00:00 Hello, I'm Seth For Privacy and welcome to season two, episode one of Opt Out. Opt Out's a show where I sit down with passionate people to learn why privacy matters to them, the tools and techniques they found and leveraged, and where we encourage and inspire others towards personal privacy and data sovereignty. In season two, we're taking a look at some of the privacy-preserving tools, FOSS projects, and privacy-centric companies in the space to get a better understanding of what they do well, what their limitations are, and what we all could do to help drive their tools forward.

Have you heard about email alacing but not really sure where to start? This episode, we're going to sit down with Son from SimpleLogin to chat about email aliasing. Welcome on to Opt Out, Son. Hey, yeah, thanks for having me. Yeah, I'm really excited to kick off season two with SimpleLogin since it was actually the first episode of Opt Out where I learned about SimpleLogin from Henry from Techlore as it was one of the tools that he highly, highly recommended.

And I had never explored email aliasing at all or even SimpleLogin, but I have been absolutely hooked on the service ever since. So I'd love it if you don't mind just quickly introducing yourself and what SimpleLogin is for any listeners who aren't familiar with you. Yeah, so my name is Son. So I'm living in France now. So I created SimpleLogin two years ago in order to take control of my mailbox. So initially, it was something I created for myself, but then I realized that it can be useful to other people as well.

And that's when I, you know, I build the product and start talking about it. Awesome. Yeah, yeah. It's definitely a powerful service. And I know a lot of email providers allow some simple email aliasing with like catch-all mailboxes and that kind of thing. But I feel like SimpleLogin just makes the process very, very smooth, especially the browser extensions and mobile apps that make it easy to generate those aliases whenever you want, however you want and use those broadly.

But before we dive too deeply into SimpleLogin, I'd love to just hear a little bit from you about what it was that woke you up to the need for personal privacy. Yeah. So about 10 years ago, I worked for an advertising company. So I know quite well how to track people, you know, via cookies, via browser, fingerprinting, etc. And so I kind of, you know, I'm always conscious about what information I'm sharing online and how to protect my privacy. But I was really interested in protecting my privacy about two or three years ago when I tried to follow the inbox zero principle, meaning that I tried to keep my inbox as clean as possible.

And somehow I still see a lot of emails that are sent to my inbox without my permission, meaning that I don't remember giving them the permission to send me emails. And I also noticed that I received more and more calls, phone calls from unknown people, you know, trying to convince me to buy something. And yeah, so I see that my privacy is not protected enough. And because I used to work in advertising, I know that our data is bought online quite often.

Like companies can sell our data to other companies and they can use the data to, you know, to enrich their data in order to learn more about us and to send it more and more personalized advertising message. Yeah. And you mentioned that you actually created SimpleLogin for yourself initially and then decided to share it. What was it exactly that made you decide to share SimpleLogin as a service that other people could use after creating it for yourself?

Yeah. Yeah. Yeah. So I always wanted to be an entrepreneur. So I worked on several products in the past. Most of them fail. Yeah. But then when I worked on SimpleLogin, I see that there's no such product on the market yet, at least in the way that I want it to be. And I thought to myself, why not, you know, making the product a little bit easier to use, creating an interface for it, you know, and create my own product, trying to build my company.

Awesome. Yeah. Yeah. I've really enjoyed the simplicity of, like I mentioned, all the different platforms. But it's very easy to manage the different aliases that you set up to see when the last email was sent to them, when they were used last, and obviously to very quickly and easily disable any of these aliases that maybe do get put onto a mailing list you didn't agree with, or maybe a service that you just wanted to use that one time and not worry about emails in the future.

So I really do enjoy how simple it is to actually manage the aliases, because obviously that's the key part of what SimpleLogin allows is for you to create those email aliases that they forward to another email address or mailbox that you have, but let you really create, let you quickly create custom aliases you can use per service, per account that you have, per subscription that you sign up for, maybe like an email newsletter or something like that.

