6 ms·

I'll repeat my comment from nearly seven months ago [1] since it left a really bad taste about how users are dealt with. Nearly a year ago when the initial wave

I'll repeat my comment from nearly seven months ago [1] since it left a really bad taste about how users are dealt with. Nearly a year ago when the initial waves of the pandemic were raging on, Migadu removed its free tier. That's not a problem by itself because businesses have to make money to sustain and grow. But Migadu gave one month’s notice (contrary to the claims in the replies, that's what I saw) for users to switch. The replies to the comment also said that the new lowest paid tier was "affordable in every corner of the planet", which sounded quite ignorant even for a non-pandemic time. Another point, which may matter to some people, is that while Migadu may be a Swiss company, the data centers where the mails are hosted were in France (this was the case at least a year ago). So the situation is somewhat comparable (not entirely though) to Fastmail being an Australian company with data centers in the U.S. being used. For those who want multi-domain email services for a lower (flat) price, look at mxroute. It's based out of the U.S. though, which may not be an option for people who want certain services outside Five Eyes jurisdictions. [1]: https://news.ycombinator.com/item?id=25382626 https://news.ycombinator.com/item?id=25382626

vgalin 5y ago
> while Migadu may be a Swiss company, the data centers where the mails are hosted were in France > So the situation is somewhat comparable (not entirely though) to Fastmail being an Australian company with data centers in the U.S. being used I don't know if it is a good comparison, as European countries (France included) are subject to GDPR, which does not really have an equivalent in the U.S.
- newscracker 5y ago
  GP here. My points were about surveillance arrangements and information exchange between countries, like the Five Eyes, Nine Eyes, Fourteen Eyes, etc. Also, as far as I know, Migadu does not encrypt data at rest. Anyone who gets access to the servers gets access to all the data.
  - estaseuropano 5y ago
    They have a great FAQ explaining that and I agree with their conclusion - all the encryption claims by other providers are nonsense and don't offer real protection.
robertlagrant 5y ago
> It's based out of the U.S. though, which may not be an option for people who want certain services outside Five Eyes jurisdictions. Are you saying it's based in the US? (Brit here.)
- newscracker 5y ago
  Yes, mxroute is based in the U.S. (the company as well as its data centers).
  - louis-lau 5y ago
    This isn't true. MXroute mostly uses Hetzner in Germany. But there no guarantee to server location.
- nanis 5y ago
  The question is not Brit-specific so to speak. Saying "based off of" to mean "based on" and "based out of" to mean "based in" etc started relatively recently in the U.S. In the NYC area, people also say "waiting on line" instead of "in line" which grates me to this day, but at least I could find that usage special-case in a foot thick Webster dictionary back when I first encountered. I believe the "based off of" and "based out of" were popularized among the hipster brogrammers of early 21st century, but I might be wrong. I am not a native speaker.
  - necovek 5y ago
    > which grates me to this day You might be saddened to learn that languages are a living thing :), and only "owned" by the people speaking it. Dictionaries are always behind by definition, because they encode the words that have caught on sufficiently: there was never a new word created that was first put into a dictionary and people picked it up from there. Basically, don't get stressed too much with language changes, because it does and always will. Or what are we to make of "brogrammers" (even "hipster" is relatively new, not to mention most of the computing jargon).
    - 5y ago
pqb 5y ago
> Another point, which may matter to some people, is that while Migadu may be a Swiss company, the data centers where the mails are hosted were in France (this was the case at least a year ago). So the situation is somewhat comparable (not entirely though) to Fastmail being an Australian company with data centers in the U.S. being used. > For those who want multi-domain email services for a lower (flat) price, look at mxroute. It's based out of the U.S. though, which may not be an option for people who want certain services outside Five Eyes jurisdictions. Weird speaking that, but I would be more of concerned of (an accidental) breach of privacy by some Migadu employee than some <country-name> burreau. Not saying about some typical script kiddie or some hacker-magician getting in possession of logins with passwords as leak. It is likely new on the market and I am tempted to say it has near-zero reputation for anyone looking for a private mail right now. Location do matter, but execution more.
