Hacker News Reader

You absolutely should own your own domain and use it to email somewhere besides Google. I use Fastmail but ProtonMail is great, tutanota, mailfence, etc. Getting locked out of your email is no joke you don’t want to be in that situation.

I have a paid account with Fastmail and a free account with protonmail just in case something goes wrong with Fastmail I can transition my free protonmail account to paid and use it with very minimal downtime

Edit: adding my fastmail referral link just in case https://ref.fm/u26310488

If you have a domain, that's just another liability for email security. Look at what NameCheap did. Imagine losing your domain for some reason -- even forgetting to renew. All your contacts need a new address now, and until then it's dropped emails.

A custom domain is mostly a vanity measure. It does allow you to migrate to a new email service if your provider cancels your subscription, I suppose... But I'd rather only have one thing to worry about.

The entire point of your own domain is to provide continuity. Of course it's one more thing to worry about, but it also one more layer of protection (an important one).

Password managers are just another liability. One more thing you could lose the password to. What if the service shuts down entirely?

This has happened to me, briefly. I once forgot to renew and lost access to email. Luckily I was able to fix the issue quickly.

I do kind of wish I had never gone down the route of using my own domain for email. I use gmail with it, and will now have to bear a recurring payment of $6 monthly (IIRC). I could move hosts but none of them are free to my knowledge, and a free service comes with its own risks anyway. Plus that's my primary Google account.

Now I feel locked in ... it's less about updating my contacts, as I don't field a lot of personal or business email from that account, but more about all of the services where my account is associated with that email address. Not to mention that I've logged into some sites via Google. It would be a royal pain to switch now.

Edit: Also, my domain is super awkward, sometimes doesn't fit in the field when I'm writing it down on a form, and tends to draw comments when I just want to get my business done and go on. ALSO the account name is different from the name I actually use day to day now -- it's James when everyone knows me as Jay.

> and will now have to bear a recurring payment of $6 monthly

Is this the cost for gmail to use a custom domain? or is it a very expensive domain name spread over 12 months?

Google is phasing out free "apps for your domain" accounts, so starting in a few months it will be necessary to pay a monthly fee per user.

I see. At least you have the freedom to move email hosts though.

Do you really need to switch? IME most services don't really use email for anything.

> It would be a royal pain to switch now.

I know it's tough (migrated off G Suite Legacy myself) but it's probably best for the long run since G Suite accounts have less consumer features (in my case, lack of play store reviews and free Google Voice) and it's unlikely to change.

There are many submissions on HN discussing alternatives. Fastmail, Protonmail, iCloud+ (I switched to this), Microsoft 365 are frequently mentioned. I think Zoho also had a free plan.

Not being able to review things in the Play Store was a blocker for your free G Suite account?

Also I still have a legacy G Suite with Google Voice attached to it which works fine -- and will add additional cost when/if I switch away.

It definitely wasn't the sole reason, but a sign that G Suite wouldn't maintain feature parity with consumer Gmail accounts. There are other features like Google Play library sharing which won't be added.

Yeah, people who used Google Voice early on were exempted from paying for managed Google Voice. It might be possible to port your Google Voice to a consumer Gmail account.

So without a domain whoever owns the domain you're using can deplatform you. The result is dropped emails at that address forever.

With your own domain, the registrar can pull a namecheap and cancel your country. The result is temporarily dropped emails while you transfer to another domain registrar.

You can set the registrar to autorenew.

I de-googled last year but still use google domains as my registrar. It's just so darn cheap and includes DDNS. I've looked at alternatives and I haven't been able to strongly identify one I trust more than google (as strange as that sounds). How do other people pick a registrar that they trust?

gandi.net

There are DDNS scripts on github to update the DNS record. Picked gandi a very long time ago and have no complaints.

Just a reminder to everybody that Fastmail is an Australian company, and is therefore subject to Australia's TOLA / Assistance And Access.

I avoid them like the plague for this reason. Having your e-mail provider compelled to work against your interests is no joke and you may not want to be in that situation.

Maybe it's just me but I don't have "Australia going to force my email provider to hand over my data" in my threat model.

It's probably worth thinking about that too before hastily switching email providers. Fastmail is a solid provider, with great support and I never had a real issue with them. I give them money, they provide me a good and stable email service.

2028 headline:

"Australian intelligence services decline to comment on massive data breach."

You should have "my mail data should not be shared with third parties" as a general rule for mail providers. If that's not you, cool - but I'd wager most folks don't want their mail read :)

If you don't want your mail shared with third parties you just have to encrypt your email and then it doesn't matter who your provider is.

There's a difference between "don't want their mail read" and "someone will be able to read my emails if there's a court order and they are interested in the content of my specific inbox".

