15 ms·

Your online identity is owned by your email provider (2019)

297 points by memorable 4y ago

raxxorraxor 4y ago
> The only real solution is to rethink online identity and stop depending on email addresses. I think that is true, but it would have to be a better solution. Some groups heavily push for this reformation of online identity but most of them have in common that they want to strongly bind online identity to your offline one. That simply isn't desirable in many cases.
- hapiri 4y ago
  iirc online identity used to be tied to your public key signature ? Might be too technical for most population to use, but the ideal solution is already there I think ?
  - httpz 4y ago
    Some people will definitely lose their private key
    - Zamicol 4y ago
      Use multiple keys and use a system that permits easy revokes.
  - weberer 4y ago
    That's what Apple is doing for their new thing https://news.ycombinator.com/item?id=31643917 https://news.ycombinator.com/item?id=31643917
exabrial 4y ago
I wish i could have my PGP key be my identity root.
- yonrg 4y ago
  And then how do you envision the web of trust?
exolymph 4y ago
For me it's Fastmail with a side of Namecheap (or maybe vice versa). Thankfully I pay both companies, thus there's an incentive to keep me happy so I keep paying... In particular, Fastmail has real support staff, which provides at least a modicum of peace of mind.
- xedrac 4y ago
  I've been using the same setup for several years now. I purchased my own domain, and have Fastmail do all the email hosting for me. Super simple. I also forward my gmail to my custom domain email, because I was only able to transition about 95% of my various services to my new email.
- lifeinthevoid 4y ago
  I use the same setup, had to contact Fastmail support once during the initial week of transferring from gmail. Support response was quick and professional.
- pwpw 4y ago
  Can you use fast mail with any email service that supports IMAP or is it like Proton Mail where you have to use their app to check your emails?
  - d2wa 4y ago
    FastMail offers seneric JMAP, IMAP, and SMTP access with app-specific passwords.
    - pwpw 4y ago
      Thanks! And what about using a Fastmail calendar? For example, can I receive a calendar invite from someone, accept the invitation in my email, and have it automatically show up in my calendar app of choice (e.g. iOS calendar)? That's another thing where Proton makes me use their app, which can be annoying.
irjustin 4y ago
This is largely true for myself as well. 1Password helps me and my family from going full in, but if I lost my gmail i would have a lot of problems. The recent discussion of CP flagging wreaking havoc[0] has caused us to start evaluating because we do have young children and we do take pictures for healthcare providers. Feels like a ticking time bomb for us. [0] https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html#commentsContainer https://www.nytimes.com/2022/08/21/technology/google-surveil...
- tjpnz 4y ago
  The bastards even refused to restore access after the individuals involved were cleared by police. That part alone has made me start considering other options. No company should be allowed to wield that much power over a person.
  - throwaway4good 4y ago
    I think they refused to right the case as there are many others and they don’t want to set the precedence of people getting anything out of challenging them.
  - NoPicklez 4y ago
    Absolutely, this part frustrated me the most. People were saying well Google likely did that because they didn't want to admit they were wrong. From my point of view they didn't really do anything wrong. They flagged something that was suspicious, which is fine. Then relied on the authorities to clear any wrongdoing due to the nature of what they flagged. At that point they should have reinstated the account.
- exodust 4y ago
  Google stood by their decision even when the police cleared the man. Wow, that's hostile. Google's motto: Guilty until never. The software Dad probably should have known better than to assign Google the task of handling that type of image. But still, that he lost his account when valid explanation provided is unforgivable. I don't understand how people can ignore the big "eye" of Google and other tech giants, watching everything we do, treating everyone like a low-life suspect. Scanning our shit and forcing our content through a kind of twisted police line-up. I stopped using Google for anything personal years ago, but feel sorry for people caught up in their clumsy joke of a service.
vaagen 4y ago
The problem with several of these email subscriptions is that they will reissue your email address to another if you leave them, with all the risks that entails. The answer is to buy and use your own domain or get someone else to do it.
- texaslonghorn5 4y ago
  This is a good idea but in practice it just shifts the problem onto the domain registrar. Maybe/hopefully they are friendlier than email provider but if you do Gmail vs Google Domains, what's the difference?
  - account42 4y ago
    > if you do Gmail vs Google Domains, what's the difference? Google Domains has (at least in theory) the option to transfer the domain to another registrar. Gmail does not let you transfer the email to annother mail provider (because that would be impossible).
- remram 4y ago
  This seems backwards. Most email providers won't reissue your login, while domain registrars will definitely resell your domain.
  - brewdad 4y ago
    They may not reissue it immediately but I am not aware of any mainstream email provider that promises to never reuse an identity.
    - zinekeller 4y ago
      > I am not aware of any mainstream email provider that promises to never reuse an identity. Google: https://support.google.com/mail/answer/56256 https://support.google.com/mail/answer/56256 In contrast, Microsoft only waits a year before recycling email addresses.
daenz 4y ago
State-funded email with E2EE. Every citizen gets an email address. You don't have to use it (and it will probably suck compared to competitors), but you'll have it as a permanent fallback address. And presumably it will come with some legal protections and due process.
- httpz 4y ago
  State-funded, E2EE: Pick one
  - thayne 4y ago
    Also if you want good E2EE, it's not going to be email (at least not with current protocols). Especially if you want interoperability with the existing web.
- thayne 4y ago
  Alternatively, give everyone an assymmetric encryption key associated with you identity. To prove your identity, you sign a challenge with your private key, and the other party verifies it using your public key (which could itself be signed your government). Although, for that to fully work,you would need international cooperation on a standard for that protocol.
  - EGreg 4y ago
    Nah. Just have people generate their own keys. Then distribute a token to everyone, like registering to vote or NYC ID. Finally, have an official mixer like tornado cash that only works with these tokens. Ring signatures baby ! Now you distribute UBI, allow voting etc. And it is all pseudonymous. That’s what we are building out at Intercoin.org/applications btw :)
    - smashed 4y ago
      Sounds interesting but can you elaborate on the social benefits, challenges and potential downfalls of such an approach?
ulrikrasmussen 4y ago
Another solution that the article doesn't mention: separate the email address from the email provider. It really is the domain name that is your legal identity. Make it as easy for people to register a personal domain name as it is for them to sign up for free email so they can switch from Gmail to Hotmail to Protonmail without changing their email address. Edit: We then need a standard for discoverable DNS settings that providers can publish, together with an endpoint that the domain name provider calls to inform the email provider that it should accept email from person@personaldomain.person and forward it to person@emailprovider.com. Then your domain name provider can discover these, and switching email provider can be done with a click of a button without you having to have any knowledge of DNS. Of course email providers will have little interest in supporting something like this, so this is where regulation would be needed.
- hamstergene 4y ago
  But what credentials do you use to log into the personal domain name provider, to manage it? Another email? Unless there is state-guaranteed ownership of a domain name, this will remain to be chicken-and-egg problem: to manage a domain one needs an account with an email, and to have an independent email one needs a domain. Even then, moving between countries is normal now which poses a huge challenge to the concept of "online identity", because what one state guarantees is not necessarily what another recognizes.