- newscracker 5y ago
  > It is likely new on the market and I am tempted to say it has near-zero reputation for anyone looking for a private mail right now. GP here. Not sure if you meant Migadu in this sentence, but Migadu is not new in the email market. It has been around for several years (don't want to visit the website to look it up). I also don't believe that it has near-zero reputation.
  - aesyondu 5y ago
    About page says 2014.
  - pqb 5y ago
    Maybe "likely new" is a bad word to describe it. Comparing to many email providers I know or used 7 years is a pity. It have matured enough to consider it will stay for longer and it won't disappear soon, what has happened to many competitors on e-mail service market. I said "new", because both Migadu (since 2014) and even ProtonMail (since 2013) brought a lot of fresh air in last decade. I my observation for some reasons Migadu gained more attention among people looking to have an email with own domain name in last few years than in previous. When I also shared a link to Migadu to some friends, they also saying "oh, I hear about it for the first time". That's why I am saying "it is likely new on the market", it still have potential to gather new customers by advertising (on the contrary to ProtonMail, which seems media coverage helped a lot). > I also don't believe that it has near-zero reputation. Well, I guess I was too harsh but it is small company that already had various problems while operating (thankfully only downtime / lack of support) and it is hard to trust that no leak or breach will happen (and this is what makes me more concerned than some bureau). I also said "it has near-zero reputation for anyone looking for a private" - I don't generalize to whole service but only to private/safe message exchange. This service is perfectly fine for people in IT, startups or just personal emails but if I would be a person, who exchanges confidential documents I will stay away from Migadu. Why? They do not encrypt data on their servers [0][1], which is clearly opposite to what ProtonMail does [2]. [0]: https://www.reddit.com/r/privacytoolsIO/comments/ltcjc5/whats_your_review_of_migadu_email/ https://www.reddit.com/r/privacytoolsIO/comments/ltcjc5/what... > 4. They don't encrypt anything other than SMTP, IMAP, HTTPS. You can encrypt your emails manually but they don't encrypt anything on their servers. They claim this is impractical and doesn't truly help with privacy or security. > 5. They don't force you to give them your real name or personal info, but there are no anonymous or cash payments. They only process payments via PayPal or Stripe though they claim to not keep any information about you that way. [1]: https://www.migadu.com/procon/ https://www.migadu.com/procon/ [2]: https://protonmail.com/support/knowledge-base/what-is-encrypted/ https://protonmail.com/support/knowledge-base/what-is-encryp...
xPaw 5y ago
Around the same time last year they also had a storage layer failure, and my catch-all rules disappeared. And about a month before that they changed POP3 address. Both of these changes happened without any email announcement, only visible on their site. So effectively because I didn't login into Migadu dashboard, I was losing emails.
- Normal_gaussian 5y ago
  Yep. This was exactly my experience, resulted in failure to recieve mail (and my email being deassociated from the accounts of my bank and rental agency). I had a back and fore with them on HN some months back and they were trying to whitewash their handling of the storage failure / rules deletion. The savings are not worth the risk.
- estaseuropano 5y ago
  I had this issue too - all rules were deleted as they switched form regex to something else. I have no idea whether I missed anything and they really could have done an anouncement. Otherwise have been quite happy and except for a lack of calendar it all works quite well.
- t-mw 5y ago
