6 ms·

The most important change you can make for your email is to own your own domain. Once you own your own domain, changing providers is much easier since it is tra

The most important change you can make for your email is to own your own domain. Once you own your own domain, changing providers is much easier since it is transparent to the people that email you. Even if you decide to keep Gmail, you should switch your email to your own domain.

cpascal 7y ago
One worry about tying your identity to your own domain, is the security of your identity (aka your domain) hinges on the security of your registrar. If a bad actor can socially engineer their way into controlling your domain, your entire identity is compromised. Here's a blog post about this nightmare happening to someone: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...
- ashtonkem 7y ago
  I agree that that would be catastrophic, but I’m not convinced that using custom DNS changes my risk factor. If someone took over <my name>@gmail.com, they could do as much damage as they could by taking over <my name>@<my domain>.
  - Roujo 7y ago
    Yes, but there's still an increase in the attack surface - it's a lot harder to convince a registrar to turn over gmail.com than <my domain>, for most values of <my domain>. It's not a deal breaker, of course, but it's something to consider when looking at the risk factor.
  - cpascal 7y ago
    If you use an email provider to host your domain's email (e.g. Fastmail, GSuite, etc.), I believe you're actually increasing your risk factor. The security of your identity will depend on your registrar, your DNS provider, and your email provider.
- toohotatopic 7y ago
  So, which ones are the good registrars?
  - nucleardog 7y ago
    I generally trust the major cloud providers a bit more than the companies focused on acting as a domain registrar. The domain registrars are generally a race to the bottom and focused on "add-on" sales as most people are shopping on price and that's going to reflect in the overall quality of the things that most people don't really notice like, y'know, security and validation. You don't hear a lot of stories about Amazon/GCP/Azure handing over someone's entire account based on a couple digits of a credit card number and it would be a PR nightmare if they did (hell, look at the flak they catch just for the data that people leave public on their services that ends up released... imagine if they handed it to someone). An active account with 2FA/etc enabled and a secure recovery email is probably safe enough for most people. Spend the extra couple bucks to register through one of those guys instead of JimbosDiscountDomains.
    - mythrwy 7y ago
      So use Google or Microsoft to register your domain? Doesn't that bring us back to the same potential problem though?
      - justinholt 7y ago
        I think the idea is to use their "enterprise", paid offerings as opposed to relying on the "free" services that Google or Microsoft offer.
      - nogabebop23 7y ago
        Google, Microsoft and AWS offer registrar services becuase it keeps you in their ecosystem for their higher margin products. THey generally offer competitive pricing for things like doamin registration and don't pull stunts like charging 2x as much for "privacy protection" or the even more dirty tricks like godaddy and other bottom feeders. I recently trialed hosted email with AWS and while it is very basic it only costs 4/user/month - cheaper than my google apps service. I was also able to register a new domain at market rates and get dns automatically setup (I think?) on AWS as part of the service. Now because I tie my monthly AWS spend with my registrar I'm more confident I can get some customer service as well. staying inside a vendor's ecosystem for very selective services can actually work out quite well, as long as the seller/customer incentives align and they are relatively commodity services.
- propogandist 7y ago
  owning your domain and having control of a domain through a trusted registrar is better than relying on the worlds largest advertising company to manage your digital identity (email), which is offered as a free service, that's subject to a catch-all ToS.
  - gowld 7y ago
    The article is literally about a user who was attacked because Twitter, Facebook ad GoDaddy have bad security, while his Google account was safe.
    - propogandist 7y ago
      An isolated fail in 2014 by one vendor, primarily due to poor support processes, is not a convincing argument to keep all digital identities in Google's possession. There's also the risk of Google shutting down your account because you do something they don't like. This will lead to a similiar outcome and you won't have any recourse.
    - andrepd 7y ago
      I think that GP's point is that "safe" is a tricky word to use when your data is in the custody of the world's largest non-governmental surveillance network with a a catch-all TOS.
    - StavrosK 7y ago
      Google Domains exists.
tracker1 7y ago
I know some will reject the idea.. but if Google is your domain registrar, they'll do email forwarding without an extra charge. I've started using @mydomain where the is the website/service I've registered for... doesn't help with my existing stack though.
- gumby 7y ago
  You can just do forwarding. I’ve run my own mail service since the 80s, and when I need a google login to work with someone I just create it and forward my mail. When the project is over, just delete it. Easy-peasy. Unless a client wants to use google docs I‘ve never found an account to add any value anyway. I don’t use google search much any more but when I do it works fine without cookies. And I try chrome occasionally (it’s needed to use google docs) but it uses too many resources to use as any kind of default. It’s also harder to enforce privacy with it.
  - tracker1 7y ago
    I was referring to google hosting the mail service, so no need to diy or pay for another server, and you don't need to use gmail with it.
    - gumby 7y ago
      Oh, ok. In my case some of my servers are over 20 years old, though I run less critical services on them. My newest machines is about 4 months old. My buddy in the rack next to me is a few servers from the same batch as my 20 year old ones. Obviously the most critical stuff runs on the newest hardware but when you’ve had a machine running uninterrupted for a decade or so why mess with it? Annualized cap ex + the op ex is negligible at this point. As personal servers of course “critical“ is pretty idiosyncratic, though I have used them to start and host various companies overnthe years until it was worth giving them their “own” hardware and identity. I admit the age of managing a rack full of servers in a colo has largely passed.
  - ThePowerOfFuet 7y ago
    Google Docs works fine in Firefox and Safari.
jrochkind1 7y ago
> Even if you decide to keep Gmail, you should switch your email to your own domain. Do you pay for Google Domains, or just have some other thing forwarding to gmail, and gmail configured to send with that as a 'from' address, which I think is possible? What's your advice?

