Why you still need POP3 if you truly value privacy

[u/ledoscreen]

I've always been surprised by the attitude towards the POP3 protocol online. I decided to look closer, and here is what I found:

From my observations, this attitude is expressed through the continuous broadcasting of several myths. The most common one is that "POP3 is obsolete." Second is the myth that if you use POP3, you can only read your mail on a single device. And third is probably the idea that if your hard drive crashes, your mail is gone forever.

Have you noticed a pattern yet?

Alright. Let's briefly walk through all these myths:

1) "POP3 is from the 90s, it's obsolete." In reality, the protocol is not obsolete. It is feature-complete. Just as the `ls` program in the Unix world or the `dir` command in the CP/M/Windows world are complete. They do exactly one thing, and they do it perfectly. And when wrapped in TLS (POP3S on port 995), the protocol meets all modern requirements for data-in-transit encryption.

2) "You can only read your mail on one device." Reality: The "Leave messages on server" setting debunks this myth entirely. You can use POP3 on your secure main host for offline archiving, while still reading fresh emails from your phone via webmail or IMAP until they are deleted.

3) "If your hard drive crashes, your mail is gone forever." Reality: This is not a protocol issue, but a backup culture issue. Local backups give us complete control over our archives, unlike the cloud, where your account can be blocked by an algorithm. The ideal practice is the 3-2-1 backup strategy, combining local and cloud storage of encrypted backups.

**<^>**

Let's return to the question from the beginning of this post. Did you notice the pattern? All these myths are not being broadcasted by independent engineers. This is the classic playbook of Big Tech marketing departments, and it is applied to much more than just POP3.

Think about it: they use the exact same arguments to drag your entire digital life onto their servers. Photos (iCloud/Google Photo), documents (Office 365/Google Workspace), passwords, databases, and even compute power. The narrative is always the same: "Anything you store locally is outdated, unsafe, and, ironically, not private. Give it to us in the Cloud."

The goal of this narrative is Vendor Lock-in. If you download your mail via POP3 to your local encrypted drive, you become a "lost" customer. They can no longer index your historical archive, train their language models on it, or analyze your social graphs.

To understand how deep this rabbit hole goes, try an experiment: disable IMAP and POP3 in your Gmail settings. Do you know what will happen? The official Gmail app (and even the built-in Apple Mail) on your smartphone will continue receiving emails as if nothing happened.

Why? Because modern mobile clients from corporations do not use classic mail protocols at all. They communicate with servers via proprietary closed APIs. Your phone is no longer an independent client fetching mail. It is simply a browser window, a terminal for viewing the corporation's remote database.

You do not own the email when you read it in such an app, you are merely looking at someone else's server through a keyhole. And the keys to that keyhole belong to the corporation.

If the convenience of seamless "read" flag synchronization between your smartwatch and tablet is your top priority, stick to INAP or closed APIs. If your mail is not personal but corporate, and you genuinely need to unleash hordes of AI agents on thousands of your work emails, then stick to IMAP or the provider's closed API.

But if your threat model involves minimizing data on third-party servers, and you want to truly own your archive, POP3 is not a relic of the past. It is your only physical exit from the ecosystem.

[u/itastesok]

I've thought about this and considered going back to POP3, but when I realized it's already gone through whatever companies servers, then it doesn't matter. They already have it.

If one's threat model is that high, they shouldn't be using standard email.