Hacker News Reader

Comment by palata | Hacker News Reader

> I don't think people want to change email addresses very often.

You probably know this already, but people should have their own domain. Then they can change provider without changing the address.

View on HN

> You probably know this already, but people should have their own domain.

Until they forget or unable to renew. And then their PII is in the hands of the person who gets the domain.

I mean, sure, but I and probably 99% of other folks have a credit card set up to autorenew. This is a security problem, but not a very serious one.

Credit cards have expiry dates, or at least they do over here. I expect my partners domain to expire 10 years after my death, as I can only pay 10 years in advance. To many people, there are more important things to worry about (and often second thoughts after the fact).

Why hasn’t anyone made a TLD with infinite expiration?

The price should just be the present value of the annual fee cash flows.

I don’t get it, example?

A promise of money in the future is worth less than getting this money now. Present value (PV) here would be - how much you would pay now to get $X after T time.

Turns out that sum of PV($X in 1 year) + PV($X in 2 years) + … converges even though the series is infinite. Look up “perpetual bonds”.

The value of $10 paid annually forever is probably $200-500 depending on [things].

Source: I work in a bank but I’m also shit at finance so take this with a large grain of salt.

I agree, although if a business decides to close a service could it get tricky? What if all other providers charge much more and the provider can't sell your domain on to them to manage? Or they sell it on to an unscrupulous provider? A yearly fee means they can't get all the cash up front and then run.

We’re talking about the cost to save a <1KiB database record. The only reason this doesn’t exist is that the entire TLD ecosystem is a rent seeking enterprise.

But this would only converge if you assume the fees will stay fixed or at least grow more slowly than the discount rate.

Hate to say, but might actually be a legitimate use case for blockchain here. Identity provider which is responsible for being a source of truth on aliveness tied to a smart contract for paying annual registrar fees.

Though the traditional way would just be finding a registrar which can direct debit (e.g. CSC Global or MarkMonitor) or setting up a trust account for someone to manage it for you. Or just power of attorney plus escrowed account.

Apart from cryptocurrencies, I don't think that there are any legitimate use-cases for blockchain.

Then the question is whether we want cryptocurrencies or not (I don't).

Taking over a domain is not particularly connected to access to PII.

You own/control the name, not the set of files on a hosting service somewhere.

But if someone else gets the name, they get your email going forward, and therefore access to a lot of your accounts.

If you buy someone's domain name, then they'll probably have emails going to it. So you set up a catchall address and discover what accounts are related to it, then you can use the reset password functionality to get access to the accounts. In some cases, they'll have a backup gmail account - and perhaps you can guess what it is (e.g. emails come through to Paul Davis so you guess, oh, maybe they have the paul.davis google account, and reset password on that).

That happened to me, but fortunately it didn't end up being a huge deal.

I had forgotten to renew my domain from Gandi, it expired, and I stopped getting emails. I also could not find my password for Gandi, and I couldn't get the password reset to work, so I panicked, but fortunately Gandi will let you renew someone else's domain. Not a transfer, just if account A wants to pay to renew account B's domain without any change of ownership, they allowed that, so I made a quick throwaway account, and renewed everything for eight years.

If you're going to buy a domain for this, don't get fancy with the TLD. I made the mistake of choosing a .io domain for this purpose and with the future of the TLD uncertain, I have been moving away from it, so I'm not left in a bad spot if things go sideways.

wait what? Is .io going away?

I have a .app domain for my email, and have had it since like 2018. Now I'm wondering if that was a mistake.

.io is the ccTLD for Chagos Islands.

UK will give sovereignty of Chagos Islands to Mauritius.

There is a mixed history of what happens to the ccTLD in such cases.

The British Indian Ocean Territories (.io) might go to control of Mauritius. They will be able to decide what to do with the TLD. It could in principle be restricted to residents, or go away entirely.

> It could in principle be restricted to residents, or go away entirely.

