The Intercept's top security expert reviews Helm, a standalone home email server that keeps your comms out of Big Tech's data-centers

Last October, a startup called Helm announced a $500, plug-and-play home email server that was designed to be a secure, decentralized, privacy-oriented alternative to using one of Big Tech's email systems like Gmail, an option that was potentially even more robust than using email from a privacy-oriented provider like Riseup or Protonmail because your metadata would not be stored anywhere except in your home.

Micah Lee is a computer security engineer who was formerly a staff technologist at EFF; now he works at The Intercept. For several months, he's been hosting his personal email on a Helm device in his living room. He's just published an excellent, in-depth review of Helm, including a preliminary security audit.

His conclusion: largely positive. Helm's biggest security gap is the lack of an intrusion detection system that can warn you if someone is trying to hack it (this is in the works); but it has a "proximity-based authentication" setup that makes it much harder to phish an account (it also means that any time you set up a new account or a new mobile device to manage an existing account, you have to be within Bluetooth range of your Helm device, which might be a problem if your phone breaks while you're traveling).

The service itself works just like you'd expect a traditional, POP-based email service to work. Using a program like Thunderbird, you fetch your email and it just shows up in your inbox. The Helm doesn't support server-side filtering (a feature that power-users who already run their own mail-servers might miss), but it otherwise functionally identical to a managed, data-center-based mail server, except that it lives in your house. Read the rest