5 ms·

1. Email on your own domain. You can still use Google (or any other service) for this, but having your own domain means you're not dead in the water if your pro

1. Email on your own domain. You can still use Google (or any other service) for this, but having your own domain means you're not dead in the water if your provider decides they don't like you. 2. For accounts on large websites (big targets) use a unique email address that is only used on that website. Obviously passwords should never be reused, which leads to: 3. Password manager. Just do it. 4. Use the highest security options available at each website. If it's just 2FA, do it. Yubikey is great if they offer it.

igetspam 5y ago
This is how I do everything. I have a *@domain.tld address that lands in a single account and I track spammers and breaches.
captn3m0 5y ago
A lot of orgs will (for security reasons) treat your Google OAuth login, and a email+password login as two distinct accounts, even if they are on the same email address. So it is possible that if Google shuts your account, and you migrate your email to a different provider - you will still lose access to your service account.
- jaywalk 5y ago
  Well, that's one reason why using Google SSO wasn't on my list of things to do.
  - captn3m0 5y ago
    Misread your comment, my bad.
sodimel 5y ago
> Email on your own domain. You can still use Google (or any other service) for this, but having your own domain means you're not dead in the water if your provider decides they don't like you. And if you give up your domain then someone just have to buy it and use the "forgot password" option :D
- jaywalk 5y ago
  You do have some additional management overhead, but a good registrar will bug you well before your domain expires if they aren't able to auto renew it for some reason. You also have a 30 day grace period after it expires before someone else grabs it.
  - ziml77 5y ago
    They need to bug me by mail and by phone. Last time my payment couldn't be processed, I lost email for a week (didn't notice because I was reading email in an email client that pulls from both my custom domain and gmail). Once I brought the domain back up, many of the missed emails did come through including ones from the registrar saying that I needed to fix my payment info...
    - jaywalk 5y ago
      I had a similar scenario happen, where my domain expired without me realizing and my incoming emails slowed down as DNS caches expired. I finally realized it after a few days when I hadn't received an email that I was expecting, and once I renewed the domain I got a flood of emails that I had missed. After that, I was much more careful about where my domain registration emails go.
      - ziml77 5y ago
        I only noticed because I was expecting a specific email too. I should have realized sooner but I was blaming not getting account confirmation emails from a service I was trying to register for on the service itself. I remember that I was even trying multiple browsers and devices thinking that the client was failing to properly send something to the server!
    - lallysingh 5y ago
      .. Can you put a reminder in your calendar? So you re-up before expiration? Leave the automated charge for a backup, but do the important stuff yourself.
signal11 5y ago
Note that email on your domain opens you up to a different sort of risks along the lines of domain hijacking / registrar account takeover. However, if you pick a good registrar you should be okay, and also there are commercial/legal remedies available.
- toomuchtodo 5y ago
  Use Cloudflare as your registrar. They have strong account protection mechanisms available.
smrtinsert 5y ago
Tying your own configuration to your identity is like the digital version of cash under the mattress but with more risk imo.
core-utility 5y ago
#2 is always fun when you're dealing with humans directly. "Yes my email is <yourcompanyname>@<mydomain>.com. No I don't work for the company, it's so I can track where emails come from. Yes I work in tech."
bradknowles 5y ago
Don't build your castle on someone else's property. If your Google account gets suspended for some reason, that will likely take you down for all other Google systems. You don't want to have your entire universe shut down just because one person out there decided that they didn't like you and complained to Google that you were spamming them. This kind of thing has happened before, and will happen again. Do you want to take the risk it will happen to you?

igetspam 5y ago

This is how I do everything. I have a *@domain.tld address that lands in a single account and I track spammers and breaches.

captn3m0 5y ago

A lot of orgs will (for security reasons) treat your Google OAuth login, and a email+password login as two distinct accounts, even if they are on the same email address. So it is possible that if Google shuts your account, and you migrate your email to a different provider - you will still lose access to your service account.

jaywalk 5y ago
Well, that's one reason why using Google SSO wasn't on my list of things to do.
- captn3m0 5y ago
  Misread your comment, my bad.

sodimel 5y ago

> Email on your own domain. You can still use Google (or any other service) for this, but having your own domain means you're not dead in the water if your provider decides they don't like you. And if you give up your domain then someone just have to buy it and use the "forgot password" option :D

jaywalk 5y ago
You do have some additional management overhead, but a good registrar will bug you well before your domain expires if they aren't able to auto renew it for some reason. You also have a 30 day grace period after it expires before someone else grabs it.
- ziml77 5y ago
  They need to bug me by mail and by phone. Last time my payment couldn't be processed, I lost email for a week (didn't notice because I was reading email in an email client that pulls from both my custom domain and gmail). Once I brought the domain back up, many of the missed emails did come through including ones from the registrar saying that I needed to fix my payment info...
  - jaywalk 5y ago
    I had a similar scenario happen, where my domain expired without me realizing and my incoming emails slowed down as DNS caches expired. I finally realized it after a few days when I hadn't received an email that I was expecting, and once I renewed the domain I got a flood of emails that I had missed. After that, I was much more careful about where my domain registration emails go.
    - ziml77 5y ago
      I only noticed because I was expecting a specific email too. I should have realized sooner but I was blaming not getting account confirmation emails from a service I was trying to register for on the service itself. I remember that I was even trying multiple browsers and devices thinking that the client was failing to properly send something to the server!
  - lallysingh 5y ago
    .. Can you put a reminder in your calendar? So you re-up before expiration? Leave the automated charge for a backup, but do the important stuff yourself.

signal11 5y ago

Note that email on your domain opens you up to a different sort of risks along the lines of domain hijacking / registrar account takeover. However, if you pick a good registrar you should be okay, and also there are commercial/legal remedies available.

toomuchtodo 5y ago
Use Cloudflare as your registrar. They have strong account protection mechanisms available.

smrtinsert 5y ago

Tying your own configuration to your identity is like the digital version of cash under the mattress but with more risk imo.

core-utility 5y ago

#2 is always fun when you're dealing with humans directly. "Yes my email is <yourcompanyname>@<mydomain>.com. No I don't work for the company, it's so I can track where emails come from. Yes I work in tech."

bradknowles 5y ago

Don't build your castle on someone else's property. If your Google account gets suspended for some reason, that will likely take you down for all other Google systems. You don't want to have your entire universe shut down just because one person out there decided that they didn't like you and complained to Google that you were spamming them. This kind of thing has happened before, and will happen again. Do you want to take the risk it will happen to you?