  I experienced the same thing, and it took me a couple of weeks to realize I wasn’t receiving emails. Luckily I was only testing it out with emails for non-essential services. I found it difficult to understand why they continued to not make an announcement even after I, and presumably other people, made them aware of the impact the change had.
GrumpyNl 5y ago
Im surprised that there is no response from Migadu here.
spinax 5y ago
> For those who want multi-domain email services for a lower (flat) price, look at mxroute I was very interested and very seriously considering signing up, until I read this: https://mxroute.com/docs/do-you-support-2fa-on-email-accounts/ https://mxroute.com/docs/do-you-support-2fa-on-email-account... While I respect Jarland's opinion/stance, I do not agree.
- hellcow 5y ago
  What do you disagree with specifically? The reasoning in that link is absolutely correct. We can argue that POP, etc. should have 2FA support added to the protocol, but that's not the point the author was making.
  - arp242 5y ago
    Loads of folk use just webmail though, and SMTP/IMAP is usually disabled until they generate an app password. If you do enable SMTP/IMAP: sure, it's correct. But that often doesn't apply, so I don't think it's a "trick" or "sleight of hand".
  - spinax 5y ago
    Use case: I have an unattended cron task polling my IMAP account to archive the mail every 4 hours. I specifically use an IMAP read-only unique ("per-app") password for that script/connection; under no circumstance should that password have access to write to IMAP, touch POP or SMTP. Fastmail allows me to do this with ease, and I can create as many as I'd like with different ACLs. The mxroute reasoning simply does not consider all the use cases people have and want per-app passwords for to increase their personal security posture.
    - Raineer 5y ago
      The ease of creation of app passwords and protocol-level controls really are fantastic in Fastmail. I hope it never goes away.
    - deleted 5y ago
      [deleted]
throwthere 5y ago
Similar issue. Just chiming in to say it wasn't just you and I've since left Migadu forever as well.
tptacek 5y ago
I remain baffled at the folk wisdom of using providers outside the United States in order to avoid the Five Eyes IC. You accomplish the opposite thing by doing that. NSA is literally chartered to hack into things outside of US jurisdiction; they don't even need permission to do it. They might even need permission not to do it. Obviously, hosting in the US isn't a cure-all. And there are other good reasons to work with companies in Europe; for instance, their data privacy rules can often be better than ours, which can give you some commercial protections. But these discussions about where people's email is hosted always talk about jurisdictional issues, and the only jurisdictional issue that matters here is this: if NSA is going to swipe mail from Google Mail, there's a whole fuckload of paperwork they have to do. If they want to get mail from your random email provider in Switzerland, they can just push a button.
- TedDoesntTalk 5y ago
  Excellent point! Illegal domestic spying in the US has mostly gone the way of the dodo bird because of certain whisteblowers.
  - tptacek 5y ago
    I want to be clear that I have zero doubt that illegal domestic spying happens in the US. I chose my words carefully.
    - shadilay 5y ago
      Recently there has been increasing government interest in "domestic terrorism" which is basically the public facing component of an increase in funding for three letter agencies.
  - colordrops 5y ago
    You are being sarcastic I assume.
- davidwritesbugs 5y ago
  If you are trying to avoid spook you're fucked anywhere you are: US EU whatever. Yes, if the NSA want your US email they probably won't press that button, but they'll ask GCHQ to press a UK button insetad and get it that way. Also, if the FBI wants your email they will just send a guy in a black MiB suit & 9/10 times the email company will roll over. If they meet resistance FBI just go to a tame US judge (they have loads) who rubber stamps the writ. If your server is in .CH they need lots of paperwork and a good arguable case. So yes it is worth hosting outside US. Ask Microsoft about why they do EU data hosting in Ireland.
deleted 5y ago
[deleted]
jarland 5y ago
I appreciate your recommendation. I'm no friend to intelligence agencies, but I don't want to necessarily put myself out there as a competitor to something like the old Lavabit. I'm not looking to be a victim of the US government any more than I want to see my customers victimized by them.

