Hacker News Reader

Comment by NoPie | Hacker News Reader

I stopped using gmail. I pay for my own domain (approx $10 per year and subscribe a hosting service that costs about $4/month). The total cost is not much different from a paid google email which is about $50/year.

If I happened to forget/lose all passwords (lost laptop, burned house etc.), I would probably need to deal with the hosting company who would try to identify me with my credit card or some other way (phone number, mailing a letter to my physical address on file). Nothing is absolutely secure but I think it is secure enough for me while I also have fair good chances to recover my lost access. I am not a big target to scammers anyway.

View on HN

In most cases it’s easy to social engineer hosting company staff into granting unauthorized access (even the major ones) all it takes is a bit of know-how and maybe a photoshopped ID. The weakest link in any security stack is always the human element. The fact that Google makes it impossible to get in touch with a human is why I trust it.

This is one of the reasons I've been reluctant to start using a hosting provider (in addition to social engineering, it's always possible that their infrastructure gets compromised). Their problems become my problems. And on the other hand, some of the big ones are also prone to arbitrarily blocking you for random reasons, just like Google. Didn't take long for Hetzner to block me.

I still host my mail at home and am my own registrar. There are still human elements of course but I've minimized them to the extent that is currently feasible.

The biggest risk I think is falling a victim of the scam. I usually get emails purportedly from my hosting provider (sometimes from my bank etc.) that I need to verify payment or something like that. Obviously they are fake but I can understand that even an attentive person can have a bad day and click on a malicious link and enter all required details. Google is probably better in filtering out such scam. And yet I wonder if it still happens often enough that they actively block login attempts if they are from unusual locations.

It can be done but it is not guaranteed. Smaller companies have more geeky staff who would be more suspicious and wouldn't let that easily to be had. They have more accountability.

I hear that many accounts of celebrities get hacked and I wonder how? Apparently even with 2FA it is not that secure. Some countries let you order a replacement SIM quite easily and then it can get intercepted (maybe by stealing from mailbox or similarly). This appears to be a reason why google has been refusing access even with 2FA in place.

BTW A paid Google email via Workspace (previously G Suite) has gone up to $6/month/user, so $72 USD a year for a single user setup.

Reply on news.ycombinator.com