Hacker News Reader

Comment by systemvoltage | Hacker News Reader

Folks - pay $5/month for Fastmail, Migadu, ProtonMail, or self host + your own domain name. Companies like this come and go, it’s a good chance you’ll still own the domain name.

There is no such thing as free. They’ll nag you for hosting on their site. UI will degrade over time. Something will give, if not now, at some point in the future. Lifetime is a bold claim. I’m being cynical but this smells like an attempt to get a whole lotta buzz.

I also do not buy the Swiss marketing. You know how you know a company is Swiss? They’ll tell you. 100% of the time, every time.

That said, I think Swiss laws are great and immune to a lot of bullshit.

Edit: I meant free in absolute sense. There are some relatively free things out there. For example: readthedocs.org, but runs on donations from big companies like Microsoft. Same with GitHub (free private repos after Microsoft acquisition). Perhaps Ik is big enough to afford to build goodwill through free email? I know Apple is getting a lot of flak lately, but iCloud email is also “free” and not adtech driven.

View on HN

Swiss guy here, surprised to see Infomaniak on the front page of HN!

I wouldn't say companies like this come and go: Infomaniak was my first (dial-up!) internet provider in 1995 and I still have my email there. Back then they used to be a small computer shop ran by passionate hackers in Geneva, organising demo scene competitions and such, and now and they grew up and are one of the biggest and most interesting internet company in Switzerland.

> I wouldn't say companies like this come and go

How about this then: Free services come and go?

Most recent example: Google Photos. Google isn't going anywhere, and neither is Photos. But free unlimited storage forever is definitely going away, even though it was _the_ distinguishing feature back when it launched.

The more you get for free, the lower the chances the provider will be able to cross-subsidize the free tier from the paid ones (and/or make enough money from ads/selling your data) in a sustainable manner.

The point here is valid: a “free email address for life” is equivalent to a statement like “You can sleep on my couch as long as you need to”. It’s true until it isn’t.

Unlike crashing on someone’s couch, for an actually very insignificant amount (and a nonzero quantity of technical skill), you can own actually own the domain and the email server and not depend on the charity of another, and not be even possibly inconvenienced someday by the service ending when someone turns out the lights on their way out.

The cost of maintaining such a service is also minimal, but nonzero and can be an intimidating feat to attempt. The alpha nerds will beat their chest and state that they are so technically inclined that this approaches zero for them.

> you can own actually own the domain and the email server

I believe the worst problem here is spam. Google grew that much as email provider also because they have among the best filters out there, but what about different servers on small hosting providers? Security issues aside (I assume their sysadmins know how to setup a safe email server), I've planned that route many times and resisted because having to fiddle with constantly changing spammers lists is something I really wouldn't want to waste a minute on.

Swiss here.

> That said, I think Swiss laws are great and immune to a lot of bullshit.

In 2016, people voted in favour (65.5%) for giving mass surveillance power to our intelligence service [0]. And we also did it before it was cool (and legal), so trust us, we are good at that [1].

[0] https://www.admin.ch/opc/en/classified-compilation/20120872/... [1] https://en.wikipedia.org/wiki/Secret_files_scandal

In 2012, the swiss people also rejected a referendum about longer holidays. Another weird one is the Federal Gambling Act, a referendum of 2018 that made it legal to DNS block unlicensed gambling websites (for tax reasons). The swiss people basically voted to approve censorship with that one.

[0]https://www.swissinfo.ch/eng/voters-say-no-to-longer-holiday...

[1]https://www.admin.ch/gov/en/start/documentation/votes/201806...

>The swiss people basically voted to approve censorship with that one.

Absolutely!! And the politicians said: But to all the young peoples..don't fear that's the only thing we do, it's to prevent excessive/addicted gaming.

And funny enough, now we have 10x more advertisements for online-casinos but Swiss based (probably we should talking about that addictive thing again? And maybe micro-transactions in Games too?)

I received a "free for life" GitHub developer account in 2008 as part of a thank you for the company I was working for at the time which hosted and helped them grow.

