Leaving Gmail for Mailbox.org
giuliomagnifico.blog
giuliomagnifico.blog
I ended up going with Proton because they had a good solution for mail, calendar, and drive which I was looking to replace. I set up my custom domain to point to it and have my Gmail forwarding to it - any time I get an email to the old Gmail address I go change it on the website or delete the account altogether.
For Google Docs / Keep, I switched over to Obsidian and pay for the sync there. It's a great replacement for my main use case of Docs / Keep which is just a dumping ground for ideas.
For Google Photos, I now self-host Immich in Hetzner on a VPS with a 1TB storage box mounted via SSHFS. I use Tailscale to connect to it. It took a few days to use Google Takeout + immich-go to upload all the photos (~300GB of data) but it's working really well now. Only costs $10/mo for the VPS and 1TB of storage.
Android I think I'll be stuck on - I have a Pixel 8 Pro that technically supports Graphene but there are too many trade-offs there. Next time I need a new phone I'll take a serious look at Fairphone but I think the Pixel 8 Pro should last a few more years.
My FitBit Versa is really old and starting to die - I ordered one of the new Pebble watches and am patiently waiting for it to ship!
YouTube I'm stuck on because that's where the content is. I have yet to find a suitable replacement for Google Maps - OpenStreetMap is still really hard to use and gives bad directions.
The key is that if you have your domain, you can swap the provider and nobody has to know about it.
https://www.magicearth.com/ works well for car navigation with OSM data, and https://cycle.travel/ is the best way to navigate on a bike, also with OSM data.
In which country do you live, if I might ask?
https://ir.halliburton.com/news-releases/news-release-detail...
- Magic Lane for the navigation app which traces back to 1992: https://www.magiclane.com/web/about
- Halliburton for something related to 3D visualization “that was formed slightly more than a year ago”: https://www.chron.com/business/article/halliburton-to-pay-10...
2) While I occasionally need to allow some scripts from google, it's absolutely nowhere near 1/3rd of sites.
Apple's software and services (sync, drive, photo backup etc) are so inferior, especially compared with Google's (technically speaking), you'd be anyway forced to use third party (often cross platform) solutions. No risk of going deep into Apple's ecosystem ;-)
I did the exact same thing with Immich (what a great software, by the way!).
And in case it helps:
Instead of always relying on google maps, I now mostly use CoMaps (https://www.comaps.app/). Way better than using directly OpenStreetMap. And for my Pixel 7, I switched to LineageOS with gapps (https://lineageos.org/) and I'm not missing anything and am very happy with it.
Also, I'm trying now Nextcloud (https://nextcloud.com/), with a setup similar to Immich, and now I do believe there is life beyond google, and it's a better life.
I used Ente and I learned all the files I had "added/uploaded" to iCloud photos had lost their real names (that I had painstakingly given them over the years/decades) when ente exported to those photos back on my laptop via their desktop app and were these long random uuid strings kinda names. That was my yikes moment and I was glad I had still kept my photos outside of iCloud and Ente. And it is not even Ente's fault. Apple does this skullbuggery.
Are there PAYG hosted instanes of Immich?
https://github.com/simulot/immich-go?tab=readme-ov-file#from...
> Are there PAYG hosted instanes of Immich?
I was really surprised to learn that there aren't right now. It sounds like FUTO, the org behind Immich, is working on something like this but they haven't put out any real details so it's probably far off.
I have an iphone so I use Apple maps and an icloud based obsidian vault, and that is all that is tied to Apple which feels fine for now.
What are the tradeoffs? I have been following GrapheneOS for a while, and it doesn't seem like there are many tradeoffs.
> OpenStreetMap is still really hard to use and gives bad directions.
OpenStreetMap is a database, and most commercial services that are not Google use it. E.g. Uber or Lyft.
You just need to find an app that you like. CoMaps is nice, OSMAnd has a lot of feature but the UX is harder. And of course you can contribute to OSM and make it even better than it is! You'll see it's a great community!
Many banking apps work fine though not all.
Unfortunately every EU bank card uses Mastercard or visa so the Americans still get to snoop. Time for that to be changed too.
Apparently the common workaround for the Google Wallet stuff is to pair a GrapheneOS phone with a stock Android smartwatch.
Edit: Here's some additional information on banking apps: https://privsec.dev/posts/android/banking-applications-compa...
Apparently the common recommendation these days is to use Curve Pay as a virtual card provider on GrapheneOS, which can then route to arbitrary underlying cards. And evidently Google Wallet does work for things that aren't payment cards (airline tickets, transit passes, etc.) on GrapheneOS.
Now I just accept life as it is.
Bank apps - as per him none work. Uber (no Lyft here; other taxi apps) work flawless. Payment apps, he said is a coin toss. On his phone even WhatsApp doesn't work. He anyway prefers Signal (which prob. nobody else uses in his circle except maybe me who has it installed on a secondary phone) or plain SMS. Basically most of the "normal" apps that add integrity checks don't work but he is fine with that.
Whatsapp can work if you use sandboxed Google Play (I still use a Google account, I just don't want gplay to have effectively root on my device).
Depending on the level of integrity check your app might just work. Gory details: https://grapheneos.org/articles/attestation-compatibility-gu...
And like others said: no contactless payment, but I dont use that personally anyway.
Then last week I used it for navigation (on a phone with no SIM card).
Absolutely. Terrible.
Worst navigation app I've seen. Told me to make a turn at an intersection that did not allow turns. Then at another intersection, it told me to "Turn left", but the display clearly showed it going straight. I'm guessing that the straight road probably is angled 1 degree or something at the intersection and the app was viewing that as a turn.
