Hacker News Reader

Comment by zalzane | Hacker News Reader

I think what's even more horrifying that isn't mentioned in the article is how many services use email as a form of user authentication.

If you lose access to your gmail account, you also lose access to changing your password on any service that makes you do so through an email link - I know of some services that don't even let you change your account email without clicking on an email authentication link.

So not only is there the always-lingering possibility of losing your google account to automated shutdowns, you can also lose access to services that you use that use authentication through email, quite an uneasy thought.

View on HN

Unfortunately though, it's poor practice to let a user change their email address without first sending a confirmation email. If you don't confirm the action before making the change then bad people can lock out the true owner of an account simply by being logged-in.

Which is why everyone should have their own domain name, or have a contract with a reputable provider.

It's crazy to cede over ones entire identity to a free "best-effort" service.

Identities and accounts are two separate matters.

Accounts can only be some of identity's credentials. You are not your email address (and you should never be considered so), but your email provider can optionally act as one of trusted third parties who can assert your identity. Not the other round.

Also, you can't really own a domain name — you can only rent it from your domain registrar, in almost a same manner you rent your email account. And the idea of paying for keeping my own identity somehow frightens me.

You can pay for many years in advance, and you can register for auto-renewal.

Paying to keep your identity is far better than borrowing it from someone who has made no promises to you.

Well, if possible, I'd really prefer to actually posess my identity (like I possess my GPG keypair) and be the authoritative source of it, not lease it.

I really don't want others to define who I am, and prefer them to merely assert my own definition of myself.

Unfortunately, modern trends of the Web is to make things work in exactly the opposite way.

(Original comment was edited from one-liner to a more verbose explaination.)

> Which is why everyone should have their own domain name

Better never let it expire, though

The problem is that by all measures, Google is the most reputable provider... of course there are some problematic stories from time to time, but they probably happen also with paid providers, just that you don't hear from them so often because there are less people using paid providers! :)

You can always point your MX records at another server, if you have your own domain + gmail. Still sucks (and doesn't serve everybody), but it's an option if the worst happens to your account.

My current setup usually works.

I make it a point to have my emails on my own domain. I use Google Apps and then use my own IMAP backup app (http://thehorcrux.com/). In case something goes wrong, I intend to move providers and restore the emails back.

There are also a few command line tools like http://gmvault.org/ if you love tinkering.

Reply on news.ycombinator.com