If the UK loses control of it, I'd put most of my betting money on Option 3: The new owners extort everyone with a .io domain for a rate proportional to the perceived value. In other words, $50K a year for a successful tech company, $1000 a year for the average joe who doesn't want to lose control of a domain tied to 1,000 accounts.

The average Joe with an io domain is probably a developer happier to code up a migration than be extorted so dearly.

I bought the tombert.com domain about eleven years ago, forgot to renew it, GoDaddy auctioned it off and a squatter sat on it, and they wanted $1800 for it back, which of course I wasn't going to pay for my dumb internet alias. I tried calling the squatter and offered to pay them $200, and they said that maybe they could setting for $1000, but this domain is in "really high demand" so they can't go lower than that.

I would occasionally check it, and the price would vary by hundreds of dollars, but never a price I was willing to pay. Eventually I think it lapsed again and was picked up by some Chinese site that (I think) was trying to sell massages.

Finally, in 2021, I guess they got tired of paying for it, and it fully lapsed, and I was able to purchase it, so I bought it for ten years.

Yeah even sensible looking decisions can backfire. Am in the UK. Had to scrap my .eu domain due to brexit.

Never go for ccTLDs for anything critical, since you're practically at the whims of the government controlling it (see: .af ccTLD that the Taliban took over)

One exception is the country you actually live in, then a local TLD wins you at least a more reasonable way to go to court.

Never ever? Should I start moving away from my .li domain?

People should, but is the existing process simple enough even any laymen can do is the question.

To be fair, most people I know that are competent to do it just don't. So there is probably another reason, like "people can't be arsed to do it".

The average person is not intelligent enough to have their own domain.

Sounds like a business opportunity.

Or they have better things to do vs fighting Route53 MX records errors.

Records, shmekords.

The practical experience of having your own domain for your email is that you delegate your domain to Google / Fastmail / Proton / whatever, and it takes care of everything else. Some webmail providers will also let you buy a domain on their own website as a part of registration flow.

It really is not hard. Harder than not having a domain of your own, but not as hard as you make it sound.

Okay, do you think if we just picked some random person they would have any idea what we're talking about?

It's just not something normal people do, but I don't like the snarkiness of implying that's an indicator of intelligence. Otherwise we go down the no true Scotsman rabbit hole, what do you mean you're using Proton. You didn't set up your own mail server ?

What do you mean you're using AWS, your not using a solar powered raspberry pi?

Random people don’t know how to do most things, but how easy it is to follow the directions is what matters here not knowing all the individual steps.

Even following all the directions is not trivial, nor is it easy to troubleshoot when something mysteriously goes wrong with what is usually a pretty vital connecting piece for most of your digital life.

Plus all the good places to host your personal domain cost money, so now people who have gotten email for 'free' for 20+ years now have to start paying a monthly email hosting bill and annual domain registration fee because some 'nerd' told them they "should"? And if they ever forget to pay either one, suddenly their email is down and their email 'identity' is at risk of being resold.

This advice is exactly like changing your own oil: Anyone with enough interest in cars and dedication to learn the steps certainly can easily do it, yet nobody should try to convince their grandparents who aren't already highly self-motivated to start doing it.

Eventually you have to trust someone anyway.

If you don't trust Gmail, then you have to use Proton to host it, don't trust them then your on AWS, don't trust them you still need you ISP to play nice with a home server.

Unless you want to raise your own carrier pigeons...

Have tried giving detailed directions to people? Nobody follows them, and the few who try don't do it effectively. There are many steps to setting up a domain - and with an email host!

You're both wrong (-:

Currently it's too hard for normal users, but it would be possible for e.g. Proton to add a feature where you can either import your domain name, or create a new one.

"Normal" users aren't going to be using Proton.

It's not an indicator of intelligence, but mail providers (including Google) could offer this if they want to, with a simple "Choose a personalized email address, like john@smith.com, for $9.99 per year" radio button on signup. They don't do this because:

1. Most people will choose the free option, so it wouldn't be much of a useful revenue stream.

2. People having @gmail.com email addresses is a little bit of zero-cost marketing for them.

I said "own your domain", not "self-host your email server".

