Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

I (and a lot of other people around here) are enthusiastic FastMail customers. Hit any of us up off-site if you are interested in a referral code (10% off). It costs money, but you get a really solid webmail experience with real human customer support. The CEO is active here on HN and posts pretty solid things like this: https://blog.fastmail.com/2018/02/14/email-is-your-electroni...

I have a strong belief that FastMail's business model is aligned with my interests/values, and they're a strong open source community member with initiatives like JMAP.

View on HN

One issue I have with FastMail is the reuse of email addresses. It is possible to "hack" accounts on websites which were registered to expired email addresses by simply registering that email address anew and doing a password reset. This is very common in the domain space, where email addresses are publicly listed.

Does this affect custom domains, or is it only an issue with @fastmail.com accounts?

Well, with custom domain email addresses this is always true regardless of service provider.

If you ever abandon the domain, someone else could come along and buy the domain and create the same email address. They could then receive any mail intended for that email address (e.g. password resets). This is why I consider any domains purchased for email purposes to be lifetime investments.

There are other "security issues" too.

One is that you can send email as any other FastMail user, and it won't stop you. SPF passes and DKIM signatures signed (even for other customers' custom domains), totally impossible to tell the difference between a legitimate and spoofed message.

To be fair, DKIM is a borderline useless technology and doesn't really prove anything, but it still appears to be an intentional policy decision by FM to be "lax".

Interestingly enough they do track the real sender in mail headers (which I suspect enables them to mark their own official emails with "verified" badges), but it's a dynamic obfuscated value iirc so it's absolutely worthless for regular users.

It kind of makes my stomach churn when I consider that it's trivial for any other FastMail user to impersonate me, but OTOH, it's best not to be under the delusion that email is authenticated, so I'm staying with them.

Great service, despite my comments.

Have very recently moved over to Fastmail from a hosted Exchange service (personal - own domains). Very pleased so far although my only issue was that I couldn't get SRV records to work properly on my domain (the DNS is at cloudflare, and I'm more than certain it was my own incompetence) which made setup on my iPhone a bit of a faff for calendar, contacts and mail compared to exchange. The web-interface is excellent for mail and calendar - for work I have to change between browsers and OSs regularly and it's worked perfectly with all combinations I've come across so far. Also very interested in the work they're going with JMAP as hobby projects of mine have led to me running my own mail servers and developing clients, and this new protocol looks very straightforward and lightweight.

I found the idea of mail as long-term memory (also, as file-system) alluring. I instantly started working on a "pay once" email system, reserved http://memoria.email and put up an early-acces address reservation system. Working on it as speaking.

Reply on news.ycombinator.com