A common situation in my life is the following: a small-ish organization consisting of somewhere from 3 to 50 people need some type of way to be reached as a group. The current solution is to have an email adress, normally with a password that is shared in some way among the trusted subset of members that need to be able to access the email directly.
The solution isn’t great for multiple reasons:
- Sharing a password among multiple people isn’t great, 2FA is tricky
- Most email communication are readable by the email provider, unless PGP is correctly used. For most people, PGP is non-trivial to use correctly, and meta-data will not be encrypted even with correctly used PGP.
But it has the following upsides:
- A single stable address to reach the group
- Communication is gathered in one place, searchable, possible to for multiple members to track communication with someone that has reached out.
- Easy to use from any device anywhere
Ideally we’d like all of these things: sensible access controls, some level of transparency within the org regarding who has responded to what messages, an address that is easy to share with people outside the group, minimal (meta)data accessible by the providers, and easy to use across devices.
How do you handle this? What would your recommendation be? I have considered setting up a Signal account, but having multiple signal accounts on a single device is non-trivial, as is setting it up on a new device, meaning that probably each group would need a single dedicated device, which isn’t super practical.
Hmm yeah, I thought this is about organisation internal discussion. Of course if it is just a mailbox for outsiders to use, you could just configure some forwarders so that multiple people get the emails and can respond from their own account if necessary.
Selfhosting email specifically is quite hard. Not so much technically, but because of how a few large providers have cornered the market and drop most self-hosted emails reaching them with the excuse of fighting spam.
Hosting a forum that requires login credentials (incl. 2fa etc.) is quite easy though. But I guess that wouldn’t work as a way for outsiders to contact you.
Right, forwarders solves the password issue, but the encryption issues remains. Any thoughts on how to handle that? PGP in my experience is non-trivial to set up correctly, and even when correctly setup does not protect metadata.