In 2012 they terminated the "free for life" status of all of those they had given out.

So yeah, it can and will happen.

I do agree that Swiss laws are generally good, but consumer protection is significantly worse than for example the EU. For many things, a EU person will take something for granted and get screwed over, mostly in terms of strange socially accepted norms + "if it's in the AGB (terms of service) good luck arguing/defending".

>I do agree that Swiss laws are generally good, but consumer protection is significantly worse than for example the EU.

I'm Swiss and i have to tell you that your 100% right!

Even the ~good privacy was slaughtered with the last Secret service law. The NDB (the Swiss CIA/NSA-komplex) has a really mixed past.

Started with the CryptoAG Skandal (aka never trust/buy Swiss security Products ever), the Data-leak (everyone had access to any digital datas...), and the Fichen-skandal (where the NDB/UNA wanted to be a bit more like the Stasi in east germany)

> "if it's in the AGB (terms of service) good luck arguing/defending"

It might be hard to argue without suing, but legally there are provisions that if the AGB contain “surprising” terms, you have to be made specifically aware of them or they are invalid. There is currently a high-stakes case building because of this: Some of the epidemics insurances for restaurants had a provision that “pandemics” are excluded and won’t pay out for COVID-19, now restaurants are suing.

https://www.srf.ch/news/schweiz/epidemie-versicherer-kein-ge...

The whole Swiss government is insurer friendly/best buddy, since last year the insurer can change the contract on his side without you to have to accept it...it's disgusting.

Also the lobby is really big...even bigger then the financial lobby:

https://www.nau.ch/politik/bundeshaus/so-viel-geld-pumpen-sc...

And that is the real interesting graphic:

https://c.nau.ch/i/RNNxO/1360/spenden.jpg

Switzerland isn't part of the EU.

That's why he compared it WITH the EU.

Also german ones mailbox.org, posteo, tutanota and norwegian runbox.

Mailbox has been around since early 90s ive been happy user for a longtime.

You make good point that Swiss (German also) laws should protect your privacy more than US laws. That includes fastmail and icloud.

I would advise everyone to stay away from services that also provide and allow use of an email address on their (provider) domains i.e. user-name@service-provider.tld (e.g. name@mailbox.org) but don't have any free tier (even the bare minimum). So the moment you stop paying you are cut off and if you had been using email on their domain you might be less inclined to migrate away even if better competitors are around at better prices.

So, mailbox.org (my current mail host), posteo (they don't even allow custom domain!) and the like should be avoided. It's nothing but lock-in.

Because you will eventually start using it. the domain sounds very easy and tempting and it is easy to tell someone <4 letter name>@mailbox.org rather than <4 letter name>@<9 letter first name>.com.

I was a FastMail user until Gmail’s launch and regret that I abandoned my free FastMail account and it was deleted. Not sure if I ignored email warnings and that was years before Twilio so there were no SMS reminders and iOS didn’t exist so there were no push notifications to try to give me a last chance! I wish I hadn’t lost years of personal email history, especially since there were probably photos there that I didn’t have anywhere else. Back in those days, data was expensive enough that they probably wouldn’t think of automatically archiving your account into a zip file in case you came asking for it later (when I asked, it was long gone). Now I wouldn’t hesitate to pay if I could resuscitate that account. Can’t really blame FastMail and now I use them for a business and love their service but it was a good lesson for me.

AFAIK you can use a custom domain with mailbox.org.

Exactly paying for your domain name is the safest way how to "own" email. I wouldn't expect people to use email without owning domain. What happens when your service of choice ends or changes rules?

I advice against tutanota. I was surpised to learn that they try to scam customers into paying for longer than was intended.

They refuse to accept cancellations of their paid premium services for when the paid for duration ends.

They insist you to login the day the duration ends to switch to the free mode. If you miss the date (by not much), they say they'll cancel and reimburse you.

The intent of this scam is clear, they hope you miss the date and pay for one more year. However, they have absolutely no legal standing in refusing the cancellation.

I'm engaged with customer protection organisations against this scam by tutanota.