  - colordrops 4y ago
    This is the most important comment in this entire post/thread. This is what needs to be addressed to truly solve the problem. I don't know how to solve it other than perhaps using a token on a blockchain to indicate ownership of a domain.
  - ulrikrasmussen 4y ago
    A physical address to receive recovery codes? In Denmark, every person has a digital identity and they can authenticate themselves using either a smartphone or a dedicated TOTP key fob, and that could also work. Heck, we even have digital mail boxes for every person. The reason that email is popular as an online identity is that it is an easy and cheap method for the service provider and user to establish an identity. It would be acceptable for a domain name provider to use a more expensive way of establishing identity since you only have to go through this process for this single provider. A physical office could work if you don't live in a country where people have government-issued digital identities. Edit: Actually, why would we need all that? We don't need anything but a username, password and maybe a phone number to sign up for GMail, so why should it be different for a domain name provider? Sure, you need some recovery mechanism if you lose your credentials, but that problem is already solved by current email providers by using phone numbers, recovery codes, TOTP, Yubikeys, etc.
vladkovalev 4y ago
Metamask
- eimrine 4y ago
  All an internet user needs is a private key and wiseness not to compromise it.
kelnos 4y ago
And this is why, back in 2007, I registered my own domain, and signed up for then-free Google Apps for Your Domain (then GSuite, Google Workspaces, whatever they're calling it now). Earlier this year I moved my email to Fastmail, and I can move it elsewhere if I want to, with zero disruption or downtime. I really wish email providers would make custom domains either the default, or a very obvious option when signing up. Google is already a domain registrar, and other providers could partner with one. Granted, this option would not be free (though Google could probably swing making it free; they just wouldn't let you use the domain for anything else unless you start paying for the registration), so that would reduce its desirability for most people, unfortunately. (On the downside, I wish I could convert my GSuite account to a regular Google Account, because GSuite accounts are occasionally crippled in random ways, and now I'm not even using the email part of it anymore. But that's a separate complaint.)
- megapatch 4y ago
  Totally +1 this. Buy a domain (= "rent" it long term) and be free.
- Gareth321 4y ago
  > I really wish email providers would make custom domains either the default, or a very obvious option when signing up. They don't because it creates huge friction to leave. They'll have to be mandated to do this, and I think they should be.
- pjerem 4y ago
  > though Google could probably swing making it free Even if it was cost-effective for Google (which I doubt), it's not going to happen because it would mean that, to be effective, Google would have to allow you to transfer it out of their hands (to change your provider) and thus, it would also mean that you could basically use Gmail to hold domains for free.
- woutr_be 4y ago
  I was in the same boat as you, got a free GSuite account with custom domain, then moved my email to FastMail. I’m considering just removing my GSuite account, and registering a new one, although still evaluating the implications that might have.
Animats 4y ago
"You can take some control over your own identity in the current email-based online ecosystem by renting a domain name" Originally, the idea was that you owned a domain name. Gradually, domain registrars have moved this to the concept that you're just renting it from them. Although you can still transfer domains to another registrar. I'd like to find a domain registrar whose contractual terms stated that you own your domain name, and they are contractually prohibited from cancelling it or revoking it without a court order. Basically, a contract that forbids what lawyers call "self-help".
- conjuredbytes 4y ago
  For ICANN accredited registrars, aren't there rules about when and how a registrar can delete or revoke a domain? You can submit complaints to ICANN here: https://www.icann.org/compliance/complaint https://www.icann.org/compliance/complaint
  - Falkon1313 4y ago
    Yes, and one of those cases is anytime you don't pay them rent to renew your lease before the expiration.
    - immibis 4y ago
      If you didn't have to keep paying for domain names, big businesses would have registered all the interesting ones two decades ago. Same for physical property.
- neodypsis 4y ago
  The Costa Rican NIC has the concept of personal domains for costa-rican citizens, but it isn't free [0]: > Personal .cr domain names may only be registered by Costa Rican citizens over the age of 12 having an identity card and included in the Citizens' Registry of the Supreme Electoral Court of Costa Rica. In order to certify that they are citizens of the Republic of Costa Rica, the identity card must be valid at the time of submitting the application to register the personal domain name. > NIC Costa Rica shall only approve a personal domain name once it verifies that its holder meets the requirements set forth in Section 9 of this document for the registration of personal domain names. The applicant must also send a copy of both sides of the identity card to the email info@nic.cr. > Requests for personal domain names under .cr shall be reviewed by NIC Costa Rica using the tools provided by the National Registry and the Supreme Electoral Court of Costa Rica, as well as any other means NIC Costa Rica considers necessary. [0] https://www.nic.cr/politicas/personales https://www.nic.cr/politicas/personales
httpz 4y ago
Before writing about your bulletproof technical solution to this problem, think about all of your older relatives on facebook. Is the solution something they'll be able to handle?
- koheripbal 4y ago
  As long as emails can be routed to/from the old system, more technical adopters can still adopt a more secure solution.
somat 4y ago
It is a bit overkill, but the closest you can get to owning your online identity is to "own" your own domain. sarcastiquotes used because you don't really own a domain you only rent it. I run my own mail server because I am a sys-admin and running a mail-server is something I do for fun. but the amount of agency you gain once you have a domain is staggering. people without a domain are pretty much second class net citizens. I wish municipality offered domains, for example: you move to St Louis you would get name.stlouis.mo.us this would give you the same agency online that a mail address gets you offline.
- kingds 4y ago
  but if you stop renting from the registrar then whoever rents the domain next gets access to your email. seems like a horrible solution to this problem. at least i can be reasonably confident that google will never recycle my email address and send all incoming mail to a rando.
  - colordrops 4y ago
    Being in control of your own destiny entails more risk.
  - account42 4y ago
    > at least i can be reasonably confident that google will never recycle my email address and send all incoming mail to a rando. What do you base that confidence on? Short, meaningful names are valuable and there is no reason to believe that somewhere down the line they won't be recycling ones that aren't used anyway as premium accounts.
- deepdriver 4y ago
  I think I have a good idea of what you mean, but for those who don't, could you elaborate on the benefits?
  - TeeMassive 4y ago
    You can give unique throwaway addresses to people you don't fully trust (e.g. newsletters, recruiters) and apply the rules you want. It would be very naive to think that Big Tech won't abuse their market positions.
deleted 4y ago
[deleted]
exabrial 4y ago
These days it’s your cell provider with ‘texting as 2fa’
- lilsoso 4y ago
  Could you explain how the tracking via the cell provider works with 2fa? Do you mean they have an idea of the services you use based on the phone number of the sender and perhaps the format of the message? Or do you mean they actually tie the 2fa code to your identity through agreements with third party services?
netmonk 4y ago
