6 ms·

This looks pretty slick and well done for having a comprehensive FAQ section and plenty of info which answered most of my questions. For me, email is the 'mast

This looks pretty slick and well done for having a comprehensive FAQ section and plenty of info which answered most of my questions. For me, email is the 'master key' for most of my online accounts (because password resets are done via email so if your email account is compromised an attacker can quickly leverage access to other services) and email security is top priority. I didn't see anything about using two-factor authentication with this service - is it available? Also, your site only supports obsolete HTTPS protocols. TLS 1.0 and SSLv3. You should drop SSL 3 and enable support for TLS 1.2. Here's a test you can run with feedback and resources to learn more about secure configurations: https://www.ssllabs.com/ssltest/analyze.html?d=migadu.com&s=91.121.157.186&latest https://www.ssllabs.com/ssltest/analyze.html?d=migadu.com&s=...

matt_wulfeck 10y ago
I was also discouraged to see there was no 2fa option. Email is simply too important. One of the reasons I stick with gmail is because I know Google hires some of the best security people in the world and takes it very seriously. They also support 2fa and other security measures.
- rahrahrah 10y ago
  Same here.
- rovr138 10y ago
  On the other hand, unless you use their paid service or you know someone, you don't really have many options to get in touch with them.
  - Whitestrake 10y ago
    Even if you're paying for G Suite, my experience has been that it's tough to get a hold of a human Googler.
hartator 10y ago
At the same time, if you access your email only from secure devices, is your password at any risks?
- scott_karana 10y ago
  Yes. Password leaks, bruteforcing, and some "rubber hose" attacks can be mitigated by 2FA.
  - hartator 10y ago
    Password leaks are server-side. If they don't know how to properly hash passwords, how you can trust them to implement correctly 2FA? Bruteforcing is not realistic with even medium password strength. If by "rubber hose", you mean physically coercion, what would forbid the attackers to coerce you for your email or your phone as well? I think that the main reason 2FA has been pushed, it's for the Facebooks or the Google to have good reasons to get your valid email and your valid phone number. Or maybe I am missing something obvious?
    - rovr138 10y ago
      > Or maybe I am missing something obvious? Yes. Google and Facebook aren't the only ones. > I think that the main reason 2FA has been pushed, it's for the Facebooks or the Google to have good reasons to get your valid email and your valid phone number. You don't need a valid phone number to implement 2 factor authentication. There are implementations that require it, sure. But it's not the only way.
      - hartator 10y ago
        > Yes. Google and Facebook aren't the only ones. > You don't need a valid phone number to implement 2 factor authentication. There are implementations that require it, sure. But it's not the only way. Are your referring to AWS Multi-Factor Authentication (MFA)? It's indeed a good implementation, but it's usage is very limited and most people are not referring to this when they are talking about 2FA.
jonathonf 10y ago
Just as an implementation note, one way to maintain compatibility with older devices while allowing modern ones to use better levels of security is to use haproxy on the front end. This can handle TLS/SSL itself or hand over to the correct SSL backend depending on the connecting device.
solatic 10y ago
Can't up vote high enough. TLS 1.2 and Yubikey support are necessities, IMO.
- rovr138 10y ago
  I don't think Yubikey is a necessity. But at least a form of 2 factor authentication yes.
dubberx 10y ago
I, too, would like 2FA for my email account(s). So I wrote Migadu support and got a quick and reassuring reply: We'll add 2FA in the near future. We were unaware of the great demand for it. :)

matt_wulfeck 10y ago

I was also discouraged to see there was no 2fa option. Email is simply too important. One of the reasons I stick with gmail is because I know Google hires some of the best security people in the world and takes it very seriously. They also support 2fa and other security measures.

rahrahrah 10y ago
Same here.
rovr138 10y ago
On the other hand, unless you use their paid service or you know someone, you don't really have many options to get in touch with them.
- Whitestrake 10y ago
  Even if you're paying for G Suite, my experience has been that it's tough to get a hold of a human Googler.

hartator 10y ago

At the same time, if you access your email only from secure devices, is your password at any risks?

scott_karana 10y ago
Yes. Password leaks, bruteforcing, and some "rubber hose" attacks can be mitigated by 2FA.
- hartator 10y ago
  Password leaks are server-side. If they don't know how to properly hash passwords, how you can trust them to implement correctly 2FA? Bruteforcing is not realistic with even medium password strength. If by "rubber hose", you mean physically coercion, what would forbid the attackers to coerce you for your email or your phone as well? I think that the main reason 2FA has been pushed, it's for the Facebooks or the Google to have good reasons to get your valid email and your valid phone number. Or maybe I am missing something obvious?
  - rovr138 10y ago
    > Or maybe I am missing something obvious? Yes. Google and Facebook aren't the only ones. > I think that the main reason 2FA has been pushed, it's for the Facebooks or the Google to have good reasons to get your valid email and your valid phone number. You don't need a valid phone number to implement 2 factor authentication. There are implementations that require it, sure. But it's not the only way.
    - hartator 10y ago
      > Yes. Google and Facebook aren't the only ones. > You don't need a valid phone number to implement 2 factor authentication. There are implementations that require it, sure. But it's not the only way. Are your referring to AWS Multi-Factor Authentication (MFA)? It's indeed a good implementation, but it's usage is very limited and most people are not referring to this when they are talking about 2FA.

jonathonf 10y ago

Just as an implementation note, one way to maintain compatibility with older devices while allowing modern ones to use better levels of security is to use haproxy on the front end. This can handle TLS/SSL itself or hand over to the correct SSL backend depending on the connecting device.

solatic 10y ago

Can't up vote high enough. TLS 1.2 and Yubikey support are necessities, IMO.

rovr138 10y ago
I don't think Yubikey is a necessity. But at least a form of 2 factor authentication yes.

dubberx 10y ago

I, too, would like 2FA for my email account(s). So I wrote Migadu support and got a quick and reassuring reply: We'll add 2FA in the near future. We were unaware of the great demand for it. :)