(Though, I should mention that twice in the last year I've had Organic Maps become hopelessly confused about where I was, and where I should go. Both times, it had gotten a good GPS location, but then got confused while being out for an extended period of time, like maybe it was dead-reckoning only after that initial lock.)
Not had any GPS problems other than that time I was in an area where it was being jammed. Bloody Russians.
https://community.openstreetmap.org/t/organic-maps-open-lett...
Short story: forget Organic Maps, use successor CoMaps or competitor OsmAnd.
Do you have pointers to information about the governance and legitimacy of CoMaps?
(I see a mention that it's non-profit, but no statement about what kind of non-profit, not even on the donate page where that info is customary and relevant for US tax reasons. Also, I see no mention of who's who, nor how they operate.)
The closest I find is this:
https://www.comaps.app/support/what-is-the-comaps-history/
> As a result of the issues not being resolved, in April 2025, the community of former Organic Maps contributors created the CoMaps project, based on the Organic Maps open-source code.
If what that sounds like is true (that it does represent the community of contributors), it still will be important to have safeguards against someone taking over the project.
Or, if what that sounds like isn't true, that could be bad.
One matter that will have to be resolved with governance (if it hasn't already), is that there's what looks like an allegation that the CoMaps project is already tainted with code to which is expressly doesn't have license:
https://codeberg.org/comaps/comaps/pulls/1039#issuecomment-6...
A concern is that a funded commercial competitor could bankrupt a less-funded volunteer project with lawyer fees just arguing the merits of that.
It appears Alex is angry about the fork and doing anything possible to spread negativity.
The fork also took the new website design that was developed for Organic Maps even before the Organic Maps website was updated.
Don't believe everything on the internet; there are many lies spread around.
It shows that you, biodranik, removed the MIT licence from the repo with a commit saying "No MIT yet, sorry". It says that the code had been licenced as MIT since 2021. It is not clear if you own the copyright to all the contributions since 2021, and therefore it is not clear if you are legally allowed to remove the MIT licence.
It also says that the fork was made from the repo in the state it was when you removed the MIT licence. Therefore it is a fork of an MIT project by someone who had legal access to the MIT-licenced code: it's legal.
> Don't believe everything on the internet; there are many lies spread around.
You don't say :-).
I was not entirely sure about the CoMaps vs Organic Maps situation, but this very comment of yours clearly favours CoMaps IMO. Or did I misunderstand something?
[1]: https://github.com/orgs/organicmaps/discussions/9837
[2]: https://web.archive.org/web/20250815050441/https://github.co...
This is temporary though and a permanent nonprofit home is a top priority.
https://github.com/orgs/organicmaps/discussions/9837
https://web.archive.org/web/20250815050441/https://github.co...
In the discussion you link, biodranik tries to say that it was illegal for those with access to the repo to dispose of the open-source code because that open-source code had not be published. I don't think this is right:
Open-source does not mean at all that the code has to be public. It can be private to a community. But whoever has access to that code is allowed, under the open-source licence, to dispose of it under the terms of the licence. My understanding is that this is what happened with the fork of Organic Maps. And it is pretty clearly explained in the codeberg discussion you linked.
> an allegation that the CoMaps project is already tainted with code to which is expressly doesn't have license
I don't think it says that CoMaps doesn't have the licence. It says that whoever forked the codebase did not have permission by some of the founders of Organic Maps. That's very different: the licence doesn't say that you must ask permission to the founders; it says that the code can be used under the terms of the licence. A fork part of those terms.
I wonder if there was some issue with the map data in the area you were driving in that led to the issues you experienced. I've used OSMand in Belize, Mexico, California, Connecticut, New York, New Hampshire, Vermont, and Maine and had a good experience, especially with the offline maps.
That's an OpenStreetMap bug, the intersection likely isn't marked as not allowing turns. If you put a note (OSMAnd calls them OSM Notes) on the map someone will fix it when they can.
Even Google is relying on user submissions to keep its stuff accurate these days, they just have money to pay editors and reviewers.
And I recently installed GMaps WV from Fdroid as a wrapper for Google Maps. It gives current traffic information but I don't really know if it is even close to gmaps.
As others point out, my main worry is about banking and NFC. I use NFC payments on my phone a lot, especially for the bus. Getting an Android Smartwatch just for that kind of defeats de-Googling haha.
I will probably try out Graphene at some point but that seems like a multi-day project to get it set up, find the tradeoffs, determine if they're worth it, and then potentially switch back to Android.
I also worry about the future of Graphene with AOSP going more closed/private: https://www.androidauthority.com/google-android-development-...
> OSMAnd has a lot of feature but the UX is harder
OSMAnd was the one I tried and it bordered on unusable. I'll try out CoMaps, somebody else suggested Mapy.
Microg, right? I don't think this is more private than the Google Services, is it? It's just open source, but it can phone home just the same?
> With my Pixel 8a on Calyx
Any reason you haven't tried GrapheneOS, given that you already have a Pixel? I have /e/OS because it's the only alternative Android that runs on my FairPhone 3, but I've come to realise that it's actually worse than the Stock Android in terms of security. I really would like to go with GrapheneOS, and I wish more manufacturers made this possible.
This may be useful: https://privsec.dev/posts/android/banking-applications-compa...
> I also worry about the future of Graphene with AOSP going more closed/private
I don't think it's AOSP going more closed, but rather the evolution of the Pixels line. GrapheneOS wants the ability to unlock the bootloader, install their own key and relock the bootloader. Google could technically stop supporting that for the Pixels (just like many (most?) manufacturers do), but they haven't said anything about it.