"own your domain" is technobabble to 99.999+% of email users. Most people understand emails addresses are <something> "@gmail.com" or "@yahoo.com" or "@<somebigcompany>.com". They don't understand the parts of an email address, nor how or why they are constructed that way.

I have been using a personal domain for my email address for decades and when I have to give it out verbally to someone, it is about a 50% chance that the conversation is:

"My email is <name@myname.tld>"

"uuhhh... at gmail.com?"

"No it's just <@myname.tld>"

"Yeah, but is it gmail or yahoo?"

Worse is the California DMV. All password reset emails going to my custom .com would be subject to multi-hour delays; the password resets were valid for only a few minutes. The only way into the account was to call the tech support phone line. I had them delete the old account and re-registered with a bland gmail email address.

I don't know of any technical reason to delay emails to minor domains. My domain has valid MX records, uses SPF, has valid DKIM TXT records, etc.

> I don't know of any technical reason to delay emails to minor domains. My domain has valid MX records, uses SPF, has valid DKIM TXT records, etc.

I still run into that with my business address; after much mucking around with client's MS admin who did various pieces of magic on their online/azure/microsoft email platform until we finally got it down to around 2m for the delay.

The upside appears to be that now all clients who are using microsoft appear to have only a 2m delay when sending email to my business domain.

Strange. I have my own .org and I've never had a problem with the California DMV's reset emails... I just had to reset mine a month or so ago to start my license renewal, and the reset email showed up almost as fast as I could switch tabs to my webmail.

Thanks, I appreciate the additional data point. They do have a tech support method so I can use this to start a ticket. It could be the same situation as the other commenter, where the underlying service is delaying outbound emails.

This was the exact kind of trouble I used to have when I gave out @myname.com emails. It was super not worth it. It confused people all the time. I switched to a plain Gmail with nothing hard to spell, just a few letters and (sadly) numbers. (I waited like a decade before 'claiming' a Gmail address, so no decent versions of my name or anything professional remained without numbers.)

Also, Gmail actually blocks true spam, whereas nothing I tried on my shared-hosting server with SpamAssassin ever worked.

I don't have any love for Google, but I'll never go back to giving out a personal domain email for any reason.

Due to spam and deliverability issues, I'd personally never self-host an email server either. Plenty of good providers will allow you to bring your own domain and deal with the hard parts for you.

Well, I actually like to have my own domain for things where I have purchased something and have ownership, like my Amazon Kindle account. It is tied to my Gmail account and then Gmail decides I am sketchy for some reason I lose access. It’s probably a little easier to maintain my Domain, and there are legal mechanisms to restore it if it is taken away for any reason other than nonpayment.

I've had my own domain for ~20 years, first on Google Apps for Domains -> GSuite -> Google Workspaces (or whatever their naming changes have been), and moved over to Fastmail a few years ago.

Fastmail's spam filtering isn't as good as Googles, but has fewer false-positives, and the spam it does let through is trivially manageable. I did host my own mail server for a year or so prior to using Google, but I agree dealing with spam filter configuration and tuning was a headache, and I gave up. Nowadays I can only assume it's even harder to run your own email server, so I'd never recommend anyone do that when there are options for other people to do it for you.

I occasionally get a confused customer support person on the phone when I need to give them my email address, but they understand in about 7 seconds and it's no big deal.

> It was super not worth it. It confused people all the time.

Genuinely interested: was it in the US? Feels like people in the US are more used to having one big service that everybody uses.

I have never seen confusion about my personal email...

Yes, exactly. US. Every millennial has Gmail, idk what GenZ does, probably also Gmail. GenX and Boomers probably split between Gmail, Yahoo, iCloud, and a few AOLs - and that covers probably 95% of Americans.

It was almost embarrassing for me, I have to admit — especially times when I’d been clever about it and set up, say, searsaccount@myname.com as a forwarder, and the cashier at Sears needed my email address. They once asked me oh, do you work for Sears?

