Comment by rdl | Hacker News Reader

Comment by rdl | Hacker News Reader

Parent Full thread

There are a lot of good reasons not to use gmail or google hosted apps (performance, especially, but apparently also security). Two factor auth as google implements it goes partway, but email really is the skeleton key to all accounts. I'm not sure how meaningful Google Authenticator is as two factor auth when you're actually using the iPhone or iPad to access mail much of the time. Google Authenticator protects against untargeted mass attacks, but if you are specifically a target, it's a pretty mediocre two factor solution. I think it's fair to consider administrators of any major SaaS app to be specific targets.

Unfortunately, there really isn't a great alternative. The next best thing I've found is to just run your own mail server, which is pretty obnoxious if you have any non-technical users to support. Kerio is the thing which most Mac shops I know use (since people want directory services and the other stuff you can't easily implement just from open source). Yet, there's better search on server on gmail than from iOS to IMAP (i.e. Kerio), so that's a sacrifice.

I kind of hate Google for being the Craigslist of email -- a crappy product at $50/yr which sets the maximum price people are willing to pay below the point where anyone can offer a less crappy product. More like $250-$500/yr/mailbox would be a supportable price for real email.

The biggest weakness's to 2 factor auth are:

1: You can remove 2 factor auth without having to enter the auth code. So if your computer gets a virus, someone can just remove 2 factor auth via your browser

2: The "app specific passwords" are full on backdoors. If one of your app specific passwords gets hijacked, someone can login to your gmail with it and then remove the 2 factor auth pass (See above)

* http://productforums.google.com/forum/#!category-topic/mobil...

Aren't app specific passwords simply single-factor auth tokens, thus defeating the purpose of using two factor auth? Wouldn't a sufficiently complex pass-phrase be just as secure?

No, because each app has a different token and you can revoke them individually.

Google does want people to use OAuth instead of app-specific passwords as much as possible, but sometimes that's not possible or just isn't done. Then you at least get some security from not posting the same password to a million places.

Google's own products don't even conform to this. My Galaxy Nexus and Chrome browser requires app-specific passwords.

The latest version of Chrome dev (21.0.1155.2 dev-m) does not require an app-specific password - it works with the OTP if you have it enabled, but at least for me the sync is broken at this point.

Please define "real email" and what justifies it to cost $250-$500/yr/mailbox in your opinion.

If you're questioning the grandparent's notion that Gmail is "crappy" compared to expensive email products, I'd agree with you.

For me, the answer to what justifies a cost for email is deliverability. Of course, having recipients receive your email promptly, and receiving theirs promptly. But more importantly, receiving next to zero spam in my actual inbox, and misclassifying absolutely zero ham in my spam folder.

The only solution I've found that accomplishes this at any price is GMail / Google Apps.

Not only does it easily keep 12 - 18 year old email addresses that have been on usenet spam free, it happily handled over 3000 spam per second per box while letting through valid emails for sex.com. The owners could actually use their addresses on Google Apps. They hadn't been able to on email systems costing 4 and even 5 figures. Refreshing the spam label while seeing the inbox stay empty, day after day and month after month, was astonishing.

Gmail does better than most alternatives for antispam. It's pretty good for deliverability (although it's actually kind of bad for receiving mail from semi-sketchy places; it doesn't even go into my spam box).

It's a slow UI (I often see 20-30 second page loading times on a fast network, over SSL), the support on the free tier is horrible (i.e. non-existent), the $50/user/yr support is below what I'd want for a company to rely on it (it's ok as second or third tier support for your in-house people, I guess, but not great frontline support for non-technical users when traveling).

The real killer, though, is lack of the enhanced features Exchange offers for directory, scheduling, etc. I always hated people who depended on those kind of things, but once I started using them, it made life annoying to not have them. Google Calendar and Google Contacts are feature-incomplete and often buggy (syncing to devices, other than maybe Android phones), especially when you have multiple calendars, sharing, etc.

It's all fine for individual users, but for a group of 5-25+ people (startup, pe fund, etc.), using google apps often sucks.

Look at Exchange and Zimbra

Exchange is a pain to run, but is quite featureful. Zimbra is actually on my list; Kerio for OSX for self-hosted. Nothing is perfect.

If 2-factor is used simply to log in, then any attacker who targets your phone/tablet to get your totp secrets from google authenticator could compromise rsa token protected logins as well. They'd only have to wait until you log in legitimately and compromise your account at that point.

Real security against compromise of the device you're using to access a service, whether the 2nd factor is a hardware token or generated from a seed stored on an android/ios device, would require making every significant action, not just logins, re-prompt for a token. I haven't seen many systems that do that, because it harms usability.

I'm not disputing that there are cases where RSA tokens or other hardware solutions make sense, but the physical burden of more than a few hardware tokens would be too much for normal people, even if cost were no object. 2-factor totp/hotp oath auth is far better than 1-factor auth, and presents minimal annoyance to people who already have their smartphone with them 24/7. It can be deployed on every saas website with minimal additional burden to users.

A compromised android/ios device that you use to login to services is, as outlined above, pretty close to game over even if you have a separate hardware token. An attacker may not be able to maintain access, but the account information and various settings can be compromised in an instant. 2-factor of any sort pretty much solves the password reuse problem, and also the problem with individual service passwords getting compromised somehow in a way other than an ongoing compromise of the user's machine(s).

Reply on news.ycombinator.com