And then some version of Russia-Ukraine happens with Australia where you are locked out of your email accounts and all bets are off

This could happen to any country and is also precisely the reason why you use your own domain. You'd just point it to a new mail provider and you'll be up and running in an hour.

If you use a local mail client that stores your email locally you'll also have access to all these.

> Just a reminder to everybody that Fastmail is an Australian company, and is therefore subject to Australia's TOLA / Assistance And Access. [...] Having your e-mail provider compelled to work against your interests is no joke and you may not want to be in that situation.

This is not quite true.

The TOLA bill does allow the Australian government to compel an employee to break their product's encryption — which, yes, is dumb as hell. But Fastmail does not offer end-to-end encryption. As an Australian company, they already have had to comply with a court warrant asking them to surrender data; in other words, law enforcement does not need them to install a backdoor when they already have a front door. Your comment implies that TOLA made Fastmail less secure somehow, but this has been the case long before TOLA; the existence of that bill changes nothing.

I feel like it's important to point this out, not for the sake of pedantry, but to say that if you want truly secure encrypted e-mail, you must be in control of the encryption and decryption step, rather that having a company do that for you — you can't assume you'll be safe just because your provider isn't based in Australia. It's been a while since I've looked, but I think it would be very hard to find an e-mail provider that explicitly says it won't hand over data when presented with a valid warrant.

Step 1: just hook up a desktop mail client to your Gmail (Outlook, etc) and download all your emails locally.

That way you have a backup. And copies if your email account gets blocked.

It’s not a permanent or complete solution, but for all the people contemplating this issue, but not yet committed to switching… start with copying down your emails.

I personally am fine sticking with Gmail as I really enjoy the interface/features. One of the things I really like is the scripting I can do with Google Sheets, Gmail, and my Google Calendar. I have some pretty nice automations setup that do things like automatically adding details to my calendar based on emails. Parsing emails to put data into a spreadsheet, automatically adding details to calendar entries for certain things, etc...

What I do to avoid too big of a headache with a lockout is using my own domain name. I essentially just forward my emails to my Gmail account. And then I set it up so I can reply with my own domains address in emails. So if I want to switch to a different provider it's just a matter of switching where I forward to or switching mx records. I also use Google takeout to take frequent full backups of all my data.

I'll add a thumbs up for Migadu! Great service, great principles, I'm a happy customer. It's also pretty cheap (specially if you're a student).

https://migadu.com

This is often the result of browser extensions. Specifically, CDN replacement extensions like Decentraleyes or LocalCDN.

I only use uBlock origin, but also do DNS level ad and tracker blocking separately..

I've been using Firefox for years, never faced this issue before... have you tried updating your browser?

> have you tried being a botnet enabler?

Heh.

How is updating Firefox enabling botnets?

Seconding this. I'm running Firefox on mac, with the built-in "Enhanced Tracking Protection" enabled, and uBlock Origin with the default settings. I've never seen that error. I don't use a VPN and I'm in the United States.

I only use uBlock Origin and the built in tracking protection. However I do not use Firefox defaults: I block all third party cookies and don't save cache/history on exit.. I guess it could well be the latter that Google finds "unusual" and frankly, this is what is pushing me away... I don't care what the metric is, I want to be in control, i'm not an idiot who tries to log in from ancient browsers or not understand the risk of logging in from a computer I don't own... But Google is optimising for the 99% at the risk of locking out 1%, that seems careless to me.

It is unusual. Google uses some of those cookies to determine whether it can lower the "threat signal" on your user agent (a UA carrying tokens that only Google could have issued to it is a huge indicator that Google has a pre-existing trust relationship with that UA).

By throwing away those cookies, your browser is doing the equivalent of showing up to the Google DMV wearing a different hat / sunglasses / beard pattern every time; the agent behind the counter can't say "Oh, that's just tomxor, I know them at a glance already so I by default trust they aren't an active threat to me" and has to do the equivalent of going through the process of doing a background check on you every time.

> But Google is optimising for the 99% at the risk of locking out 1%, that seems careless to me.

It's not careless; it's extremely intentional. Google has a responsibility to protect the 99% and assumes that those who are Internet-savvy enough to do the work to wonk up their UA's thumbprinting are Internet-savvy enough to do the additional work to make that process smooth for their fancy non-defaults configuration.

At the scale they operate, you can expect Google to make the decision that benefits the 99% over the 1% most of the time (particularly when it comes to account security). They'll assuredly risk losing business by making the 1%'s auth story more inconvenient if it makes it 1% more likely that the 99% don't lose the whole farm to a hacker.

I'm using the latest Firefox available via flatpack on Debian (v97 at time of writing), and I believe this is the same as other platforms. As I said it happens randomly, there is no pattern, as if they are just trying their luck.