GrapheneOS has mentioned talks with a major manufacturer. I wonder if it will be a Graphene phone (which sounds very tricky) or if it could be something like Huawei or Samsung offering to unlock/relock the bootloader and committing to providing the features necessary for GrapheneOS. The latter would be amazing.
> OSMAnd was the one I tried and it bordered on unusable.
I love it. But if that's your feeling, definitely try CoMaps: in terms of UX it's on the other end of the spectrum :-).
Do you simply trust hetzner to not lose the data on your 1TB storage box?
(I am aware that I am currently trusting google and dropbox to do just that.)
My solution against photo anxiety is to actually look at them and decide to physically print the best ones every year. More likely to be used as gifts or just fun to look through them in a photo album, nobody is going to sit next to you on a phone or computer but bring out an old photo album and everyone is on it.
Yes, please print your photos! I love it when my clients print their photos, and I print my favorites as well. There's still something magical about a real, physical photo vs. digital.
I have vast archives of digital photos and you know what? I barely look at them, but I have prints up all over my walls, in my wallet, etc and I enjoy them all the time.
But what happens if you don't use that stuff for a long time. You are in hospital when the bill needs to get paid. Your credit card gets stolen and the number needs to changed. Whatever personal crisis that you are not able to take care of life as usual for some weeks. They will just delete your data before you are back in business.
Does anyone know how long it takes, how many warning mails will come? I have very little data in AWS, but I more or less constantly feeling it might happen to me. Maybe not because of such big crisis, but just the simple fact that my bank will reject the automatic payment requiring a PSD2 second factor and I miss the email...
The price of Glacier Deep Archive is roughly $1/mo per terabyte. (I struggled to produce 500 GB of photos in 15 years.) Set up a dedicated AWS account, put $50 on it, set up a yearly auto-payment of $10, and you're likely safe for several years of nonpayment.
Retrieval is not free though, something like $20-40 for retrieval from tape, and about $90 for a terabyte of egress traffic. Okay for the rare occasion of a full restore.
Backblaze B2 is $6/mo per terabyte, and they only give you 44 days of grace period before deletion for nonpayment. But the traffic is free either way, up to 3x the amount stored per month. They are good for frequent full backups, and for doing full restores periodically.
The biggest hazard, especially if the whole family uses your stuff, is key-person risk, since infrastructure requires maintenance. The second biggest is being out of your depth in securing it.
My only regret in all my years of self-hosting was that time I returned a portable /24 to APNIC. Still stings even if it was the right thing to do, civically speaking.
I retain gmail & hotmail accounts for deliverability checks and as signup swamps.
I don't! I haven't set it up yet, but my plan is to set up a daily cron job to use rsync to copy the photos down to a physical hard drive I have in my desktop computer. This desktop isn't on 24/7 so I would need to remember to turn it on to sync.
It would take something real catastrophic for actual data loss; Hetzner would have to somehow lose my storage box data & all its backups (or I lose access to my Hetzner account), my local cron job would have to fail or the hard drive would die, and I would have to lose my phone which has the last few years of photos on it.
If you're unfamiliar with the concept of "monoculture" in agriculture:
https://en.wikipedia.org/wiki/Monoculture
> Monocultures increase ease and efficiency in planting, managing, and harvesting crops short-term, often with the help of machinery. However, monocultures are more susceptible to diseases or pest outbreaks long-term due to localized reductions in biodiversity and nutrient depletion
This was how I felt - it was easy and efficient to "just use Google" but long term it felt a bit like "nutrient depletion". A lot of the services I moved onto are better than Google in a lot of ways and have different ideas about how things should work. Sticking with Google, you will only get the Google way of doing things and services you may rely on can be killed off on a whim by some C-suite executive (https://killedbygoogle.com/)
There are also a lot of political reasons behind why I'm doing this but I don't want to get into that too much here on HN. Tech oligarchy is ruling the United States and I don't want to be complicit in that. I was also tired of being a serf of "technofeudalism" (https://www.penguinrandomhouse.com/books/751443/technofeudal...) and am seeking ways to avoid that.
I’m amazed at the feature parity of immich, it works great. Jellyfin for media and Pydio for Dropbox/drive functionality, email via infomaniak 12$ a year.
But there's no substitute for GMap's POI database.
> But there's no substitute for GMap's POI database.
I was surprised to see that Kagi uses Apple's POIs for searching maps. It seems to be pretty decent, and Apple is at least a little more privacy-friendly. Lately I've been using Kagi to search for businesses then opening the directions in Google Maps.
I tried using OSM directions, but the walking time calculations are always really far off from what Google Maps says. I don't drive anymore, only walk and public transit, so I can't really speak to how well OSM's driving directions are.
Using proton as well, but if you're stuck on the free tier you can't use any 3rd party email clients.
>YouTube
Using Google takeout for Youtube will give you a .csv of your subscriptions and playlists (just be sure to un-check getting a download of your videos). From there you can get the rss feeds and use RSSguard as a subscription viewer/media player, this site was a big help in figuring things out https://charlesthomas.dev/blog/converting-my-youtube-subscri....
>The only real trick is that most YouTube channels use a vanity URL and it’s more complicated to get the channel ID in those instances.
Go to the channel's videos page ( https://youtube.com/.../videos ) -> right-click -> View page source -> search for "rssUrl" . It'll look like https://www.youtube.com/feeds/videos.xml?channel_id=UC...
