Hacker News Reader

Comment by pembrook | Hacker News Reader

After seeing posts like this on HN for years, this one officially scared me enough to completely migrate off Gmail altogether. I’m in the process right now of removing my gmail from any online account.

Pro-tip: if you use a password manager, it’s as easy as searching for your Gmail address. For all other accounts, I’ve been able to find them by searching for the phrases “verify your email” or “verify email” or “verification” in Gmail.

Just imagining the nightmare that would happen if I got locked out of my Gmail account (10 years of accounts)…I can’t believe I didn’t do it sooner.

You can also do a full export of your Google data, which I highly recommend.

Switched to fastmail recently for my personal domain and could not be happier with the service. It costs money every month, so they have actual human support if anything goes wrong.

View on HN

Just gonna throw Migadu in here as a mail host. Everyone loves Fastmail, which is cool - I'm an ex-happy-user - but Migadu's point of difference is their pricing.

Whereas Fastmail charges by the user/month (or did when I was there), which can add up quickly if you've got a bunch of domains, Migadu does not. They charge by volume. You can add as many domains and mailboxes as you like. For some use cases - mine, and likely many of you - that ends up with a way smaller bill.

They're run by real people in Switzerland. I've been a customer for a couple of years now and it's worked flawlessly.

Usual disclaimers, just a happy customer, not affiliated.

https://www.migadu.com/pricing/

https://www.fastmail.com/pricing/

Note that if you're just using the domains for one user, you can set them up as aliases rather than seperate mailboxes to avoid stacking fees that way.

I do this, but it does make me wary of lock-in. It’d be a pain to have to change all of these in order to leave fastmail.

This is one of my problems for migrating from Google Workspace. I use aliases and groups to have significant numbers of separate email addresses for specific services.

Mapping all these accounts will be a big pain in the butt.

I had a very poor experience with migrating off Migadu when they dropped their free tier. It completely soured me off them forever.

Can you elaborate? Were you using something like IMAP sync and having trouble or are you moreso talking about timelines and their comms?

Moreso timeline and comms. First e-mail communication I got regarding sunsetting of the plan was a section at the bottom of a length e-mail announcing pricing changes sent on August 28, 2020.

The e-mail announced that on October 1st 2020, free tier would be sunset, and immediately locked until upgrade to a paid account.

On a related note, I’ve commented earlier about this. I didn’t like the way Migadu dropped the free tier when the pandemic was raging, with a short notice. From that experience, I can’t bring myself to trust it. I really appreciate the pricing that’s not per user/mailbox, but there’s more to a business than just pricing.

Mxroute provides a similar service that’s not based on users/mailboxes and is cheap enough for multiple domains and multiple mailboxes.

For those concerned with privacy and data stored in certain countries, Mxroute stores data in the U.S. (like Fastmail) and Migadu stores data in France (a 14 eyes country) even though the company is incorporated in Switzerland. Migadu also does/did not encrypt data at rest (as of a couple of years ago). So any seizure of its servers in France means your data could be exposed.

I recommend Purely Mail: https://purelymail.com/

Very cheap, pay-as-you-go, unlimited accounts and domains with routing. It's a 1-man company with rough UI but works well for keeping control of your own data.

+1, Migadu is simple, reliable, easy, and just works. Cost is low enough it might as well be free. I've only ever had one issue (from incorrectly interpreting documentation) and had an actual human respond and walk me through it.

The only downside to be aware of is the lack of calendar support (technically yes via CalDAV, but that doesn't work for most users--e.g. Calendly won't work).

Edit: the way they handle domains and email aliases has simplified my email life.

I did enjoy Migadu and want to support them, but I had more than one important business email get filtered on the receiving end as spam because of the host. I found myself having to check in with people on sensitive matters to ensure they got my email, which is not a great look.

This was back in the free tier days (though I had a paid account), so maybe its improved now.

It's a terrible look — one that you can't avoid with 100% certainty even with a Google or Microsoft email!

Yes, but it's much less likely to happen when using Google.

Gmail is much more likely to mark emails from smaller providers as spam, thats my experience.

Kind of sad that “it looks bad” if your email lands in spam. It happens, this is the technology.

