6 ms·
I'm moving email providers in the near future and was looking at Google. AMP for Gmail ensured that I won't touch it.
by JohnTHaller 9y ago
I'm moving email providers in the near future and was looking at Google. AMP for Gmail ensured that I won't touch it.
- x0x0 9y agoYou should read the top comment here before you move to fastmail, and fastmail's response. https://news.ycombinator.com/item?id=15855081 https://news.ycombinator.com/item?id=15855081 I'm a founder of a company, and I use fastmail for my personal email and gmail for my professional email. I like fastmail more, but I need the security of gmail + yubikey because that professional email can manage DNS/domains/bank accounts. You should also be aware that fastmail doesn't really integrate that well on Android phones. Eg in order to access calendars hosted on fastmail, you will have to use a third party caldav program. I currently used caldav-sync, which fastmail recommends. It's a piece of shit that stops working approximately every other week on a stock HTC 10. The symptom is my calendar stops syncing. I have to notice this, go to the accounts option, and manually trigger a long term sync. This is very very very annoying and I'm going to find a new program as soon as I have the time. Note this isn't fastmail's fault, but it does significantly inhibit use of their service. The email composition box on mobile firefox on fastmail is a little funky too, but that's on me. I wouldn't be surprised if I'm essentially the only person using mobile firefox/android/fastmail's web client. This was pretty much the outcome of my effort to de-google myself. That said, I'm really happy with fastmail and I think I'm prepaid for another two years.
- JohnTHaller 9y agoI won't be managing calendars. Sadly, your choices for that seem to be either Gmail (which I'll continue using for my calendar) or Outlook (and the Outlook calendar). I'd pay good money for a working third party calendar/contacts solution that worked well on my phone, tablet, and Windows. Google doesn't fit the bill there, either, unless you like web-only. As for securing Gmail with yubikey... how do you gain access via a standard email client like Thunderbird in that case? Anything that can't do that is a non-starter for me.
- efreak 9y agoDo Gmail's app passwords not work with yubikey? I know that with totp 2fa enabled, I can generate passwords that bypass the 2fa codes. There also might be some way of using a 2fa code in the password field as well (PayPal used to do this, you just appended your 2fa code to your password). Nextcloud or owncloud have calendars/contacts sync iirc, but I'm not sure how well it works.
- JohnTHaller 9y agoI meant I won't manage calendars with my own domains. I'll be using a personal Gmail account to manage my calendars and contacts. But no critical emails will pass through Gmail and no financial or similar accounts will be tied to it.
- brongondwana 9y agoyeah, that one is hard to live down. It's happened (as far as we can tell) twice in the entire history of the company, amongst hundreds of "I've lost my password" requests per week. Lost password was seriously in the top three most common support requests every week right up until we built the automatic recovery system: https://blog.fastmail.com/2016/07/21/multiple-ways-in-keeping-password-reset-secure/ https://blog.fastmail.com/2016/07/21/multiple-ways-in-keepin... and we responded fairly directly to that Hacker News thread the next day with this: https://blog.fastmail.com/2017/12/06/security-account-recovery/ https://blog.fastmail.com/2017/12/06/security-account-recove... Obviously it's hugely embarassing to the company that it happened at all, and awful for the victim. I think it's perfectly reasonable for you to bring it up, and it is a consideration for anybody choosing us to do their research and decide if the steps we've taken to mitigate it happening again are sufficient.
- chrisper 9y agoHello, I'd recommend you to change your recommendation to DavDroid. It's free and seems to be much better than the one you are recommending.
- JohnTHaller 9y agoClarification: It's free to side load, but not to install from the Google Play Store.
- chrisper 9y agoHuh, you are right. I was remembering wrong! Thanks for correcting. Now I remember why I installed F-Droid.