Bonus: Replace the "?channel_id=UC..." with "?playlist_id=UULF..." to get a feed without shorts and livestreams.
They should offer a lifetime option for the core service and monetize the add-ons and new features.
Personally I'm happy to pay proton a few bucks a month to not have to give up those things.
I'm not criticizing those that do, just that given my financial situation the trade off is simply not worth it.
Other services deprecate or get weird. Hopefully Proton keeps going in the good direction.
I like the idea of having everything hosted somewhere that's guaranteed to be up-and-running 24/7 using Debian with automatic full backups turned on. If I go on vacation somewhere and something goes wrong, I can easily SSH into it. If it was on my desktop and I was away and there was a power outage or something, I'd be out of luck.
It *is* a little slow but it's honestly fast enough. I was going to do periodic backups of the storage box to a local hard drive just in case, though.
I'm still using docs, sheets, drive and maps.
Most of it because my clients use it. But drive and maps out of convenience. Don't know if there even exist something with a similar feature set as maps.
I probably could move my stuff to proto drive but the docs and sheets integration is vital for me.
At work we use GSuite, so even though I was able to get out of all of it personally I still interact with Google products every day. I'm okay with that since it's not my data that's being stored - it's the data of the company I work for.
I block all Google products (at the router level), and do miss their Maps/Earth products.
The best non-Google mapping I've found http://www.bing.com/maps (no affiliation, just ¢¢)
It has so much integrated information, without being annoying (e.g. store listings); also is the only free product I know with built-in tilt-shift perspectives (from each major of eight cardinal directions).
I was a paying Kagi customer, after fleeing Google, but I can’t stomach even a trivial sum of money going to Yandex/Russia.
I miss Kagi.
This is the first I'm hearing of this, I love Kagi. Looks like Yandex represents about 2% of their costs. I assume the hangup here is that by Kagi giving money to Yandex, the Russian government gets some of that money, and that money is being used to fuel war machines?
By that logic any company that ends up giving money to a country that is participating in active wars is not okay. If you draw the line at Yandex, do you also draw it at Apple/Google/Microsoft or any other US-based company that pays taxes to the US government which has a long and *active* history of killing innocent people? Or products coming from China who is actively exterminating ethnic groups?
At some point it becomes easier to just stop using technology altogether because once you look deep enough at anything you will find ethical issues. Do you know where the precious metals in your phone, laptop, or TV came from? Where is the energy you use to power these devices coming from? What happens to those devices when they reach end of life and you don't use them anymore? By using technology in any capacity you are affecting poorer countries that bear the brunt of mining, e-waste, and climate change.
I guess what I'm trying to get at is - it's important to be cognizant of these things and reduce harm that you're doing wherever possible, but you can never be fully 100% ethical and still be a consumer of goods and services unless you do so at great inconvenience to yourself.
And no nobody's perfect but the sanctions are a means of policy pressure. It's not so much about feeling ethical.
After Fastmail I went to Migadu, and it's absolutely great. I have never seen support requests getting answers that quickly :-).
https://migadu.com/guides/identities/
I can send as the address, and emails arrive in my normal mailbox. I also use them for giving self-hosted services their own address/password to email me.
I've been using identities created in the admin panel, but they do have subdomain addresses where everything to *@user.domain goes to user@domain, and you can configure a 'Catchall' address (and of course 'plus addresses'). I haven't used either though.
And my requests are usually well written as we deal with emails a lot and understand how it works (if you pardon my slight bragging)
Recently they started tinkering with spam filter, which worked fairly well before. Now it doesnt work - good mails go to spam, spam garbage goes inbox. Support tried - I'll give them that - but almost all their advises were either not working or working just partially.
My guess is they integrating "AI" with spam filter, hence the quality decline.
I use just use help-> Open ticket and getting one response per day (this is to address timely responses). Granted I am in UTC+7, but from company as big as FastMail you would expect support around the clock.
Or they could just absorb that.
Any idea why it works that way? Have they offered an explanation?
I'm a Fastmail customer but I've never noticed this because I use my own domain.
Do that, it's a non-issue, though I do agree with you that it shouldn't be a thing (or at least have like a multiple year embargo on the address).
I think the issue is why use an email provider that has designed such a glaring security hole into their system? Does it not raise questions about their judgment in other matters that are less visible to the user?
Second, and I don’t know how much weight this carries - but I personally know some of the people on the Fastmail team. They’re some of the most thoughtful, steady engineers I’ve ever met. Every time I’ve criticised something about Fastmail to my friends there, it turns out they’ve had the same discussion internally and immediately tell me about a bunch of arguments I hadn’t thought of which explain their final product choices. I wish much more of my software was made at companies like that. They have excellent judgement. They’re absolutely the right kind of people to host a long lived email service.
The commenter above may have never deleted the alias to release it for reuse.
Reusing email addresses is pretty universally considered terrible practice. So you may want to discuss it with your friends there.
Am I missing something?
(You can even sign up for a Google Account without GMail, using a third-party domain. And this is distinct from Google Workspace, or whatever they're calling it today. You get a normal, regular, personal Google Account, just without GMail and using your own non-gmail.com address.)
Do you have the same problem with domain names? If so, how would you propose to fix it?
Now that you've said what you wanted to say about how dishonest the question is, would you like to either answer it or explain why the analogy fails to hold?
If it wasn't clear enough when you made your fallacious argument, and even after I called it out twice, issues with domain name registration has no bearing on the choice of commercial email providers handing out previously used addresses to anyone who asks. They can stop doing that today without having to break the internet for an unrelated issue or go through internet standards committees to do so.
