Off topic: I wish Fastmail provided SSO (IdP) services. I want to move my small business over to it but lack of SSO is a blocker. I guess I’ll just continue to use it for personal.
Really appreciate you noticing my comment and responding. I really love your company for its values (and it doesn't hurt that you have the best webmail interface I've ever used ... and I've used them all).
Essentially, I have a small company of 11 employees. All remote. We have no on-premise infrastructure, cloud for everything. The vast majority of my team use: Github, Zendesk, Zoom, and Slack daily.
Whenever I hire a new employee, without SSO (and identity management), I have setup a multiple account credentials just for that single employee (and off boarding employees to deactivate access is a whole bigger issue).
It's not uncommon that an employee of mine might have 8-10 different username and passwords for all the various systems they use daily. Because of differing username or password retention policies, the usernames might be different and/or the passwords become out of synch because one provider is on a 90 day password change when another is on a 60 day password change. It's a mess and I'm sure people have sticky notes with their username/password written down just to keep up with all of their various username/passwords.
By having SSO/IdP provided by our email provider, I can eliminate all of these problems. Note: I'm not saying for you to accept SSO from a 3rd party - I'm suggesting that Fastmail be the Identity Provider (IdP) for my employees so that they can use their Fastmail (my domain) account with Github/Slack/Zendesk/etc.
Here's some SSO documentation from common 3rd party services we use.
Again, thanks so much for considering this. I would LOVE it if you became an IdP/SSO provider. Happy to answer any more questions.
EDIT: I should mention that I've looked into Okta in the past but for sites that don't support SSO, what Okta does is essentially a formfill/Lastpass like feature. Which kind of makes me uncomfortable. But if Fastmail allow SSO, Okta becomes more appealing (though not required)
EDIT2: this might be more heavy weight that you're looking for but I know at one time the gold standard for open source SSO offerings is OpenAM (it's the forked SSO offering that was from Sun back in the day and Sun at the time was the IAM leader). https://github.com/OpenIdentityPlatform/OpenAM/
[1] https://docs.github.com/en/github/authenticating-to-github/a...
[2] https://slack.com/help/articles/203772216-SAML-single-sign-o...
[3] https://support.zendesk.com/hc/en-us/articles/203663826-Sing...
We have a similar issue in terms of onboarding and offboarding - we have a rather large checklist which has migrated from Dropbox Paper to being a Notion template these days - but it still has a large set of checkboxes and we edit it at least as often as we on-and-offboard people (and try to remember to update it in between as well, if something changes).
So I'm seeing two possible requests here:
1) become an ID provider that can be used by other sites; or
2) support Okta (I've had a call with them, and we're looking into the OpenId Connect stuff and what would be involved in allowing that to mint sessions safely)
No promises on timelines of course, but we know that this is something of value to small businesses! And we'd probably use it ourselves if we had it, which is also great because dogfooding is important.
Hope more folks use you guys.
They're also based in [edit: I thought Protonmail was Russian based, but they're not]. I think that's probably worse from a country level.
Encrypted email is a bad way to do private communication - services that pretend otherwise set off alarms for me.
The main advantage of Fastmail vs. Google is that it's a separate service focused on providing you a good experience with custom domain support. The business model is not ad driven so incentives are more aligned and it lets you leave Google services.
The privacy people's faith in proton is misplaced (imo).
No, they’re based in Australia. They’ve been blocked in Russia recently though.
If your concern is with state-level actors with the ability to do mass spying on emails in transit and collection from many different providers, then no, Protonmail won't be that useful. If your concern is with someone getting access to your email archive, possibly years after the emails have been sent, then Protonmail does offer something: even if its own data storage is compromised, your emails should be secure. I suspect the latter is actually a much more common problem than the former, as we've seen with data ransoming lately.
Unfortunately, Protonmail's implementation is rather clunky. I actually would consider using a self-hosted system that did something similar: get clear-text emails, but immediately encrypt them with a key that the server doesn't have the private key for, and still allow searching and notifications in some way.
My personal approach is to treat email as public communication and to delete archives aggressively.
I recognize that this isn't something most people do.