But really, really does simplify that process of I've enjoyed using it. But what is it that you would hope that users get from using SimpleLogin? Yeah, I would say the one thing that I want users to benefit from using SimpleLogin is to be less prone to phishing attempts. Because I see that recently, like myself, I received more and more phishing emails. And these emails, they are so personalized, that is very easy for someone, you know, to click on the link or to give out the information.

And using email aliases can solve this problem. Because if, let's say you create an email aliase for your bank account, and someday you receive an email from an e-commerce website to your bank account. You can know immediately that you can know immediately that this one is a fake email. It's a phishing attempt. And you can be more cautious when dealing with this kind of email. And because phishing is actually, I would say, the most dangerous threat that we have nowadays.

And being able to detect phishing attempts is very important. So until now, I see that email providers like Gmail or Outlook, they are quite good at detecting spams. But they are less and less efficient doing that because spammers, they become more and more intelligent. They have more and more data about us. So they can customize the emails. They can prepare a campaign so carefully that it's very hard for a non-tech person to detect. So I would say that's the most important thing about using Symbologin.

And the second thing is to be able to hide our digital identity. Because advertisers, they use to check us via cookies. But cookies are now, I would say, blocked by most browsers. And so using cookies is not as efficient as before. So they turn to use browser fingerprinting. But same thing applies here. It becomes more and more difficult. So naturally, they will use other unique features about ourselves, such as the user. So we can use email, phone number, or maybe IP address.

And with IP address, we can hide IP address using VPN. But there's no way to hide our email address if we use the same email address everywhere. It will become our digital identity. So it's very easy to check someone from website to website with their email address. And by using a different email address for every website, it becomes much harder to kind of link together our navigation on the internet. Yeah, it's one of definitely, I think, the underrated features of using an email aliasing service is, like, you definitely do get those advantages against phishing and against spam, being able to easily disable an alias.

But the ability to...

10:00 at least gain some pseudonymity when using different online accounts because you're able to create those unique aliases for each account that you have and each service that you use. You can make it a lot harder for them to correlate across those services that you're the same person and make it a lot harder for people to easily tell kind of who you are just because you're using that same email address everywhere you go. And it's very much the normal practice to just have one email address and use that with literally every account you have online. But like you mentioned, it's a very easy way that people who can get access to that data, like data brokers or governments, any other company that's kind of correlating that data across services. It's easier for them to use that email address that you use for every service that you have online.

It's easy to track that across those different services. That's a very important feature there. And that's probably one of my favorites is just the ability to create an account and not have to worry that it's very, very easily linked back to me through the unique email address through simple login. So definitely, definitely one of my favorite features there. And I'd love to kind of shift and talk a little bit about some of the limitations that users should be aware of when using SimpleLogin.

I think probably the clearest one is just that obviously, when you send the email through simple login, rather than straight to your inbox, like when you receive an email that way, obviously, SimpleLogin does get visibility into that email. But what other limitations should people be aware of when they're using a service like SimpleLogin? Yeah, I would say like the most important thing, the most important limitation about SimpleLogin is the one that you just said is that an email is sent via SimpleLogin before arriving to your mailbox. So actually, we can, you know, in theory, we can, we can read the emails, we can extract information from the emails. But we don't do that, right. So sometimes you can have a little bit of delay before receiving an email. But it's kind of, I would say it's very rare. So because of the processing time, the average processing time on our server is less than half a second. So it's almost instant when you expect to receive an email. And if the email passed through SIM login, or if the email goes directly to the mailbox, they are

quite the same, you know, just maybe half a second away. Another thing about SIM login is to send an email from from the email. It requires an additional step. You can not just, you know, write your contact, you know, open a compose email, and send the email directly to, to your contact because in this case, the contact will know what is your real mailbox address. So on SIM login, you need to create something called reverse Elias for this contact. And by sending emails, an email to this reverse Elias, SIM login will send the same email, but from the Elias to the contact. So that requires an additional step. Yeah, so I would say, this has the most important limitations of using SIM login.

