44 ms·

This is actually terrifying to me. If my domain goes, so goes my email -- everything is @myname.com, so I won't receive any email. If my email is gone then I ju

This is actually terrifying to me. If my domain goes, so goes my email -- everything is @myname.com, so I won't receive any email. If my email is gone then I just instantly lost access to a big chunk of the internet services I use, and my online identity might as well be dead. Sure I still have my work email but that's no consolation for all the services registered to my domain email. I'm not sure what the right course of action here is to mitigate such a risk. Add backup emails on a different domain registered with a different registrar to services that support such a thing? Stop worrying because it's rare enough that it's a waste of time? Is this what happens to people that get banned on gmail?

qingcharles 3y ago
I've recently been through this and it is a total nightmare. I lost my phone number too, so there was no way to use that validation channel. And many systems have no human support now, so you are super screwed. And then things break for no reason at all and panic the shit out of me. My Namecheap TOTP stopped working today for no reason at all. So I had to go through hours of support to verify my identity, but the whole way through I was thinking "What if I can't verify?"
nucleardog 3y ago
It's a rabbit hole to go down, for sure. I spent a while one week going through all my online identity, services I use, etc and putting together basically a dependency tree. What kicked this off was an overlapping but probably more unusual concern. Basically, I was worried that I had things _too_ secure. If I lost certain access, I'd be _screwed_. It's great that this account needs 45 factor 6 dimensional holographic password authentication to log in, but what happens if I lose something or get bonked on the head and forget something or... how can I recover access, but also set this up in a way where the backdoor I leave is _not_ one that's easily accessible to others. Anyway, long story short is I have a separate ccTLD domain from my country that is _exclusively_ for use as the root of my identity/recovery. Everything related to it is in a separate account. It charges to a credit card that's not used for anything else. The only thing it does is receives email and dumps them into object storage so I can periodically review. (I don't want them forwarded elsewhere in case the email is something like a password recovery email.) The recovery solution for this is the ccTLD's dispute resolution policy, and finally my (local) courts. As sexy as that Cocos Islands or Indian Ocean Territory or vanity TLD is, I have a lot more options more easily available to me with my local ccTLD administrator and local courts. I'm pretty much relying on the court's ability to accurately verify my identity as the lock on the back door.
- teddyh 3y ago
  > The recovery solution for this is the ccTLD's dispute resolution policy, and finally my (local) courts. As sexy as that Cocos Islands or Indian Ocean Territory or vanity TLD is, I have a lot more options more easily available to me with my local ccTLD administrator and local courts. I'm pretty much relying on the court's ability to accurately verify my identity as the lock on the back door. I work at a domain name registrar, and I agree completely. In fact, I have recommended this attitude for years¹. Use your local ccTLD if at all reasonable. 1. <https://news.ycombinator.com/item?id=32802909 https://news.ycombinator.com/item?id=32802909> <https://news.ycombinator.com/item?id=32801880 https://news.ycombinator.com/item?id=32801880> <https://news.ycombinator.com/item?id=30598899 https://news.ycombinator.com/item?id=30598899>
- mbork_pl 3y ago
  Maybe use a secret sharing scheme and give parts of the secret to a few people you trust?
Dalewyn 3y ago
I'm using my Hotmail (yes I'm old, shut up) for my critical-to-life email communiques because I'm reasonably sure Microsoft won't randomly shit on me, unlike Google whom I'm always wary of even though I've had my Gmail for the better part of 2 decades now. For services that allow tying more than one email to, I've got one or the other as a backup/secondary so I won't be completely fucked one way or the other. As a general concern it's good to not have all your eggs in one basket anyway. If it's critical, have a backup plan and ideally a backup plan to the backup plan.
gerdesj 3y ago
I have exactly two email identities and one mobile phone number, oh and a slack handful of "POTS" (VOIP really) numbers. I run the lot myself. VoIP - my company has a retail account with a wholesaler. I can allocate UK phone numbers at will. My wife set up a new business a few years ago and I had another phone number with distinctive ring running within 20 mins. Obviously not your usual setup. My dad and stepmum have a RasPi running their phones at home. At my place it's a VM. email - despite the usual HN groupthink with regards email, I have been running tiny email systems as well as some rather larger ones for quite some time - decades. I do note that this does not work for everyone but for me in the UK it does. I do have access to long running static IPs and have made sure that their "reputation" is top notch. I recently added a "vanity" domain for a friend so they can escape ISP lock in. Their surname is the same as a village in North England and some wankers had squatted on village.co.uk and wanted £25,000 for it. I advised my friend that if he registered a UK LTD with his family name then we could probably get the .co.uk by default. I registered .org.uk instead - too much faff for my friend. I set up SPF to use my family's MTA (Exim) to ensure that things tie up. A .org.uk domain costs about £6 + VAT (sales tax) hereabouts. I suggested £20 per annum as a charitable donation of his choice, in return for me running his email. He chose St Margaret's Hospice. It turns out that both my mum and his mum received end of life care from St Madge's. I have digressed somewhat! You do need at least two identities for safety. You mention "my domain" - do you actually run it? If not then you need another one as well. Do not, whatever you do, rely on any single hyperscaler to give a shit. The well informed user can route around damage in the cloud. It sounds like you are unlikely to run your own system(s) so have a backup plan. Remember that say FB provide a smtp service if that helps - ISTR that id@facebook.com should work. There are lots of other freeish email offerings. Just make sure you have two well known identities that those whom you care about can contact you with. You can also recommend the same advice to them.
Arnavion 3y ago
Yes, different domain on a different registrar is the usual solution.

