Hacker News Reader

Comment by drivebyacct2 | Hacker News Reader

Not sure why any of these steps should lead you to fear about using Gmail. Hosting your email yourself is almost surely more risky. Those hosting their own email aren't going to have complex password recovery system with the abuse protection that Google's has. There isn't going to be a warning system to alert you that there have been sign-ons from foreign states/countries. There isn't going to be two-auth out of the box unless you install the PAM module.

If your weak link, was, as usual, the human link... I would be inclined to trust a system more catering to (forgive me) ignorant users.

I just worry that the mindset is, "I got hacked because I use Gmail, if I used something else I'd be safer." and I find that logical to be pretty flawed.

View on HN

Here are some reasons why self-hosted email is a better bet than Gmail:

1. Your self-hosted system will be unique, which means it won't be attractive to phishers (by definition).

2. Because your system isn't a major email service like Gmail, your address won't have the same cachet with other mail services (i.e. auto-whitelisting). Therefore it will be even less of an attractive target to someone attempting to spam. (For the case of criminals attempting social engineering of a contact list, see point 1.)

3. Because Gmail must run mostly without human intervention, you get bad security such as the "last chance" form, in which everything you need to recover the account can be determined by hacking into the account. Self-hosted email won't have this problem, because it will have a human devoted to correcting problems (i.e. you).

There are of course obvious problems with self-hosted email that Gmail doesn't have, but it's not exactly one-sided.

Why would a server that only runs ssh and qmail be less secure than Gmail? Why would I need a password recovery system?

Remember that Gmail had a sysadmin reading the mail of users:

http://gawker.com/5637234/gcreep-google-engineer-stalked-tee...

> There isn't going to be a warning system to alert you that there have been sign-ons from foreign states/countries. There isn't going to be two-auth out of the box unless you install the PAM module.

Your points are valid, but why wouldn't these things exist? Doesn't code exist to do this? And if not, is it truly difficult to write?

I'm not saying it's a trivial task, but someone who decides to host their own e-mail would probably be willing to work at it.

Well, they probably do exist, but not as a default install of any webmail client that I've used in the last few years.

http://www.duosecurity.com/

https://github.com/duosecurity/duo_unix

Just as a note, Google's "Google Authenticator" app for Android is open-source, supports the open standard for OTOP, and has a free OSS lib for PAM.

If you choose not to use webmail (or run it at just about any URL that deviates from the default) you will be a lot less vulnerable to a whole host of XSS and CSRF attacks.

Every site you visit in a browser can attack every site you're logged into, but they have to know the URL scheme of those logged in sites.

> Every site you visit in a browser can attack every site you're logged into, but they have to know the URL scheme of those logged in sites.

That's assuming nobody uses anti-CSRF measures, right? If I've got an anti-CSRF token on a form, how are you going to attack it? Or what about pages (e.g., change password pages) that require you to enter your password? Certainly you'd need to know more than the URL scheme.

I'm not assuming that nobody uses CSRF protection, but there have been a few high profile driveby attacks against gmail over the years. Presumably future gmail attackers will do the same thing that past gmail attackers did: find a bug.

In the sense that Gmail is a big target, and a self-hosted account is a tiny one, I do understand the feeling that if for no other reason than obscurity, you are safer avoiding the "big names" in any online service.

A paid provider would be more likely to listen to you.

Reply on news.ycombinator.com