In addition, email addresses handed out by commercial email providers are highly personal as opposed to your typical domain names. End users, who are oblivious to how any of this works, risk being victims of identity theft by having their previous address taken. Scammers can impersonate as grandchildren and steal from the elderly. They can take over online accounts that's tied to that email address. There are grave consequences to these kind of decisions.
This is obvious stuff to anyone who has an idea of what a domain name is. But I understand, you're "just asking questions."
Also, whoever takes your old residence is probably not malicious (they just want the house because they want a house), but whoever takes your email address is much more likely to be malicious (as the acquisition cost is low and it scales).
I find it "meh" as well.
My mailbox.org username is literally three random short Engish dict words concatnated by underscores (e.g jet_sit_gill@mailbox.org) just to ensure I'd never share that email with anyone. I only use my domain's email addresses. This way there's ZERO lock, zero fear of them giving my email to someone else and staying with the domain provider for a day longer than I have to.
For email addresses on others' domains here
- icloud.com came with the devices (I honestly have not thought about what happens to these if I have zero Apple device at one point in future :D)
- tutanota(barely ever used; just to support them I paid until they removed the 12/year plan)
- protonmail, and sdf.org (ARPA)
All of these at least let me hold on to the email address even with little resources when I stop paying or have an unpaid a/c. So little risk of email goign to someone else. And I never use these for anything important anyway.
For temp emails - duck.com, HideMyEmail (stopped using this one for new accounts though).
Are you sure you didn't confuse domains? My original handle is on fastmail.fm, but it will let me register that on fastmail.com.
Could the above report have lost the distinction between original, paid-for Fastmail address, and user-created free aliases to it?
It turns out that most people don't really need anonymity. That is why most systems these days don't bother the user with all the associated hassle. Briar and Session come to mind as contemporary examples of such things.
I don't mind running an email server for receive. I despise all the hoops you have to jump through for send deliverability.
I really like that they offer a Gmail migration, including an initial import and _ongoing Inbox sync_. It only syncs the Inbox though, not spam (which is sometimes legit, especially with Gmail) or mail that gets immediately archived by a rule.
I created an alternate domain so I could try them out and perform the switch after a significant evaluation period. Since they have advanced options for figuring out which address to reply to an email with and how, it works seamlessly with gmail and with the catch-all for domains.
I could go on and on. The only thing I miss from Gmail is custom notification sounds. I don't like my email notifications having the default OS sound. Oh and you can't migrate stars/icons for emails. I wish I could do that and convert them to labels, but not a big deal.
(1) Create s label for starred emails, eg "Star-struck". A Unicode star would do if you like it literal.
(2) In gmail, search for "is:starred", mark all on the page, then "mark all matching emails".
(3) Drop the "Star-struck" tag on them. Now you can migrate it as a normal tag.
https://userforum-en.mailbox.org/topic/anti-spoofing-for-cus...
https://kb.mailbox.org/en/private/e-mail-article/customizing...
Interestingly, one of my biggest problems with Gmail is that they don't allow actual plaintext. I used to routinely collaborate with developers who were vision-impaired, and the official Gmail phone app wouldn't let me send them plaintext email. Instead, it was some sort of HTML thing. Unfortunately, we sometimes sent code snippets to each other over email, and though admittedly it looked more or less fine, Gmail changed the underlying representation enough that my collaborators' screen readers would mess up on the parsing.
This led to me leaving Gmail on my phone, which led ultimately to me leaving Gmail entirely.
- OXdrive is terrible and does not retain file backups like Dropbox or Google Drive. Nearly lost a lot of files when a co-worker deleted his duplicate OXdrive folder.
- NO 2-factor for the business tariff. Major red flag, especially for a company that claims privacy focus.
- Very low functionality software suite.
Etherpad - I cannot figure out a use case
OX office suite: Every cloud alternative is so much better.
Video conferencing: No single sign on across mailbox.org meaning you have to login again to setup a meeting.
Email client still has only a Folder philosophy- tags would be so much better.
All in all we had high spirits but were very disappointed by the pretty bad feature set. For private Email it might be fine.
Still would never recommend it after 8 month of use.
If you use your own email client and your own domain name, you don't really need to worry about UI with email providers at all (as long as your provider supports those features). And your own domain name makes it easy to move around in future if you need to.
I don't really have any plans to move away from mailbox.org, though I just saw the post about Thunderbird offering an email service in the future. That might actually prompt me to move as I'd like to support the makers of a FOSS email client I've been happily using for years.
And on mailbox you can easily send and receive PGP encrypted mail on mailbox.org. They provide a page for key import, allowing you to send encrypted emails like regular mail when needed.
It’s your choice, if you always want to use proton mail app everywhere you can use proton.
Didn’t need to do anything special for the migration. The in house importer they offer pulled over 80GB in a day and I was set from there.
Fastmail isn’t going to give you end to end encryption - but - I think just shedding a major Google service is a massive win privacy-wise.
I remember briefly looking into Proton but the search was awful.
With that out of the way I feel perfectly happy with FM — no need to go further down the paranoia hole.
And secondly, many sites, like Reddit, use a Gmail address as some sort of signal of quality. You can avoid a lot of new account bans on Reddit simply by registering with a Gmail instead of your own domain.
And backup your emails of course.
Like you, this hasn’t been a problem for me.
So, I use my personal domain for all mail except anything that's "vital" like government websites, banking, paying rent, etc. for which I use my email provider's domain. And of course I'm registered with my domain registrar with a different email domain.
You probably shouldn't use a premium domain unless you really need one. It's just a money grab by registrars and registries.
