Hacker News Reader

Comment by havaloc | Hacker News Reader

I do some tech support on the side. No one, and I mean no one wants to pay for email. So here we are.

The problem is, even when email is paid for, like an O365 account, the clients are still forced into being the product.

>No one, and I mean no one wants to pay for email.

I and several people I know are happy to pay for email. Every report like the one linked here makes me an even happier paying customer.

Perhaps you have a different definition of "no one".

A charitable interpretation of "No one, and I mean no one" would be an incredibly small fraction of a percentage of people to the point of being insignificant and irrelevant to the conversation.

There's enough people paying for email that there is not one, but several farly large providers of such services - Proton Mail among them, but also e.g. Fastmail.

"No one wants to pay for email" because they haven't thought they needed to in a very long time. For over 2 decades, the leading email providers have all provided email for free. Before that, consumers (at least in the US, as that's what I'm familiar with) received email service from their ISP, which wasn't "free", but still provided as a part of your service fee. I honestly don't think it's all that alien that folks would balk at the concept of paying for email service.

If folks ask "why would you pay for email", I think the right first answer to that question is that it's a better service than the free service providers. Then, you can talk about the why's (when you pay for email, you're the customer, not the product, the privacy aspect of not having their email being farmed to enhance a company's advertising profile about you, or being used for AI/ML research if that's important to you, or any of the other reasons that might be important to folks).

So yeah, paid email is a premium service, and if we're being honest, it's been a premium service for regular folk for decades. I happily pay for email myself, but my parents sure don't, my wife doesn't, and most of my friends don't.

I pay for ProtonMail but understand that most wouldn't. AFAIK they still offer a decent free tier, which I'm happy to help support.

The cool part about Proton is they bundle a lot of their services. You aren't just paying for email—you're paying for VPN, encrypted cloud storage and more.

Why is it cool to pay for stuff you may not use?

They also have offers where you only pay for email || vpn || cloud-storage. Their payment structure is somewhat confusing, but very flexible.

You mean the VPN? Because we all use cloud storage these days.

You're missing the point, however, I'll entertain it.

Most services just offer a paid email. Proton offers all of its services for an extremely low monthly price. Not to mention their security protocols are among the best.

Everyone uses email. Most use a VPN (everyone should) and almost everyone utilizes some form of cloud storage.

I started off purchasing to use their VPN and now actively use all 3.

Why should everyone use a VPN?

It’s a false sense of security and a waste of resources. The ones making the money are datacenters and middle-men.

Using the internet in general is a false sense of security. If you want total security crush all of your technology and go live in the woods.

The point of cyber security tools like VPNs is to limit tracking, data sharing and reduce the potential for malicious actions to be taken against you.

You can't honestly say not using a VPN is better than using one. What's the alternative? Unencrypted web traffic? Your ISP harvesting your web data and selling it? Exposure on public networks?

Is it limiting tracking, or potentially exposing a untrusted middleman with knowledge of all your traffic, and who it belongs to?

What is the difference between the ISP knowing this and being a problem, but the VPN sitting with the exact same information, also knowing it?

ISPs knowingly collect it and sell it. Proton (at least according to them) do not collect it. You must choose your VPN carefully.

That’s a pretty strong statement to make about all ISPs in the world.

https://arstechnica.com/tech-policy/2017/03/senate-votes-to-...

Those sources appear to be about ISPs in the US. At most, this shows that ISPs in the US sell your data, not that all ISPs do so.

It's true. In fact, in the US they even lobbied congress to do so: https://techcrunch.com/2017/03/28/house-vote-sj-34-isp-regul...

At most, this shows that ISPs in the US sell your data, not that all ISPs do so.

If any ISP were to be caught doing this in the EU, it would be fairly big news.

