3 ms·
A perspective I've read on this (Granted, this was at least 5 years ago) was that it was paradoxically much harder to compromise a Google account than it is to
by xp84 2y ago
A perspective I've read on this (Granted, this was at least 5 years ago) was that it was paradoxically much harder to compromise a Google account than it is to hijack a domain from many registrars. I read an account by someone who had a custom domain and the attacker had social-engineered the registrar into allowing him access, then he proceeded to update the MX, directing the email into the attacker's server.
This probably varies from one registrar to the next, and hopefully all have stepped up their game somewhat since that time, but it left an impression on me and caused me to update a lot of my accounts to my Gmail. Obviously, nobody is going to be able to call into a customer service desk and talk them into updating the gmail.com MX record, so for someone to illicitly gain access to mail sent to <me>@gmail.com either I have to be pwned myself (leaked a credential somehow) or there has to be a global 0-day exploit affecting it. In the latter case I am personally willing to bet that mine would not be the first one (or even in the top 10 million) accounts that the hackers would try, so I sleep pretty well.
- alchemist1e9 2y agoI understand. For me this raises the question of who is the most secure and reliable registrar for a US citizen. The security of a self-hosted approach appears to be determined by the security of the MX records, the self-hosted server security, and the IP security of the server. With the increasing authoritarian tendencies of governments it seems worth considering since they can clearly pressure the big tech companies to access or hijack your email address.
- nobody9999 2y ago>The security of a self-hosted approach appears to be determined by the security of the MX records, the self-hosted server security, and the IP security of the server. Don't forget DMARC/DKIM/SPF. They're necessary these days as well.
- alchemist1e9 2y agoDefinitely and I assume learning all of those will provide enhanced security layers also. I’m looking into MarkMonitor as a registrar with advanced security systems.
- nobody9999 2y agoSorry for the late reply. I've heard good things about Mail-in-a-Box[0], but haven't used it myself (although I have/do use(d) a bunch of the servers/tools amalgamated into the product). The setup guide[1][2] also gives a good overview of implementation requirements. Have fun! [0] https://mailinabox.email/ https://mailinabox.email/ [1] https://mailinabox.email/guide.html https://mailinabox.email/guide.html [2] Annoyingly, the setup guide wants to you 'curl setup.sh | bash'. You might want to check it out first at https://github.com/mail-in-a-box/mailinabox https://github.com/mail-in-a-box/mailinabox
- alchemist1e9 2y agoIt definitely seems doable. Another one is iredmail that has been mentioned. https://github.com/iredmail/iRedMail https://github.com/iredmail/iRedMail
- dredmorbius 2y agoI've lost several Google accounts through excessive authentication requirements with no viable alternatives. Fortunately I'd anticipated such issues and largely abandoned the platform. I have one account which I care about somewhat. I have to remember to log into that at least once per year to retain it or it will also be lost.
- dredmorbius 2y agoThe last time this happened: <https://toot.cat/@dredmorbius/111105389290062668 https://toot.cat/@dredmorbius/111105389290062668>
- alchemist1e9 2y agoSo what is your secure email approach? Any thoughts on this problem would be interesting.
- dredmorbius 2y agoPersonally, protonmail. I'd like to run my own infrastructure, that's problematic on several grounds, and regardless not a generalisable solution. I'm increasingly of the mind that government postal services should offer email directly. That should also come with privacy protections we're not seeing from private-sector providers. I'm not pretending that postal mail is free from government surveillance. However simply by way of the fact that it is universally used there is an exceptionally large contingency with concerns that it have strong privacy protections. Government-provision of email services would no more precluded private and individual provisions than is the case for parcel and courier delivery. What it does do is insure universal access at a defined minimum standard regardless of failings in commercial markets. (The details on what specifically should be considered is a long one, beginning with whether or not SMTP protocols are really suited to the present age, and including questions of access to multiple email aliases, pseudonymous email, and all that jazz. I'm not going to pretend this is settled or simple.) I'm also relying increasingly on postal rather than email. The latter is increasingly intractable.
- alchemist1e9 2y agoI’m looking into MarkMonitor as a possible registrar with extreme security features. I think gmail is very dangerous they can delete your existence by accident and they don’t even have a human to contact.