Hacker News Reader

Comment by 5ESS | Hacker News Reader

In most cases it’s easy to social engineer hosting company staff into granting unauthorized access (even the major ones) all it takes is a bit of know-how and maybe a photoshopped ID. The weakest link in any security stack is always the human element. The fact that Google makes it impossible to get in touch with a human is why I trust it.

View on HN

This is one of the reasons I've been reluctant to start using a hosting provider (in addition to social engineering, it's always possible that their infrastructure gets compromised). Their problems become my problems. And on the other hand, some of the big ones are also prone to arbitrarily blocking you for random reasons, just like Google. Didn't take long for Hetzner to block me.

I still host my mail at home and am my own registrar. There are still human elements of course but I've minimized them to the extent that is currently feasible.

The biggest risk I think is falling a victim of the scam. I usually get emails purportedly from my hosting provider (sometimes from my bank etc.) that I need to verify payment or something like that. Obviously they are fake but I can understand that even an attentive person can have a bad day and click on a malicious link and enter all required details. Google is probably better in filtering out such scam. And yet I wonder if it still happens often enough that they actively block login attempts if they are from unusual locations.

It can be done but it is not guaranteed. Smaller companies have more geeky staff who would be more suspicious and wouldn't let that easily to be had. They have more accountability.

I hear that many accounts of celebrities get hacked and I wonder how? Apparently even with 2FA it is not that secure. Some countries let you order a replacement SIM quite easily and then it can get intercepted (maybe by stealing from mailbox or similarly). This appears to be a reason why google has been refusing access even with 2FA in place.

Reply on news.ycombinator.com