qingcharles 3y ago

I've recently been through this and it is a total nightmare. I lost my phone number too, so there was no way to use that validation channel. And many systems have no human support now, so you are super screwed. And then things break for no reason at all and panic the shit out of me. My Namecheap TOTP stopped working today for no reason at all. So I had to go through hours of support to verify my identity, but the whole way through I was thinking "What if I can't verify?"

nucleardog 3y ago

It's a rabbit hole to go down, for sure. I spent a while one week going through all my online identity, services I use, etc and putting together basically a dependency tree. What kicked this off was an overlapping but probably more unusual concern. Basically, I was worried that I had things _too_ secure. If I lost certain access, I'd be _screwed_. It's great that this account needs 45 factor 6 dimensional holographic password authentication to log in, but what happens if I lose something or get bonked on the head and forget something or... how can I recover access, but also set this up in a way where the backdoor I leave is _not_ one that's easily accessible to others. Anyway, long story short is I have a separate ccTLD domain from my country that is _exclusively_ for use as the root of my identity/recovery. Everything related to it is in a separate account. It charges to a credit card that's not used for anything else. The only thing it does is receives email and dumps them into object storage so I can periodically review. (I don't want them forwarded elsewhere in case the email is something like a password recovery email.) The recovery solution for this is the ccTLD's dispute resolution policy, and finally my (local) courts. As sexy as that Cocos Islands or Indian Ocean Territory or vanity TLD is, I have a lot more options more easily available to me with my local ccTLD administrator and local courts. I'm pretty much relying on the court's ability to accurately verify my identity as the lock on the back door.

teddyh 3y ago
> The recovery solution for this is the ccTLD's dispute resolution policy, and finally my (local) courts. As sexy as that Cocos Islands or Indian Ocean Territory or vanity TLD is, I have a lot more options more easily available to me with my local ccTLD administrator and local courts. I'm pretty much relying on the court's ability to accurately verify my identity as the lock on the back door. I work at a domain name registrar, and I agree completely. In fact, I have recommended this attitude for years¹. Use your local ccTLD if at all reasonable. 1. <https://news.ycombinator.com/item?id=32802909 https://news.ycombinator.com/item?id=32802909> <https://news.ycombinator.com/item?id=32801880 https://news.ycombinator.com/item?id=32801880> <https://news.ycombinator.com/item?id=30598899 https://news.ycombinator.com/item?id=30598899>
mbork_pl 3y ago
Maybe use a secret sharing scheme and give parts of the secret to a few people you trust?

Dalewyn 3y ago

I'm using my Hotmail (yes I'm old, shut up) for my critical-to-life email communiques because I'm reasonably sure Microsoft won't randomly shit on me, unlike Google whom I'm always wary of even though I've had my Gmail for the better part of 2 decades now. For services that allow tying more than one email to, I've got one or the other as a backup/secondary so I won't be completely fucked one way or the other. As a general concern it's good to not have all your eggs in one basket anyway. If it's critical, have a backup plan and ideally a backup plan to the backup plan.

gerdesj 3y ago

I have exactly two email identities and one mobile phone number, oh and a slack handful of "POTS" (VOIP really) numbers. I run the lot myself. VoIP - my company has a retail account with a wholesaler. I can allocate UK phone numbers at will. My wife set up a new business a few years ago and I had another phone number with distinctive ring running within 20 mins. Obviously not your usual setup. My dad and stepmum have a RasPi running their phones at home. At my place it's a VM. email - despite the usual HN groupthink with regards email, I have been running tiny email systems as well as some rather larger ones for quite some time - decades. I do note that this does not work for everyone but for me in the UK it does. I do have access to long running static IPs and have made sure that their "reputation" is top notch. I recently added a "vanity" domain for a friend so they can escape ISP lock in. Their surname is the same as a village in North England and some wankers had squatted on village.co.uk and wanted £25,000 for it. I advised my friend that if he registered a UK LTD with his family name then we could probably get the .co.uk by default. I registered .org.uk instead - too much faff for my friend. I set up SPF to use my family's MTA (Exim) to ensure that things tie up. A .org.uk domain costs about £6 + VAT (sales tax) hereabouts. I suggested £20 per annum as a charitable donation of his choice, in return for me running his email. He chose St Margaret's Hospice. It turns out that both my mum and his mum received end of life care from St Madge's. I have digressed somewhat! You do need at least two identities for safety. You mention "my domain" - do you actually run it? If not then you need another one as well. Do not, whatever you do, rely on any single hyperscaler to give a shit. The well informed user can route around damage in the cloud. It sounds like you are unlikely to run your own system(s) so have a backup plan. Remember that say FB provide a smtp service if that helps - ISTR that id@facebook.com should work. There are lots of other freeish email offerings. Just make sure you have two well known identities that those whom you care about can contact you with. You can also recommend the same advice to them.

Arnavion 3y ago

Yes, different domain on a different registrar is the usual solution.