Interesting that nobody question the core concept of online identity. In real world it is useless. Same in the internet. The axiom of online identity is useless and only exists for the sole purpose of control by capitalist cybernetics
- Falkon1313 4y ago
  I think it's especially useful, largely because it's easy to have multiple IDs online, for different aspects of your life. And for the most part, they can be as pseudonymous as you want them to be, or they can be linked directly to your real-world ID, if you want that. Those things give you control, instead of others.
TedDoesntTalk 4y ago
> people should stop and think carefully when choosing the @example.com part of their email address. It’s a decision you’re probably set to live with for life Really? I’ve had dozens of email addresses over decades. I have a few favorites but even those have changed over time. I think your is hyperbole.
- demopathos 4y ago
  Then you fall outside the probably. The overwhelming majority of people have a single address their entire life
  - TedDoesntTalk 4y ago
    I guess those people only have one job their whole lives, too, and never lived before Gmail became popular.
    - demopathos 4y ago
      Jobs exepted for pretty clear reasons. And yes Gmail has been dominant for quite a bit of time - especially since the period where it was possible to have your email be your digital identity.
TekMol 4y ago
The solution I hope for: A crypto based toplevel domain like the Ethereum Name Service. But with a twist: If I lose my private key, the domain is not lost, but locked for 3 months and nobody, not even the registry can move it. After the 3 months, if I stay "silent" and not confirm my ownership via my private key, the registry can move the domain. The registry should have this process: During these 3 months, I have to start an expensive process at the registry to validate my identity and ownership of the domain. When completed successfully, the registry will move the domain to my new public key. So the worst thing that could ever happen to my domain (and my emails under that domain) is that I end up in a situation that is normal for domains today: That the registry has control over it.
- sph 4y ago
  Sounds like ICANN with more steps. If there's a central registry doing the ID validation, why the blockchain?
- raffy 4y ago
  For a .eth name, this is trivial: provide operator approval to N-additional wallets
- hiq 4y ago
  You mention losing your private key, what about somebody else getting it (data leak, hack...) and controlling your identity before the end of the 3 months? Blockchain-based "solutions" are not actual solutions because they don't account for this fairly common case. Once they do, they rely on a 3rd-party, and you're back to square one.
satellite2 4y ago
It's a technical board so everyone propose technical solutions. But I really hope that the solution will be a legal one. That the law will change to make it as hard to kick someone from an email service as to cut running water. And to forbid the companies to define anti litigation, private courts etc. in their TOS.
jakuboboza 4y ago
That is why you setup 2 factor authentication ;) it puts one item outside of their control.
bartq 4y ago
Is there email counterpart of HTTP 301? This could be the solution. But it would have to be much more secure and would require human confirmations to make the "301" to take the effect.
- d2wa 4y ago
  Email relay and email forwarding filters. However, it’s up to the email service provider to handle this. Which is out of your control.
  - account42 4y ago
    It's also not really equivalent since there is no feedback to the sender that the canonical address for the user has changed.
Gareth321 4y ago
I've spent the last year or so moving from a Gmail address to my own domain (hosted on Worksplace). I kept reading report after report of people having their Google accounts banned for any and no reason, and I realised how many services I have tied to me email. I'd be spending a lifetime trying to recover them all, and I don't think I'd be successful for half of them. Now, if my Workspace account is ever banned, I can immediately take my domain elsewhere and retain access to everything.
atoav 4y ago
I like my email provider — he is me.
zh3 4y ago
I too run my own mail server, using a mixed approach of a dumb cloud server as a point of presence on the public internet and a private server at home as the actual email store. That gets the benefit on being a non-consumer presence as far as the internet is concerned, but with all personal data stored locally. With a little practice and experience, it's not difficult for those with technical skills to host their own email on a cheap rented server (along with a personal website etc). Buy a suitable domain, host at a reputable supplier on a dedicated host (i.e. IP) and there should be few problems (test with free accounts from the bit tech outfits). Even nicer is to use Dovecot for IMAP either locally or remote. I run it locally with fetchmail to periodically (or on demand) grab email from the public server, with a little utility that lists the remote headers first so I can decide which/whether any are worth even downloading and reading - quite often it's a single click to delete everything unread.
EbNar 4y ago
juniperplant 4y ago
Somewhat tangential, but I wonder where do people using their own domain draw the line. I personally use a "stable" firstname@lastname.com for supposedly trusted, long-term services (e.g. bank, utilities, etc.) and for services that require my identity for obvious reasons (e.g. shipping/billing address). For sites where I prefer not to reveal my identity (not even to the site operator), I use Fastmail’s Masked Email (akin to iCloud Hide My Email). This, however, means I don't own those addresses, and if I need to change email provider for whatever reason, it's a PITA to update the email address field on possibly hundreds of sites (assuming you can). I could buy a domain like randomstring.com to use with catch-all, but then I would be more likely to be tracked across sites, especially in the case of data leaks (which do happen eventually). Then there are those awkward in-person situations when somebody asks my email and I have to say firstname@lastname.com. What's a good tradeoff?
- OkGoDoIt 4y ago
  I also use firstbame@lastname.com for personal and professional communication. But for signing up for services, I have a custom domain name with a catchall email address. Then I register with something along the lines of servicename@mycustomdomain.com. All of those emails go to the same place. The only downside is sometimes a person I work with or whatever will go ahead and sign me up for some third-party service using my main first name last name email address, which is kind of annoying.
- ckcheng 4y ago
  > Then there are those awkward in-person situations when somebody asks my email and I have to say firstname@lastname.com. I suggest making up a domain name unrelated to your actual name exactly because of this. Saying "homer@juniper plant.com" feels less awkward to me than saying "homer@homer simpson.com".
- quickthrower2 4y ago
  I think the intersection of [service where I prefer not to reveal my identity] and [matters if I lose access to the service and therefore control of the email address at 1000-1 odds] is very small. It is going to be mostly for things like a spare "fun" Reddit account, or some one off crappy give your email to download the PDF sort a thing.
gvko 4y ago
Enter Blockchain...
- eimrine 4y ago
  Implement private message transfer then I will get rid of email.
jillesvangurp 4y ago