cpascal 7y ago

One worry about tying your identity to your own domain, is the security of your identity (aka your domain) hinges on the security of your registrar. If a bad actor can socially engineer their way into controlling your domain, your entire identity is compromised. Here's a blog post about this nightmare happening to someone: https://medium.com/@N/how-i-lost-my-50-000-twitter-username-24eb09e026dd https://medium.com/@N/how-i-lost-my-50-000-twitter-username-...

ashtonkem 7y ago
I agree that that would be catastrophic, but I’m not convinced that using custom DNS changes my risk factor. If someone took over <my name>@gmail.com, they could do as much damage as they could by taking over <my name>@<my domain>.
- Roujo 7y ago
  Yes, but there's still an increase in the attack surface - it's a lot harder to convince a registrar to turn over gmail.com than <my domain>, for most values of <my domain>. It's not a deal breaker, of course, but it's something to consider when looking at the risk factor.
- cpascal 7y ago
  If you use an email provider to host your domain's email (e.g. Fastmail, GSuite, etc.), I believe you're actually increasing your risk factor. The security of your identity will depend on your registrar, your DNS provider, and your email provider.
toohotatopic 7y ago
So, which ones are the good registrars?
- nucleardog 7y ago
  I generally trust the major cloud providers a bit more than the companies focused on acting as a domain registrar. The domain registrars are generally a race to the bottom and focused on "add-on" sales as most people are shopping on price and that's going to reflect in the overall quality of the things that most people don't really notice like, y'know, security and validation. You don't hear a lot of stories about Amazon/GCP/Azure handing over someone's entire account based on a couple digits of a credit card number and it would be a PR nightmare if they did (hell, look at the flak they catch just for the data that people leave public on their services that ends up released... imagine if they handed it to someone). An active account with 2FA/etc enabled and a secure recovery email is probably safe enough for most people. Spend the extra couple bucks to register through one of those guys instead of JimbosDiscountDomains.
  - mythrwy 7y ago
    So use Google or Microsoft to register your domain? Doesn't that bring us back to the same potential problem though?
    - justinholt 7y ago
      I think the idea is to use their "enterprise", paid offerings as opposed to relying on the "free" services that Google or Microsoft offer.
    - nogabebop23 7y ago
      Google, Microsoft and AWS offer registrar services becuase it keeps you in their ecosystem for their higher margin products. THey generally offer competitive pricing for things like doamin registration and don't pull stunts like charging 2x as much for "privacy protection" or the even more dirty tricks like godaddy and other bottom feeders. I recently trialed hosted email with AWS and while it is very basic it only costs 4/user/month - cheaper than my google apps service. I was also able to register a new domain at market rates and get dns automatically setup (I think?) on AWS as part of the service. Now because I tie my monthly AWS spend with my registrar I'm more confident I can get some customer service as well. staying inside a vendor's ecosystem for very selective services can actually work out quite well, as long as the seller/customer incentives align and they are relatively commodity services.
propogandist 7y ago
owning your domain and having control of a domain through a trusted registrar is better than relying on the worlds largest advertising company to manage your digital identity (email), which is offered as a free service, that's subject to a catch-all ToS.
- gowld 7y ago
  The article is literally about a user who was attacked because Twitter, Facebook ad GoDaddy have bad security, while his Google account was safe.
  - propogandist 7y ago
    An isolated fail in 2014 by one vendor, primarily due to poor support processes, is not a convincing argument to keep all digital identities in Google's possession. There's also the risk of Google shutting down your account because you do something they don't like. This will lead to a similiar outcome and you won't have any recourse.
  - andrepd 7y ago
    I think that GP's point is that "safe" is a tricky word to use when your data is in the custody of the world's largest non-governmental surveillance network with a a catch-all TOS.
  - StavrosK 7y ago
    Google Domains exists.

tracker1 7y ago

I know some will reject the idea.. but if Google is your domain registrar, they'll do email forwarding without an extra charge. I've started using @mydomain where the is the website/service I've registered for... doesn't help with my existing stack though.

gumby 7y ago
You can just do forwarding. I’ve run my own mail service since the 80s, and when I need a google login to work with someone I just create it and forward my mail. When the project is over, just delete it. Easy-peasy. Unless a client wants to use google docs I‘ve never found an account to add any value anyway. I don’t use google search much any more but when I do it works fine without cookies. And I try chrome occasionally (it’s needed to use google docs) but it uses too many resources to use as any kind of default. It’s also harder to enforce privacy with it.
- tracker1 7y ago
  I was referring to google hosting the mail service, so no need to diy or pay for another server, and you don't need to use gmail with it.
  - gumby 7y ago
    Oh, ok. In my case some of my servers are over 20 years old, though I run less critical services on them. My newest machines is about 4 months old. My buddy in the rack next to me is a few servers from the same batch as my 20 year old ones. Obviously the most critical stuff runs on the newest hardware but when you’ve had a machine running uninterrupted for a decade or so why mess with it? Annualized cap ex + the op ex is negligible at this point. As personal servers of course “critical“ is pretty idiosyncratic, though I have used them to start and host various companies overnthe years until it was worth giving them their “own” hardware and identity. I admit the age of managing a rack full of servers in a colo has largely passed.
- ThePowerOfFuet 7y ago
  Google Docs works fine in Firefox and Safari.

jrochkind1 7y ago

> Even if you decide to keep Gmail, you should switch your email to your own domain. Do you pay for Google Domains, or just have some other thing forwarding to gmail, and gmail configured to send with that as a 'from' address, which I think is possible? What's your advice?