Yeah, thanks for thanks for bringing those down a little bit. I definitely like when I recommend SimpleLogin to people, I recommend they use it in a similar way that I do, which is that I don't send like personal emails between people through SimpleLogin. It's not really like the service isn't really designed for that as a way for you to communicate between people, at least kind of the approach that I take to SimpleLogin. But rather, I treat SimpleLogin like a way to proxy and manage emails from online accounts that I don't directly communicate with from like newsletters online, things like that, so that I know they're just mainly going to be sending me emails, I want to be able to more easily manage that control who gets access to my real email address. But then when I'm actually wanting to communicate with a person, I'm generally going to use my my direct mailbox itself. When I'm not worried about exposing my email address there, obviously, in those cases that I do want to keep that private

and keep my own email address private, I'll still use SimpleLogin. But I normally don't recommend it to people to proxy personal email, because obviously, like we talked about, SimpleLogin gets visibility into that. And so obviously, there's some some trust there that SimpleLogin doesn't abuse that or read those emails or do anything with that data. So I do try to minimize that I recommend people try to minimize what sensitive info goes through SimpleLogin. But obviously, like you said, like, y'all aren't aren't using that data and you you have a very strong reputation in the in the community to to handle that data well and then be a really solid and dependable service. So definitely thankful for that. And then there is also the kind of an option to help with privacy when using SimpleLogin, which is to have SimpleLogin GPG encrypt emails between SimpleLogin and the ultimate mailbox. It is important people don't realize or that they realize that that doesn't, again, hide the original email from SimpleLogin, but it does allow

you to have an extra layer of privacy in between SimpleLogin and your your kind of end final mailbox. Unless you choose if you want to provide GPG keys to your your email provider, which normally you wouldn't want to do, but gives you some some extra privacy tools there, which is a nice little addition that I've used quite heavily and enjoy using. Yeah, I just want to add something is actually it's quite it's quite easy to send an email from from an email or less. So apart from, you know, receiving newsletters or signing up on websites without revealing our real email address, SimpleLogin can also be used for business emails. So for example, our support email address is hi symbol login dot io, which is actually an alias.

And we got a lot a lot of questions from users every day. And we reply to them using the same alias. So anyone in the team can can reply using that alias. And in our team, everyone use a different mailbox service, you know, some email address. And that doesn't matter because all the emails are still sent from hi symbol login dot io. That's a really cool use case. I had not considered that at all. That's a great way to be able to share an email, an email address with with multiple people. That's fascinating.

Yeah. And another use case that, you know, at the beginning, we we hesitate to to split simblogging into two, into two different products. So first one is really about email address, hiding our online digital digital identity. And another product is for the entrepreneur community to to have an alternative to the Google workspace or your whole, you know, professional email service like this. So anyone, they can just buy domain and then using login on that domain and to create email address like hi at domain dot com or contact domain dot com.

You know, instead of buying Google workspace subscription, which is much more expensive. So for just saying that simblogging can also be used as I would say a live solution for business email. Yeah, it's definitely definitely unique one. I hadn't considered only I'd only thought about it from the kind of personal perspective. I hadn't considered the business use case there, which is pretty, pretty fascinating. Are there any other use cases that kind of jump out at you that that people might want to use SimpleLogin for?

Yeah. And as it is, and as it is case that I use personally is to filter emails. So, you know, if when I look at the destinations of the email, I can know that what are the emails for? If the destination is an alias for newsletters and I know immediately that this is this email is for a newsletter. And so using that I can create filters on my mailbox to classify emails into newsletter folder, into banking folder, into maybe finance folder, etc. And I find that quite, quite easy to do and more.

20:00 efficient than the default email classification engine provided by some email services. Nice. Yeah, it definitely does simplify things so you can quickly see which alias it's going to and have more control over the actual the to address that people are sending into. It does make it a lot simpler to filter things out there. Let's take a quick break from this episode to chat about the sponsors of OptOut, Cake Wallet and LocalMonero. Cake Wallet is a key tool that I use daily as it allows me to easily and quickly use Monero for private by default payments. It's available in both iOS and Android and is a fantastic way to get started buying and using Monero with a simple and easy to understand user experience. I regularly onboard new users to Cake Wallet and hope that it will help simplify and ease your journey into cryptocurrency. If you're interested in purchasing Monero for the first time or helping to bring others into a parallel economy, I'd recommend you look at using LocalMonero like I do to buy and sell Monero while maintaining your privacy and avoiding