It's a pretty accurate assessment. A large number of people depend on freemium email addresses provided by the likes of gmail and many others as well as some ISPs. Those are only valid for the duration of your relationship with the companies behind those and that relation may be terminated for reasons beyond your control. Then there are a lot of company email addresses that are only valid for the duration of people's employement. Only a small minority of people have their own domain. And saying that they own it would be a stretch. They merely own the right to pay to renew their lease every year. Then there is the wide spread practice of tying identity to a single email address that may be used to reset passwords. There is no good technical reason to limit it just one email address or indeed just email addresses; that's just a historical quirk that gets mindlessly copied by world + dog when they spin up a new service because of the mistaken belief widely held by non technical product managers that that just is how things are done. Only a minority of websites provide 2FA, which enhances security but does not solve the root problem of people not owning their identity. Changing your email address is not a feature that is commonly supported either. Whatever email address you pick when you signup is what you are stuck with. If your email provider shuts you down, you lose the ability to reset passwords, receive notifications, etc. IMHO the way out of this mess is to start making multi modal signins more common. Some companies already do this but it is not a widespread practice. Simply encourage users the ability to add multiple ways of authenticating themselves. Phone number based authentication, device based authentication (using e.g. QR codes), public key based authentication (ssh or otherwise), social media account based verification, etc. are all viable strategies to authenticate. And why have just one? Combined with 2FA this makes for a much more durable account ownership. It can also remove a lot of onboarding friction as you don't actually need users to provide a lot of information about themselves. A lot of the reasons for this not being so common has to do with a misguided notion of big trillion dollar companies wanting to "own" the relation with their users. So Google will not allow people to use their MS owned identities to sign in or vice versa. Even though both implement variations of OpenID 2.0 and generally have a large overlap in terms of how they implement security technically. It's a simple matter of ownership. They own you. They consider you their property. Your identity is theirs to control. This is the notion that needs to be challenged for this to ever be resolved. Imagine that citizenship worked like that. It doesn't of course. But imagine. There would be a lot of stateless citizens no longer able to prove who they are because gmail shut them down or whatever. That would be unacceptable of course. Banks can't get away with that either. A passport is all you need to reclaim ownership of your bank accounts. And in case of your death, a death certificate and some paper work from a notary is good enough for your surviving relatives. Online identity should be just as strong. People confuse the means of authentication with the actual identity.
alangibson 4y ago
Email should be considered legally equal to physical mail. It should be regulated by the USPS. Just like a company can't yank your ability to send snail mail, they shouldn't be able to yank your ability to send electronic mail.
- account42 4y ago
  I definitely would not want my mail to be regulated by Deutsche Post AG so this only works for countries that are not already prone to privatizing their essential services.
icare_1er 4y ago
I have the feeling that we are gradually shifting from email-centric to phone-centric systems. With 2FA and recovery, ultimately, your unique phone number becomes more and more THE foundation of everything online, and switching phone number is harder than switching email.
- octobus2021 4y ago
  I agree. Our online identities are ultimately based on our phone numbers, and email provider can only serve as identity provider since they require your phone number.
poseva 4y ago
After the NYT article [0] I purchased (rented) my own domain, created a cloudflare account and started using their email routing to forward all the email to my gmail address. I also configured gmail to allow me to send emails from the new email address. As I have a small child and use a lot the telemedicine services I do have a fear that I will be blocked soon. A drawback to this is that cloudflare does not allow you to forward to multiple email addresses. [0] https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html https://www.nytimes.com/2022/08/21/technology/google-surveil...
- 6ak74rfy 4y ago
  Consider Forward Email instead of Cloudflare: their free tier is pretty good and they allow forwarding to multiple emails. Not affiliated with them, just a happy user myself.
alexslobodnik 4y ago
web3 is correcting this with censorship resistance usernames via ethereum name service[0]. a lot of famous folks have already using them [1]. [0] https://ens.domains/ https://ens.domains/ [1] https://ethleaderboard.xyz/ https://ethleaderboard.xyz/
- hiq 4y ago
  With no recourse if you lose your private key, is it really any better for 99% of users?
  - alexslobodnik 4y ago
    that's a good question. would i rather have an entity that i have no power against (google) or only my own error? the outcome is the same, i had x, now i don't. personally, i'd prefer being responsible, but it is a by a thin margin. that being said, key management has and will continue to get easier. so over time, the risk of key loss should diminish.
    - hiq 4y ago
      > Personally, I'd prefer being responsible, but it is a by a thin margin. I'd wager that's not the case for 90% of users choosing the email provider they trust the most, both in terms of what they expect the risks are, and what they actually risk in practice. > key management has and will continue to get easier You're talking about the blockchain space where it was not even the state of the art when it started. Key management remains a problem in all spaces, but it has even more dramatic consequences when you have no recourse.
      - alexslobodnik 4y ago
        i'm not well versed on key management outside of the blockchain space. one key management wallet i like is https://www.argent.xyz/ https://www.argent.xyz/ maybe this is rudimentary by traditional standards but this an advancement for wallet management. the key feature is you can recover access to your assets even if you lose your keys through social recovery.
synthc 4y ago
This the reason I use my own domain and a paid email service. I used Gmail before but got super worried about all the stories of accounts getting blocked with no way of contacting a human. Sure domain registrars and email providers are not infallible, but it's a huge step up from trusting Googles customer service to do the right thing
denton-scratch 4y ago
There's a lot of hyperbole in this article. > These extra trips through different email servers strip the emails of information about the sending server which is critical to protect against spam and email forgery. Sure, a forwarder can strip information from a forwarded message; but that's a rogue SMTP server. And this would be your previous email provider; so you'll know whether they're rogue before you start forwarding messages through them. > Email was designed in the 1960s s/1960s/1970s/ You get your own domain; then host your email at a provider that offers bring-your-own-domain. Now you have a portable email. Your domain registrar cannot interfere with your messages, unless you choose to host your email with your domain registrar. I agree that an email address is a poor identity token. As with SQL, an identity should be an opaque object with no embedded meaning. In addition to being an identity, an email address is a communications endpoint, and is parseable, so it's not opaque.
running101 4y ago
Why not use google workspace, I believe you can have a custom domain.
shultays 4y ago
You can be your email provider, or own your own domain at least. Honestly owning a domain should be a minimum for anyone that is capable and their email is almost their identity
anotheraccount9 4y ago
I use purelymail with a registered domain. That's the best I can do that is functional and practical at this point.
SergeAx 4y ago
...and your mobile operator. Good luck to Google Fi users.
hjupadhyay 4y ago
In order to have an email with my own domain I need to own (rent technically) a domain. Registering a domain requires an existing email. Which is obviously going to be from a third party / consumer email provider whose domain I don’t have control over. Kind if circular reference situation!
samoit 4y ago
For those afraid of misconfiguring/running their own server, you can use a ready to use docker with everything in it and with nice security defaults (no relay, for instance): https://github.com/docker-mailserver/docker-mailserver https://github.com/docker-mailserver/docker-mailserver
cx42net 4y ago
Shameless plug here, but that is the purpose of [ImprovMX](https://improvmx.com https://improvmx.com). We forward emails from a custom domain to a destination email that can be updated. My personal email is contact@{custom domain} and currently points to Gmail because I never took the hassle to change it, but if someday I decide to move elsewhere (I'm contemplating Fastmail and Protonmail), all I will have to do is update my destination email at ImprovMX and that's all. This is a liberty that only us, tech people, can grasp. My parents, even my wife, doesn't see the importance of being locked to mail provider.

