Hacker News Reader

Comment by vilhelm_s | Hacker News Reader

This really seems like it needs to be regulated in law. For telephone companies, there are rules about when they may disconnect you, e.g. the Arizona Utilities Division write

> f I am unable to pay my entire bill, what can I do to maintain local dial tone?

> The Arizona Administrative Code specifically states that a telephone company may not disconnect a customer for failure to pay an unregulated portion of their bill. To maintain local service, you must pay for the regulated (landline) charges on your telephone bill while you work to resolve problems with the other portion of your bill. If you fail to pay the unregulated charges on your bill, those services may be subject to disconnection and a deposit to reestablish. (R14-2-509)

> How much notice does a telephone company have to give before disconnecting service?

> A telephone company is required to give 5 days advance written notice before disconnecting service. (R14-5-509 Section E)

In this case, Google killed people's email without any prior warning, and in retaliation for an unrelated business transaction (selling smartphones). Having your email disrupted like that is at least as bad as getting your phone cut off.

View on HN

Fastmail. I'm just a regular (paying) customer, not a business or anything. I've opened a small number of tickets, one or two of the RTFM variety. I've always got a human response and satisfaction, even a "here, let me RTFM that for you."

I can't imagine being locked out of my fastmail account for anything other than abuse of my fastmail account. Or not paying my bill.

We also stalk you on... I mean, we read the same tech news sites you do.

(I'm on third line ticket duty right now, so if you have something significantly more complex than RTFM, or an actual bug, you'll probably be talking to me this week)

The most common cause of getting locked out other than you abusing your fastmail account is having your credentials stolen and used for spam/fraud, which is why we recommend 2 factor authentication:

https://www.fastmail.com/help/account/securityupgrade.html

But yeah, even then we don't lock you out forever - just need you to reconfirm your identity and re-secure your account.

Awesome - I moved across to fastmail a couple of days ago. I've been using a custom domain for email for awhile (josephg.com), merged with a gmail account. I'm very happy I set that up because moving to fastmail was a cinch - there's no forwarding to do, just a few DNS records to reconfigure. And with a custom domain I'll have that email address for life, no matter what happens to fastmail.

My gmail account (josephg@) gets a tremendous amount of email for other people. Earlier this year I was getting a lot of marketing trash from a particularly excited group of car dealerships in Illinois. Around the same time youtube suspiciously started advertising new cars to me. Its all way too creepy, and reading articles like this about people's gmail accounts getting locked out I'm very happy to reinforce my digital independence from google.

> My gmail account (josephg@) gets a tremendous amount of email for other people.

Same with my josephb@. It's amazing how many companies start sending personal identifiable information to a random email address without validating it.

Doctors, real estate, universities, banks and the list goes on.

The only thing that has put me off Fastmail very recently, and indeed I moved to another provider (Runbox), is the loss of their Family plans.

Requiring three accounts now for instance would cost $150 a year minimum for the size I would have needed and unfortunately because I needed to rearrange my old grandfathered plan to re-organise accounts I'd have lost my previous plan.

Basically, Fastmail is good (very good), and you can still do admin type stuff by creating your master account first and creating your 'users' under it, but do look around if you are price conscious.

NOTE - I know you can't please everyone and that doesn't detract from the fact Fastmail was extremely stable, fast and had excellent customer support so don't take this as a 'Fastmail is bad' type post, because it isn't. Just look around and make sure you're getting the rid price/value for your needs.

Fastmail killed their Family plan?

Damn. I was going to move to them at the end of this year when my VM (where I currently run my mail) is up for renewal. But if I now need to buy several Standard plans instead, and get several gigabytes of storage I don't need, then that's less appealing.

Runbox looks good. Any other suggested alternatives?

> Fastmail killed their Family plan?

They announced this on 18 August: https://blog.fastmail.com/2016/08/18/easier-user-management-...

PloarisMail is pretty 'barebones' on the face of it but works well:

https://www.polarismail.com/

Zoho is actually very good too but they (like Gmail) enforce IMAP connection limits, so it you have a lot of folders etc or use mobile clients like K9 that open a connection per folder then you can get errors very regularly.