vgalin 5y ago

> while Migadu may be a Swiss company, the data centers where the mails are hosted were in France > So the situation is somewhat comparable (not entirely though) to Fastmail being an Australian company with data centers in the U.S. being used I don't know if it is a good comparison, as European countries (France included) are subject to GDPR, which does not really have an equivalent in the U.S.

newscracker 5y ago
GP here. My points were about surveillance arrangements and information exchange between countries, like the Five Eyes, Nine Eyes, Fourteen Eyes, etc. Also, as far as I know, Migadu does not encrypt data at rest. Anyone who gets access to the servers gets access to all the data.
- estaseuropano 5y ago
  They have a great FAQ explaining that and I agree with their conclusion - all the encryption claims by other providers are nonsense and don't offer real protection.

robertlagrant 5y ago

> It's based out of the U.S. though, which may not be an option for people who want certain services outside Five Eyes jurisdictions. Are you saying it's based in the US? (Brit here.)

newscracker 5y ago
Yes, mxroute is based in the U.S. (the company as well as its data centers).
- louis-lau 5y ago
  This isn't true. MXroute mostly uses Hetzner in Germany. But there no guarantee to server location.
nanis 5y ago
The question is not Brit-specific so to speak. Saying "based off of" to mean "based on" and "based out of" to mean "based in" etc started relatively recently in the U.S. In the NYC area, people also say "waiting on line" instead of "in line" which grates me to this day, but at least I could find that usage special-case in a foot thick Webster dictionary back when I first encountered. I believe the "based off of" and "based out of" were popularized among the hipster brogrammers of early 21st century, but I might be wrong. I am not a native speaker.
- necovek 5y ago
  > which grates me to this day You might be saddened to learn that languages are a living thing :), and only "owned" by the people speaking it. Dictionaries are always behind by definition, because they encode the words that have caught on sufficiently: there was never a new word created that was first put into a dictionary and people picked it up from there. Basically, don't get stressed too much with language changes, because it does and always will. Or what are we to make of "brogrammers" (even "hipster" is relatively new, not to mention most of the computing jargon).
  - 5y ago

pqb 5y ago

> Another point, which may matter to some people, is that while Migadu may be a Swiss company, the data centers where the mails are hosted were in France (this was the case at least a year ago). So the situation is somewhat comparable (not entirely though) to Fastmail being an Australian company with data centers in the U.S. being used. > For those who want multi-domain email services for a lower (flat) price, look at mxroute. It's based out of the U.S. though, which may not be an option for people who want certain services outside Five Eyes jurisdictions. Weird speaking that, but I would be more of concerned of (an accidental) breach of privacy by some Migadu employee than some <country-name> burreau. Not saying about some typical script kiddie or some hacker-magician getting in possession of logins with passwords as leak. It is likely new on the market and I am tempted to say it has near-zero reputation for anyone looking for a private mail right now. Location do matter, but execution more.

newscracker 5y ago
> It is likely new on the market and I am tempted to say it has near-zero reputation for anyone looking for a private mail right now. GP here. Not sure if you meant Migadu in this sentence, but Migadu is not new in the email market. It has been around for several years (don't want to visit the website to look it up). I also don't believe that it has near-zero reputation.
- aesyondu 5y ago
  About page says 2014.
- pqb 5y ago
  Maybe "likely new" is a bad word to describe it. Comparing to many email providers I know or used 7 years is a pity. It have matured enough to consider it will stay for longer and it won't disappear soon, what has happened to many competitors on e-mail service market. I said "new", because both Migadu (since 2014) and even ProtonMail (since 2013) brought a lot of fresh air in last decade. I my observation for some reasons Migadu gained more attention among people looking to have an email with own domain name in last few years than in previous. When I also shared a link to Migadu to some friends, they also saying "oh, I hear about it for the first time". That's why I am saying "it is likely new on the market", it still have potential to gather new customers by advertising (on the contrary to ProtonMail, which seems media coverage helped a lot). > I also don't believe that it has near-zero reputation. Well, I guess I was too harsh but it is small company that already had various problems while operating (thankfully only downtime / lack of support) and it is hard to trust that no leak or breach will happen (and this is what makes me more concerned than some bureau). I also said "it has near-zero reputation for anyone looking for a private" - I don't generalize to whole service but only to private/safe message exchange. This service is perfectly fine for people in IT, startups or just personal emails but if I would be a person, who exchanges confidential documents I will stay away from Migadu. Why? They do not encrypt data on their servers [0][1], which is clearly opposite to what ProtonMail does [2]. [0]: https://www.reddit.com/r/privacytoolsIO/comments/ltcjc5/whats_your_review_of_migadu_email/ https://www.reddit.com/r/privacytoolsIO/comments/ltcjc5/what... > 4. They don't encrypt anything other than SMTP, IMAP, HTTPS. You can encrypt your emails manually but they don't encrypt anything on their servers. They claim this is impractical and doesn't truly help with privacy or security. > 5. They don't force you to give them your real name or personal info, but there are no anonymous or cash payments. They only process payments via PayPal or Stripe though they claim to not keep any information about you that way. [1]: https://www.migadu.com/procon/ https://www.migadu.com/procon/ [2]: https://protonmail.com/support/knowledge-base/what-is-encrypted/ https://protonmail.com/support/knowledge-base/what-is-encryp...

xPaw 5y ago

Around the same time last year they also had a storage layer failure, and my catch-all rules disappeared. And about a month before that they changed POP3 address. Both of these changes happened without any email announcement, only visible on their site. So effectively because I didn't login into Migadu dashboard, I was losing emails.