297 points by memorable 4y ago

> The only real solution is to rethink online identity and stop depending on email addresses. I think that is true, but it would have to be a better solution. Some groups heavily push for this reformation of online identity but most of them have in common that they want to strongly bind online identity to your offline one. That simply isn't desirable in many cases.

hapiri 4y ago
iirc online identity used to be tied to your public key signature ? Might be too technical for most population to use, but the ideal solution is already there I think ?
- httpz 4y ago
  Some people will definitely lose their private key
  - Zamicol 4y ago
    Use multiple keys and use a system that permits easy revokes.
- weberer 4y ago
  That's what Apple is doing for their new thing https://news.ycombinator.com/item?id=31643917 https://news.ycombinator.com/item?id=31643917

exabrial 4y ago

I wish i could have my PGP key be my identity root.

yonrg 4y ago
And then how do you envision the web of trust?

exolymph 4y ago

For me it's Fastmail with a side of Namecheap (or maybe vice versa). Thankfully I pay both companies, thus there's an incentive to keep me happy so I keep paying... In particular, Fastmail has real support staff, which provides at least a modicum of peace of mind.

xedrac 4y ago
I've been using the same setup for several years now. I purchased my own domain, and have Fastmail do all the email hosting for me. Super simple. I also forward my gmail to my custom domain email, because I was only able to transition about 95% of my various services to my new email.
lifeinthevoid 4y ago
I use the same setup, had to contact Fastmail support once during the initial week of transferring from gmail. Support response was quick and professional.
pwpw 4y ago
Can you use fast mail with any email service that supports IMAP or is it like Proton Mail where you have to use their app to check your emails?
- d2wa 4y ago
  FastMail offers seneric JMAP, IMAP, and SMTP access with app-specific passwords.
  - pwpw 4y ago
    Thanks! And what about using a Fastmail calendar? For example, can I receive a calendar invite from someone, accept the invitation in my email, and have it automatically show up in my calendar app of choice (e.g. iOS calendar)? That's another thing where Proton makes me use their app, which can be annoying.

irjustin 4y ago

This is largely true for myself as well. 1Password helps me and my family from going full in, but if I lost my gmail i would have a lot of problems. The recent discussion of CP flagging wreaking havoc[0] has caused us to start evaluating because we do have young children and we do take pictures for healthcare providers. Feels like a ticking time bomb for us. [0] https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html#commentsContainer https://www.nytimes.com/2022/08/21/technology/google-surveil...

tjpnz 4y ago
The bastards even refused to restore access after the individuals involved were cleared by police. That part alone has made me start considering other options. No company should be allowed to wield that much power over a person.
- throwaway4good 4y ago
  I think they refused to right the case as there are many others and they don’t want to set the precedence of people getting anything out of challenging them.
- NoPicklez 4y ago
  Absolutely, this part frustrated me the most. People were saying well Google likely did that because they didn't want to admit they were wrong. From my point of view they didn't really do anything wrong. They flagged something that was suspicious, which is fine. Then relied on the authorities to clear any wrongdoing due to the nature of what they flagged. At that point they should have reinstated the account.
exodust 4y ago
Google stood by their decision even when the police cleared the man. Wow, that's hostile. Google's motto: Guilty until never. The software Dad probably should have known better than to assign Google the task of handling that type of image. But still, that he lost his account when valid explanation provided is unforgivable. I don't understand how people can ignore the big "eye" of Google and other tech giants, watching everything we do, treating everyone like a low-life suspect. Scanning our shit and forcing our content through a kind of twisted police line-up. I stopped using Google for anything personal years ago, but feel sorry for people caught up in their clumsy joke of a service.

vaagen 4y ago

The problem with several of these email subscriptions is that they will reissue your email address to another if you leave them, with all the risks that entails. The answer is to buy and use your own domain or get someone else to do it.

texaslonghorn5 4y ago
This is a good idea but in practice it just shifts the problem onto the domain registrar. Maybe/hopefully they are friendlier than email provider but if you do Gmail vs Google Domains, what's the difference?
- account42 4y ago
  > if you do Gmail vs Google Domains, what's the difference? Google Domains has (at least in theory) the option to transfer the domain to another registrar. Gmail does not let you transfer the email to annother mail provider (because that would be impossible).
remram 4y ago
This seems backwards. Most email providers won't reissue your login, while domain registrars will definitely resell your domain.
- brewdad 4y ago
  They may not reissue it immediately but I am not aware of any mainstream email provider that promises to never reuse an identity.
  - zinekeller 4y ago
    > I am not aware of any mainstream email provider that promises to never reuse an identity. Google: https://support.google.com/mail/answer/56256 https://support.google.com/mail/answer/56256 In contrast, Microsoft only waits a year before recycling email addresses.

daenz 4y ago

State-funded email with E2EE. Every citizen gets an email address. You don't have to use it (and it will probably suck compared to competitors), but you'll have it as a permanent fallback address. And presumably it will come with some legal protections and due process.

httpz 4y ago
State-funded, E2EE: Pick one
- thayne 4y ago
  Also if you want good E2EE, it's not going to be email (at least not with current protocols). Especially if you want interoperability with the existing web.
thayne 4y ago
Alternatively, give everyone an assymmetric encryption key associated with you identity. To prove your identity, you sign a challenge with your private key, and the other party verifies it using your public key (which could itself be signed your government). Although, for that to fully work,you would need international cooperation on a standard for that protocol.
- EGreg 4y ago
  Nah. Just have people generate their own keys. Then distribute a token to everyone, like registering to vote or NYC ID. Finally, have an official mixer like tornado cash that only works with these tokens. Ring signatures baby ! Now you distribute UBI, allow voting etc. And it is all pseudonymous. That’s what we are building out at Intercoin.org/applications btw :)
  - smashed 4y ago
    Sounds interesting but can you elaborate on the social benefits, challenges and potential downfalls of such an approach?

ulrikrasmussen 4y ago

Another solution that the article doesn't mention: separate the email address from the email provider. It really is the domain name that is your legal identity. Make it as easy for people to register a personal domain name as it is for them to sign up for free email so they can switch from Gmail to Hotmail to Protonmail without changing their email address. Edit: We then need a standard for discoverable DNS settings that providers can publish, together with an endpoint that the domain name provider calls to inform the email provider that it should accept email from person@personaldomain.person and forward it to person@emailprovider.com. Then your domain name provider can discover these, and switching email provider can be done with a click of a button without you having to have any knowledge of DNS. Of course email providers will have little interest in supporting something like this, so this is where regulation would be needed.