I feel like the US have a culture of big chains like that. You want an email? GMail. You want mexican food? Chipotle. etc. I don't mean that as a criticism, but there seems to be a cultural thing.

In most parts of the world, you don't almost exclusively chains of restaurants, and people don't expect that. Just like it's normal to have someone suggest a restaurant you have never heard about, it's normal to have someone use an email provider you've never heard about.

Or maybe that's completely unrelated, I don't know :-).

I think the confusion was less about the part after the @ not being a major well known service, but not being something that sounds like a company or a service. I think their confusion is that it has my name in it, and people are used to a name going before the @. ...so when I say my name, they're expecting another @.

Just curious: do you own your own domain? My experience is that many (most?) people who would be competent to own their own domain just don't.

> I have been using a personal domain for my email address for decades

Yeah sorry, I answered to the wrong comment :-).

But still, I have this feeling that many people who would be competent to own their domain just don't do it. And they could give an email to their family, too. And help friends setup theirs.

I'm not completely sure that the issue is "it's too hard". To me, it's like password managers. Sure, it's too hard for some people. But most people just can't be arsed to use a password manager, though they would be totally competent.

"It's too hard" is, in my experience, often an excuse to be lazy.

For the average person, the benefits of having your own email domain are not very weighty compared to the risks, complexities, spent social capital, and inconvenience of having one.

For most people, if they want or need to switch email providers they will simply sign up for a new service, give people their new address, and move on with their life.

This whole conversation is a lot to do about something that the average joe just doesn't give a shit about. It isn't laziness. It really isn't that important of a life task for most. It's an appropriate prioritization of tasks under a lifestyle different than yours.

I agree that most people don't care, and probably don't have the energy and time to care, and that's mostly fine. That is, until Google decides to arbitrarily close their account, with no recourse. Sure, over the number of people who use GMail, only a tiny percentage experience this, but it still sucks. And in that case people are usually more upset that they've lost their photos, docs, etc. than their email.

I don't really see an actual problem here, unlike some others commenting, but it is a general shame to me that more people don't have their own email domain. It would make the world more... colorful... somehow, even if in just a small way.

Agreed, of the things people keep in their Google account, the email address is probably the least valuable to them.

> For the average person, the benefits of having your own email domain are not very weighty compared to the risks, complexities, spent social capital, and inconvenience of having one.

I honestly think that most people don't know why it matters. 20 years ago I was happy (and proud) to have gmail, and didn't see a point in having my domain. Until I chose to move away from gmail, and then it all made sense.

I have an example: many (most?) universities give you an alumni email when you graduate. Some offer actual hosting, but others just ask you to redirect. It is free, and for many universities, graduates would trust their university more than gmail, right? And it wouldn't lock them into gmail. Still, none of my friends from university use it. Most use gmail instead.

Now tell them: "Look, if you use gmail, then Google can read all your emails. You didn't give a shit 4 months ago ("I have nothing to hide"), but now you've heard of random Canadians and Europeans getting deported or declined entry in the US for random reasons, including one who wrote stuff against Trump. How do you feel about the US reading you emails and deciding whether they should deport you or not based on that? If you controlled a domain, you could move away from gmail. Now you can't. Also know that if they can read your emails, it means that they know the flights/hotels/trips you booked, whatever you bought online, and they can just access all your accounts everywhere."

What will they think? "If I was to do it again, I would still use gmail" or "Would actually be nicer if I had been using my alumnus email all along"?

> now you've heard of random Canadians and Europeans getting deported or declined entry in the US for random reasons, including one who wrote stuff against Trump

This doesn't happen because people are using gmail. It happens when people post things on social media or get searched at border crossings.

It happens for random, unjustified reasons. Wouldn't you want to protect your data from a country that behaves like that? I sure would.

Not using gmail doesn't solve that. If you cross a border you can have your device searched and denied entry if you don't cooperate. If you post on social media, the data is in plaintext for the world to see.