I mean, sure, it really depends on who is providing the VPN. With Proton, you're already using them for your email, so if they were a bad actor, you're basically fucked already. If you have ProtonMail, then the choices are 1/ No VPN, so your ISP will collect this data, 2/ a popular VPN provide who will collect this data, or 3/ Proton who say they won't and they've already got you email too if they are liars. Option 3 is the lowest risk of event if they are good actor, but also the potential damage of an event, if they are bad actor, is much higher since they have more data including email based 2FA.

Like I said above, the best option is to not use technology at all. If you want to use it, you play the odds and attempt to limit nefarious activity against you.

Am my own isp.... I rarely use a VPN. Fixed ip and all.

Your VPN doesn't protect against squat when it comes to the agencies that might be watching. Hell it doesn't even protect much against marketers fingerprinting your movement around the internet. You leave a plenty big breadcrumb trail that isn't just IPV4.

Honestly VPNs have been a great marketing example of the last 5 years. You all buy something without needing it or knowing why t f you have it. Yes using internet without one is better. Why? It's cheaper for starters.Auth. faster! No relay slowing down your connection!

VPN best use isn't on consumer end. It's on orchestration end as another tool to guarantee you are who you say you are via another layer of auth.

There is one specific case in which using a VPN is faster: if your ISP has bad peering in general, but good peering with your VPN provider.

> Unencrypted web traffic?

I don't know if you're aware, but basically all sites on the internet use something called SSL these days. However, SSL is useless if you use a VPN that also provide DNS servers (which most do) - because the provider could listen in on all of your traffic by hijacking the handshake, DNS and traffic to and from any target server - making it much easier to create a user profile, because you're authenticated to the VPN.

Also, third party cookies are blocked in the mainline browsers by default, making VPNs even more useless.

Most if not all of the ISPs also use dynamic IPs, making it unlikely to be cross-site-tracked based on IP sources.

Control over a clients DNS doesn’t let the VPN provider view the contents of TLS encrypted traffic. However they can view unencrypted data from connections like SNI headers, DNS queries etc.

The point here is that if you use someone else’s dns, they can redirect any domain to their server and sign the cert too since they also control the traffic.

You can’t serve a valid certificate chain to the client even if you control their traffic, because your malicious certificate isn’t signed by a trusted CA. And you can’t get a CA signature without demonstrating control of the domain to a CA.

What does that have to do with your ISP having access to this information and selling it? In addition to using public networks?

Additionally, 3rd party cookies may be blocked but cross-site are not.

You realize 3rd party cookies and cross-site cookies are the same thing?

Lots of people have this strong psychological need to feel like they’re Doing Something™. VPNs sell them that peace of mind.

It's like Apple offering a default "privacy vpn", and lately now google too, it's really just a way for them to slurp your data as well what you're visiting, dns resolving, basically everything you do over the network. Even worse is apple enables it by default for all their devices, so all day long firewall logs for customers fill with "proxy avoidance" drops for apple proxy service as that's what a firewall should do in a corporate environment, treating this as data exfiltration.

What does Apple really do with that information? I at least know what Google or Microsoft is doing, by example of this article.

I just laugh as Apple users misplace their trust and think they're somehow secure for it buying an iphone, at least Microsoft users know the insecure mess they're stuck with.

https://support.apple.com/en-us/102602#:~:text=iCloud%20Priv....

Why should everyone use a VPN?

It’s their emotional support software.

> Not to mention their security protocols are among the best.

What does this even mean?

I pay for Fastmail (for now), iCloud Mail, and have paid for 15 years. I know I'm the outlier, but it's not no one or services like Hey wouldn't exist at all.

You're writing this comment in response to an article by a company that only exists because people want to pay for email.

Enough people to make protonmail profitable it seems

I pay for Migadu and very happy with it

Me too. Another vote for them.

I pay for a mailbox.org account.

How does this jive with the fact that people using Outlook are almost surely paying for email because it's their work's Exchange server?

In this case Outlook isn't actually Outlook, it's the replacement for Windows Mail which they're now calling Outlook, not what you and I think of as Microsoft Outlook.