hamstergene 4y ago
But what credentials do you use to log into the personal domain name provider, to manage it? Another email? Unless there is state-guaranteed ownership of a domain name, this will remain to be chicken-and-egg problem: to manage a domain one needs an account with an email, and to have an independent email one needs a domain. Even then, moving between countries is normal now which poses a huge challenge to the concept of "online identity", because what one state guarantees is not necessarily what another recognizes.
- colordrops 4y ago
  This is the most important comment in this entire post/thread. This is what needs to be addressed to truly solve the problem. I don't know how to solve it other than perhaps using a token on a blockchain to indicate ownership of a domain.
- ulrikrasmussen 4y ago
  A physical address to receive recovery codes? In Denmark, every person has a digital identity and they can authenticate themselves using either a smartphone or a dedicated TOTP key fob, and that could also work. Heck, we even have digital mail boxes for every person. The reason that email is popular as an online identity is that it is an easy and cheap method for the service provider and user to establish an identity. It would be acceptable for a domain name provider to use a more expensive way of establishing identity since you only have to go through this process for this single provider. A physical office could work if you don't live in a country where people have government-issued digital identities. Edit: Actually, why would we need all that? We don't need anything but a username, password and maybe a phone number to sign up for GMail, so why should it be different for a domain name provider? Sure, you need some recovery mechanism if you lose your credentials, but that problem is already solved by current email providers by using phone numbers, recovery codes, TOTP, Yubikeys, etc.

vladkovalev 4y ago

Metamask

eimrine 4y ago
All an internet user needs is a private key and wiseness not to compromise it.

kelnos 4y ago

And this is why, back in 2007, I registered my own domain, and signed up for then-free Google Apps for Your Domain (then GSuite, Google Workspaces, whatever they're calling it now). Earlier this year I moved my email to Fastmail, and I can move it elsewhere if I want to, with zero disruption or downtime. I really wish email providers would make custom domains either the default, or a very obvious option when signing up. Google is already a domain registrar, and other providers could partner with one. Granted, this option would not be free (though Google could probably swing making it free; they just wouldn't let you use the domain for anything else unless you start paying for the registration), so that would reduce its desirability for most people, unfortunately. (On the downside, I wish I could convert my GSuite account to a regular Google Account, because GSuite accounts are occasionally crippled in random ways, and now I'm not even using the email part of it anymore. But that's a separate complaint.)

megapatch 4y ago
Totally +1 this. Buy a domain (= "rent" it long term) and be free.
Gareth321 4y ago
> I really wish email providers would make custom domains either the default, or a very obvious option when signing up. They don't because it creates huge friction to leave. They'll have to be mandated to do this, and I think they should be.
pjerem 4y ago
> though Google could probably swing making it free Even if it was cost-effective for Google (which I doubt), it's not going to happen because it would mean that, to be effective, Google would have to allow you to transfer it out of their hands (to change your provider) and thus, it would also mean that you could basically use Gmail to hold domains for free.
woutr_be 4y ago
I was in the same boat as you, got a free GSuite account with custom domain, then moved my email to FastMail. I’m considering just removing my GSuite account, and registering a new one, although still evaluating the implications that might have.

Animats 4y ago

"You can take some control over your own identity in the current email-based online ecosystem by renting a domain name" Originally, the idea was that you owned a domain name. Gradually, domain registrars have moved this to the concept that you're just renting it from them. Although you can still transfer domains to another registrar. I'd like to find a domain registrar whose contractual terms stated that you own your domain name, and they are contractually prohibited from cancelling it or revoking it without a court order. Basically, a contract that forbids what lawyers call "self-help".

conjuredbytes 4y ago
For ICANN accredited registrars, aren't there rules about when and how a registrar can delete or revoke a domain? You can submit complaints to ICANN here: https://www.icann.org/compliance/complaint https://www.icann.org/compliance/complaint
- Falkon1313 4y ago
  Yes, and one of those cases is anytime you don't pay them rent to renew your lease before the expiration.
  - immibis 4y ago
    If you didn't have to keep paying for domain names, big businesses would have registered all the interesting ones two decades ago. Same for physical property.
neodypsis 4y ago
The Costa Rican NIC has the concept of personal domains for costa-rican citizens, but it isn't free [0]: > Personal .cr domain names may only be registered by Costa Rican citizens over the age of 12 having an identity card and included in the Citizens' Registry of the Supreme Electoral Court of Costa Rica. In order to certify that they are citizens of the Republic of Costa Rica, the identity card must be valid at the time of submitting the application to register the personal domain name. > NIC Costa Rica shall only approve a personal domain name once it verifies that its holder meets the requirements set forth in Section 9 of this document for the registration of personal domain names. The applicant must also send a copy of both sides of the identity card to the email info@nic.cr. > Requests for personal domain names under .cr shall be reviewed by NIC Costa Rica using the tools provided by the National Registry and the Supreme Electoral Court of Costa Rica, as well as any other means NIC Costa Rica considers necessary. [0] https://www.nic.cr/politicas/personales https://www.nic.cr/politicas/personales

httpz 4y ago

Before writing about your bulletproof technical solution to this problem, think about all of your older relatives on facebook. Is the solution something they'll be able to handle?

koheripbal 4y ago
As long as emails can be routed to/from the old system, more technical adopters can still adopt a more secure solution.

somat 4y ago

It is a bit overkill, but the closest you can get to owning your online identity is to "own" your own domain. sarcastiquotes used because you don't really own a domain you only rent it. I run my own mail server because I am a sys-admin and running a mail-server is something I do for fun. but the amount of agency you gain once you have a domain is staggering. people without a domain are pretty much second class net citizens. I wish municipality offered domains, for example: you move to St Louis you would get name.stlouis.mo.us this would give you the same agency online that a mail address gets you offline.

kingds 4y ago
but if you stop renting from the registrar then whoever rents the domain next gets access to your email. seems like a horrible solution to this problem. at least i can be reasonably confident that google will never recycle my email address and send all incoming mail to a rando.
- colordrops 4y ago
  Being in control of your own destiny entails more risk.
- account42 4y ago
  > at least i can be reasonably confident that google will never recycle my email address and send all incoming mail to a rando. What do you base that confidence on? Short, meaningful names are valuable and there is no reason to believe that somewhere down the line they won't be recycling ones that aren't used anyway as premium accounts.
deepdriver 4y ago
I think I have a good idea of what you mean, but for those who don't, could you elaborate on the benefits?
- TeeMassive 4y ago
  You can give unique throwaway addresses to people you don't fully trust (e.g. newsletters, recruiters) and apply the rules you want. It would be very naive to think that Big Tech won't abuse their market positions.

deleted 4y ago

[deleted]

exabrial 4y ago

These days it’s your cell provider with ‘texting as 2fa’

lilsoso 4y ago
Could you explain how the tracking via the cell provider works with 2fa? Do you mean they have an idea of the services you use based on the phone number of the sender and perhaps the format of the message? Or do you mean they actually tie the 2fa code to your identity through agreements with third party services?

netmonk 4y ago

Interesting that nobody question the core concept of online identity. In real world it is useless. Same in the internet. The axiom of online identity is useless and only exists for the sole purpose of control by capitalist cybernetics

Falkon1313 4y ago
I think it's especially useful, largely because it's easy to have multiple IDs online, for different aspects of your life. And for the most part, they can be as pseudonymous as you want them to be, or they can be linked directly to your real-world ID, if you want that. Those things give you control, instead of others.

