Hacker News Reader

Comment by cedws | Hacker News Reader

Email services in general. My worst nightmare is my email provider (which isn't Google) going dark and losing access to everything.

View on HN

You can use a custom domain with most providers, so when they go dark you can at least migrate to another one.

Two things about fronting with your own domain:

1. You have to own that domain forever, until or at least until you're 100% confident that an email intended for you will never be sent to that domain ever again. Even then, there are security risks with giving up the domain.

2. You give up some privacy. You can use mailbox aliases but it doesn't really matter if all the mailboxes are tied to a domain registered to your name and address.

1. A little money solves this. You can register for 10 years at a time. Any decent registrar will blow up your email near your domain’s renewal date regardless of renewal status.

2. Whois privacy solves this. Free from any decent registrar.

Whois privacy is basically standard these days, no?

Doesn't completely solve the problem. You now have to pay per (unaffiliated) alias since each requires an independent domain. You also become extremely vulnerable to data breaches because rather than learning that foo@provider is john.doe@provider with IP xxx you instead learn that foo@domain is John Doe, phone number, street address, credit card, etc.

This issue goes far beyond email alone. The ICANN domain system effectively rents a string out to you on a temporarily basis and mandates that an Impressum be attached to it. It's a deeply flawed scheme when viewed from the context of both historical hacker culture as well as the fundamental values of a free and open society.

Yes but all of your aliases would be under the same domain so one could surmise that the same person uses the domain.

You can usually setup several domains. Some domains are very cheap to register, so you can register some inconspicuous, universal, email provider-sounding domain and add aliases at will.

For (1) you can prepay i think up to 10 years? And every year you just prepay 1 year again and you will have 10 years to remember that you forgot to pay a domain registration bill.

That is moving the point of failure to the domain registrar. Which is probably less likely, but you are always relying on someone.

I think that the point here is that your domain registrar will pick up the phone if there is a problem, where Google clearly will not.

I use AWS to register the domain and AWS supports up to 8 different MFA factors. I have totp and 4 different passkeys registered

If you use a password manager like Keepass, you should still be able to log into your other accounts if you lost access and at least with financial institutions you can call, ask that no changes be made with without coming into the branch and showing ID.

Yes, but many companies will also drag their feet, refuse for "security reasons", or you'll just never be able to reach them in the first place because their only support is an AI concierge that tells you the same thing over and over.

As an example Anthropic and OpenAI don't let you change your email address.

If you use a password manager like Keepass, you can put your TOTP into it as well. With both a password and a keyfile it's still two factors, technically.

Why don't you keep a copy of your email offline?

Worst case you need to self host

Great when it works. Too many senders will only deliver to widely used hosts, and silently fail for anything outside their tiny allowlist.

Note that I'm not even talking about trying to send email FROM a self-hosted account, but trying to get someone else to send email TO such an account.

Reply on news.ycombinator.com