Hacker News Reader

Comment by dmw_ng | Hacker News Reader

Seems like a great opportunity for folk to reevaluate whether they need a Google account at all. I finally escaped in September, after first trying all the way back in 2011. Dragged my feet for so long until eventually just saying "fuck it" after a few glasses of wine, and even recorded a screen cap of the final GAFYD deletion.

For anyone attempting escape, rclone seems to be the only tool that supports exporting all Google Docs ever shared to the account. Google Takeout (or the equivalent GAFYD tool) worked for everything else

View on HN

And move to what?

Your choices are:

- Run it yourself: And get eaten alive by third party anti-spam products. Maintaining a mail server is a full time job.

- Move to another large corporation (e.g. Apple, Microsoft, et al). What have you solved exactly?

- Move to a small mail provider and hope they don't go under (and you lose your x year old email address associated with tons of stuff) or have security issues because they didn't/couldn't afford the expertise.

The "least bad" option right now just seems to be to spread yourself around, so you're not too invested in any one vendor (in particular in case they ban you randomly for reasons they won't disclose or discuss).

Chiming in with what everyone is saying:

1. Have your own domain name.

2. Use a small-ish mail provider that supports IMAP, etc.

3. Store all your emails/folders on a device (laptop, whatever). This way if the provider locks you out or goes under, it's easy to switch to another.

Has worked since what, the 80's? Personally been doing this since before Gmail existed. Ironically I chose this route precisely because the major providers (Yahoo, etc) were too unreliable for me - I had lost accounts multiple times because some of the (then) top mail providers decided to get out of the mail business and/or regressed their featureset so much that it hurt.

Of all the Internet services, this is the easiest one for someone to own.

HN’s darling fastmail has been around for 22 years, I somewhat doubt they’d randomly go under.

On the other hand they are small enough to certainly be hurt by concentrated DDoS attacks as it’s been happening the last week.

Domain name with Namecheap, Gandi, $your_favorite_registrar.

Mail provider with any small provider.

Use Thunderbird, it's honestly better that it has been in maintenance-only mode for a decade and isn't being "innovated".

D) go with any vendor but use your own domain. That way if you get randomly banned or they go under you still have the address, and it mostly solves issues with deliverability/being spam filtered.

That only shifts the issue from having to trust Google to having to trust the domain registrar. It does not solve the underlying problem.

you can register domain on your own name.

> Move to a small mail provider and hope they don't go under (and you lose your x year old email address associated with tons of stuff) or have security issues because they didn't/couldn't afford the expertise.

You can also just use an email client that downloads the emails you get, and then point your MX-records to another provider if and when your provider goes belly up.

I will never again create an email that matters for a domain I don't control. I learned that lesson with my nerdshack account.

I use my own domain + small mail provider. If they go under, I just need to change DNS records.

> The "least bad" option right now just seems to be to spread yourself around

Sounds about right. For e-mail I'm using SES for outbound on my domain, and.. of all things.. Yandex Mail for inbound. SES doesn't seem to have any problem with spam filters, Yandex OTOH, it's definitely a temporary solution, I'm only using it for POP3, but their webmail is also fairly cute. Yandex outbound is treated as spam by basically everything except Yandex

i find migadu great, using my own domain names

Why would 2FA of all things be the critical issue? Tech savvy people should understand and use hardware security keys at this point to be securing their cloud accounts in general.

> Why would 2FA of all things be the critical issue? Tech savvy people should understand and use hardware security keys at this point to be securing their cloud accounts in general.

Yeah, sure, should be.

Meanwhile I've yet to actually see one in the wild, in a 20 year career, aside from one that's used on a server I know of.

Coworkers at small tech companies? Nope. Serious-business clients coming into the office? Don't see them busting out the USB stick and plugging it in to their laptops. Medium-sized tech companies? Nope.

Hell, I'd hate it even worse than phone 2fa. I lose my actual keys all the damn time. 80% of all remote controls in our house are, at any given time, vanished to some other dimension, because I have kids. The last thing I need is another tiny, super-important physical thing to lose. The only reason a cell phone is a useful object to me, and not another annoying thing I can never find, is because of "Find My".