Another recommendation you should consider is to find a domain that ends in one of the common top-level domains - like .COM, .NET, or .ORG - because for using with *vital government services* you would not believe how many good natured civil servants (or for that manner even customer service folks in private/commercial companies too!) have no idea that email addresses can end in something other than .com, .net, or .org...and if you try to give them an address that, say, ends in like .FR, or .CC, or .ME, etc...They will try to place a ".com" at the end of it! My experience shows that folks in the U.S. know far less about other TLDs...and are more likely to commit this error, but folks outside of U.S. are perfectly cool with all manner of different TLS. I have had a somesurname.CC domain name as the mailbox for all my family members for more than a decade...and they are all trained to be LOUD and explicit when they communicate to government workers and customer service folks. So, i should have just gotten an easier TLD, but ah well. Live and learn! :-)
EDIT: Forgot to add that choossing the more common .COM, .NET, or .ORG TLDs for a domain name *tends* to be cheaper than many premium domains names. Each registrar wil of course vary, but mostly these tend to be reasonably priced.
To your point, agreed that *logins* for web site/apps and mobile apps are usually not an issue for my non- .com/.net/.org email addresses. In fact, for logins, gov services tend to be quite accomoddating and i don't ever think i had any issues there, and usually not a problem...But, years ago i *DID* encounter a couple of commercial/business/non-gov websites where they only expected .com/.net/.org email address...so it was a problem there on the non-gov website side of things...but even then, it thankfully was not very often, and nowadays its nearly a non-issue.
Again, my recommendation was just saying that for real, human interactions, if its possible, pick a common enough TLD to make life easier. ;-)
Users in other countries are very likely to be more familiar with both their own local domain, and have probably also experienced websites from neighbouring countries, while your average American has never even seen a website with a .us domain (never even seen it used myself), and are a lot less likely to have needed to go to a .ca or .mx website.
That said, I'd expect to get a similar reaction from people in other countries if you said your email was firstname.lastname@mydomain.christmas, or whatever other funny top level domain.
Yeah, agreed; that has been my experience as well. And in fact, i think that because folks outside U.S. are at least familiar with the TLDs of their neighboring countries, that fact at least helps them understand that there are more TLDs out there than simply their country's or only .com/.net/.org...its an awareness that they at least learn about...whereas folks in the U.s. might be - i don't know - maybe sheltered more in these things.
> ...That said, I'd expect to get a similar reaction from people in other countries if you said your email was firstname.lastname@mydomain.christmas, or whatever other funny top level domain...
True, there are just so many TLDs - well, outside the country code TLDs - now that it is hard to know what is real/valid or not. :-)
Your ISP, the hardware not failing, needing to do routine maintenance and (expensive!) upgrades, having room in your house, having consistent power to your servers, possible theft, natural disasters causing you to lose your home, etc.
There's a reason I use a VPS for hosting a lot of things haha. Mostly because I live in a small apartment and don't have room for a server rack.
For me and my partner was enough when Google started collecting info about purchases/delivery orders on gmail and dumping it in some separated page without any consent nor notification.
We moved to Proton but once they changed branding and starting introducing additional services beside mailbox we knew they enter milking-out path. Their newest AI plaything was reason to leave.
(1) tech support that actually reads your messages and replies with a solution demonstrating comprehension of the message that you wrote. Amazing. I've emailed them twice and gotten a great response both times.
(2) it is the best UI I've seen outside gmail;
(3) They have continued actively developing their UI, with nice updates released perhaps in the last 6 weeks.
(4) keyboard shortcuts that work
(5) Instead of inbox 0, I practice inbox 50k and it handles it fine.
(6) I just had a decade-anniversary there and I've never regretted it.
Tech support forwarded an inquiry I was asking about an IMAP command in my MUA which led to an actual engineer that said my MUA was using an outdated/deprecated part of the IMAP protocol and provided the RFC for the new way of doing things, which then lead to a patch in said MUA. Very few companies offer this calibre of support, the only other one I can think of is Tarsnap.
(2) it is the best UI I've seen outside gmail
I think it's a much better UI overall than gmail; at least I found with gmail you had to manually paginate things, I can easily do a search in FM that might have 10000 emails over 20 years and I can usually jump to a specific month/year very quickly via scroll and then from there a specific day.
(5) Instead of inbox 0, I practice inbox 50k and it handles it fine.
Similar, 37k in my Inbox, nay issue. I have probably 200k overall across different folders. But I know I'm outsourcing a service, so I do full infrequent backups via IMAP.
Here's my (7):
Fastmail has the only web interface I've come across that handles (catch-all) aliases correctly and knows how to respond with the correct one every single time. Maybe roundcube/squirrelmail can do this, but roundcube/squirrelmail overall is not very good.
I'd say it's better (maybe gmail has features it doesn't, but fastmail does everything I need and loads much much faster than gmail)
Running an online forum, I've encountered people using Atomic Mail, and that service has terrible reliability.
Whether they're "good" or even "passable" is another matter entirely, but without switching away from Google to Namecheap for a few months, one wouldn't have much of an idea. And now I know.
How many really decent email providers are there aside from Google? What's today's obvious choice? And will they last?
Talking about decent emails providers can get discussion heated quite shortly. Historically I arrange most important chunck of mail as self hosted, but of course it's not the way many people would take.
This is not quite right. The only offer e2ee if you send an email to someone on the same provider (e.g. ProtonMail to ProtonMail). If you write to someone using Gmail, it's not e2ee.
