Hacker News Reader

Comment by ukoki | Hacker News Reader

To add to this: Never use a @gmail.com address, buy your own domain and pay the $6/mo to get a Google GSuite with your name@fullname.com address instead. If Google locks your account, you can now move your email hosting to another provider and won't lose access to your entire digital world.

Be aware that doing this now means your DNS provider and domain registrar become vectors for hackers to take over your email account, so make sure these are companies your trust and your access to these accounts is as secure as possible (ie strong unique passwords and app-based, not SMS-based two-factor authentication)

View on HN

You can do this without paying as well. If your DNS provider supports email forwarding you can use that (if it doesnt you can use improvmx free tier) and use gmail's inbuilt smtp server to send emails using your own domain.

Only issue with not using GSuite is that you won’t be able to DKIM sign those emails, although just SPF might be sufficient.

Why not just use Fastmail?

You can also use Gmail as POP3/SMTP client for your e-mail account at other provider.

This is what I do, and it works well.

Ya but then you can’t use googles SSO right?

yes, you have to use your *@gmail.com for SSO in this case

As long as you don't want to use any Nest products, which now insist that you have a gmail.com address as apparently hosted domains are for business only.

There have been a ton of products where Google didn't initially support that but eventually added it. Maybe Nest will one day.

Obviously their sign-in/account infrastructure creates technical impediments against making their products do what they want. They should really fix that.

It appears to have been a deliberate choice, and one they have justified on several occasions.

That's not to say you're wrong, but it would be a turnaround at this point.

yep, noticed that too. i'm getting nagged to use my gmail login. what a virus.

i will add that it's possible to create a google account WITHOUT gmail,

https://support.google.com/accounts/answer/27441?hl=en

maybe that's sufficient for nest.

Hmm, thanks, I'll have a look into that. The objection to nest using "Google for Domains" or whatever they changed it to these days seems to be to do with the domain admin having access to everything. Which would be just fine for me, as I'm the only one that uses the domain.

Hopefully signing my address up that way, when it's already a domain account, won't b0rk all sorts of other things :/

Related to your warning, the story of that guy who lost his @n Twitter account because of that[1] (even though I think it still reduces the impact radius because until your password gets reset you can still access the service)

[1]: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...

For those that don't want to pay, Yandex allows you to set up a number of emails using your own domain for free.

The only thing worse I can think than having Google read your email is having Yandex read it.

The issue here isn't privacy but independence from a specific provider. If privacy is an issue as well then you should be using encryption as emails are not private.

It doesn't have to be fully trusting or not at all, there's different levels. I think using a provider you trust more (In my case Fastmail vs. Google) is a fair tradeoff. Fastmail has a pretty straight forward business model that makes sense to me so I feel like they don't have a reason to scan my emails for ad purposes or else.

Of course if you are worried about some nation state looking into your emails you should encrypt them and use whatever provider.

Depends on where you are. If you're in the US, sure, there is at least the theoretical possibility of legal protection against misuse. If you're elsewhere, they're not very different, and Yandex at least doesn't already have a million other data points about you to connect with this and build a bigger picture about your life.

If you aren't in the US, then Yandex is probably safer.

Russian companies cannot refuse data requests from the Russian government. American companies can.

This is such excellent advice that I wrote a detailed step-by-step instruction guide for people that don't know how to do precisely that:

https://sneak.berlin/20201029/stop-emailing-like-a-rube/

It even has special instructions about how to secure the domain registration and DNS accounts. :)

(Don't use G Suite, though.)

I have attempted to read two articles on your site. As I am a privacy-focused person the articles were of interest to me. Both times I haven't gotten past reading the opening sentences when an obnoxious pop-up appeared asking for my email address. It seems ironic that someone publishing articles on privacy advocacy would be so keen to collect my email address. This practice also creates a real miserable experience and I have simply closed the page immediately both times. If someone is interested in subscribing to your newsletter why not simply provide a link for them to do so at the end of an article?

An email address is public information not private. You can have as many as you like for different purposes.

Email addresses are not public in general. They are not supplied to every site you visit automatically, and should not be manually supplied to every site you visit either. Whether it's a unique per-site address or not, it only makes sense to give it to people/organisations you want correspondence from. Therefore, sites that ask for it when you start reading an article seem really sketchy.