TedDoesntTalk 4y ago

> people should stop and think carefully when choosing the @example.com part of their email address. It’s a decision you’re probably set to live with for life Really? I’ve had dozens of email addresses over decades. I have a few favorites but even those have changed over time. I think your is hyperbole.

demopathos 4y ago
Then you fall outside the probably. The overwhelming majority of people have a single address their entire life
- TedDoesntTalk 4y ago
  I guess those people only have one job their whole lives, too, and never lived before Gmail became popular.
  - demopathos 4y ago
    Jobs exepted for pretty clear reasons. And yes Gmail has been dominant for quite a bit of time - especially since the period where it was possible to have your email be your digital identity.

TekMol 4y ago

The solution I hope for: A crypto based toplevel domain like the Ethereum Name Service. But with a twist: If I lose my private key, the domain is not lost, but locked for 3 months and nobody, not even the registry can move it. After the 3 months, if I stay "silent" and not confirm my ownership via my private key, the registry can move the domain. The registry should have this process: During these 3 months, I have to start an expensive process at the registry to validate my identity and ownership of the domain. When completed successfully, the registry will move the domain to my new public key. So the worst thing that could ever happen to my domain (and my emails under that domain) is that I end up in a situation that is normal for domains today: That the registry has control over it.

sph 4y ago
Sounds like ICANN with more steps. If there's a central registry doing the ID validation, why the blockchain?
raffy 4y ago
For a .eth name, this is trivial: provide operator approval to N-additional wallets
hiq 4y ago
You mention losing your private key, what about somebody else getting it (data leak, hack...) and controlling your identity before the end of the 3 months? Blockchain-based "solutions" are not actual solutions because they don't account for this fairly common case. Once they do, they rely on a 3rd-party, and you're back to square one.

satellite2 4y ago

It's a technical board so everyone propose technical solutions. But I really hope that the solution will be a legal one. That the law will change to make it as hard to kick someone from an email service as to cut running water. And to forbid the companies to define anti litigation, private courts etc. in their TOS.

jakuboboza 4y ago

That is why you setup 2 factor authentication ;) it puts one item outside of their control.

bartq 4y ago

Is there email counterpart of HTTP 301? This could be the solution. But it would have to be much more secure and would require human confirmations to make the "301" to take the effect.

d2wa 4y ago
Email relay and email forwarding filters. However, it’s up to the email service provider to handle this. Which is out of your control.
- account42 4y ago
  It's also not really equivalent since there is no feedback to the sender that the canonical address for the user has changed.

Gareth321 4y ago

I've spent the last year or so moving from a Gmail address to my own domain (hosted on Worksplace). I kept reading report after report of people having their Google accounts banned for any and no reason, and I realised how many services I have tied to me email. I'd be spending a lifetime trying to recover them all, and I don't think I'd be successful for half of them. Now, if my Workspace account is ever banned, I can immediately take my domain elsewhere and retain access to everything.

atoav 4y ago

I like my email provider — he is me.

zh3 4y ago

I too run my own mail server, using a mixed approach of a dumb cloud server as a point of presence on the public internet and a private server at home as the actual email store. That gets the benefit on being a non-consumer presence as far as the internet is concerned, but with all personal data stored locally. With a little practice and experience, it's not difficult for those with technical skills to host their own email on a cheap rented server (along with a personal website etc). Buy a suitable domain, host at a reputable supplier on a dedicated host (i.e. IP) and there should be few problems (test with free accounts from the bit tech outfits). Even nicer is to use Dovecot for IMAP either locally or remote. I run it locally with fetchmail to periodically (or on demand) grab email from the public server, with a little utility that lists the remote headers first so I can decide which/whether any are worth even downloading and reading - quite often it's a single click to delete everything unread.

EbNar 4y ago

juniperplant 4y ago

Somewhat tangential, but I wonder where do people using their own domain draw the line. I personally use a "stable" firstname@lastname.com for supposedly trusted, long-term services (e.g. bank, utilities, etc.) and for services that require my identity for obvious reasons (e.g. shipping/billing address). For sites where I prefer not to reveal my identity (not even to the site operator), I use Fastmail’s Masked Email (akin to iCloud Hide My Email). This, however, means I don't own those addresses, and if I need to change email provider for whatever reason, it's a PITA to update the email address field on possibly hundreds of sites (assuming you can). I could buy a domain like randomstring.com to use with catch-all, but then I would be more likely to be tracked across sites, especially in the case of data leaks (which do happen eventually). Then there are those awkward in-person situations when somebody asks my email and I have to say firstname@lastname.com. What's a good tradeoff?

OkGoDoIt 4y ago
I also use firstbame@lastname.com for personal and professional communication. But for signing up for services, I have a custom domain name with a catchall email address. Then I register with something along the lines of servicename@mycustomdomain.com. All of those emails go to the same place. The only downside is sometimes a person I work with or whatever will go ahead and sign me up for some third-party service using my main first name last name email address, which is kind of annoying.
ckcheng 4y ago
> Then there are those awkward in-person situations when somebody asks my email and I have to say firstname@lastname.com. I suggest making up a domain name unrelated to your actual name exactly because of this. Saying "homer@juniper plant.com" feels less awkward to me than saying "homer@homer simpson.com".
quickthrower2 4y ago
I think the intersection of [service where I prefer not to reveal my identity] and [matters if I lose access to the service and therefore control of the email address at 1000-1 odds] is very small. It is going to be mostly for things like a spare "fun" Reddit account, or some one off crappy give your email to download the PDF sort a thing.

gvko 4y ago

Enter Blockchain...

eimrine 4y ago
Implement private message transfer then I will get rid of email.