- youseecomrade 9y agoI pay fastmail for a side business account but I've been thinking about buying a Google Domains "account" for personal use just so I can use a custom domain for free on Gmail. Identity theft is the sole reason I don't trust anyone else and Google owns my soul for that. In a matter of hours, just like your link shows, a hacker could reset the password for everything I have. With the data he acquired it could also be possible to circumvent TFA. Unfortunately even with me owning everything after the "@" I'm still locked to Google (I don't mind losing data) and they could freeze my domain if I do something wrong on Gmail. Could as in theoretically. Am I being over paranoid? Did this ever happened to anyone? Will I at least be able to reach a human on Google domains? Because I sure as hell won't be able to using a free Gmail account.
- mfer 9y agoWhy not use 2FA with Fastmail? https://www.fastmail.com/help/account/2fa.html https://www.fastmail.com/help/account/2fa.html
- chrisper 9y agoI'd recommend you to change to DavDroid. It's free and also on F-Droid.
- bad_user 9y ago> Eg in order to access calendars hosted on fastmail, you will have to use a third party caldav program If using an app bothers you, stop using Android, because CalDAV is the standard for synchronizing calendars. iOS supports CalDAV natively. That Android doesn't support it natively is yet another example of Google infecting the market with proprietary stuff.
- lern_too_spel 9y agoYou can expect the iOS implementation to be buggy and not fixable without an OS update. Meanwhile, there are multiple open source CalDav implementations for Android that update automatically. The most probable reason it isn't installed by default is that CalDav is a failed standard, which most people don't use and don't want wasting space on their devices. ActiveSync and Google Calendar won, which is why even iOS paid the Microsoft tax to support ActiveSync long before it supported CalDav.
- bad_user 9y agoI used CalDAV on both iOS and MacOS for the last 2 years and worked just fine. Never had any problems. Feel free to correct me if I'm wrong. It's true that back in 2015 FastMail was not doing invitations and RSVPs through CalDAV, but they fixed that since then. > most probable reason it isn't installed by default is that CalDav is a failed standard That is extreme bullshit, the same kind of bullshit that Google used to kill Google Talk and its XMPP interop, while pushing for their shitty and completely proprietary Hangouts. People used Google Talk back in the day due to its simplicity and interoperability. Who is using Hangouts now? I actually hope it dies, because we can then put such bullshit arguments to rest. CalDAV can only become a failed standard because unpaid fanboys and shills keep normalizing this behavior. But until then I'll keep using CalDAV and I'll be happy about not participating in this charade ;-)
- brongondwana 9y agoCalDAV has some issues - we're working on making it easier to work with at https://devguide.calconnect.org/ https://devguide.calconnect.org/ (when I say "we" - I haven't actually attended a CalConnect for a year, due to spending half my life traveling as it is - but FastMail has sent someone to every event for the past few years, and Ken has been going for ages before that) And JMAP calendar support will be really nice: http://jmap.io/spec-calendars.html http://jmap.io/spec-calendars.html With the JSON format on the standards track now: https://tools.ietf.org/html/draft-ietf-calext-jscalendar-00 https://tools.ietf.org/html/draft-ietf-calext-jscalendar-00
- unhammer 9y agoI've also noticed the thing on mobile Firefox. It's not unusable, but there is something weird going on.
- pvdebbe 9y agoIf you read closely, you'll notice that Fastmail is not entirely dismissing AMP either
- ainiriand 9y agoIf you read closely, you will notice that due to the enormous amount of power that Gmail has, they cannot refuse to serve emails with AMP content in the end.
- brongondwana 9y agoYeah - our duty is to serve the needs of our customers while making wise and pragmatic security decisions to keep them safe. If large amounts of email that people want to see is delivered via AMP pages, we'll make them viewable and usable somehow - hopefully in a way that makes it clear that they are mutable, and maybe even informs users if they've changed since last view.