Sorry i had no experience with tutanota. I just mentioned some providers. I have only experience with mailbox and runbox which both were no issues.

Is there any reason to switch to fastmail from an Microsoft 365 business account? Microsoft offers mail, 1tb cloud storage and more for essentially the same price.

Not that I can see. Both lets you setup multiple domains and aliases. Since Fastmail's datacenters appear to be in the US (New York region and Seattle), they'll end up falling under the same laws as Microsoft.

Theoretically you might save a bit with Fastmail - it seems like you can have 1 standard account that is $5/month and owns the domain and then other basic accounts at $3/month that have an alias for the domain, but I don't know how that works in practice. For a large family the savings could add up.

Privacy

The US government still can get your data from fastmail, since it's an US based company

They are an Australian company. It does have US servers, though.

+1 for Migadu or ProtonMail, both offer great service, but Migadu with $19 yearly plan and amount of features is just incomparable to any other service.

Worth noting i suspect they had some issues and maybe the company was sold? It was quite young company. I had it for few years but there was very litle activity, no bug fixes, updates, messages. It was a bit worrysome.

Now they have changed branding and pricing so hopefuly its moving again.

I remember they had some issues at the beginning of a year when international lockdown struck. That huge surge of remote workers made problems for many companies.

But I’m using them for few years and never been happier. :)

ProtonMail (and ProtonVPN, ...) is unrealistically expensive.

Posteo [1] runs on green energy, and does support TOTP (in constrast to Migadu). 12 EUR/year.

[1] https://posteo.de

Unrealistic? The same pricing like many other commercial products in this area, and even cheaper than Google.

EDIT: Posteo doesn’t have custom domains, total deal breaker for me.

Posteo is not very transparent there. They do not mention SMTP/IMAP/POP access on their 2FA docs. 2FA is not supported by any email client for generic IMAP/POP/SMTP[1]. Just think of that experience, providing a token on every sync or sending. This is why we sometimes take such a harsh stand in our copy. You need to tell users about these things and not throw marketing BS counting on information asymmetry.

We (Migadu) do support TOTP + Yubikey on the admin account. We also support TOTP on the webmail just like Posteo does. However, we call that B.S. ourselves and are working on a real solution for mailboxes.

If you do setup 2FA on Posteo, how is your e.g. IMAP access protected? They most likely offer an app-specific password which is very different than 2FA. We do those too, they are called _identities_ in our context.

We have a long and bumpy road behind and ahead of us, but one thing we made clear on day one is that we will not B.S. users. Email is not perfect, it has serious conceptual issues due its age, but one should not go about it as "there we fixed it!" (Hey hey.com!)

[1] https://security.stackexchange.com/questions/173807/does-ima...

> You have been mislead by Posteo intentionally it seems.

I don't like such tone.

TL;DR I didn't verify how Posteo's TOTP works.

FWIW, I've never used Posteo; I have some German friends who are happy with it. I'm staying local, using Soverin as my primary e-mail provider.

The reason for using a token for authorization is that the user can revoke the token (e.g. when device is lost), instead of having to change their password. These are indeed not TOTP because they are not time-based, nor do they depend on another factor (ie. password); they replace that factor. It is indeed dishonest to call such MFA/2FA.

Its perfectly possible to get IMAP to work with TOTP though. For example, you can use PAM to authenticate, and PAM can use TOTP or FIDO2 (ignoring the issues with PAM every major OS barring OpenBSD uses it). We use something similar for OpenVPN because of requirement of ISO 27k1.

I don't trust webmail at all because I don't audit the JavaScript. Nor can I verify that every visit. Same issue with OpenPGP.js. Then again, I also don't trust e-mail authenticity because the protocol is broken by design, and nobody has come up with a suitable alternative. Which is why I wouldn't pay much for it; as I would not and do not use it much, since its fundamentally broken. For example, at rest and at transit there is not enough data integrity/authenticity.

A lot of people are using a weak password as first factor, btw. Do you protect against such?

> I don't like such tone.