Yes, asking for an e-mail for site-update-sending purposes is very sketchy. That's what RSS is for, just publish a feed like a good netizen.

And indeed, your site does have a RSS feed, so what's with the e-mail address collecting? Rude!

Thx for that. Great help for many of us.

But why referring to Protonmail and using Fastmail for yourself?

I use different services for different things. I have 3 email accounts at FastMail and 6 at ProtonMail. Also, some of it is inertia: I've hosted the MX for sneak.berlin at FastMail for several years (and have prepaid some time into the future), and have only been using ProtonMail for about one year (and the HOWTO article is recent).

The fact that FastMail might be subject to the new Australian crypto key escrow law[1] is a little bit worrisome, and I may not continue to use them in the future depending on how that plays out.

For things where surveillance is less of an issue, I prefer being able to use a plain IMAP client, which ProtonMail does not support. Their current iOS client is pretty lame, for example (although their web client is better, and I understand that their next major release will improve things a lot across the board). I mention the IMAP issue in the article.

[1]: https://parlinfo.aph.gov.au/parlInfo/download/legislation/bi...

> The fact that FastMail might be subject to the new Australian crypto key escrow law

FM is saying it doesn’t affect them, as they are not a secure provider and can already give any information out upon lawful requests.

Do you disagree with that?

This is exactly how I understood it. But maybe I'm wrong?

Fastmail’s specific response: https://fastmail.blog/2018/12/21/advocating-for-privacy-aabi...

That in short, the A&A bill is about breaking end-to-end encryption, which Fastmail has never had anything to do with. It’s scary-sounding legislation, and I reckon it’s misguided at best, but it honestly doesn’t affect all that many businesses [note I’m saying businesses rather than people; many affected businesses will be among the largest ones, serving consumers], because end-to-end encryption of communications is uncommon, because it’s so frightfully inconvenient for all parties involved, because now the server is necessarily dumb and the client has to do a lot more work, and things like searching are typically just altogether broken because you’ll need the full index on the client to do a search.

(And specifically of the domain of email, I wouldn’t trust first-party encryption; if you care about governments accessing your data, first-party encryption such as ProtonMail offers is almost equivalent to no encryption if you can’t verify the code that is running, since that party may be compelled to backdoor the code to steal your password. This is one of the many reasons that Fastmail has never implemented PGP, ⅌ https://fastmail.blog/2016/12/10/why-we-dont-offer-pgp/.)

Thx for your detailed feedback. Appreciate it.

So your advice would be to go with Protonmail all the way, as you wrote it within your blog?

Really good article, could you share it as a hn submission by itself? Would love to see a discussion around it

Lately I try to avoid submitting my own website, per the HN guidelines discouraging promotion (the one exception is when I find a submission to be time critical). I only link to my own site in threads where it's directly and precisely relevant, such as this one.

If you found it valuable, you should submit it yourself. I'm not interested in the accumulation of updoots, feel free to get 'em. :)

I'd rather other people decide what subset of my writing is relevant to HN, as I'm no good at it: I'm too close to the work. (I only write about things I care a lot about.)

I don't care that much for the upvotes either btw

But the article is very well written and would be a shame if we didn't got other opinions here in HN, kudos for you, already added it to Pocket for later

Will try to get it rolling then

Nice. I'd highlight that conceptually, there are two entirely separate concerns here:

1) the front, if you so will - the emails which you give out and to which people (or algos) send you stuff

2) the back, where you receive and read your emails.

For many people, for example:

1) abc@gmail.com

2) gmail.com web mailer, or gmail app on mobile, or native OS app on the computer

You suggest a complete revamp:

1) catchall at own domain: anything@mydomain.com

2) one (or several) protonmail/fastmail accounts

But it's worth highlighting that people can get many benefits already by

1) catchall at own domain: anything@mydomain.com (as you explained)

2) keep whatever you're using now.

Just forward 1) to 2). Then you can start handing out the new email.

I'm definitely not a power user, but I see and understand the issues.

But for someone like me, if I take all this advice, there is still the aspect of trusting the domain registrar, maintaining a personal email server, hosting, CloudFlare, etc. etc. I have just shifted some risk of offending Google to some other risks of 3x more companies that I have to remember how to deal with now.

