5 ms·

You should read the top comment here before you move to fastmail, and fastmail's response. https://news.ycombinator.com/item?id=15855081 https://news.ycombinat

by x0x0 9y ago

You should read the top comment here before you move to fastmail, and fastmail's response. https://news.ycombinator.com/item?id=15855081 https://news.ycombinator.com/item?id=15855081 I'm a founder of a company, and I use fastmail for my personal email and gmail for my professional email. I like fastmail more, but I need the security of gmail + yubikey because that professional email can manage DNS/domains/bank accounts. You should also be aware that fastmail doesn't really integrate that well on Android phones. Eg in order to access calendars hosted on fastmail, you will have to use a third party caldav program. I currently used caldav-sync, which fastmail recommends. It's a piece of shit that stops working approximately every other week on a stock HTC 10. The symptom is my calendar stops syncing. I have to notice this, go to the accounts option, and manually trigger a long term sync. This is very very very annoying and I'm going to find a new program as soon as I have the time. Note this isn't fastmail's fault, but it does significantly inhibit use of their service. The email composition box on mobile firefox on fastmail is a little funky too, but that's on me. I wouldn't be surprised if I'm essentially the only person using mobile firefox/android/fastmail's web client. This was pretty much the outcome of my effort to de-google myself. That said, I'm really happy with fastmail and I think I'm prepaid for another two years.

JohnTHaller 9y ago
I won't be managing calendars. Sadly, your choices for that seem to be either Gmail (which I'll continue using for my calendar) or Outlook (and the Outlook calendar). I'd pay good money for a working third party calendar/contacts solution that worked well on my phone, tablet, and Windows. Google doesn't fit the bill there, either, unless you like web-only. As for securing Gmail with yubikey... how do you gain access via a standard email client like Thunderbird in that case? Anything that can't do that is a non-starter for me.
- efreak 9y ago
  Do Gmail's app passwords not work with yubikey? I know that with totp 2fa enabled, I can generate passwords that bypass the 2fa codes. There also might be some way of using a 2fa code in the password field as well (PayPal used to do this, you just appended your 2fa code to your password). Nextcloud or owncloud have calendars/contacts sync iirc, but I'm not sure how well it works.
  - JohnTHaller 9y ago
    I meant I won't manage calendars with my own domains. I'll be using a personal Gmail account to manage my calendars and contacts. But no critical emails will pass through Gmail and no financial or similar accounts will be tied to it.
brongondwana 9y ago
yeah, that one is hard to live down. It's happened (as far as we can tell) twice in the entire history of the company, amongst hundreds of "I've lost my password" requests per week. Lost password was seriously in the top three most common support requests every week right up until we built the automatic recovery system: https://blog.fastmail.com/2016/07/21/multiple-ways-in-keeping-password-reset-secure/ https://blog.fastmail.com/2016/07/21/multiple-ways-in-keepin... and we responded fairly directly to that Hacker News thread the next day with this: https://blog.fastmail.com/2017/12/06/security-account-recovery/ https://blog.fastmail.com/2017/12/06/security-account-recove... Obviously it's hugely embarassing to the company that it happened at all, and awful for the victim. I think it's perfectly reasonable for you to bring it up, and it is a consideration for anybody choosing us to do their research and decide if the steps we've taken to mitigate it happening again are sufficient.
- chrisper 9y ago
  Hello, I'd recommend you to change your recommendation to DavDroid. It's free and seems to be much better than the one you are recommending.
  - JohnTHaller 9y ago
    Clarification: It's free to side load, but not to install from the Google Play Store.