The above is true for Zoho on the free plans anyway, but it may be different for the paid ones. But the free ones have pretty much all you could need if you don't run into the high number of IMAP connections issues.

https://www.zoho.com/mail/

If you have enough accounts to make it worthwhile I think Rackspace is supposed to be very good, but last I looked you needed a minimum of 5 accounts (I only had 4) so it didn't work out:

https://www.rackspace.com/email-hosting/webmail

Really helpful. Thanks.

Here is another fastmail customer. Just curious how do you confirm identity? I don't remember setting a backup email.

Possibly something similar to this[0]?

[0] https://www.fastmail.com/help/account/icantlogin.html

Thanks for the link. Need to prepare for it.

Nice. :) Reading this in the context of this thread made me setup my own trial account, with a new domain name. As soon as those MX records propagate, I'll be good to test it for a while.

Wish you had a dark theme, that'd be my only feedback for now (Stylish also works). Appears to be very fast, but of course, my account is 100% empty.

ime: it stays very fast, even with 1.5k emails in inbox, ~30k emails / 2.5G total in various folders.

Also, changes propagate faster even than gmail. If you have your inbox open on 2 computers and move an email out of your inbox on one of them, you'll see it replicated in near real time on the second computer. I don't know how they do it, but it works really well.

You can know how we do it if you like:

https://blog.fastmail.com/2014/12/02/dec-3-push-it-real-good...

and how we do the initial load as well:

https://blog.fastmail.com/2014/12/15/dec-15-putting-the-fast...

Thanks, that was fascinating. And props to the salt-n-pepa fan!

Interesting, thanks for that. I'm up and running on my own domain after waiting for the domain name server to transfer from Bluehost where I registered the domain. I did start out doing manual configuration until deciding I might as well use Fastmail's; their DNS config page is rather nicely laid out.

Was very easy in the end, but must admit I had forgotten just about everything I once learned about DNS. As such it was nice to get a little refresher.

EDIT: I would probably have gone for Google Apps / G Suite if not for this article. So, yeah, hope it served Google well to freeze those accounts with no warning.

some feedback from a happy fastmail customer: please add 2 factor authentication via sms! I neither have a smartphone or yubikey.

SMS is not very secure, there have been quite a few stories of people losing digital access due to an attacker just calling Verizon and taking over their phone account.

That's in the US. In other countries things may be more secure. In Russia I barely can make any changes by phone because they verify so much info. Forwarding will certainly require an in-person visit to the carrier office.

So I guess it's better to leave the choice to the user, with an appropriate warning text.

—Another happy Fastmail customer

There's the other side of it, which is that SMS delivery is awfully unreliable in many places, and it's a frustrating experience for everyone. We can fire off the SMS, but if it fails to reach you it's an expensive and time consuming support headache for us, and a shitty experience for you.

A Yubikey costs less than a year's FastMail service.

So no, we're not leaving this choice to the customer sorry, SMS sucks for too many reasons to consider adding back.

Previously I've been hesitant to disuse Gmail, but now I'm 100% confident to actually transition to Fastmail. And I'll take Fastmail in consideration for my company usage too (we're a smb).

You should, it's awesome :)

Will Fastmail have CDN? I'm currently in Vietnam and latency to Fastmail isn't good (250ms RTT), as I connect to server that's located in US. While my home's internet service might be worse, so I hope Fastmail servers are closer.

Based in AU I'm further away than that by latency. As a fastmail web interface or mobile app user I don't notice the latency.

CDN for unique items like mail probably doesn't offer tons of gain for the additional complexity.

We tried using CDN for static files (interface javascript and such) for a while, but we found that it didn't really give much benefit. The faster connect times got eaten up in the second SSL negotiation required for a different hostname. And it meant fun and games with content security policies or giving a third party SSL certificates that were inside our domain, so it was a wash. We decided the benefits didn't add value.

And yeah, our core dev team is in .AU, so we know all about the latency. It's really not a big deal once you sync up the first time - all the static artifacts are cached and the dynamic data is loaded in the background, often before you need it.

I also transitioned from gmail to fastmail a few months back and am very happy so far. Haven't had any issues and moving over was less stressful than I had imagined.

Can you clarify what this means:

"Flexible tamper-proof data retention policies with unlimited archiving space" - from the pricing page.