invasive exchange surveillance. LocalMonero is entirely peer-to-peer and is an important part of opting out of the surveillance state and into a parallel economy. Thank you to both sponsors for their incredible support and partnership and I hope you'll take a moment after the episode to learn more in the show notes or at optoutpod.com/sponsors. And then what settings or features within SimpleLogin would you recommend that people take a look at or become familiar with when they first start to use SimpleLogin? Yeah, so SimpleLogin is meant to be, you know, the default setting in SimpleLogin is meant to be suitable for most people. So actually there's nothing to do when you start using SimpleLogin, just click on the small icon to create a new alias every time you are asked for a new email address and that would be all.

So if you want to dig more into SimpleLogin, the first thing I suggest is to try to send an email from the alias. So that would require creating a reverse alias, which might sound scary at the beginning, but actually just, you know, after the first email sent from the alias, the process is quite simple and kind of natural. And once you know how to send an email from the alias, you might be interested in learning more about PGP. I think not all people know about PGP. PGP is quite, you know, it might sound scary because it's about encryption and to an encryption you have to generate. And then you have to generate, you know, a public key, a private key, etc. to manage your key, to make sure that the keys are not expired, for example. But actually, if you use email services like Protomail, everything is handled transparently. So you don't have to, you know, to install a PGP software on your computer, generate a key, etc. And everything is still the same. You can still search for an email, you can still receive email,

sending email, etc. And yeah, so I would suggest to use PGP as much as possible. This way, you can be sure that even your mailbox service can't know what emails you are reading. So for example, if someday Protomail, you know, is bought by a big corporate, then we are sure that our emails cannot be read by, cannot be exploited by this big corporate. Yeah, it's definitely a feature worth looking into. It is very straightforward, especially like you mentioned, if you're willing to use the keys that are provided to you by good privacy preserving email providers like Protomail, Ctemplar. I think Tudonota as well provides you with the GPG keys that are used within your mailbox by default. And you can use that key with that SimpleLogin if you want to, again, provide that layer of encryption between SimpleLogin and your your ultimate mailbox, which is a really nice feature to have. And I hope people will get more familiar with using PGP and explore using it, at least as just kind of an alternative method for private communication. There's a lot of power there,

but it is definitely not the easiest, the easiest privacy tool to use. But I do enjoy that that simple login really does simplify that process of using it between SimpleLogin and your your final mailbox. It's very straightforward to set up and use there. I'd also love to hear if there are any competitors or alternatives to SimpleLogin and then maybe what makes SimpleLogin better or unique in your eyes there. Yeah, actually, before simlogin, there's a tool called SpamGourmet, which is an email service that I think this one was created 20 years ago. It's not a new shiny tool. It's something that has been there for a while.

And I actually like this tool a lot. So I learned about it by a simlogin user who introduced me to this tool. And when I try out this tool, I really like the community behind this tool. I don't like this tool itself because it's for me, it's too complex to use. And it's and and it's I would say it's too technical. It's only for for for developers, for for gigs. So everything is really complex there. But I really I really like the community. The how the community is support support the tool, the forum, how the forum is is active.

And I I want to to be similar in the same way, you know, being transparent, being transparent and and do not hesitate to ask for help on the forum, for example. So I would say SpamGourmet is the first one is the first email that exists. And after SpamGourmet, there's also 33mail, which is another email service. I think this one was created 10 years ago and is based on something called username. You can have your username and then after that you can you can create as many earlier as you want using your username.

I think this one is really easy to use, but it likes a lot of features. Like, for example, you cannot reply to a forward email. So it can be useful for receiving emails. But if someday you have to reply, then you are kind of blocked. And after 33mail, I think people mentioned a lot about unknown ID. I really so I don't use unknown ID, obviously, but I really like, you know, the the I would say the the vision. Everything about unknown ID, you know, is open source is transparent.

