5 ms·

Good point, but if Google suspends my account I've got bigger things to worry about than the dozens of sites I've used once or twice a year. Paying for your ow

Good point, but if Google suspends my account I've got bigger things to worry about than the dozens of sites I've used once or twice a year. Paying for your own domain also comes with its own troubles. If you're not using Google (or some other service) as your mail forwarder, good luck being able to email anyone. Stealing you custom domain is also a real possibility, and negates your investment in Gmail 2FA.

jhasse 6y ago
How could my domain be stolen? :O
- undebuggable 6y ago
  - does you registrar have physical office? is it in a country with legislation friendly towards the country you're based in? - does your registrar send Auth-Info code over email in plain text? - did you enter real contact and residence data when registering the domain including public WHOIS database? This is only a fraction of the attack vector.
  - jhasse 6y ago
    > does you registrar have physical office? Yes. > is it in a country with legislation friendly towards the country you're based in? It's in the same country. > does your registrar send Auth-Info code over email in plain text? Of course not, that would be a big red-flag. > did you enter real contact and residence data when registering the domain including public WHOIS database? I have no idea what a public WHOIS database is, never registered anything there. For the registrar I've entered my real contact and residence data, should I've not?
    - undebuggable 6y ago
      I mean the contact details specified at the registrar and returned over the WHOIS protocol. Depending on the nature of a conflict the entity returned by the WHOIS requests might be considered the owner of the domain. Unfortunate phrasing on my side:) Actually there exist scammers reaching out to well known mailbox names and requesting a fee for an entry in "WHOIS database".
    - angry_octet 6y ago
      Your real world mailing address is published in WHOIS ("who is") by default, often you have to pay the registrar extra to keep it private, which is admittedly a total scam. You could use a fake one, but then it eliminates a way to verify you own the domain. The WHOIS client is in most distros, try it out.
      - jhasse 6y ago
        Thanks :) I've tried it out and it only showed my registrars contact details.
- mattmanser 6y ago
  Social engineering attack on your domain registrar, court order, choosing a domain controlled by a dodgy registar. There's actually quite a few ways.
  - jhasse 6y ago
    > court order I don't think that's a "real possibility". It isn't impossible, yes, but very unlikely.
- sp332 6y ago
  Phishing or bribing an employee at a domain registrar. Phishing you to get your password and then bribing or social-engineering someone at the phone company to forward your SMS-based 2FA codes to them. Waiting for you to forget to renew your domain and then registering it.
  - jhasse 6y ago
    > Phishing or bribing an employee at a domain registrar. Okay? I don't think anyone would go to that trouble. > Phishing you to get your password and then bribing or social-engineering someone at the phone company to forward your SMS-based 2FA codes to them. Seems unlikely, I never log into my registrar's website. I do often have to enter my Google password though! > Waiting for you to forget to renew your domain and then registering it. It's auto-renewing.
    - angry_octet 6y ago
      It often surprises people what effort someone will go to to steal their identity. Consider that you have a github account. You might be in the supply chain for a bit of code someone needs to read or backdoor to attack a company that you've never heard of. Github is a harder target though. The scary ones are the real estate funds redirectors. They just need to be in your inbox for a little bit and boom, hundreds of thousands of $ gone because people don't take the time to re-verify bank account details by in person.
- bhartzer 6y ago
  So many different ways domains are stolen. Or you lose your domain: UDRP, social engineering at the registrar, hack into the account at registrar, the email you use on whois record isn’t valid anymore, you have auto renew turned off and it doesn’t renew.
- robjan 6y ago
  If anything happens to you which prevents you from renewing your domain, e.g. you are detained or in a coma, then it's probably gone as well unless you have a lot of credit on your registrar account.
  - amadeuspagel 6y ago
    Most domain registrars support autorenew with a credit card.
    - robjan 6y ago
      Most credit cards have an expiry date
  - jhasse 6y ago
    It's auto-renewing.
yosamino 6y ago
Running a mailserver is something that doesn't just work out of the box, but it's not true that it's impossible to run a relatively reliable email service. Takes a bit of work, for sure. But it's the best and biggest federated network we have at the moment. Your custom domain can be secured by 2FA as well, if one is using a reputable registrar, and you can legally own it. So even if it's stolen, there is recourse. I really don't enjoy this giving up on online sovereignty, just because of the convenience and some quasi-monopolists. And I say that as someone who has very few accounts at any online-services (if avoidable, I'm not a fundamentalist, after all I am posting here right now) and runs mailserver (and cloudstorage and more). So I'm aware it's not all rainbows and unicorns, and I appreciate this is something that takes the skills and time that not everyone is willing to invest. Nor should they. But one's own "domain" (in the DNS and also the territorial sense) is something that enables some freedom in a world where power is increasingly being concentrated und surveillance is becoming so ubuquitous.
- angry_octet 6y ago
  > it's not true that it's impossible to run a relatively reliable email service Good thing I didn't say that then. Running your own email service isn't hard, even with setting up DKIM and anti-spam and so on, though it is time consuming. It is much harder to make sure people will receive your mail and it not be in their junk mail. I'm still seeing lots of email to mailing lists, with impeccable message content, ending up in spam based on mail server reputation or content similarity metrics. If you're running an organisation that can be very costly. If only a fraction of your recipients mark you as spam you'll get lots of misses. Handcrafting your own internet stack is very libertarian, but it doesn't scale to anyone without access to deep tech expertise. Even governments decide they can't run mail any more. And I would argue that this isn't something you can fix about email. The problem is that the next system isn't federated at all -- it's balkanised and monetized: WhatsApp/Messenger, iMessage, Duo, Telegram, etc etc.
eloisant 6y ago
You don't have to run your own server, you can use a services that will (1) have a better privacy policy than Google and (2) supports custom domains as a built-in feature. Like Protonmail for example.