I completely agree on the pricing front. Migadu’s pricing (like Mxroute’s) is good for those who need multiple mailboxes.

> They're run by real people in Switzerland.

Please note that the data centers used by Migadu are in France. This may be a concern for some people who are looking to avoid 14 eyes countries.

Their explanation why: "We find EU privacy laws much more elaborate and restrictive than the Swiss ones. Switzerland used to be famous for banking secrecy, but that has nothing to do with digital data." https://www.migadu.com/procon/

Sounds like a similar pricing model to MxRoute, who I've been quite happy with.

I had super bad experience with Migadu. They had changed important settings and sent email about it few days later (pop server name), then they doubled the price despite their old home page claims (again no email notification). During the pandemia there were several downtimes. Emails to yahoo were not really delivered (I have an old domain, and I send only private emails.)

I switched to mxroute and it just works. Migadu's price is ok but the support and communication was really weak back then.

Just wanted to send you my thanks. For the last hour or so drinking my morning coffee I read their page.

I will give them a try but you might have provided me with the service to switch to from Google.

I already have replacements for storage (my second main use) and Documents. And I do not have a problem in general with proprietary solutions. But Google sadly more and more is not in line with what I see as values good for the internet nor humanity.

Your post reminded me to back using my gmail locally and to ensure a script does so automatically from now on. I need to do the same with google docs as soon as possible.

I keep forgetting that “the cloud” just means “a computer that belongs to someone else, that they can take back at any time”

The danger is not just that Google may one day delete your data, maybe. The danger is that an advertising surveillance company that has leveraged its ad surveillance into hundreds of billions of dollars per year in revenue has access to (and uses!) 100% of your personal correspondence, today and every day, no maybe.

Additionally, they regularly turn such data over to government snoops, without due process or probable cause, something that storing your data with them enables. This is a terrible thing for a free society even if you don't yourself personally care for or value privacy, as you opt in everyone who corresponds with you without their consent by using these systems.

> has access to (and uses!) 100% of your personal correspondence

I have nothing nice to say about google, so I'm not defending them, but didn't they announce our email is not getting scanned any more? Given that they reversed the do-no-evil motto, the sad part is that I guess they have enough information about us not to bother reading our emails.

They did, but they also have a feature that will tell you about everything you’ve purchased, mined from your email.

They said email was not being scanned for adwords and similar products. They never said it wasn’t being scanned for other reasons.

> The danger is that an advertising surveillance company that has leveraged its ad surveillance into hundreds of billions of dollars per year in revenue has access to (and uses!) 100% of your personal correspondence, today and every day, no maybe.

There is nothing dangerous with being shown more relevant ads.

When I have the stomach for it, I click irrelevant ads which don’t reflect my interests. You know—out of curiosity—to spend their money. It’s astonishing how quickly a silly hat becomes literal violent propaganda. I mean, in the same minute.

  > It’s astonishing how quickly a silly hat becomes literal violent propaganda. I mean, in the same minute.

Could you please explain?

Like if I click an ad for, say, hunting gear… I’m instantly inundated with “thin blue line” and not very subtly threatening “guns rights” stuff and pretty much every single thing I would expect to see in a far right mob.

Interesting, thanks.

You are correct, and if that were the end of it, people like myself who are concerned about it could rightly be labeled paranoid.

However, the collected data create an intimate, detailed portrait of you. Data aggregators can know how old you are, your general state of health, where you have been, your interests, including sexual interests, your political views both expressed and unexpressed, your associations, your associates, your family, your daily habits, your unusual habits, your credit score, whether that credit score is accurate, etc, etc.

And, this is true for everyone you come into contact with: friends, family, business associates.

An AI could, with this data, model you and your behavior more accurately than could your own spouse.

Moreover, not only must you trust the people with access to that data, and everyone they sell it to, to only ever use it for targeted ads, but you must trust everyone who will ever have access to it, forever.

While you may believe you're boring and your views are entirely uncontroversial, times change. Or, hell, with enough data and motivation, someone can paint a damning portrait of you made up whole cloth from true, innocuous details.

You have to just hope that neither you nor anyone you associate with become a political target, or the target of criminal activity, or garner just plain negative attention, for whatever reason, because if so, you and your loved ones will be trivially easy to find and manipulate.