The developer behind unknown ID is is quite reactive as well. So for me, I have a lot of respect for unknown ID. I don't agree on the on the pricing. I don't agree on how features are implemented in unknown ID, for example. But apart from the technical details, everything else is I really like about about it. And recently, we also have Firefox with Firefox relay that provides email or as a service. I think it's very limited. So the beginning is, you know, you can only quit.

Finally, I think the email has to be really small. Now, the email size has to be less than 100 kilobytes or something like that. So basically, you can't attach an image in your email. And that's what's it. There's one thing that I don't like about it is using AWS. So Amazon Web Service for sending out emails. Yeah. So I don't recommend Firefox relay at all. Yeah. And more importantly, I think six months or three months ago, Apple announced the Hi, My email features in iCloud, which is actually very similar to SimRowin, surprisingly very similar.

So I see that they also use the reverse alias features since they don't name this feature like that. But it's basically.

30:00 a reversal so that you can reply to a forward email. Yeah, we don't have any patent on the reversal. So anyone can can use this. So it's kind of, you know, for me, it's a good news that big companies like Apple invested in this technologies because that means that these technologies can be used by the general public and not only by the privacy focus community or by developers. Yeah. Yeah. Thanks. Thanks for going into that a little bit. I know that talking about your competitors is definitely definitely a tricky, a tricky part of being a business around this.

But I think it's helpful for people to hear about some of the alternatives and hear what separates SimpleLogin from them. And I mean, like even the Apple service, I think it seems well thought out, but it also is only available to people who are kind of deeply entrenched in the the Apple walled garden ecosystem. So having an open source service like SimpleLogin that you can use no matter who you use for email and no matter if you use Apple or iOS devices or not, it's super, super important.

So I'm thankful that SimpleLogin exists as open source and is such a powerful tool there. And then I did want to jump into just a few different listener questions. I shot a tweet out and got some good responses. So the first question, I think we touched on it a little bit, but just to get a little clarity, a listener wanted to know what logs, if any, are kept of users activity within SimpleLogin? I would say very little. So our logs are deleted after seven days.

So all the logs are deleted, automatically deleted after seven days. And in terms of logs, we only keep logs that allows us to investigate issues. So basically to debug problems if there are any. So for example, we log what are the senders and what are the destination to and that's the automatic logs by postfix programs that we use for for receiving emails, which is also open source. Yeah. I will say we don't log much and we don't log. We never log email content or even email subject.

We only log like metadata about the email so that we can investigate later if there are some abuse attempts or something like that. And in any way, those are logs added to after seven days. Awesome. Thank you for taking such a good, good pro privacy and really data minimizing stance there. I wish that more, more companies and projects would, would try to minimize as much as possible the amount of data that they're collecting in the first place and then obviously have a very short retention period on that.

So thank you for your approach there. I think it says a lot about SimpleLogin and just shows that they are serious about the, the approach to privacy you're taking. So I love to hear responses like that from, from centralized services like, like SimpleLogin. And then the second listener question that I had was just, is there a way for listeners to actually self host SimpleLogin or maybe a service like it? Yeah. So actually, SimLogin is the first email OLEA service that you can self host.

It's based on Docker. So it should work, you know, on any operating system, on Ubuntu, Debian, Fedora, etc. So we have a detailed guide on how to run SimpleLogin. It's a bit long because hosting email is, I would say, it's more complex than that than just hosting a website. For example, you have to make sure that your server doesn't become an open relay, meaning that spammers cannot use your server for sending out spams. So there are more things to do on a mail server, but we write a very complete guide on how to run SimpleLogin.

And actually, we are working on making everything as simple as possible, you know, creating a script that you can just run the script and it will install everything needed for SimpleLogin, like post fake as Docker running the containers for SimpleLogin, etc. And that's one thing that we add in every SimLogin client. By client, I mean like UI client, like mobile application, browser extension. In all the clients, you can easily change the URL to point to your server instead of using SimLogin.

Awesome. Yeah, I'm so glad that y'all kind of go the extra mile and don't just publish the source and let people view the source code. But obviously, like you really want people to be able to self-host it. It's something I haven't looked into yet, but I do want to take a look at doing that myself. So I'll definitely have to dig into that, dig into that guide and just kind of see the approach and see how feasible it'd be for me to self-host my own.