jhasse 6y ago

How could my domain be stolen? :O

undebuggable 6y ago
- does you registrar have physical office? is it in a country with legislation friendly towards the country you're based in? - does your registrar send Auth-Info code over email in plain text? - did you enter real contact and residence data when registering the domain including public WHOIS database? This is only a fraction of the attack vector.
- jhasse 6y ago
  > does you registrar have physical office? Yes. > is it in a country with legislation friendly towards the country you're based in? It's in the same country. > does your registrar send Auth-Info code over email in plain text? Of course not, that would be a big red-flag. > did you enter real contact and residence data when registering the domain including public WHOIS database? I have no idea what a public WHOIS database is, never registered anything there. For the registrar I've entered my real contact and residence data, should I've not?
  - undebuggable 6y ago
    I mean the contact details specified at the registrar and returned over the WHOIS protocol. Depending on the nature of a conflict the entity returned by the WHOIS requests might be considered the owner of the domain. Unfortunate phrasing on my side:) Actually there exist scammers reaching out to well known mailbox names and requesting a fee for an entry in "WHOIS database".
  - angry_octet 6y ago
    Your real world mailing address is published in WHOIS ("who is") by default, often you have to pay the registrar extra to keep it private, which is admittedly a total scam. You could use a fake one, but then it eliminates a way to verify you own the domain. The WHOIS client is in most distros, try it out.
    - jhasse 6y ago
      Thanks :) I've tried it out and it only showed my registrars contact details.
mattmanser 6y ago
Social engineering attack on your domain registrar, court order, choosing a domain controlled by a dodgy registar. There's actually quite a few ways.
- jhasse 6y ago
  > court order I don't think that's a "real possibility". It isn't impossible, yes, but very unlikely.
sp332 6y ago
Phishing or bribing an employee at a domain registrar. Phishing you to get your password and then bribing or social-engineering someone at the phone company to forward your SMS-based 2FA codes to them. Waiting for you to forget to renew your domain and then registering it.
- jhasse 6y ago
  > Phishing or bribing an employee at a domain registrar. Okay? I don't think anyone would go to that trouble. > Phishing you to get your password and then bribing or social-engineering someone at the phone company to forward your SMS-based 2FA codes to them. Seems unlikely, I never log into my registrar's website. I do often have to enter my Google password though! > Waiting for you to forget to renew your domain and then registering it. It's auto-renewing.
  - angry_octet 6y ago
    It often surprises people what effort someone will go to to steal their identity. Consider that you have a github account. You might be in the supply chain for a bit of code someone needs to read or backdoor to attack a company that you've never heard of. Github is a harder target though. The scary ones are the real estate funds redirectors. They just need to be in your inbox for a little bit and boom, hundreds of thousands of $ gone because people don't take the time to re-verify bank account details by in person.
bhartzer 6y ago
So many different ways domains are stolen. Or you lose your domain: UDRP, social engineering at the registrar, hack into the account at registrar, the email you use on whois record isn’t valid anymore, you have auto renew turned off and it doesn’t renew.
robjan 6y ago
If anything happens to you which prevents you from renewing your domain, e.g. you are detained or in a coma, then it's probably gone as well unless you have a lot of credit on your registrar account.
- amadeuspagel 6y ago
  Most domain registrars support autorenew with a credit card.
  - robjan 6y ago
    Most credit cards have an expiry date
- jhasse 6y ago
  It's auto-renewing.

yosamino 6y ago

Running a mailserver is something that doesn't just work out of the box, but it's not true that it's impossible to run a relatively reliable email service. Takes a bit of work, for sure. But it's the best and biggest federated network we have at the moment. Your custom domain can be secured by 2FA as well, if one is using a reputable registrar, and you can legally own it. So even if it's stolen, there is recourse. I really don't enjoy this giving up on online sovereignty, just because of the convenience and some quasi-monopolists. And I say that as someone who has very few accounts at any online-services (if avoidable, I'm not a fundamentalist, after all I am posting here right now) and runs mailserver (and cloudstorage and more). So I'm aware it's not all rainbows and unicorns, and I appreciate this is something that takes the skills and time that not everyone is willing to invest. Nor should they. But one's own "domain" (in the DNS and also the territorial sense) is something that enables some freedom in a world where power is increasingly being concentrated und surveillance is becoming so ubuquitous.

angry_octet 6y ago
> it's not true that it's impossible to run a relatively reliable email service Good thing I didn't say that then. Running your own email service isn't hard, even with setting up DKIM and anti-spam and so on, though it is time consuming. It is much harder to make sure people will receive your mail and it not be in their junk mail. I'm still seeing lots of email to mailing lists, with impeccable message content, ending up in spam based on mail server reputation or content similarity metrics. If you're running an organisation that can be very costly. If only a fraction of your recipients mark you as spam you'll get lots of misses. Handcrafting your own internet stack is very libertarian, but it doesn't scale to anyone without access to deep tech expertise. Even governments decide they can't run mail any more. And I would argue that this isn't something you can fix about email. The problem is that the next system isn't federated at all -- it's balkanised and monetized: WhatsApp/Messenger, iMessage, Duo, Telegram, etc etc.

eloisant 6y ago

You don't have to run your own server, you can use a services that will (1) have a better privacy policy than Google and (2) supports custom domains as a built-in feature. Like Protonmail for example.