IMHO this kind of e2ee is interesting for companies (because every employee is on the same provider, and it's better to have the internal communications on ProtonMail than shared with Google on Gmail), but for a personal email it doesn't matter so much.
What's really important is to have a custom domain so that you are not stuck with one provider.
Mailbox also offers e2ee via browser among the same mailbox users, but it also has IMAP and PGP.
Happy customer over a couple of years.
After that, someone else can register your old address.
If your subscription lapses, your email account is closed after 30 days, data is deleted after another 30 days [2].
[1]: https://kb.mailbox.org/en/private/account-article/when-is-a-...
[2]: https://kb.mailbox.org/en/private/payment-article/what-happe...
ProtonMail and Tutanota offer end-to-end encryption only when both the sender and recipient are using the same (i.e., ProtonMail->ProtonMail or Tutanota->Tutanota). If you’re emailing someone outside those or if you’re receiving emails from someone outside those, and you want encryption, you’d have to go to PGP (with its own complexities).
I mean for god's sake just let me use IMAP/POP3.
You give me encryption at rest, safety and privacy in transit, and do not sell my data. You also offer to let me put up my GPG key on your admin portal so that I can easily read e2ee mails in your webmail.
Thank you, all that is very nice. Now get out of my way and do not try/pretend to be Signal and email at the same time.
Renewing your domain, keeping your registrar account safe, keeping your DNS records safe etc
Some people prefer a domain registrar that allows 10 year renewals so pick carefully as not all do
Maybe I need to buy a domain that sounds like a generic email host.
That's not a Gmail problem, and no reason to migrate. Some use cases just don't fit email, and for those, we have other, more fitting platforms.
> So, I went with mailbox.org that still offers integrated PGP encryption, and if you want, you can always use external PGP too (which I was already doing with Gmail).
Ok, so now you have two problems.
I was fortunate enough that my solution was to host my own mail server 20+ years ago and create a separate email address per relationship with a company, so I can tell the moment some 3rd party has been comprimised when I receive spam on a specific address. My personal spam has been minimal over time.
If for example moc.elgoog@mydomain.com gets spam - I know they're compromised or have sold me out.
Yes gmail has had something similar using the + character, but most people don't know about/make use of this and still abdicate spam filtering to things they don't understand like bayesian algorithms which suffer from false positives. (Have you checked your spam folder for our very important message...?)
Email has never been secure and despite modern updates, I still don't consider it as such. Then again I don't have much to worry about, so I'm ambivalent most of the time. That said, special 'fuck you' shoutouts to Ticketek for being compromised and their general ineptitude and shitfuckery in so many ways... It took them 2 months to respond to an issue I raised with them only to ask whether it was still an issue... (yes, it still is).
Unfortunately I don't know if you could easily manage to convince majority email providers you're legitimite with a new domain in this day and age - I suspect its now a major hurdle to overcome as I've read often enough of mail bouncing because "we've never heard of you until now, so we don't trust you" - which makes communicating with the majority of the world via email almost impossible to build up the trust level you're considered legitimite and that's despite all this extra DMARC, DKIM, and SPF and SSL/TLS supposed safeguards which have appeared over time and I've had to comply with.
Security as an afterthought means its still probably never going to be secure. I've always considered email the equivalent of transmitting plaintext and have always treated it as such. This has led to some pretty difficult situations where I don't email important stuff to a 3rd party just because they expect it and everyone else does it.
Once you realize this, the "just keep whatever I have right now" is often the best solution.
Speaking of which, receiving is free. There are no spam checks when other providers send email to yours. So feel free to only use Gmail when you need to send an email out to a big provider. It's still a 95% win.
It is a problem with Gmail, because they're helping themselves into your email, as was explained by the author in the sentence immediately after the one you quoted:
> Technically, Google can store every message you receive and know everything, and U.S. agencies can request access to that data
What, specifically do you mean by this?
Microsoft's been a bit annoying, since some emails I've sent to @hotmail.com domains go to spam, but at least they do arrive and aren't just bounced, as I've heard from some horror stories. Sending to @gmail.com accounts seems to work perfectly though. I don't send a lot of outgoing mail from my personal account anyway, so it doesn't really matter in the end. Some mails seem to take longer to arrive, but I had that problem on Gmail too, so I don't think there's anything actually wrong per se.
(This is for the author and anyone else) If you are looking for responsive (or even barely responsive) and responsible support responses whenever you need it, weigh your options very carefully about which mail host you want to move to. You might need it once or twice a year, but that might be crucial.
Edit: And if you can help it, and have your own domain, never use a mail host's domain-based email address (no matter how catchy and short that is) because it will be a headache switching away from it if you want to change your host.
But having burnt my fingers couple of times I need to be with a provider who has some sort of "real" and responsive support (and accountable) and that costs money so there's that. For me EU is not a condition, neither is e2ee (as long as it's E at Rest), but I understand it might be for others. I hope mailbox is good for you and unless you need some support it will good. There were no outages or any general things breaking during my usage of many years.
Good luck.
- cheaper
- unlimited number of subaccounts (e.g. for family members)
- unlimited number of domain names
- support is handled by CEO himself
e.x. For self hosting photos, am I gonna do something dumb that exposes the NAS on my network? Immich is not encrypted at rest, so what if someone just breaks in and steals my NAS? I could try and set up whole disk encryption, but what if I’m an idiot and end up losing all my photos because I make a mistake?
Philosophically I applaud articles like this, but I find iCloud with Advanced Data Protection to be way less scary than dealing with the weakest link: me (as a sys admin).