>model you and your behavior more accurately than could your own spouse.

To me this is a natural thing. It makes sense that computers are better at remembering and interpreting data than humans. YouTube is able to recommend me videos much better than I could myself. I don't remember the names of all the people I like, but YouTube does.

> To me this is a natural thing. It makes sense that computers are better at remembering and interpreting data than humans. YouTube is able to recommend me videos much better than I could myself. I don't remember the names of all the people I like, but YouTube does.

This is a true statement that doesn't address any of the arguments; a non-sequitur. Yes, computers are better at remembering and interpreting (some) data than humans.

What does that have to do with the humans who access and use that data for their own, very human ends? You skipped that part.

Another pro-tip: forward to your new email, and set up a filter that labels all the items sent `TO` your old Gmail. This becomes a record of items you missed, and can update (or better yet, unsubscribe) as needed.

This is a great idea. I thought about forwarding, but hadn't thought of automatically labelling them as requiring an update (or unsubscribe).

This somehow reminds me of Yahoo. The fall of Yahoo starts with people stopped using Yahoo Mail and went to Gmail.

I've tried and failed to migrate off Gmail a few times. Mostly due to the number of SAAS accounts I've created with that email address. I like your suggestion to search for "verify your email" etc. I tried searching my Gmail inbox using search you suggested: “verify your email” or “verify email” or “verification”. I got 3 results despite having hundreds of signups since starting the account back in 2006.

Something that would be super useful is a script that can be run against a local Gmail mailbox file that does a comprehensive search for "account created" type confirmation emails and produces a CSV of domain, date, etc. Something that would enable user to delete old accounts, or migrate them to a new email service.

> it’s as easy as searching for your Gmail address

And then taking a week off of work so that I can change 672 passwords.

I thought it was going to be a huge hassle (I too imagined I had hundreds of accounts), but for me there were less than 30 accounts I actually cared about. Basically credit cards, banking, airlines, government services, social accounts, FAANG accounts, and domains/hosting. Annoying, but only took about an hour and a half.

The rest that are non-important I'll just let languish in the Gmail account, assuming I'll be able to go back and get them if needed, yet, also not being heartbroken if I get screwed by some faceless algorithm like OP.

> Just imagining the nightmare that would happen if I got locked out of my Gmail account (10 years of accounts)

We think the things we've built up over the years are important, but really they're just digital sandcastles. The only account you have online that matters is your bank account. When everything else goes, it turns out it doesn't affect you in the future. You just create new accounts and move on.

The only account you have online that matters is your bank account

Can’t you just visit your bank office in person and reset it? Or if they can’t do it, just withdrew all the funds and create a new account?

Oh sure, you can recover your account or create a new one in person. I imagine online banks have similar avenues

I'm not sure what the situation described above has to do with Gmail and migrating off of it. OP was storing hundreds of videos, probably against Youtube ToS, to run their business. Pretty sure unlisted videos can't run ads either, so they were basically using Youtube as a free hosting service for their business.

According To OP, YouTube noticed them about cyber bullying, not ToS violation because of hosting many unlisted videos.

The common thread that they are trying to raise awareness about is that Google at any time, for any reason, can lock you out of your account with no way for you to actually find out why or what's happened.

Yes it's probally against YouTube's ToS to get people to pay for content in unlisted videos, but the terms of service doesn't explicitly talk about using YouTube to host paid-for content - it is covered in a border statement though in their ToS [0]

But they should still at least be able to talk to a real human about it and get told the actual reason "Your account was terminated for commercial use of unlisted videos" instead of automated email bot responses/Or have been given some warning "This is against our ToS, your account will be terminated in 7 days"

[0] https://support.google.com/youtube/thread/38348285?hl=en

1. Why would hundreds of unlisted videos be against the ToS?

2. OP didn't say the videos contained ads. And why can't unlisted videos contain ads anyway?

3. YT weren't complaining about ads anyway. It was "cyberbullying" in one video.

> Why would hundreds of unlisted videos be against the ToS?

It's most likely against ToS if you use said videos in a commercial way. Youtube isn't your companies private video hosting service.

> OP didn't say the videos contained ads.

No, but they were used to run their business. So it was commercial in nature.