    - chrisper 9y ago
      Huh, you are right. I was remembering wrong! Thanks for correcting. Now I remember why I installed F-Droid.
youseecomrade 9y ago
I pay fastmail for a side business account but I've been thinking about buying a Google Domains "account" for personal use just so I can use a custom domain for free on Gmail. Identity theft is the sole reason I don't trust anyone else and Google owns my soul for that. In a matter of hours, just like your link shows, a hacker could reset the password for everything I have. With the data he acquired it could also be possible to circumvent TFA. Unfortunately even with me owning everything after the "@" I'm still locked to Google (I don't mind losing data) and they could freeze my domain if I do something wrong on Gmail. Could as in theoretically. Am I being over paranoid? Did this ever happened to anyone? Will I at least be able to reach a human on Google domains? Because I sure as hell won't be able to using a free Gmail account.
mfer 9y ago
Why not use 2FA with Fastmail? https://www.fastmail.com/help/account/2fa.html https://www.fastmail.com/help/account/2fa.html
- LaGrange 9y ago
  _And_ they support Yubikey apparently.
  - danieldk 9y ago
    And U2F keys (including Yubikey U2F), which I have used since they introduced it.
chrisper 9y ago
I'd recommend you to change to DavDroid. It's free and also on F-Droid.
bad_user 9y ago
> Eg in order to access calendars hosted on fastmail, you will have to use a third party caldav program If using an app bothers you, stop using Android, because CalDAV is the standard for synchronizing calendars. iOS supports CalDAV natively. That Android doesn't support it natively is yet another example of Google infecting the market with proprietary stuff.
- lern_too_spel 9y ago
  You can expect the iOS implementation to be buggy and not fixable without an OS update. Meanwhile, there are multiple open source CalDav implementations for Android that update automatically. The most probable reason it isn't installed by default is that CalDav is a failed standard, which most people don't use and don't want wasting space on their devices. ActiveSync and Google Calendar won, which is why even iOS paid the Microsoft tax to support ActiveSync long before it supported CalDav.
  - bad_user 9y ago
    I used CalDAV on both iOS and MacOS for the last 2 years and worked just fine. Never had any problems. Feel free to correct me if I'm wrong. It's true that back in 2015 FastMail was not doing invitations and RSVPs through CalDAV, but they fixed that since then. > most probable reason it isn't installed by default is that CalDav is a failed standard That is extreme bullshit, the same kind of bullshit that Google used to kill Google Talk and its XMPP interop, while pushing for their shitty and completely proprietary Hangouts. People used Google Talk back in the day due to its simplicity and interoperability. Who is using Hangouts now? I actually hope it dies, because we can then put such bullshit arguments to rest. CalDAV can only become a failed standard because unpaid fanboys and shills keep normalizing this behavior. But until then I'll keep using CalDAV and I'll be happy about not participating in this charade ;-)
    - brongondwana 9y ago
      CalDAV has some issues - we're working on making it easier to work with at https://devguide.calconnect.org/ https://devguide.calconnect.org/ (when I say "we" - I haven't actually attended a CalConnect for a year, due to spending half my life traveling as it is - but FastMail has sent someone to every event for the past few years, and Ken has been going for ages before that) And JMAP calendar support will be really nice: http://jmap.io/spec-calendars.html http://jmap.io/spec-calendars.html With the JSON format on the standards track now: https://tools.ietf.org/html/draft-ietf-calext-jscalendar-00 https://tools.ietf.org/html/draft-ietf-calext-jscalendar-00
unhammer 9y ago
I've also noticed the thing on mobile Firefox. It's not unusable, but there is something weird going on.