So what difference does it mean to me, average user, that I just stick with Google and don't misbehave, versus open myself up to having to deal with 3 other manual processes and companies to remember? It's turtles all the way down.

You see the dilemma for the average user.

Yeah but they’ve still got your emails.

For that you have this:

https://takeout.google.com/

You can export all your email in a single .mbox file.

This might not work if your account is suspended, but if you set up email forwarding to an alternative address (e.g. to protonmail) that might still stay active so you can transition your addresses.

I wonder if Google lets you Takeout if they’ve locked your account…

They do now (although you only have 7 days to do so I think).

It also depends on the reason for the block - if for example they suspect you of having illegal content (child porn) in your Gmail, you aren't allowed to takeout it.

That's great news. Facebook and Twitter don't (Facebook as of a few years ago, Twitter as of this year), as I learned the hard way.

If you are in the EU, GDPR says they have to.

The GDPR (in Article 15(4)) states that the right to obtain a copy of your personal data should not ‘adversely affect the rights or freedoms of others’. This means that when responding to an access request, the controller should consider the rights of third parties, such as their data protection rights, trade secrets, or intellectual property rights such as copyright. This could arise, for example, where your access request relates to a record containing both your personal data but also the personal data, trade secrets, or intellectual property of others.

A balancing of rights exercise would need to be conducted by the controller to balance your right of access your personal data as against the identified risk to the third party that may be brought about by the disclosure of the information. The GDPR notes that these considerations should not result simply in a refusal to provide all relevant information, but the controller should endeavour to comply with the request insofar as possible whilst also ensuring adequate protection for the rights and freedoms of others.

Google doesn't let you Takeout when you don't allow Google to track your browser. It will give an error to "please use a device you regularly use" even if you can see in your account that there are no other active sessions that you could possibly make use of. I tried a few hours later with the session still open but no dice. Guess I'll have to find a human to talk to at Google in order to get my data pursuant article 15, GDPR.

I have very little hope indeed that they will let you do a takeout without finding a human to talk to when your account is locked.

For what it's worth, Facebook does let you do this. You login, get a message your account was banned for no apparent reason, and that you can download a copy of your data. Unfortunately it's broken (screenshot: https://dro.pm/a.png) but hey, there was an attempt.

Use a third-party client that grabs the emails locally.

Well, at least you don't lose everything. Worst case you lose access to a few emails you got in the time between begin locked out of your Google account and when you set up another email provider, and assuming you configured IMAP and use something like Thunderbird or K-9 as an email client (which I highly recommend) you should have a copy of all your email on your device (seriously don't use the Gmail app on Android, they even display ads in your email categories.

I like GMail for their spam filtering power, and I honestly believe spam to be email's biggest weakness, and the reason people don't host their own. It certainly scares me, the thought of being flooded with thousands of spam emails daily, or the chance that my own emails would be falsely marked as spam since I'm not part of the major providers or because I did not configure it correctly. Don't know how this can be solved though, email itself is too permissive, and too "tweakable".

There are alternatives to GSuite -- for instance, Fastmail. Or even the old PObox.com service which has been around since the 90s and is really cheap (Fastmail have bought it now, I notice).

Also, many registrars offer a managed email service.

Fastmail is very good. The web client is pretty simple, but feels so darned responsive (as in fast) compared to what I was used to from GMail. And spam is so far a non-issue.

Or, host your own on your own metal, to avoid depending on any third party. Alternatively, if you are ok with semi-dependence on a third party, get a $5/mo Linux VPS, and host your E-mail there.

With your own Linux instance, you can host whatever you want, have full control, can host other services too like www, git, whatever, and have the assurance that you're not going to suddenly lose access because AI-BOT-204432 decided you violated some obscure terms of service. I've been doing this for close to a decade now (exim + dovecot for E-mail), and it works great. Back in the 90's, this used to be the default. How did we end up in this world where we so utterly rely on 3rd parties for such everyday critical Internet services?

> How did we end up in this world where we so utterly rely on 3rd parties for such everyday critical Internet services?

The same way we ended up in a world where we so utterly rely on 3rd parties for such everyday critical services as growing our food and fixing our cars. There's too many things to do for everyone to do them all on their own.

> How did we end up in this world where we so utterly rely on 3rd parties for such everyday critical Internet services?

For email? Because Google and Microsoft broke SMTP federation in the name of "anti-spam".