I am considering to switch to Fastmail, seems nice!

At a techinical level it means we take a copy of each incoming and outgoing (assuming you send via our web interface or via our SMTP servers) email and dump them into a separate folder in a separate account on our server which your admin accounts get a READ-ONLY ACL to, so you can see the messages, but can't remove them or modify them.

Unlimited is a bit buzzwordy, because we do have sending and receiving rate limits, so you can't grow the archive user faster than that.

Also if you go over about 850Gb of data right now you will make me very sad because I don't have facilities for splitting users yet, and we segment users across 1Tb partitions. I'm hoping nobody hits that point before I've got sharding inside users working - but worst case I spin up new hardware with larger individual partitions and put the user there :)

That's awesome. I've just gone through setting up my domain account and it was a slick experience. Neat 2FA authentication etc. Proud to see you're Melbourne based as myself, too.

PS. I hope no-one reads your post now and takes it as "challenge accepted". :-)

Alright, one more question: where is the data located? My main reason for switching is to move the data from US-based servers and/or companies.

> Our main servers are located at New York Internet (NYI) in New York City, USA.

Nvm... :(

I've been w/ you guys since there was a 'bounce' function (miss that, btw). Used to use 2FA w/ a Yubikey, but stopped for some reason that made sense at the time, though I don't recall what happened, was so long ago.

What keeps me from enabling 2FA again, is that there's always some kind of "I lost my 2FA device" function which essentially allows it to be bypassed. So whoever's determined enough could find answers to secret questions or whatever to gain unauthorized access. If it were possible to disable this attack vector I'd get another Yubikey & try again- if...

...The other thing that prevents me from going this route, which is: The fact that it's impossible to implement an additional Yubikey functioning as a "clone" of the one used to secure the account. I can't say I've never lost my (physical) keys. But when I do I just grab my backup copies, make new backup copies, & all is well. No can do with a Yubikey.

-My 2c

Isn't making "impossibly" hard security questions and storing them where you would store your secondary yubikey basically the same thing? Or can't you pick your own security questions?

Sorry for butting in uninformed.

Another happy fastmail customer here :-)

Keep up!!!

I started switching to fastmail due to their economical family plan but then they changed plan structures to where that is no longer available and the new plans were all a lot more expensive for a family. I was grandfathered in (I signed up just before the change), but won't start using a service on a deprecated plan. It was to bad because it seemed very good for the week or so I played with it.

Just chiming in to say I also use FastMail and love it. The only thing I wish they did differently is offer SMS 2FA. (Yeah, I know about the downsides. I am a normal person who doesn't need extreme security.)

Any modern phone should be able to run a TOTP client. For my own FastMail account I have a TOTP client on my phone plus two Yubikeys, one I carry with me and one that I keep at home. We require all our staff use 2FA because emails from us get the magic green tick :)

So yeah, if I have my phone, I have a 2FA option already without SMS. I normally use the Yubikey because it's super easy.

How do you use a yubikey on your phone? Or did you mean in lieu of totp on your phone?

If you have a Yubikey NEO and a phone with NFC, you can store the TOTP secret on the Yubikey instead of the phone, and use the phone purely as a screen with a time source by opening Yubico Authenticator app and touching the Yubikey to it to generate codes.

For Fastmail I plug it into the USB port as usual (using an OTG cable). Last I checked that was still the only way to do it specifically for Fastmail, since they do not support NFC. For Lastpass though, using the Yubikey through NFC works great.

I might have to switch at some point. It is stories like these that are freaking me out. Were there any instances of them being DoS-ed or you not getting emails from others?

I would also be afraid one day if Google sees people fleeing to them, they'd come in and buy them. I'd almost whish there was a public trust or non-profit who would run an email server. Post office is a government service (for better or for worse), email is a bit like what regular mail was 100 years ago.

ime: their spam detection is definitely inferior to gmail; I've had 2-5 false negatives per month (spam not detected) and a handful of false positives over 3+ years. Plus a payment notice from my student loan that fastmail absolutely positively refuses to believe is not spam not matter how many times I so mark it.