Normal_gaussian 5y ago
Yep. This was exactly my experience, resulted in failure to recieve mail (and my email being deassociated from the accounts of my bank and rental agency). I had a back and fore with them on HN some months back and they were trying to whitewash their handling of the storage failure / rules deletion. The savings are not worth the risk.
estaseuropano 5y ago
I had this issue too - all rules were deleted as they switched form regex to something else. I have no idea whether I missed anything and they really could have done an anouncement. Otherwise have been quite happy and except for a lack of calendar it all works quite well.
t-mw 5y ago
I experienced the same thing, and it took me a couple of weeks to realize I wasn’t receiving emails. Luckily I was only testing it out with emails for non-essential services. I found it difficult to understand why they continued to not make an announcement even after I, and presumably other people, made them aware of the impact the change had.

GrumpyNl 5y ago

Im surprised that there is no response from Migadu here.

spinax 5y ago

> For those who want multi-domain email services for a lower (flat) price, look at mxroute I was very interested and very seriously considering signing up, until I read this: https://mxroute.com/docs/do-you-support-2fa-on-email-accounts/ https://mxroute.com/docs/do-you-support-2fa-on-email-account... While I respect Jarland's opinion/stance, I do not agree.

hellcow 5y ago
What do you disagree with specifically? The reasoning in that link is absolutely correct. We can argue that POP, etc. should have 2FA support added to the protocol, but that's not the point the author was making.
- arp242 5y ago
  Loads of folk use just webmail though, and SMTP/IMAP is usually disabled until they generate an app password. If you do enable SMTP/IMAP: sure, it's correct. But that often doesn't apply, so I don't think it's a "trick" or "sleight of hand".
- spinax 5y ago
  Use case: I have an unattended cron task polling my IMAP account to archive the mail every 4 hours. I specifically use an IMAP read-only unique ("per-app") password for that script/connection; under no circumstance should that password have access to write to IMAP, touch POP or SMTP. Fastmail allows me to do this with ease, and I can create as many as I'd like with different ACLs. The mxroute reasoning simply does not consider all the use cases people have and want per-app passwords for to increase their personal security posture.
  - Raineer 5y ago
    The ease of creation of app passwords and protocol-level controls really are fantastic in Fastmail. I hope it never goes away.
  - deleted 5y ago
    [deleted]

throwthere 5y ago

Similar issue. Just chiming in to say it wasn't just you and I've since left Migadu forever as well.

tptacek 5y ago

I remain baffled at the folk wisdom of using providers outside the United States in order to avoid the Five Eyes IC. You accomplish the opposite thing by doing that. NSA is literally chartered to hack into things outside of US jurisdiction; they don't even need permission to do it. They might even need permission not to do it. Obviously, hosting in the US isn't a cure-all. And there are other good reasons to work with companies in Europe; for instance, their data privacy rules can often be better than ours, which can give you some commercial protections. But these discussions about where people's email is hosted always talk about jurisdictional issues, and the only jurisdictional issue that matters here is this: if NSA is going to swipe mail from Google Mail, there's a whole fuckload of paperwork they have to do. If they want to get mail from your random email provider in Switzerland, they can just push a button.

TedDoesntTalk 5y ago
Excellent point! Illegal domestic spying in the US has mostly gone the way of the dodo bird because of certain whisteblowers.
- tptacek 5y ago
  I want to be clear that I have zero doubt that illegal domestic spying happens in the US. I chose my words carefully.
  - shadilay 5y ago
    Recently there has been increasing government interest in "domestic terrorism" which is basically the public facing component of an increase in funding for three letter agencies.
- colordrops 5y ago
  You are being sarcastic I assume.
davidwritesbugs 5y ago
If you are trying to avoid spook you're fucked anywhere you are: US EU whatever. Yes, if the NSA want your US email they probably won't press that button, but they'll ask GCHQ to press a UK button insetad and get it that way. Also, if the FBI wants your email they will just send a guy in a black MiB suit & 9/10 times the email company will roll over. If they meet resistance FBI just go to a tame US judge (they have loads) who rubber stamps the writ. If your server is in .CH they need lots of paperwork and a good arguable case. So yes it is worth hosting outside US. Ask Microsoft about why they do EU data hosting in Ireland.

deleted 5y ago

[deleted]

jarland 5y ago

I appreciate your recommendation. I'm no friend to intelligence agencies, but I don't want to necessarily put myself out there as a competitor to something like the old Lavabit. I'm not looking to be a victim of the US government any more than I want to see my customers victimized by them.