It's practically impossible to get Google, especially, to reliably deliver your email anymore if you aren't an actual email service provider.

There's this thing called principle. It's not that we do something because we believe it's going to work. We do things out of principle because doing the right thing is the only rational alternative; because, if everyone held the same principles, then the problem would be snuffed of oxygen.

Once you have your domain, you can use Zoho create emails for your domain for free. They don't offer IMAP/POP3 access in the free tier though.

Or register a domain with Gandi and they provide a free email service to you. Only two free accounts (with "unlimited" aliases), but that should be sufficient for most personal uses.

> app-based, not SMS-based two-factor authentication)

How does that work when using an email client and connecting to the server and using SMTP and IMAP?

You generate one password per client (i.e. app-based).

How does the client identify itself during the SMTP or IMAP transaction?

It uses the password that you generated for it. I don't understand where the confusion is.

The confusion seems to be about logging into your account on the web versus using a mail client like Outlook or Thunderbird.

Pick a service that lets you use a long password and a security key (like Yubikey) or authenticator (Google, Authy) to log in.

Most services will then let you generate a specific password for an email client. I would assume that behind the scenes that the service is restricting what ports that password can be used on, etc.

> I would assume that behind the scenes that the service is restricting what ports that password can be used on

Assuming it's a device accessing the service over IMAP and SMTP that can access multiple networks, restricting by IP and/or port won't really help. As I noted in my other reply, it's easy enough to script access to the account if have the password and there's no real association between the application and the credentials that are used for access.

I don't understand how that's any more secure than just using a strong password for the account. At some point, you're going to have to make that password accessible to the client. Plus, it's arguably less secure because the account now has multiple valid passwords that will work for authentication, and, based on your description, there's nothing that prevents someone from using the exact same password over a netcat session from accessing the account.

I meant using TOTP (app-based) two-factor authentication for securing your DNS provider and domain registrar accounts. The reason for not using SMS-based two-factor authentication is that it is not very secure https://techcrunch.com/2016/07/25/nist-declares-the-age-of-s...

I'm not aware of two-factor authentication for SMTP or IMAP.

> I'm not aware of two-factor authentication for SMTP or IMAP.

This could be achieved using a client side TLS certificate along with a username and password. I know that Postfix and Dovecot support it.

My problem with the get your own domain and DNS is its far more likely I become incapacitated and become unable to pay or manage it than getting locked out of gmail or outlook mailboxes.

Is it? You can register for 10 years at a time and then keep that topped up, as well as setup autopay pointed at a bank account with as many years of funds as you'd like. At some point the likely limiting factors shift to other things. Even the most reliable longest lasting registrars could in principle go out of business or get bought, but then again Google could decide to radically alter or discontinue services at some point too (as they indeed frequently have), or get broken up or who knows. 10 years is quite a while. And while nothing about business dealings is completely certain, someone paying for a domain a revenue generator with potential for more, so even if a registrar was acquired they'd have strong incentive to try to roll over existing accounts barring active objection.

I don't know your personal circumstances of course, different people may very reasonably make different calculations. But I have more trust in a quality registrar and my bank then in Google under the most likely scenarios where I'd still care (long comas aren't impossible to come out of, even multi-year, but chances of just partial recovery plummet after even a month or two let alone full recovery). I think Google being capricious or making a mistake is a bigger concern, if only because there is almost zero chance of recovering from it (basically have to know a well placed Googler or manage to go viral or be a big enough presence to get their attention). Domains and finance in contrast are both full of competition and portability.

If you are doing all that, why use Google at all? Just to get the broken GSuite variant of Google?

$6/month doesn't sound like much... Till you realise you'll probably have this setup for 20 years, and suddenly it's $1200. That's a lot to protect against a thing that will probably not happen (account being banned)

It's insurance, a waste of money most of the time, and extremely good value for money very occasionally

I pay for gsuite for myself and a couple of my domains. Call it $12/month, because you'll want to setup two accounts:

* The admin-user.

* The daily/real-user.

In my case I have my real account "steve@steve..", and "admin@steve" which is the gsuite administrator. I only login to make changes to the domain setup, never to send/receive email.

It's annoying to have to pay for that second user, but I feel happier with the privilege separation in place.

