your region's server (based on a lookup from the username which MUST be global, so it works regardless of which of our servers you hit). If you send a username which doesn't exist, we distribute you to a random region in the same percentage, so you can't use it as an existence oracle.
Absolutely spot on.
To think that your data is safe in the EU while the EU is actively pursuing ID checks for social media and pushing Chat control every 6 months is delusional. No, your data is not safe here. If the EU wants it, it will get it.
This cult of the EU privacy needs to stop. The EU wants the same access that the US intelligence has but for some reason, some people don't believe it and defend tooth an nail this idea that things are better here.
Just so you are aware, Europol was lobbying to have access to all text messages/emails in the EU at will without a warrant as part of Chat Control V2. Say what you want about the 5 eyes countries, this is no better.
If tomorrow the EU wants access to your data, Fastmail will give it just like it will give it to the US, to the UK or to Australia.
One needs multiple data centers in europe for backup and DR, sounds like they have one