- morganvachon 9y ago> "...hopefully in a way that makes it clear that they are mutable, and maybe even informs users if they've changed since last view." That would be amazing, and as a happy Fastmail customer I'd love to see it implemented. I am in full agreement with your blog post, and Google's AMP-email plan only further cements my position to excise Google from my life as much as possible. As much as I love seeing new and emerging technologies, there are times when one must say "that's too far".
- amygdyl 9y agoFastmail user since forever, I've waited until I hope I'm not upsetting general discussion, risking this plea in case of potential remedy. I managed to convert my free for life account to a paid account when I was hoping to merge a paid admin account with my free one. AFAIK My original email account wasn't subject to required login activity but the merged account was. What I had wanted to do at the time, was to be using my lifetime account for primary receipt of multiple domain administrator user email accounts, as I had relied heavily on fastmail for the effective archive. In short, I was separated from my twelve years plus old email account, by a change in my account that I had no ability to undo, events overtaking my life very soon after the merge. Lifetime accounts such as I had can be a lifeline. Continued use of my archive enabled me to save several domains otherwise I would have lost due to the interrupted existence I had. I was able to mostly wind down my business semi gracefully, as a result. Can Fastmail once again offer lifetime accounts, without any minimum requirements of use intervals? I am not begging for a reinstatement here but asking if there is a fair price I can pay for this once off, and exhorting the creation of a account type that gives incredible peace of mind to serious users. Consider my elderly mother, whose health declined in days rendering her helpless, but it took a year and two months to obtain the necessary court authority over her affairs. A court will not make any order giving access to email accounts in a hurry. The account will be treated as being a real part of the person's identity. At least in the UK. Recent email standards that prevent sending spoof return envelope addresses reinforce the same effect of having the equivalent of identity. Arguably anyone who used any consistent signature in body in text, was identifying the same origination with their identity. Only a week ago in the high court, my McKenzie Friend (now non practising retired barrister I've known from his uni jazz band days) held at offer of test, ie implicitly asked the judge if the court accepted his email printouts and the auto reply as a legitimate correspondence with the other entity, and the vestigial gestures of approval said to me the court was absolutely not separating the autoresponder from the defendant. Service upon a known or advertised email address is definitely now service in the UK, save for where the nature of a order, such as a Penal notice requires personal service or personal attestation of the correct procedure attempted. THIS EXCLUDES so many accounts in the event of a range of life events, from incapacity due to illness or - this sank a great friend on his second time bootstrap (he made it on the third) the breakdown of a co-founder, the real possibility in England for a statutory period of declared incapacity far exceeding the eventual needs (insurance coverage, spousal and corporate, often tips this decision from one to six months), indictment or visa irregularities. The last two seem ominous but I'll be quick: the Family Division of the high court handles all manner of cases from the deterrent of stalkers to divorce. This court is provided for by no kind of legal aid. None. Zero. And the law is fiendish and the talent scarce. And the case load so high that combined with lay appellants, the temper of judges despairing of any positive result, can be brutal to unprepared litigants. To this firmament we can add a body of criminal penalties for breach of sanctions, that the judiciary at large appears to think unbalanced. Because if you're not able to comply with the court's ruling, the court forever under pressure of time and resources, the combination of both zero public funding and criminal penalty can be extreme. Far too often, spouses are prohibited from entering large geographic areas impossible to avoid, even including workplaces. This is a easy arrest for a young officer with almost guaranteed guilty plea, but a guilty plea by no means makes certain that the paperwork will not take six months to get before court. Individuals bailed find it hard to get orders varied that they have breached. Incorrectly so, but it can be understood that some people will try to make changes only for mitigation of a breach. If you're remanded to custody however, I can tell you of a local magistrate notorious for indiscriminately refusing bail who only just retired (anyone who has a name on their tongue, please get in touch, see profile) the situation is terrifying the fact you have any savings so soon history, it can't get your phone call faster than anyone else and 10 mins weekly may be the max talk from some overcrowded jail's. Okay so a seemingly minor infraction can send you down the rabbit hole and leave you with little