Hacker News new | ask | show | jobs
by spapas82 1953 days ago
K-9 is a really great mail app for android! In my opinion it's the best app if you want to use a custom SMTP/IMAP server instead of using a solution like hotmail/google/etc.

It also has PGP support (with the help of OpenKeyChain to manage certificates) that works great! There are no other well known solutions for applications supporting PGP in Android; this is huge.

People that either want to avoid walled gardens or need proper encryption to their mail need to support this project!

5 comments

> the best app if you want to use a custom SMTP/IMAP server instead of using a solution like hotmail/google/etc

IMHO, it's also the best if you're using Gmail: Google has been breaking its UIs for years (both on the app and on the web), especially for people like me who try to use proper quoting and signatures, or to send plain text emails. Apart from some glitches with reflow, K-9 does that very well even with Google as email provider.

I can't compare against Microsoft products since I've never used them on mobile, but seeing how horrible Outlook is on the desktop for plain text emails (and that's not an hyperbole), I bet K-9 is better as well.

jesus christ gmail is absolutely unusable both on the desktop and on mobile.

the only way to make it usable again is to switch to the plain html mode, that uses no javascript, loads very fast, and reminds me a lot of the first gmail ui, back from ~15 years go.

I've really enjoyed using the Simplify Gmail extension when I use Gmail on desktop. Just launched a new v2 that's very nice.

https://chrome.google.com/webstore/detail/simplify-gmail/pbm...

I'm having none of that crap.

Injecting non-google code inside my gmail window sounds like a very dumb idea to me, honestly.

I already trust google very little and keep my gmail inbox because I'm basically being coerced/forced to (no gmail = no apps on android)... The last thing I want is adding another entity to the picture.

Imagine if they just used an SSE or mixed-replace to update the plain html version in real-time when messages are received without JS. But we can’t have that (Google even unilaterally disabled mixed-replace in blink/Chrome/Chromium (except for continuing to support MJPEG) many, many years ago so no one else can do that either).
Imagine if they had just fu--ing kept gmail lean and slick as it was in the first days.
What's a mixed-replace update?
One thing that confuses me about iOS devices is when a gmail account is added to the mail program. It isn’t clear if it is adding SMTP/IMAP or if it is doing some web app type configuration and if that gives Google more access to track device activity.
This sounds like the modern OAuth-based sign-in flow (for IMAP and SMTP connections, authenticated by OAuth).

This helps avoid app-specific passwords when you use 2FA, and lets users use their regular sign-in flow (which could include enterprise SSO, TOTP, U2F key etc).

I imagine that there's the ability for Google to set some cookies as part of that process, although knowing Apple, would not be surprised to learn they had sandboxed that instance of the browser, to prevent cookies persisting into regular Safari.

I like FairEmail too... it also supports PGP.

https://f-droid.org/en/packages/eu.faircode.email/

That one supposedly has source code available under GPL3 but despite GPL3 clause 9, which says "You are not required to accept this License in order to receive or run a copy of the Program", presents the GPL3 as an EULA and refuses to run unless the user clicks "I agree".
"I agree" is presumably shorthand for "I agree to the linked license", or in other words "I agree to the GPL3", or to expand that, "I agree that I am not required to accept this License in order to receive or run a copy of the Program". Since that's part of the GPL3 text.

So I wouldn't worry about it.

That page links to their GitHub:

https://github.com/M66B/FairEmail

I can't be any less of a lawyer, but that sounds OK to me. One is not required to accept the license merely by virtue of it's having been published under that license, but this is surely compatible with the author adding extra conditions to run their program if they so wish?
The copyright holder is not bound by the license granted to others, so in general is legally permitted to add any additional restrictions. However, as this particular additional restriction is not one of the additional restrictions that GPL3 section 7 permits, section 10 applies to anyone other than the copyright holder, which states "You may not impose any further restrictions on the exercise of the rights granted or affirmed under this License." This is a problem for e.g. F-Droid's package, which is neither distributed by the author nor distributed in accordance with the terms of the GPL.
Thanks for enlightening me :)
Our of curiosity, has this been raised with the developer?
Not by me. The developer is, as far as I am aware, not doing anything illegal, and while F-Droid technically are, the developer as the copyright holder is the only one who could possibly take any action against it and is, I would expect, happier with F-Droid doing what they are doing now than with patching out the EULA acceptance screen.
I didn't know of this one, that looks really nice! Do you know why they chose to start over when K9 already existed for a long time (it says copyright 2018-2021 on the website), or is it a fork?
FairEmail was made from scratch, and has modern (from the ground up) sync logic, that works well with modern battery saving measures in Android. Push mail by default, and low power consumption during sync. I believe it actually works better than Gmail (which has the advantage of Google's push infrastructure) - FairEmail just uses IMAP idle (where possible).

K9 originated in the old android AOSP email app, and I think the developer of FE wanted to cut loose from that and build it according to newer design patterns.

>It also has PGP support (with the help of OpenKeyChain to manage certificates) that works great! There are no other well known solutions for applications supporting PGP in Android; this is huge.

As a caveat here, at least in the non-beta version, support for PGP signatures is intentionally crippled because the original author dislikes them and apparently wants to push encryption (eg, https://github.com/k9mail/k-9/issues/2375), ignoring everyone who points out that this feature may be important or required by policy for them. By default, PGP signatures on unencrypted emails are silently hidden and the emails are displayed as being unsigned. There is no way to sign emails by default, and trying to sign an email results with a popup telling you not to.

For clarity, the author doesn't like unencrypted but signed emails. Which strikes me as weird but at least it isn't something that people would normally do. They are OK with encrypted and signed emails and presumably encrypted but not signed emails. Here is the rationale:

* https://k9mail.app/2016/11/24/OpenPGP-Considerations-Part-I....

I think there are implementations out there that don't let you send encrypted but unsigned messages (anonymous encrypted). This stuff seems to bring out the enforced opinions in people.

I'm a little miffed that this comment has a better explanation of "why I should care about K-9 Mail" than anything I could find from deliberately looking for that information on their site. The "about" page just talks about the team, and their blog posts, even the one "what's up with K-9?" just talk about release schedules.
K-9 Mail never had a PR or marketing person. But help in that area would certainly be welcome.

What information would you like to find on the website exactly?

Just that by going to "about" I could find some "why K-9" page that explains what's great about it esp. compared to alternatives.
The features are listed on the homepage
The features are listed, but they're not clickable for further details. Things like "light and dark theme" could show screenshots. In fact, I can't find any screenshots at all on their site, except for the one on the front page.
K-9 Mail is great indeed. Particularly that it is available on F-Droid as I don't want to create a google account so won't/can't use their playstore.