Full disclosure: I am the maker. I am not here to tell you it is perfect. I am here because this community is best at finding the holes, and I would rather you find them now.
Elusive (elusivemail.xyz) is encrypted email. The thing I care about is honesty over claims. The landing page has a two-sided ledger showing what is sealed to your key versus what the server can see. Most services bury the second half. I put it front and center.
Sealed to your key: message bodies, subject lines, attachments, the sender and recipient of every stored message, and in keyfile mode the key itself. Visible to the server: who a message is from and to at the moment it passes through, your account details, and incoming mail the instant it arrives, before it is encrypted to your key.
The crypto: keys are generated in your browser (OpenPGP.js, curve25519, Argon2id). Your password never leaves your device, the server only stores a hash, so it cannot derive your key. End-to-end by default, plus a keyfile mode where nothing stored can decrypt your mail.
Where I will not blow smoke: incoming external mail is plaintext at receipt, the envelope is visible at delivery time to route mail (no logs), and it is closed source right now.
The whole plan is public and numbered on the roadmap (elusivemail.xyz): open source everything at 300 users, then a public API, native apps, our own hardware in Switzerland, a multi-server split so no single machine holds everything, an independent audit at 4,000, and eventually an encrypted communicator and drive. If a number slips, the page says so. Watch the roadmap, not my word.
It is free, no ads, I make no money. What would make you trust it, or not? What did I get wrong?
Haha, I chuckle at everyone shitting on it already like they've never used A Gmail, hotmail, or icloud account who are way worse than what you're stating.
Plus, it's a test, you're not asking people to migrate their whole lives to it.
Anyway, as an up-and-coming service/provider, its nice to see competition in this space. I do have a few questions:
They could start taking donations, but it is worth asking the question to get them thinking about future plans
Apreciate this, genuinely.
Thanks for the quick reply. Looks like you're at 12 users now on your website. Count me a 13 haha.
I'm not good at reading through the code, but I test features, function, errors, holes, etc. I'll do what I can.
Haha, thanks, I appreciate that. Let me know how you get on with it. I'd love to hear what works, what doesn't, and anything that feels off. And yeah, keep an eye on that 300-user milestone. 😉
OK, question(s):
Sorry you waited 15h for this, solo project so answers come when I'm awake. Good questions:
NP. Thank you for the clarification. Honestly, unless others have encrypted email on their end, what OpenKeychain and Thunderbird offer is also almost pointless as it won't remain encrypted. I just thought it might be nice if multiple services were more so widespread using common interchangeable or compatible protocols.