recourse in the UK. The immigration mishap that hit a friend is unusual and a bit extreme too: the visa of a fund trustee expired before a replacement could be issued and the system was not moving. The trustee repaired to family in France. But the foundation documents required quorum in England and Wales with arguably application to appointment of a proxy. This was a place of business test for the domicile of the fund. What happened was a temporary resolution of the board, but it was dependent on approval of the Revenue because this absent trustee had executive function over a significant area of activity. This led to the ugly situation where the email address of the trustee had to be presumed continuing for receipt of business files, but was the autoresponder from the trustee or the board or the fund? The email had to be routed to outside legal and manually attended. Because only one technicality meant that a autoresponder from that account could misrepresent or just confuse. Legal help had to get the mailbox mirrored under a different contract even, because of the requirement to leave the trustees mail intact. The board had to act, but the necessary independence of this trustee was paramount, equally enabling his executive decisions would compromise the independence of the other trustees. Now, I don't pretend that such a organisation will rely on any free or fremium type service. But I know many directors and trustees who maintain IMAP mirror accounts, outside the organisation servers. This is not in any way unlawful, in itself. (Specific aspects may be very problematic, however I don't know anyone who has set up such a archive who is not either a attorney or had taken advice. I heard about one non executive director who was given written authorization to connect via IMAP for the purpose, who was so concerned about the integrity and security of his replication that he deposited into escrow with his family attorney the only hardware stored key. The rather nasty attack on him from a fat cat board he'd voted against, was to construe his own security care as a act of bad faith to not trust the company security officer with the key. He actually had to argue that this escrow was only a extension of his discretion and authority which being compellable subject to any power over him was not at all incompatible with any contract or agreement that he was to abide. I humbly submit therefore, that the argument does strongly and positively support sale of one time payment lifetime account for email. If you still offered the chance of applying for white label reseller business, I would know what I am going to do for my remaining career. As it happens, I am going to soon decide on whether to commit the funds to a long trial of a email service in my own architectural design for the similar user demands. But I know you along with all HN would laugh at the description of my intended initial trial. It is a enterprise salesman's dream. Knowing that game I'm not the Immediate victim, but I know the minute I announce anything, my lost email archive long held in the utmost care of your company, shall be instantly forwarded to my disgrace: I used to weekly remind everyone I spoke to the first and only outage of Fastmail was not email infrastructure but a RAID6 rebuild delay, without any eventual loss. For a decade I strived to convert my every correspondent upon the frequent and regular outages that are now more forgotten than the future warning they might be if ever there is less money in the competition's email divisions. (I can't forget that rebuild, the same week I was happily on the phone with a Dell technician, just to cover my rear while replacing a drive in a workstation array. The information we neither possessed was the particular PERC model installed on my own main box, wasn't LSI but Adaptec. This array held at close hand every document that had any relation to my customers, along with the manual index and notes of two decades of research. I have not checked this one with Snopes but I became like Boeing and it's stricken 747, that they allegedly rebuilt rather than lose their perfect flight service record. The incremental backup from the same early morning wasn't my idea of continuity. SUN were just shipping the first real production ZFS filers, but where would my original NTFS metadata go? Or the FS streams my own indexer wrote keys to? Or the access log. Fastmail would transform my interactions with customers, if they adopted your email service. It kept me in business many years. I would love to be just even a tiny bit of encouragement for any future approach to the market I know that desperately needs to hear the very particular and not always happy context selling points you have accumulated over any competition.
- jonathanstrange 9y agoYou shouldn't touch it for more serious reasons. I can confirm with absolute certainty that Gmail occasionally silently drops mail you send. This does not seem to be directly related to Google's anti-spam system, neither sender nor recipient are marked as spam originators in those cases, and the mail will not bounce back. It simply disappears.
- everybodyknows 9y agoThe FastMail signup page hits both "google.com" and "google-analytics.com". Not quite what someone looking to escape the Google embrace would hope for... Bron?