Corrected, not intention to make a "tone", just pointing out that information is intentionally omitted.

> Its perfectly possible to get IMAP to work with TOTP

Yes, but that's not available in generally available email clients. There are OTP extensions to IMAP.

> I don't trust webmail at all because I don't audit the JavaScript

This. We are working on one that uses no JS or just conditinaly for enhancements.

> Then again, I also don't trust e-mail authenticity because the protocol is broken by design, and nobody has come up with a suitable alternative.

Glad I am not the only one thinking that =)

> A lot of people are using a weak password as first factor, btw. Do you protect against such?

No, we set a minimum 6 char password. However we think it is less secure to have a complex one you canot remember than one of average strength.

> Corrected, not intention to make a "tone", just pointing out that information is intentionally omitted.

Cheers.

It seems we agree on a lot of things (though I believe 6 char is a bit on the low end for a password).

> Yes, but that's not available in generally available email clients. There are OTP extensions to IMAP.

With regards to TOTP, if IMAP server can auth via PAM, then you can use a TOTP extension in PAM (OATH IIRC). It does mean the user cannot auto refresh their e-mail as they'd need to enter the TOTP after a timeout again. If you combine that with the fact that people often use TOTP client such as Google Authenticator on their smartphone, then it doesn't make their smartphone with e-mail client more secure. It would, however, allow a user to use a YubiKey as authentication method.

I pay like 7$ a month for a few domains and aliases. Not sure what you consider expensive but for such a crucial service as email i think its fair. Most my domains are just forwarded, guess i save a lot on that front tho

I use Protonmail, the spam protection feels a lot more on my side than i ever experienced with gmail (which was my main reason for staying way to long)

You can use it free or upgrade with a fair tiered model.

Would recommend it anyone.

If you go this route, be sure that you don't let your domain registration expire. Even when it's on auto-renew, you need to pay attention when your credit card expires.

If you don't get a lot of mail hitting your inbox, it's not immediately obvious it's happened unless someone tells you that their email bounced.

>There is no such thing as free.

I agree, which is why I've been paying for Pobox.com since 1996. $20 a year for three forwarding aliases of your choice. Fastmail purchased the company a few years ago but I've noticed no changes.

FastMail is an amazing company. Their UI is old school and packs a punch. Their mobile app is fantastic. They also invented some new JSON based email standard: https://jmap.io/

I Love fastmail,just renewed my yearly subscription. Having that said, the mobile app is not fantastic at all. Try working with it with a poor or non-existent connection and good luck even accessing your calendar

I’ve used their mobile app on iPhone just for reading email. It’s great! But I guess it can be better.

Last I tried their mobile app it was just an embedded web browser, quite the turnoff.

Has that changed?

Haven’t had any problems with it. You’re right, it’s not native.

I’m a fan of their HTML style which is perhaps why I like their browser based email app.

Mobile app is serviceable, not fantastic. On iOS if you tap on an email notification it'll just open the app showing some old email, not the one I just clicked. Why?

That said, I'm a very happy paying customer.

since fastmail supports push via the default iOS mail.app for a while now I just deleted their own app

> You know how you know a company is Swiss?

Here is the official commercial register entry of the Canton of Geneva. The company was founded in 1996: https://ge.ch/hrcintapp/externalCompanyReport.action?company...

It was a rhetorical question, because 'they'll tell you', just like being vegan, on keto, or doing CrossFit.

And having family in Switzerland, I agree with OP: first you see the flag, then you see the company or product name.

Further to this, a catch-all domain for signing up to sites is so handy. I use sitename@domain.com. I've only had one or two spam emails since, but all I do is change it on that site (sitename1@domain.com) and blacklist the burned one.

There's no reason not to own a domain for your email these days.

You're absolutely right.

https://en.m.wikipedia.org/wiki/There_ain't_no_such_thing_as...

Right now its only available for the Swiss.

Honestly, it depends where you are from.

Given that I am from Europe, when I host in the same country as I am from (ie. The Netherlands), I am only dealing with local law. The only problem I could have, is when I am dissident according to my country. I'm not though, and if I was I'd have to host in a country unfriendly to mine.