This is not a version issue, I suspect Google are just becoming more and more sensitive to users who don't fit their 99% of "uses chrome and doesn't block trackers" profile.

FWIW, I happened to try and login to my Google account a few months ago and was promptly kicked out in exactly the same way, and after root-causing "what did I do..." I realized it was because I'd just set --remote-debugging-port=.... when restarting my Chrome session.

Turns out this sets navigator.webdriver (as in, makes that key exist), which Google's login chucks a wobbly at. It will not let you in with that set, sadly because dumb scammers seem to absolutely love (???) using headless Chromium to attempt to fulfill their dastardly plans. (Which is really sad, because it makes legitimate tinkering that much harder (eg, can't interact with my primary session using nodejs/whatever :<).)

I'm wondering if Firefox is setting something off something similar. You say this only happens randomly? I wonder what correlated thing is happening at the same time as these failures, and if the "oh it's that" is on your or Google's side of the internet connection...

>I dislike being held to increasingly arbitrary and opaque metrics of what Google defines as "safe"... because that is anxiety inducing, what will it be next week?

Unfortunately, that's the nature of computing in the era of the Internet; being connected online exposes one's accounts to every bad actor on the planet. Google has to keep adapting to the attacks that are successful against their most vulnerable users, and since attackers keep getting more savvy, countermeasures increase in complexity. I won't be surprised when Google mandates 2FA for everyone.

But you're right that it puts a burden on the end user, and increases the odds of false-positive attack prevention kicking in. There really isn't a way off that anxiety-train I'm aware of that isn't "migrate to a different, far less popular service provider that won't be as large an attack target for bad actors," with all the negative consequences such a migration entails.

I've never experienced this and have used FF for years.

Have never experienced that since switching back to Firefox after years on various Chromium browsers.

Developer Edition, on Windows fwiw.

As others have mentioned it's probably privacy extensions blocking google's checks.

NoScript (or, not enabling javascript globally) is known to cause issues for me.

Things that hide or obfuscate user agents will break google too.

Anything that replaces common CDNs with privacy friendly ones also causes issues.

gmail login works with tor browser (based on firefox), of all things. my guess is that you're using an outdated/weird build of firefox and/or you have extensions that mess with the javascript execution environment (eg. canvas blocker, user agent spoofer)

I've got six google accounts and never seen this message while connecting from my normal IP address or a random VPN provider (so hundreds of users sharing the same IP address).

I presume something is wrong with your Firefox profile.

> I presume something is wrong with your Firefox profile.

It occurs randomly and across multiple fresh OS installs... it's Google, doesn't mean everyone will experience it, but it's annoying.

I have been having lockout anxiety lately as well. I actually took the time to look up proton mail and gave been waiting for and day to add it to any accounts I need access to such as amazon, eBay, Facebook, etc. There are just too many stories of people losing their gmail and no recourse as you will never get a human on their part to fix the issue unless you are some high profile client who can rock the boar.

Your device is probably pwned. But go ahead and blame Google. I love how people just ignore these warnings.

“Your browser might not be secure” is a worthless error message. If you have a strong reason to believe this is the case, you should tell me. If you don’t tell me, I’m going to assume you don’t have a good reason, and you’re just scaremongering.

They are telling you.

They're not telling you what's wrong, just that you're bad for arbitrary reasons that ultimately will end up boiling down to "we don't trust that you try to preserve your own privacy".

It's probably uBlock or some extension that blocks Google's tracking.

That message is generally when your user agent doesn't match Google's list of allowed browsers.

It has nothing at all to do with how secure the browser on the end user's computer actually is.

I sincerely doubt it has anything to do with a whitelist of user agents. It is probably triggered by a failure to evaluate the botguard program, which indicates that your browser may be under the control of malware.

No, Google are pretty specific that they have a whitelist of user agents for their properties. [0]

[0] https://support.google.com/mail/answer/6557?hl=en&co=GENIE.P...

There's a huge difference between "supported" and "whitelisted".

If your browser's user agent lies outside the "supported" list, you will be presented with a page telling you that your browser is insecure. It's a whitelist. I... Am unsure why you think this is not the case.

You can test it. Or look at any of the many articles after Google made the change.

I set my UA to "Bob Dobbs 42.69". It still loads, and it doesn't say "your browser may not be secure" which is what this thread is actually about.

A freshly installed Firefox, with a useragent of "Bob Dobbs 42.69" yields the "Your browser may not be secure" page, for myself. Both within and without a VM.

So, yes, I think I'm speaking to what the thread is actually about.

How are we supposed to trust 'your browser might not be secure' when Google benefits directly from hobbling everything that isn't Chrome?

Every device in a walled garden is pwned, is it not?