Moreover, Mailbox.org restricts the creation of email extensions exclusively to the plus sign: with alice@mailbox.org you can generate alice+test@mailbox.org, which inbound will automatically be sorted into the inbox folder alice (case sensitive).
But Mailbox.org does not allow the creation of alice.test@mailbox.org, which would actually be accepted as a registration email address by significantly more online services, because many of them apply standard filter rules for valid email addresses that wrongly consider the plus sign invalid and therefore reject it.
I love the concept of PGP and how well it seems to be integrated. I also don't know a single person who uses it or a provider/software capable of decrypting it. I think that's the biggest issue with PGP. Short of asking someone directly, you don't know if they'd be able to receive a PGP encrypted email, so you wont send one.
It's no big deal if you really need to send a private message.
Dovecot in my homelab seem doable to have an IMAP server to transfer the Gmail based emails to and maintain them indefinitely but would this be a maintenance headache? I've never operated it before and am curious.
After living seven years in Germany, I can confidently say that when it comes to anything digital, “quality” is the last word I would use.
I certainly wouldn’t trust this company with my data.
Not an endorsement as I haven’t actually tried it myself.
[0]: https://stalw.art/
For SSH access, I have fail2ban + access only via certificates. For the rest, I have disabled web access and APIs as I don't need them.
I also keep an eye on logs, but there is not too much there, besides some bots scanning for open relays
The report is also very good and that should be a service every other mail service could provide to people who want to move away from G'rab'mail.
Another curiosity is that you use the same password I use for everything: xxx
Simple to remember and nobody will ever figure that out! Wink! :)
I keep telling them that Google spies on you, but they don’t care because it is free and it works.
How reliable are these providers and what are the chances these providers emails would bounce or go to spam when sending an email?
As much as I don't necessarily like it, I think we have to put a price on our privacy and personal data. And for me, paying for the Proton family plan seems like a good trade-off, at least for now. So far, I haven't got any emails to bounce when using the @pm.me or @proton.me email addresses, except once (I forgot which web site).
They found a deal that seems to be ok for them. To get them to change providers, you need to suggest one that would be a better value, and to be honest, I don't think you can find one.
I considered self-hosting my own email, as I already have a domain name. But this has always put me off. The reason I would still consider self-hosting is to have readily available email address for side projects, like if I want to receive email notifications from services.
But for privacy, you unfortunately don't gain much, as most of the people/entities you're exchanging emails with are using Google or Microsoft emails.
I contacted their support, and they said my account would receive it ASAP. It's been two months, and I still haven't received it.
> That’s a no go for me, because I love Apple’s Mail app on macOS and iOS, it just works perfectly for my needs, and I don’t want to give that up.
Well, you can indeed use Apple Mail by running the Bridge. Not sure I understand the point here.
Why not shift to properly encrypted chat apps without all that single permanent pgp key nonsense that doesn't fit on a page?
Sadly I don't see a way around it unless you use PGP and the secret key is kept client side.
Phone number is just a user number. Email addresses are a user name at a server name. A little harder to do if you're looking for something as ubiquitous as phone number porting.
The closest thing to a server name when it comes to phone numbers, would be the network it is on. For example, there is the public switched telephone network (PSTN), then there is the Defense Switched Network (DSN)
The funny part is you need an email address already to register a domain, at least during a bootstrapping phase. I have several domains across 2 registrars with renewals at different time of the year.
With a custom domain, you can find a registrar where there are actual humans on the other side.
- set up new email address, hosted where you like
- https://support.google.com/mail/answer/10957?hl=en (forward your email)
- update your email address as many places as you can
It’s even easier if you list out the most important senders in a checklist and move those first. But give yourself at least a few months time. It’s certainly possible.
Once you have your own domain, future migrations to another email provider would be a matter of moving the emails and updating DNS.
When I finally changed, it was a lot easier than I thought. I just gradually migrated my accounts everywhere. I still have my old Gmail address, but I almost don't use it anymore.
Also (but I didn't try), couldn't you setup your own domain with Gmail? So that you still have everything in Gmail while you migrate all your accounts... but honestly for me it was really fine to deal with two email addresses for a while.
Does anyone have a suggested solution that allows multiple people to share and manage a calendars that isn't Google Calendar or locked to a particular platform (Apple).
Been there since many years.
I do occasionally get emails that take longer to arrive into my inbox (between 5 minutes up to 1 hour), but the emails always arrive eventually. Or maybe I haven't noticed...
Do you remember which websites rejected your Mailbox address?
Something like mailbox.org should be fine. Even a carefully-chosen VPS running your own email server should be fine (works for me, no delivery problems in ~2 years)
There's a reason even large corporates that can easily afford the resources to run email their email themselves decide against it.
There are a handful of good providers, not just Google and Microsoft, but the two hyperscalers do have very good offerings, so of course they have a lot of the market.
Genuinely asking after using Gmail and enterprise Outlook for more than 2 decades.
Currently the are distracted by AI gimmicks.
> I had no issues with paying the equivalent of two coffees a month
Where can you get coffee for €1.25?!
Anyway I wrote the details in the post.
Edit: I have to mention that I generated my PGP keys locally and then imported to Mailbox.Org
Another concern about anything social is that there are at least two sides in a conversation and whoever leaks the data to a third party will compromise privacy of all so it is really hard to prevent your email from getting to Gmail servers one way or another.
I can send you PGP encrypted email you could have used Gmail or Proton or whatever. It is about what the sender does not what service you choose. (If you and your wife are both using Proton, that probably does not have anything to do with SMTP; it would be like calling iMessage "SMS".)