jillesvangurp 4y ago

It's a pretty accurate assessment. A large number of people depend on freemium email addresses provided by the likes of gmail and many others as well as some ISPs. Those are only valid for the duration of your relationship with the companies behind those and that relation may be terminated for reasons beyond your control. Then there are a lot of company email addresses that are only valid for the duration of people's employement. Only a small minority of people have their own domain. And saying that they own it would be a stretch. They merely own the right to pay to renew their lease every year. Then there is the wide spread practice of tying identity to a single email address that may be used to reset passwords. There is no good technical reason to limit it just one email address or indeed just email addresses; that's just a historical quirk that gets mindlessly copied by world + dog when they spin up a new service because of the mistaken belief widely held by non technical product managers that that just is how things are done. Only a minority of websites provide 2FA, which enhances security but does not solve the root problem of people not owning their identity. Changing your email address is not a feature that is commonly supported either. Whatever email address you pick when you signup is what you are stuck with. If your email provider shuts you down, you lose the ability to reset passwords, receive notifications, etc. IMHO the way out of this mess is to start making multi modal signins more common. Some companies already do this but it is not a widespread practice. Simply encourage users the ability to add multiple ways of authenticating themselves. Phone number based authentication, device based authentication (using e.g. QR codes), public key based authentication (ssh or otherwise), social media account based verification, etc. are all viable strategies to authenticate. And why have just one? Combined with 2FA this makes for a much more durable account ownership. It can also remove a lot of onboarding friction as you don't actually need users to provide a lot of information about themselves. A lot of the reasons for this not being so common has to do with a misguided notion of big trillion dollar companies wanting to "own" the relation with their users. So Google will not allow people to use their MS owned identities to sign in or vice versa. Even though both implement variations of OpenID 2.0 and generally have a large overlap in terms of how they implement security technically. It's a simple matter of ownership. They own you. They consider you their property. Your identity is theirs to control. This is the notion that needs to be challenged for this to ever be resolved. Imagine that citizenship worked like that. It doesn't of course. But imagine. There would be a lot of stateless citizens no longer able to prove who they are because gmail shut them down or whatever. That would be unacceptable of course. Banks can't get away with that either. A passport is all you need to reclaim ownership of your bank accounts. And in case of your death, a death certificate and some paper work from a notary is good enough for your surviving relatives. Online identity should be just as strong. People confuse the means of authentication with the actual identity.

alangibson 4y ago

Email should be considered legally equal to physical mail. It should be regulated by the USPS. Just like a company can't yank your ability to send snail mail, they shouldn't be able to yank your ability to send electronic mail.

account42 4y ago
I definitely would not want my mail to be regulated by Deutsche Post AG so this only works for countries that are not already prone to privatizing their essential services.

icare_1er 4y ago

I have the feeling that we are gradually shifting from email-centric to phone-centric systems. With 2FA and recovery, ultimately, your unique phone number becomes more and more THE foundation of everything online, and switching phone number is harder than switching email.

octobus2021 4y ago
I agree. Our online identities are ultimately based on our phone numbers, and email provider can only serve as identity provider since they require your phone number.

poseva 4y ago

After the NYT article [0] I purchased (rented) my own domain, created a cloudflare account and started using their email routing to forward all the email to my gmail address. I also configured gmail to allow me to send emails from the new email address. As I have a small child and use a lot the telemedicine services I do have a fear that I will be blocked soon. A drawback to this is that cloudflare does not allow you to forward to multiple email addresses. [0] https://www.nytimes.com/2022/08/21/technology/google-surveillance-toddler-photo.html https://www.nytimes.com/2022/08/21/technology/google-surveil...

6ak74rfy 4y ago
Consider Forward Email instead of Cloudflare: their free tier is pretty good and they allow forwarding to multiple emails. Not affiliated with them, just a happy user myself.

alexslobodnik 4y ago

web3 is correcting this with censorship resistance usernames via ethereum name service[0]. a lot of famous folks have already using them [1]. [0] https://ens.domains/ https://ens.domains/ [1] https://ethleaderboard.xyz/ https://ethleaderboard.xyz/

hiq 4y ago
With no recourse if you lose your private key, is it really any better for 99% of users?
- alexslobodnik 4y ago
  that's a good question. would i rather have an entity that i have no power against (google) or only my own error? the outcome is the same, i had x, now i don't. personally, i'd prefer being responsible, but it is a by a thin margin. that being said, key management has and will continue to get easier. so over time, the risk of key loss should diminish.
  - hiq 4y ago
    > Personally, I'd prefer being responsible, but it is a by a thin margin. I'd wager that's not the case for 90% of users choosing the email provider they trust the most, both in terms of what they expect the risks are, and what they actually risk in practice. > key management has and will continue to get easier You're talking about the blockchain space where it was not even the state of the art when it started. Key management remains a problem in all spaces, but it has even more dramatic consequences when you have no recourse.
    - alexslobodnik 4y ago
      i'm not well versed on key management outside of the blockchain space. one key management wallet i like is https://www.argent.xyz/ https://www.argent.xyz/ maybe this is rudimentary by traditional standards but this an advancement for wallet management. the key feature is you can recover access to your assets even if you lose your keys through social recovery.

synthc 4y ago

This the reason I use my own domain and a paid email service. I used Gmail before but got super worried about all the stories of accounts getting blocked with no way of contacting a human. Sure domain registrars and email providers are not infallible, but it's a huge step up from trusting Googles customer service to do the right thing

denton-scratch 4y ago

There's a lot of hyperbole in this article. > These extra trips through different email servers strip the emails of information about the sending server which is critical to protect against spam and email forgery. Sure, a forwarder can strip information from a forwarded message; but that's a rogue SMTP server. And this would be your previous email provider; so you'll know whether they're rogue before you start forwarding messages through them. > Email was designed in the 1960s s/1960s/1970s/ You get your own domain; then host your email at a provider that offers bring-your-own-domain. Now you have a portable email. Your domain registrar cannot interfere with your messages, unless you choose to host your email with your domain registrar. I agree that an email address is a poor identity token. As with SQL, an identity should be an opaque object with no embedded meaning. In addition to being an identity, an email address is a communications endpoint, and is parseable, so it's not opaque.

running101 4y ago

Why not use google workspace, I believe you can have a custom domain.

shultays 4y ago

You can be your email provider, or own your own domain at least. Honestly owning a domain should be a minimum for anyone that is capable and their email is almost their identity

anotheraccount9 4y ago

I use purelymail with a registered domain. That's the best I can do that is functional and practical at this point.

SergeAx 4y ago

...and your mobile operator. Good luck to Google Fi users.

hjupadhyay 4y ago

In order to have an email with my own domain I need to own (rent technically) a domain. Registering a domain requires an existing email. Which is obviously going to be from a third party / consumer email provider whose domain I don’t have control over. Kind if circular reference situation!

samoit 4y ago

For those afraid of misconfiguring/running their own server, you can use a ready to use docker with everything in it and with nice security defaults (no relay, for instance): https://github.com/docker-mailserver/docker-mailserver https://github.com/docker-mailserver/docker-mailserver

cx42net 4y ago

Shameless plug here, but that is the purpose of [ImprovMX](https://improvmx.com https://improvmx.com). We forward emails from a custom domain to a destination email that can be updated. My personal email is contact@{custom domain} and currently points to Gmail because I never took the hassle to change it, but if someday I decide to move elsewhere (I'm contemplating Fastmail and Protonmail), all I will have to do is update my destination email at ImprovMX and that's all. This is a liberty that only us, tech people, can grasp. My parents, even my wife, doesn't see the importance of being locked to mail provider.