Tech savvy people often discard browser cookies at every opportunity. Adding a 2FA step to every interaction with Google is a change in routine, and forced routine changes are a great time to break any harmful habit

Firefox Containers. Sandbox Google from the rest of the internet, while still appearing logged-in to Google products.

This is the "killer feature" of Firefox, IMO. No other browser does what Firefox does w.r.t. containers.

Because my email account is that's linked to every other account and I can't afford to lose everything just because I've lost my phone (which has happened twice in the last two years, but recovered it both times).

You have many options including notifications in google apps, authenticator apps, text messages, hardware tokens, written backup codes. Not all of these rely on your phone so set them all up

So in other words dramatically increase the attack surface on my account.

Enabling SMS authentication for an account is a huge DOWNGRADE in security, not an increase. Cellular providers are infamously easy to socially engineer.

No… Well I guess if you were adding SMS as a 2fa option to your real 2fa would increase surface but that wouldn’t solve what the parent comment was saying. So yea don’t do that (but it’s better than just a password).

1)Password alone is weak. 2)Password and SMS 2fa better. 3)Password and real 2fa best. 4)Password, real 2fa, backup codes, basically just as good as best.

Google is only eliminating #1, and only requires 2fa when logging into a new device. I’m surprised HN folks are having a tough time grasping this one, in general it’s pushing people (I’d guess 90% of people would never opt into anything more than a regular password, including the parent) into #2 above.

Parent should do #4, but #2 is fine

Especially some banks that still use SMS as your 2FA.

Oh c'mon, even tech savvy people are just using email for email.

For me, I have to consider 2FA, or in the case of my son, who doesn't want a phone, a Yubikey or similar. I don't want to live with the additional management and potential disaster of 2FA blocking his access to his email account, which is currently his gateway to university.

At work I have 2FA, but there's a whole IT/IS team to manage and unblock things (which happens, co-workers get blocked out of their email accounts regularly).

Personally, I'm hoping to convince my domain cohorts (family) to move to Protonmail or similar.

> For me, I have to consider 2FA, or in the case of my son, who doesn't want a phone, a Yubikey or similar. I don't want to live with the additional management and potential disaster of 2FA blocking his access to his email account, which is currently his gateway to university.

This is a good point: For many people, passwords are already too much of a hassle. 2FA is going to be just more hassle. I manage all the passwords for everyone in my family, because they just can't manage to remember theirs (even simple ones like hunter2), and they don't want to use a password manager themselves. I'm sure ours is not the only family in the world who does this. So, the burden falls on me to keep their passwords stored and secure, and tell it to them when they need it. Now add 2FA onto that pile and it's just going to be more of a hassle for me.

As a tech savvy person, I used 2fa for all the corporate stuff I could and for some personal stuff too.

Now that I only have one phone, I've turned off 2FA as much as possible, because only one phone means when it breaks, I can't access my accounts, because I can't get to the 2FA tokens. No thanks.

You can add the 2FA authenticator codes to multiple authenticator programs. I usually add them on to 2 different devices at the same time.

You didn't read any of those screens warning about you needing the backup codes? I do realize some services don't provide backup codes (which is insane), but when they don't I have found that they provide the codes you can manually type in to authenticator apps. With that, you can add the code in multiple places, like on your phone and also another computer with any totp app like authy or TOFU or whatever to have a 'backup'.

I keep my backup codes in a plain text files in a folder on my home NAS which is encrypted on disk, and backs up through rclone (with encryption) to backblaze every night. I'm about to configure up a second NAS for redundancy because 3 2 1.

> You didn't read any of those screens warning about you needing the backup codes?

I read them, and said, no thanks; I'd rather be able to recover my accounts easily.

I use Keepass with Strongbox and save the database file in iCloud. That way I have TOTP codes backed up, and I can share with others such as my spouse.

> Seems like a great opportunity for folk to reevaluate whether they need a Google account at all.

Yeah, but still pretty inconvenient. I migrated all my main stuff way from Google years ago, but I have a bunch of accounts I use as throwaways that will be a much bigger PITA to use.

Probably a little easier for me, I stopped adopting anything new from Google for personal use after the Reader episode. I still have access to some business accounts mostly for GCloud.

Reply on news.ycombinator.com