Our sysadmins will replace two switches in our network Thursday January 9 at around 18:00 CET (12 noon EST). This will probably cause some short periods of downtime for the Runbox email services while traffic shifts from one path to the other.
No email will be lost or rejected as a consequence of this maintenance. Our US based web hosting services will not be affected.
2013 was the year online privacy really came to the forefront of people’s consciousness, after the surveillance revelations especially in the US and the UK. This had a significant impact on Runbox, whose location in Norway made it the service of choice for many people who were concerned about email privacy.
This in turn increased our focus on privacy and security, and over the past 6 months we have taken steps to improve the security of our services further.
We are now investing heavily in new hardware and are deploying privacy features such as support for PGP encryption in order to push Runbox to the forefront of email security and privacy globally.
So thank you for supporting Runbox in 2013 — let’s make next year even better!
To highlight the importance of online privacy, we have created two privacy-themed Runbox T-shirts now available from our Cafepress store.
In line with our values they are of course organic, which also means they’re a little pricier than your regular T-shirt.
But as a Runbox member, you will receive a free year added to your subscription when purchasing one or more of these T-shirts.
They are currently available in two colors, one for men and one for women.
Just forward your receipt to billing@nullrunbox.com and we will happily extend your subscription by one year!
In order to further increase the security of our services we have now installed an Extended Validation SSL certificate on our main website https://runbox.com.
The certificate is issued by the WebTrust certified certificate authority GlobalSign and verifies that Runbox Solutions AS owns and operates the website and domain name runbox.com.
The Extended Validation SSL (Secure Sockets Layer) certificate provides the strong encryption included with regular certificates, and additonally validates our company’s identity by showing our company name and country code in green to the left of the browser address bar:
Extended Validation certificates are only issued after rigorous vetting to verify the legal identity and physical presence of the website owner, establish their exclusive control over the domain name, and confirm the identity and authority of the individuals acting for the website owner.
This Extended Validation certificate also covers https://secure.runbox.com and https://www.runbox.com. Other runbox.com subdomains are still using a regular SSL certificate, which has the same encryption level but not the “green bar” identity validation.
In recent weeks there has been some discussion in news outlets about SSL/TLS, which is used by many websites to encrypt the data being transferred between web servers and web browsers.
Since it’s theoretically possible for outsiders to break such encryption, an increasing number of people are requesting improved encryption methods.
SSL (Secure Sockets Layer) and its successor TLS (Transport Layer Security) are cryptographic methods used to secure communication on the Internet. By using pairs of private and public keys, the web server and the client can securely encrypt and decrypt the data being transferred between two parties.
When a web browser connects to a website protected with SSL or TLS (indicated by a padlock icon in the browser) it receives the public key from the server, which is then used to encrypt the subsequent communication. The data can only be decrypted using the private key, which resides on the server.
However, if someone was able to break in and copy the private key from a server, they would theoretically be able to decrypt any communication to/from that server — provided that they were also able to eavesdrop on the communication.
To counter this it’s recently become possible to configure web servers to issue a unique key pair for every single connection, and immediately destroy the keys once the session is complete.
This method is called Forward Secrecy because it prevents anyone from retroactively breaking the encryption.
Runbox has now implemented Forward Secrecy in order to further improve the security and privacy of our services. It’s now virtually impossible to eavesdrop on the data being transmitted between your web browser and Runbox’ web servers — and you don’t have to do anything in order to enjoy this new level of security.
For those who are interested in the technical details, here is an analysis of the security provided by https://runbox.com, which is now our main address:
In order to improve the security of our email services have moved our front page to a new and upgraded server running Runbox 6 at https://runbox.com.
In preparation for this we have modified Runbox 6 to redirect Runbox 5 users to the corresponding server, if your account settings indicate that you have not yet upgraded to Runbox 6.
In other words, if you have been logging in at https://rmm6.runbox.com and have never clicked the “Switch to Runbox 6” button in Runbox 5, you will be redirected to Runbox 5.
To continue using Runbox 6, please click “Switch to Runbox 6” at the bottom of the folder list in Webmail.
There has been some discussion about our recent modification in Runbox 6 to place signatures at the bottom of replies and forwarded messages instead of above them. Some people prefer top-posting, while others adhere to the more traditional bottom-posting style.
So… We’ve now added an option to choose whether your signature should appear above or below quoted text! You will find the new option under Signature in Preferences.
Runbox has recently been mentioned in a Der Spiegel article about the growth in demand for secure communication and email privacy.
Read the full article here: NSA Surveillance: Demand for Mail Encryption grown by leaps and bounds (translated from German)
In Webmail > Compose (Runbox 6 only) you now have the option to save the recipients of a message in Contacts.
This option is found next to the Send button, and if checked, it will add any recipients to Contacts that aren’t already listed there. The new contacts will be saved in a separate Group called “Auto-saved” to make it easier to find them in Contacts.
The next time you compose a message, the saved recipients will show up in the Groups and Contacts list to the right. They will also appear as suggested matches when you start typing in the recipient fields.
In the last few days we have seen an increase in inquiries about privacy and security, and particularly whether Runbox could be involved in programs similar to those outlined in the recent allegations about interception of communications data by law enforcement agencies.
As a Norwegian company and service, Runbox is protected by Norwegian law and privacy regulations because all our email servers are located in a secure facility in Oslo, Norway. No entity, domestic or foreign, can access email or files stored in our data center without a Norwegian court order.
You can read more about US, European, and Norwegian privacy regulations here: Email Privacy and Offshore Email
To protect data being transferred to and from the Runbox servers in Norway, it’s important to use encryption such as SSL (Secure Sockets Layer) which is available both in the Runbox Webmail and in email clients.
When using Webmail, make sure that the SSL padlock icon is visible in the browser’s address bar and that the domain’s identity is verified as runbox.com.
In email clients such as Outlook and Thunderbird, set up your Runbox account with SSL according to the instructions found on our IMAP help page.
Runbox plans to extend our encryption support in the near future to allow complete encryption of messages all the way from sender to recipient.