This is a new version of the Mail for Windows app. Outlook for Windows is free. Outlook that comes with the Office Suite is not, it costs money.

So you could have two different Outlooks on your Windows 11 computer now. Just like there could be 3(!) versions of Teams installed (Teams for Home with Friends and Family, Teams for Work or School, and New Teams for Work and School).

Why say no one?

Do you pay for your personal emails? I do (Fastmail) and I'm very happy. Same with search (Kagi) and many other services.

> No one, and I mean no one wants to pay for email. So here we are.

This Outlook risk hangs over my client's head because they opted to pay. Last year they moved from self-hosed Exchange to hosted-Exchange + Office 365 + all the recurring fees (and support costs).

Paying rent to reside in MS's surveillance hydra isn't a terrific bargain.

You're wrong. I don't need more than one data point to make that conclusion.

I pay for protonmail, and I'm very happy with what I get. I can even use it as a client for receiving and sending email from my own domain. So, if ever I were to want to get away from it, my accounts won't be tied to the email provider.

This is talking about the paid outlook desktop app, not the free email service. There are many issues with the new version of the paid app, the main one being its really just a webview for wrapper for the website. You could just as easily pin the tab and have the exact same experience.

I pay for Amazon WorkMail (through AWS) and couldn't be happier. $4 per user (50GB mailbox) per month. Gets the job done. Integrates like a charm with mail clients, lets me use multiple domains!

I happily pay for email.

I'm happy to pay and I do.

This is an email client. Not email server.

> your IMAP and SMTP username and password are transmitted to Microsoft in plain text.

What the heck?

Their concern is valid, but it's weird that they call it "in plain text". "Plain text" has a specific meaning of "unencrypted", whereas this is encrypted in a TLS connection. Yes, both TFA and the original heise.de article say (paraphrased) "Although it's in a TLS connection, it's in plain text." but it's just confusing to phrase it this way, especially since it becomes easy to remove the "Although it's in a TLS connection" clause, as you did in your quote.

Their objection is that the credentials are being transmitted to and stored by Microsoft at all, instead of Microsoft generating and storing an automation token / app password. That is a valid concern. But tacking on "in plain text" to it just creates confusion.

> But tacking on "in plain text" to it just creates confusion.

Today, when the context is service provider and customers, "plain text" is used to say that service provider has the data unencrypted.

That’s not what transmitted in plain text means. Transmitted in plain text means unencrypted on the wire, which is not the case here. Proton definitely knows that, and deliberately worded it this way for maximum scare factor. If they’ll be deceptive here, where else will they be?

I would say that plaintext is correct.

if password "secret123" is sent to you, it doesn't matter if it was sent via carrier pigeon, locked up in a secure briefcase and delivered by someone driving an aston martin, or via a TLS channel. It's still plaintext, because the receiver now has the actual password, and not a hash of the password.

It does matter. Transmiting it in plain text, ie unencrypted, is much worse, because it means eavesdroppers also have access to it.

> > your IMAP and SMTP username and password are transmitted to Microsoft in plain text.

I think that is not true. I think that is a lie on Proton's behalf.

When I set up the email client, it connects via OAUTH2 to the other services. It's connected as an app and not via credentials. If it connected via bare credentials, then it'd be a "legacy app" and you'd need to generate an "app password" for it, but you don't.

>> your IMAP and SMTP username and password are transmitted to Microsoft in plain text.

> I think that is not true. I think that is a lie on Proton's behalf.

Sadly, it is all too true:

Microsoft lays hands on login data: Beware of the new Outlook https://www.heise.de/news/Microsoft-lays-hands-on-login-data...

Warning: New Outlook sends passwords, mails and other data to Microsoft https://mailbox.org/en/post/warning-new-outlook-sends-passwo...

I pay for proton mail and am quite happy to do so. In fact I pay for everything I use on the internet if I can. Kagi, proton, etc, unless there’s an open source option. I even buy the family versions and share with my parents.

Reply on news.ycombinator.com