Why not me@steve, iam@steve, thisis@steve, thereal@steve or any of the other variants?

I've been using name@name.tld for a long time now, I realize the repetition reads a little oddly but I've never cared enough to switch to anything else.

I guess I should have started using forname@surname.tld to make it all nice and neat, but I've no desire to change now.

I find it strange to send someone an email and address it to "me". Autocompletion may also help when typing steve instead of "thereal".

I'm a boring person. I even use my full name for kevincox@kevincox.ca

It should be possible to enable Cloud Identity Free on your gsuite tenant. So you can use a free identity account for your admin account and only pay for gsuite on your main email account.

https://support.google.com/cloudidentity/answer/7384506?hl=e...

Are you actually the owner of steve.com? Because I've been ordering Dominos pizza with the email steve@steve.com for years.

Edit: nevermind. I see you own the .net tld. I've definitely used that to order pizza too. Sorry about that.

Couldn't you use @example.com?

That's a really good idea! I'll try it next time.

example.com is good because it is explicitly reserved for this purpose and has no MX records.

Although very occasionally a service will check for MX records, but that is incredibly uncommon. My go-to email for public WiFi is fuckoff@exmaple.com and have only been denied once (<1%)

I prefer webmaster@whatever site i'm on

A fair number of places will deny that, but I like to think it sends a message. I'm not sure how many, if any, domains still have a working webmaster@ address though.

I registered steve.org.uk in 1999, and steve.fi last year.

(I moved from UK to Finland, so I checked the .fi version on a whim. Luckily it was due to expire a few months after I checked, so I setup a script to register it the moment it became available.)

6 * 12 * 20 = 1440

> That's a lot to protect against a thing that will probably not happen (account being banned)

$1,200 is a lot of money, but... anyone aged 23+ is older than Google. 17+ is older than GMail.

It is an illusion to say we know what will or will not happen to Google over the next 20 years. We don't know how entrenched the tech giants are over decades because we've never had anything like them before.

This is a problem that is obviously not going to happen in the next 12 months. But if a person don't control their email address, they shouldn't be using it for anything that it would really hurt to lose.

> It is an illusion to say we know what will or will not happen to Google over the next 20 years. We don't know how entrenched the tech giants are over decades because we've never had anything like them before.

Realistically we have little control or have any clue on what's going to happen a few years out in almost every aspect of life.

Look at Kodak (the photography company). They were around for over a 100 years, then digital photography came along to disrupt their market and they pretty much disappeared in a few months.

Kodak and Google aren't that different as being a company that offers a service that tons of folks use(d). Kodak used to be "the" place to buy film and get photos developed.

I'm all for controlling your own email (even tho I'm guilty of not doing so), but I think even if you controlled your own email, you'll still be victim of the company you're using maybe going out of business in the future. I wish nothing but success for Fastmail or any other email service that lets you control your email, but if they go down then you're in the same position as Google going down while using gmail.

>Look at Kodak (the photography company). They were around for over a 100 years, then digital photography came along to disrupt their market and they pretty much disappeared in a few months.

Kodak was well aware of digital photography, arguably one of its pioneers. What killed Kodak was cellphones. Kodak was too dependent and attached to making cameras and camera-related equipment. Most people did not need separate cameras once cellphones came along (even the 'dumb' models have a camera), so Kodak had nothing relevant to sell... Doubtful Google could be so stupid. Maybe if the Feds separate gmail from Search there'll be problems?

>I wish nothing but success for Fastmail or any other email service that lets you control your email, but if they go down then you're in the same position as Google going down while using gmail.

Keeping all your mails locally is not difficult if you use a mail client rather than a web client. Copying to a local folder every once in a while is a one/two click operation in typical clients.

$1200 of 20 years? I spend more than that on milk.

There are other options available. I personally don't use it, but Zoho Mail is free with paid plans starting at $1/mo.

I use the free hosted Zoho for a domain.

I had an incident a few weeks ago, where my mailbox lost about 1 weeks worth of messages, and were not retrievable.

I have used them for over 5 years, and this is the only negative incident.

Tbh the biggest benefit I see in such setup is the freedom of directing your email wherever you want. I wanted to quit Google 4 or 5 years ago and just having to redirect my domain to a private host rather than having to change my email address entirely is the one thing that made it possible

Reply on news.ycombinator.com