But I think it's a very powerful option that you make that available to end users to self-host. Especially for those who maybe have a more advanced threat model and are concerned with any emails being visible to SimLogin. They could self-host and work around that kind of centralized shifting of trust that would happen there. So definitely grateful for that. And I will have to take a look at that for sure. And then another question for you is just, and this is a little simpler since obviously there's a business around SimLogin that you run.

But how is SimLogin itself funded or made sustainable? And then maybe you can talk a little bit about the pricing of using SimLogin. Yeah, so we don't have any investor. So SimLogin is revenue comes from subscriptions from users. So we have just one premium offer, which is a premium option, which costs about $30 per year or $4 per month. And we have a free option that you can create up to 15 aliases. Yeah, so I would say all the money in SimLogin comes from users.

So we have to make sure that SimLogin, you know, always stays ahead of the game and is as stable as possible. Yeah, I love how cheap the subscription is. I mean, $30 a year, I think once people realize the power of email aliasing for pseudonymity or anonymity, for security, like you said, for helping to prevent phishing attacks. There are so many ways in which email aliasing can be really just one of the most used tools in your toolkit. I mean, I use SimLogin every single day.

It's definitely kind of a key piece of my toolkit for opting out of the issues that surround email. So $30 a year is definitely a small price to pay to get easy access to that. And especially for those who don't want to self-host or aren't technical enough to self-host, it's great to have a solution that's not just kind of price gouging and trying to drive prices up. I think it's super reasonable and well worth the cost to me. And for people who want a good privacy-preserving payment method, you can actually get a SimLogin subscription via Monero from an online store that I can link in the show notes.

But you can get a year subscription just paying directly in Monero so you can preserve your privacy from SimLogin as well, obviously, to really minimize the amount of info that they have about you as well. So it's great that there are options like that out there as well. And the last question I had for you, Son, was just how can listeners who want to jump in and help support SimLogin, how can they step in and really do that and make sure that you're able to keep building out SimLogin?

And what ways can they help to support your vision with that? Yeah, there's a lot of ways to help SimLogin. You know, you can talk about SimLogin to your friends, to your family, so they know about, you know, the importance of protecting their email address and how simple it is to create a different email address for every website. So, you know, if you can help SimLogin to improve the code or to improve the documentation, etc., it's very useful to us because there's a lot of things to do on, you know, in the code to fix bugs, to grind, etc.,

40:00 automatic test, et cetera. So if you are a developer and if you know about Python or JavaScript, please feel free to jump into our GitHub repository and contribute anything that you can. Yeah. So I would say if you want to have Simlogin financially, you can also become Simlogin a premium user that will also help us to be more sustainable. Awesome. Yeah, that's definitely one of the great, great pieces of being an open source tool and of choosing to make that source available to people to jump in is anybody who has a GitHub account can go ahead and jump in and see where they can help out themselves.

Or if they run into bugs, they can reach out and make sure that you're aware of them. There are lots of different ways that people can really jump in and help. And that's one of the beautiful things of open source because it's much more possible for people to step in and give direct technical help. So hopefully some of the more technical listeners will jump in and do what they can. And I definitely need to step in and do that. I haven't touched Giles GitHub yet, but I need to get in there and see if there's anything I can help with.

So I'll definitely be doing that shortly. Well, thank you so much for coming on, Son. It was a great pleasure to get to learn a little bit more about SimpleLogin, but what is, how you run it, kind of your approach behind it, and hopefully give listeners a lot more information about what SimpleLogin is and maybe what I can do for them. So thank you so much for coming on and recording this episode with me. Yeah, thank you very much for having me. It's a pleasure to share my thoughts on email layers, on privacy, etc.

Yeah, yeah, it was great having you on. Have a great day, son. Thanks. See you. Thanks for listening, and I hope you enjoyed this episode of Opt Out. If you did, please take a moment and subscribe to the podcast. Or if you're already subscribed, share it with one friend or family member this week. As always, you can check out the link to the guest content and contact info, as well as links to all of the tools we discussed in today's episode. Now get out there and opt out this week.