by x0x0 9y ago

JohnTHaller 9y ago

I won't be managing calendars. Sadly, your choices for that seem to be either Gmail (which I'll continue using for my calendar) or Outlook (and the Outlook calendar). I'd pay good money for a working third party calendar/contacts solution that worked well on my phone, tablet, and Windows. Google doesn't fit the bill there, either, unless you like web-only. As for securing Gmail with yubikey... how do you gain access via a standard email client like Thunderbird in that case? Anything that can't do that is a non-starter for me.

efreak 9y ago
Do Gmail's app passwords not work with yubikey? I know that with totp 2fa enabled, I can generate passwords that bypass the 2fa codes. There also might be some way of using a 2fa code in the password field as well (PayPal used to do this, you just appended your 2fa code to your password). Nextcloud or owncloud have calendars/contacts sync iirc, but I'm not sure how well it works.
- JohnTHaller 9y ago
  I meant I won't manage calendars with my own domains. I'll be using a personal Gmail account to manage my calendars and contacts. But no critical emails will pass through Gmail and no financial or similar accounts will be tied to it.

brongondwana 9y ago

yeah, that one is hard to live down. It's happened (as far as we can tell) twice in the entire history of the company, amongst hundreds of "I've lost my password" requests per week. Lost password was seriously in the top three most common support requests every week right up until we built the automatic recovery system: https://blog.fastmail.com/2016/07/21/multiple-ways-in-keeping-password-reset-secure/ https://blog.fastmail.com/2016/07/21/multiple-ways-in-keepin... and we responded fairly directly to that Hacker News thread the next day with this: https://blog.fastmail.com/2017/12/06/security-account-recovery/ https://blog.fastmail.com/2017/12/06/security-account-recove... Obviously it's hugely embarassing to the company that it happened at all, and awful for the victim. I think it's perfectly reasonable for you to bring it up, and it is a consideration for anybody choosing us to do their research and decide if the steps we've taken to mitigate it happening again are sufficient.

chrisper 9y ago
Hello, I'd recommend you to change your recommendation to DavDroid. It's free and seems to be much better than the one you are recommending.
- JohnTHaller 9y ago
  Clarification: It's free to side load, but not to install from the Google Play Store.
  - chrisper 9y ago
    Huh, you are right. I was remembering wrong! Thanks for correcting. Now I remember why I installed F-Droid.

youseecomrade 9y ago

I pay fastmail for a side business account but I've been thinking about buying a Google Domains "account" for personal use just so I can use a custom domain for free on Gmail. Identity theft is the sole reason I don't trust anyone else and Google owns my soul for that. In a matter of hours, just like your link shows, a hacker could reset the password for everything I have. With the data he acquired it could also be possible to circumvent TFA. Unfortunately even with me owning everything after the "@" I'm still locked to Google (I don't mind losing data) and they could freeze my domain if I do something wrong on Gmail. Could as in theoretically. Am I being over paranoid? Did this ever happened to anyone? Will I at least be able to reach a human on Google domains? Because I sure as hell won't be able to using a free Gmail account.

mfer 9y ago

Why not use 2FA with Fastmail? https://www.fastmail.com/help/account/2fa.html https://www.fastmail.com/help/account/2fa.html

LaGrange 9y ago
_And_ they support Yubikey apparently.
- danieldk 9y ago
  And U2F keys (including Yubikey U2F), which I have used since they introduced it.

chrisper 9y ago

I'd recommend you to change to DavDroid. It's free and also on F-Droid.

bad_user 9y ago

> Eg in order to access calendars hosted on fastmail, you will have to use a third party caldav program If using an app bothers you, stop using Android, because CalDAV is the standard for synchronizing calendars. iOS supports CalDAV natively. That Android doesn't support it natively is yet another example of Google infecting the market with proprietary stuff.

lern_too_spel 9y ago
You can expect the iOS implementation to be buggy and not fixable without an OS update. Meanwhile, there are multiple open source CalDav implementations for Android that update automatically. The most probable reason it isn't installed by default is that CalDav is a failed standard, which most people don't use and don't want wasting space on their devices. ActiveSync and Google Calendar won, which is why even iOS paid the Microsoft tax to support ActiveSync long before it supported CalDav.
- bad_user 9y ago
  I used CalDAV on both iOS and MacOS for the last 2 years and worked just fine. Never had any problems. Feel free to correct me if I'm wrong. It's true that back in 2015 FastMail was not doing invitations and RSVPs through CalDAV, but they fixed that since then. > most probable reason it isn't installed by default is that CalDav is a failed standard That is extreme bullshit, the same kind of bullshit that Google used to kill Google Talk and its XMPP interop, while pushing for their shitty and completely proprietary Hangouts. People used Google Talk back in the day due to its simplicity and interoperability. Who is using Hangouts now? I actually hope it dies, because we can then put such bullshit arguments to rest. CalDAV can only become a failed standard because unpaid fanboys and shills keep normalizing this behavior. But until then I'll keep using CalDAV and I'll be happy about not participating in this charade ;-)
  - brongondwana 9y ago
    CalDAV has some issues - we're working on making it easier to work with at https://devguide.calconnect.org/ https://devguide.calconnect.org/ (when I say "we" - I haven't actually attended a CalConnect for a year, due to spending half my life traveling as it is - but FastMail has sent someone to every event for the past few years, and Ken has been going for ages before that) And JMAP calendar support will be really nice: http://jmap.io/spec-calendars.html http://jmap.io/spec-calendars.html With the JSON format on the standards track now: https://tools.ietf.org/html/draft-ietf-calext-jscalendar-00 https://tools.ietf.org/html/draft-ietf-calext-jscalendar-00

unhammer 9y ago

I've also noticed the thing on mobile Firefox. It's not unusable, but there is something weird going on.