Fastmail is an Australian company. I don't believe Australia has strong privacy laws. EU, at least, has GDPR. For most people, The Netherlands is an excellent place to host your data.

If you consider non-US cloud services, you end up in Europe as well. For example Hetzner, Jottacloud, TransIP just to mention a few.

You should also ensure they use a local domain. For example, thepiratebay.org isn't local if you consider the service is from Sweden (and if its hosted in The Netherlands, neither is thepiratebay.se). Ik.me uses the .me ccTLD; Montenegro. Not a country known for its civil rights, AFAIK.

That being said, I don't believe in 'lifetime' either. Lifetime just means 'as long as we last'. Its a risk an early adopter takes to invest. If the service succeeds, yes they might have lifetime. If it fails, it was an expensive purchase.

Case in point: Emby. I bought a lifetime license. Then they changed to closed source in version 4, and it lead to me switching to the last 3.x fork, Jellyfin. License useless.

The weird thing here, is that they provide the e-mail supposedly lifetime and free. TANSTAAFL, so the default should be suspicion. They don't do advertising. What's their profit model?

Don't forget tutanota ;)

I pay the $\approx$ 1 USD a month for Posteo, but after reading about Migadu, I might decide to switch over. Their pro/con page[1] is extremely refreshing. I know this doesn't really matter, but the whole design of their site is very attractive to me following the brutalist/minimalist style (see also miniflux[2] or lobsters[3]).

[1] https://www.migadu.com/procon/

[2] https://miniflux.app/

[3] https://lobste.rs/

EDIT: Posteo is here: https://posteo.de/en

https://www.migadu.com/procon/#we-do-not-offer-email-at-our-...

> Our whole service was built around the premise of giving email liberties back to the users, not taking them away. We refuse to fence users and lock them in.

This is a very interesting take! I completely agree with it. While it may not work for many but one of the biggest mistake I made was I've used <4 letter name>@mailbox.org extensively. But I am making an active effort to change that and remove it from use completely.

This is kind of a hidden lock in. Because there's no free email service unlike Tutanota where you can keep using email on their domain in reduced capacity.

Same for Posteo. It just doesn't make sense.

I will eventually move away from Mailbox. I will be watching Migadu. Though 20/day out can be limiting. Though it's rare I've sent 20 mails per day but there has been days when I did.

> https://www.migadu.com/procon/#no-mailbox-2fa-yet

I do not agree with the tone here. Yes, IMAP doesn't support 2FA but I'd want the Migadu control panel interface to be protected by 2FA. I like how Mailbox has handled it.

The control panel does have 2FA via TOTP and Yubikey already. Webauthn is coming. We're working on a solution for the mailbox 2FA, hence the (yet).

I hadn't heard of Migadu until today but am now moving my domains from Google (thanks!). An interesting point to note about their pricing plans and policies in general - is that they're "flexible".

Foe example there's a 200 email per day "limit" on the cheapest plan, but each plan comes with a 25% tolerance.

Similarly the storage "quota" on each tier.

I just asked Migadu's support about whether there was a 10GB option available, as 5GB was too small for mea and 30GB too high / costly. "Sure," he replied in under 4 minutes - "there's actually no fixed storage limit on each plan, please see https://www.migadu.com/pricing/#how-do-storage-limits-work" And sure enough - 5GB, 10GB, 15GB... all would be possible on the "5GB tier".

If you get close to or exceed the 30GB quota of the next tier up, their systems contact you and suggest upgradng which sounds pretty reasonable.

I'm just going to check if Apple or Google are quite so accomodating...

Mini flux looks amazing. I’m a fan of this type of design. You’ll like FastMail, if you can ignore the stupid cliche cartoons on the homepage and actually use their web email client. Very much Brutalist circa 2005 style.

also inbox.eu will not go away any time soon. we are 22 year old e-mail provider :)

we have enabled web authentication recently for mailboxes so You can now login without password

Reply on news.ycombinator.com