Are you trying to say that you don't need privacy because what you say publicly is public?

I'm not following.

If you say things publicly you have already chosen not to have privacy with regard to those statements.

Sure. And if you say things privately you have chosen to have privacy. Which is very limited if you say your private things on a US service and don't feel like having the US randomly read them and deport you.

That was my point, I'm happy to see that we agree :-).

You are misinformed as to the circumstances of the above stories you cited, because that isn't what happened in those situations.

I would argue a US mailing address is at least as complicated a structure, but people managed to figure out the state abbreviations and ZIP Codes fine. We just need to teach it in elementary school just like we do addresses.

Speaking of that I do wish the post office had a mail service where they issued addresses to citizens or something.

Yeah, I think digital literacy courses cover things like that, and they should.

But mailing addresses are actually extremely complicated and most people probably don't understand the full scope even of US mailing addresses. The spec is 226 pages.[0]

[0]: https://pe.usps.com/cpim/ftp/pubs/Pub28/pub28.pdf

If you've ever had an address with any complexities beyond what is taught in elementary school (number, street, city, state, zip), you'll probably experience issues with getting others to correctly address your mail. The biggest reason this isn't a problem is because the postal service takes significant effort to deliver misaddressed mail.

whoa, I just imagined a world where USPS, Deutche Post, etc - offer domains, servers, cloud services - as a natural extension of treir previous roles..

Some countries have digital mail services that are actually better than email because they include identify verification features

e.g. https://www.digipost.no/

That used to be the case before the privatization in the 90s. What do you think the Deutsche Telekom is?

That's why you don't sell it as if you were marketing it to techies:

    (*) Choose a personalized email address, like john@smith.com, for $9.99/year.
    ( ) Choose a GMail address, like john.smith@gmail.com, for free.

They could handle the domain registration for the user, whether by being a registrar themselves, or partnering with another registrar behind the scenes. And yes, most people will still pick the free option. But that's ok.

I've had my own domain for a good 20 years now, and while I've encountered some confusion when giving it out, it's never been as bad as you describe, and people get it without my having to go into a technical explanation. And regardless, the reason there is this problem is because easy, seamless personal-domain options don't really exist. If they did, this problem would go away. I don't really consider this to be an obstacle.

> I've had my own domain for a good 20 years now, and while I've encountered some confusion when giving it out, it's never been as bad as you describe

Similar here, though I haven't encountered any confusion at all. I got remarks like "How do you get your name as the email? That's fancy!"

I am the same, self-hosting for many years and while I have the occasional question about it, it's easily corrected. I now have a short .com domain I use because my .fyi one was even more confusing to people, and simply didn't work with some systems I needed to use.

A bigger problem in my opinion is just how heavily people have associated "Google" with "the internet" and "Gmail" with all email in existence. They don't even think about outlook.com or even hotmail anymore. All email is Gmail to many people.

Well, gmail does that already. It's $7/mo.

https://workspace.google.com/solutions/business-email/

That's actually a really good point: businesses typically have addresses of the form employee@company.com.

That makes it very weird to me that someone would ever be confused by an email that is not @gmail.com...

> The average person is not intelligent enough to have their own domain.

You think that that skill (maintaining own domain for email) is an indicator of intelligence?

It is an indicator of knowledge, not necessarily intelligence.

My interpretation was that they didn't mean to talk about "intelligence", just meant that the average person is not "competent enough" to have their own domain. Which in all fairness is not wrong.

My question is always: of those who are competent, why is the vast majority not having their own domain?

Getting a domain is no more difficult than selecting some "easy web hosting and email" bundle on a site and paying for it with bank transfer, credit card or whatever. There's an entire industry around this. I've met plenty of people who are largely clueless about PCs, doctors, lawyers, artists, etc who have their own domain. It's actually extremely common, because conducting business from a Gmail account is a bit unprofessional and sketchy, particularly here in Germany.

Reply on news.ycombinator.com