> And why can't unlisted videos contain ads anyway?

Mostly a quirk of how Youtube works.

> And why can't unlisted videos contain ads anyway?

Looks like I was wrong about this one, sorry. It does seem like unlisted videos can indeed run ads. That being said, it still seems like a bad idea to run company crucial part of your business off of a free ad-based service.

I did something similar. Searching for verify and verification are good for those cases where you signed up with a Gmail email.

You can also navigate to Settings > Security > Signing in with Google to see everywhere that you've used Google Sign in (oAuth).

The simplest solution to this I can think of is to use a mail app on your laptop that syncs with your Gmail. That way you will always have a local copy of your emails.

I'm not sure if Google can kill Gmail. If any major competitor takes over, they could mine emails for ad value, which would give them a large edge.

Perhaps, but they can kill individual accounts.

That's why I pay for Gsuite.

I only need to worry about not losing control of my domain name. If my mail provider decide to kick me out, I just need to get a new host.

I've been worried about someone taking over domain in recent years as well.

I've bought a bunch of decentralized domain for this reason on handshake, sol, etc. They aren't super usable yet as most email services won't resolve the alternative DNS but who knows what future holds.

Namecheap acquired namebase (namecheap of handshake world), recently.

https://www.namebase.io/blog/namebase-has-been-acquired/

So I've hope it will go somewhere.

I’m not saying this is bad advice. It’s not a bad idea to reduce single points of failure!

But without objectivity about how often this happens, there’s probably a lot of other far worse problems that deserve our attention.

It's a digital life equivalent of a motorcycle accident I think. The risk is catastrophic, so any incidence rate is enough to require being prepared for it.

At first I thought that losing access to my gmail would be pretty bad, but now that I think about it, I don’t see anything particularly troublesome if it happens tomorrow, let alone catastrophic. Can you give some examples?

If you owm the email's domain you can switch the domain Mx record and continue just fine. But over the years a lot of accounts end up tied to Google SSO and if you are just using a plain old @gmail and have tied all your accounts to it you are probably in trouble.

I’m not a business. I don’t use domains or SSO. Yes, I use my gmail address as a login to many websites, but losing access to gmail does not mean I can’t login to those websites anymore. It just means recovering an account is more difficult (but in most cases not much more difficult). And I do export my gmail inbox every year as a backup.

Fair enough, if you feel like you have a handle on your personal situation and are comfortable with the level of risk then by all means don't be worried. When I say catastrophic, I don't necessarily mean catastrophic to your entire life with no way forward. I just mean your digital life will be pretty toast and you'll have to start again on a lot of platforms that don't make the email changeover easy. That's not going to be true for everyone either. If you've got nothing important online, nothing to worry about.

> but losing access to gmail does not mean I can’t login to those websites anymore. It just means recovering an account is more difficult (but in most cases not much more difficult).

I think this is pretty naive though, this thread is really a story about how automated systems are making the digital world more challenging to navigate and how getting a human to help you is becoming harder in many cases, making those automated decisions final. If all you needed to sign up for something was your email address, it's possible they will have no way to verify you are the owner if you lose access to that, even if you can get in contact with a human.

Well, if I lose access to gmail the first thing I do will be switching all important online services to a new email.

I’m curious though, which online services would be really bad to lose access to (for you personally)?

How are you going to log in to anything using Google SSO? It's not the email address that logs you in, it's the authentication handshake from your google account. Anything using 2FA, or one time passcodes to your email address for new devices?

One example is when I lost access to an email account tied to a Digital Ocean account. It had been hosting a project VM and I never had a need to log in to it until the project shut down. I try and log in and although the credentials are right, it needs me to verify a one time code from my email address to prove I am not a bot. Couldn't do that. I never gained access back, DO required me to give them a full suite of proof of ID before I could even get them to disconnect my credit card, and even to this day it periodically restarts charges against my card and I have to contact them. Each time they escalate to engineering and engineering says they "Fixed the issue". Now times that experience by potentially dozens of accounts.

I never use my personal gmail account for anything work related. For 2FA I always use my phone.

But I agree that there might be situations where it could be bad, especially if you work as a consultant/freelancer, and/or own a small business.

Reply on news.ycombinator.com