I've had zero deliverability issues.

edit: to be clear, the spam detection works well, and if you're going to make an error, it's far less annoying to bias (as they do) towards a few spam showing up in your inbox rather than actual messages getting lost in spam. Also, they show the spam score, and you can hand adjust your spam threshold if you want.

I get tons of false positives in Gmail. Mostly from mailing lists where I guess someone else reported it as spam because they were too lazy to unsubscribe, but also some others. But it means that I regularly have to dig through all of the Russian camgirl requests to make sure nothing important is there.

"a payment notice from my student loan that fastmail absolutely positively refuses to believe is not spam"

That's because it's not spam. I'm pretty sure there's a blog post coming soon about the difference between spam and "email I don't want to receive". If you just don't want to hear from a particular email address, the way to stop it is to put an explicit discard rule for that address in your Rules screen.

Likely changes for next year include making a much easier UI option for "don't show me email from this address again", because that's a fairly common request for situations like this where you have a vexatious sender. I suspect it will be implemented as an addressbook group - the anti-whitelist!

I think you misread the double negative?

You're right / I wasn't clear.

The student loan confirmation is sent to spam every month. I mark it as not spam.

In their defense, the message is full of all caps words that look like a sentence formatted from a sql query with little attention paid to formatting plus it has all sorts of spam words (bank, payment confirmation, loan, etc).

The address killfile sounds awesome.

That's why I'm using my own domain now for emails. Even if my email provider goes away I still keep the address.

Good point. I have an un-used domain. Maybe this is the time to finally use it.

Yeah, fastmail has some issues (see below), but they offer human tech support that ime knew what they were doing, even at the $40/year price point. And they seem to have slightly raised prices while I've been a customer, but automatically grandfathered me into the previous deal. Which is kind of them / a stand up thing to do.

Issues: they've fixed many of them -- in particular, charging for 2fa at $0.1/sms and the settings area in the web client used to feel like a bad programmer's first js project ever -- but mostly it comes down to, across almost all experiences, they're slightly to mildly inferior to gmail. Google's apps are just best of breed. Fastmail is the best non-google I've found, and I looked pretty hard a couple years ago.

Things I miss from gmail are things like: fastmail is a hybrid conversation based email with folders rather than tags. I miss tags; some folder weirdness occasionally peeks through. Fit and finish like after a message is selected, choosing add rule from message doesn't offer to filter other messages in your inbox that match the new rule. Etc.

Paying $40-ish/year to have email that isn't used for ads and that is run by a company with actual support seems like a good deal to me. Particularly if you don't have a friend inside google or the ability to hit the front page of HN to get customer service.

You can see the improvements in fastmail even over the 3 years. So that's really promising.

Seconding Fastmail. Moved earlier this year from gmail to Fastmail. Also using my own domain now instead of @provider.com.

Never been happier. Their Webmail UI is less cluttered and more intuitive than Gmail (at least to me - but I'm not a huge webmail user anyways).

Well worth the money.

I wanted to report a bug in Fastmail's android client only to discover that their ticket form requires you to type in your password. My fastmail password is gigantic, and typing it in on a phone is a major ordeal. Is it that much of a problem if a non-user submits a ticket?

Willing to bet if any of them were Google Fi or Google Fiber customers, their phones would be cut off as well. Of course, much of their fight with AT&T over pole attachment rights has been Google's unwillingness to be classified as a "telecom"[0]. I suspect Google is very unwilling to be held to these sorts of legal responsibilities.

"Basically, the current regulations require companies with utility poles in the public rights of way to provide access to certified telecommunications providers and to TV/cable companies," Paul Lewis, assistant manager of telecommunications and regulatory affairs in Austin, told Ars. "Google is not a certified telecommunications provider, and it's a video service provider as opposed to a television/cable company."

If Google were to apply to the Public Utility Commission of Texas to become a qualified telecom, "It would make them subject to all of the state and federal telecommunications regulations," Lewis said.

[0]http://arstechnica.com/tech-policy/2013/12/why-att-says-it-c...

Wouldn't Google be able to set up a wholly-owned subsidiary to be the designated telecom in Texas? That's how the ride-sharing companies do it in order to insulate the parent companies from having transportation law apply to their headquarters.

I think it's indicative of more than just Google being unwilling to be held to the legal responsibilities; it appears that even their Fiber arm doesn't want them as well.

And with e-mail, that's often a means of authentication. Many services won't change your e-mail without sending an e-mail to your prior service.

You can essentially get locked out of your Steam account.

exactly. if you pay for a service and google or facebook are your authentication, you are locked out of the third party services you pay for.

I recently got locked out of my old bank account because I didn't use the SIM from my country of origin for 5 months. My mobile operator disabled my ~15yo phone number and I can't recover it without flying there and visiting their office with my ID.

That's why I also feel uneasy towards all these number-based messengers. They're targeted at users who rarely leave their countries.

Or at least get a mail address or similar from everyone whom you're talking to on a number-based messenger, so that you can recover from a lost messenger account.

(Doesn't help, though, if you lose the phone number and your mail account at the same time.)

Google's terms of service say that each user retains the copyright to their content, but grants to Google a license so that Google can provide services.

If Google has the only copy of some of this content, I wonder if a copyright claim might have any leverage. It's one thing to give Google a license; it seems like quite another for Google to deny you access to your own copyrighted material.

That route would only get you copies of your email. It wouldn't help you change a password on a 3rd party service, if their practice was to require confirmation through your address on record.

Opinions about regarding Google as a utility aside, I think the comparison this argument makes isn't as comparable as you make it sound. Using your example with telephone companies, this situation is like saying a specific 3rd party service accessed via telephone should be regulated without actually regulating the telephone companies first. I would like to see ISPs be regulated as a utility before individual web sites are regulated as such.

In the event that becomes reality, the time would have to be taken to define what minimum level of services the web site would have to offer. Simply saying Google must keep X service available would be archaic. Would other email providers be exempt from having to maintain these rights? If your job gave you an email address, would they have to maintain it after you leave the company? These are probably contrived questions, but ones that would certainly have to be answered first.

Gmail is part of the chain of technology that lets me communicate, so I think a comparison with a telco is fair.

Also there could be a distinction in the law for mass communication, e.g. #users > 1M.

> Gmail is part of the chain of technology that lets me communicate, so I think a comparison with a telco is fair.

And it's actually harder to switch to a secondary. With my ISP, if they cut me off I can fall back on my cell provider within minutes. I have no such failover for my Google services.

> This really seems like it needs to be regulated in law.

Or use backups. Don't go crying to the government when you can handle it yourself.

It's not a question of backups. Even with no data loss, the cost of most people being shut out of their Google account is absurdly high. Missed texts. Missed calls. Missed emails. Can't log into third party sites.

If Google wants to have a monopoly on all of that stuff, they need to be subject to regulation that compartmentalizes their services and what they can and can't do arbitrarily.

They don't want a monopoly, you want them to. You opted in to it, and you only end up in such a horrible position when you make a series of horrible decisions.

Missed texts and phone calls? How did you even get into the position where Google controls your telephony? Missed emails? Why are you using gmail.com? Third-party authentication? Did they not have the option to use e-mail or a username?

You can't fix every problem by band-aiding regulation on top of it. Sometimes you need to step back and wonder how you got here, and solve that instead.

> They don't want a monopoly, you want them to.

Of course they do. Every strategic decision the company has made over the last two decades is to try to secure a monopoly on your data.

You make it sound like it's easy to run your own full stack of all web-connected applications. It's not. The cost is INSANELY high. So your real choice is whether to use one company, or dozens of individual companies for every individual service. The latter protects you against the risk of something like this happening. But it comes at a day-to-day expense which will far outweigh the prevented risk for 99.9% of people.

If your concern is data _loss_ as opposed to data _ownership_ you can still use Google all you want as long as you use it redundantly (backups, separate domain, &c.) What you're saying is more applicable to people who want Google not to see their data.

Regulate a free service?

I wonder if any G Suite customers had their accounts closed.

> This really seems like it needs to be regulated in law

Absolutely not! That way you are slowly making people to lose any bits of the common sense they might still have. Perhaps losing data once or twice will make people look for alternatives. Throwing in another regulation will just increase barrier of entry for companies offering emails and who knows what else some dumb politicians could come up with, maybe this will open the gate to even not being able to self host an email server.

Reply on news.ycombinator.com