9 ms·

Google has most of my email because it has all of yours (2014)

252 points by pabs3 1y ago

renewiltord 1y ago
I have my personal email set to Gsuite. I hide nothing. It’s in my DNS MX. Just look it up before you send me a message on my personal. Since MX records are what you need in the first place, it’s what you should be checking. If someone wants to opt out, they are welcome to.
alganet 1y ago
[flagged]
- TZubiri 1y ago
  huh? If I send an encrypted email to someone I trust to decrypt it, then they won't have it. I agree with the sentiment, but E2E encryption exists and is technically possible.
  - alganet 1y ago
    Yeah. But that's too much paranoia even for me, a schizophrenic. If someone powerful wants your encrypted data, they will have it. It's dumb. In my case, it would make them look like fools. Not even a dick pick or secret affair to blackmail me. Just a dumb guy. I care for my privacy, but I truly have nothing of importance to hide to the point of taking those extra steps.
    - TZubiri 1y ago
      "If someone powerful wants your encrypted data, they will have it. It's dumb." But that's not at all the case, you can definitely encrypt data in a way that no one can break it. Even if you assume there's an all powerful state that can decrypt everything. There's a distribution of malicious actors with varying degrees of power, you'll at least agree that not all eavesdroppers can decrypt your comms, they most certainly will be a minority, and an infitesimally small minority at that point. You can encrypt such that you protect yourself against the 99th percentile. Regarding what you have to protect, you could be in charge of an organization, and you don't need to encrypt data yourself but consider how data is encrypted by your vendors, and when those vendors get hacked or their db's leaked, you can assess how it affects your company. Just in general, knowing the many complexities of how data is encrypted and not encrypted and accessed and leaked and subpoenad, is much more useful than the binary of "THEY" have my data or "THEY" don't
      - alganet 1y ago
        That's dumb.
        TZubiri 1y ago
        Glad we are having a rich nuanced discussion
- tasty_freeze 1y ago
  If someone wants to kill you, they can. Get over it. It is silly to lock your door as even a low skilled person with right tools can break in a locked house easily.
TZubiri 1y ago
Only by a very wide definition of "having" your email. Having data in one of your servers means not much if it's not usable or findable. Can a government submit a subpoena to Gmail asking for your emails? Unlikely, they would just answer that you are not a client of theirs and as such they don't have your emails. Can they submit a subpoena asking Google to hand over all of the emails that your clients sent or received from your address? Sure they can. It's going to be a way harder sell to the judge and the reason and burden of proof will be that much higher, as it would essentially be closer to fishing or mass surveillance. But it's something that I can see passing for cases of national security or child abuse. Nothing I would personally worry about, but I understand if you want to wear a tinfoil hat. Semantics and nuance matter.
- arcanemachiner 1y ago
  What a blissfully-naive take. You're more than a decade behind the times. https://en.m.wikipedia.org/wiki/PRISM https://en.m.wikipedia.org/wiki/PRISM In 2023, Google received requests for user information for about 900,000 accounts, and complied with ~80% of them, and both numbers are on the rise. https://transparencyreport.google.com/user-data/overview https://transparencyreport.google.com/user-data/overview
  - TZubiri 1y ago
    Am I the one that is a decade behind the times? You are the one citing a case from 15 years ago, lol. Also, I'm not sure what seems to be contradicting here. The exception that you are brining up proves the rule. If I say that humans have five fingers in each hand, will bringing up the famous case of the sixed fingered lady be relevant at all to the discussion? Especially if I worded it specifically saying that "most" humans have 5 fingers? Check my wording, I said unlikely. The fact is, most government agencies do not have access to your emails, let's say that the NSA does, which is debatable, great, that is 0.01% of the government, and probably 0% of companies (that are not Google), unless they submitted a subpoena as part of some litigation. Feel free to obsess about the one or two agencies that have access to emails for national security reasons, and feel free to lump it into "THE government". But I don't think you'll ever make any important nuanced cybersecurity trade offs with that attitude, you'll just want to encrypt everything until none of your users can do shit (if you have users at all, you may not even be able to get a job because you are doubtful of sending your resume to anyone, and you might be too busy configuring your own email server instead of just using gmail and doing other productive stuff.)
xyst 1y ago
e2e encryption with s/mime is the answer, unless y’all think otherwise. I played around with it the other day. Installed actalis/digicert s/mime cert on client. Sent emails between the 2 addresses. Emails decrypted locally on clients but same message sent on webmail client is encrypted/unreadable (besides subject line)
- dylan604 1y ago
  Tony the tiger says "that's grrrrreat." Now, send an e2e encrypted to another email that is not yours and see how long it takes them to understand what you sent. PGP for email has been around for a very long time, and there's a reason it is unheard of by the general public. it is a pain in the ass.
  - spacedcowboy 1y ago
    Indeed it is, for now.
    - brewdad 1y ago
      It's been going on at least as long as Year of the Linux Desktop. Stop trying to make fetch happen.
      - spacedcowboy 1y ago
        Yeah, well, I might know something you don’t :) Remind me: 18 months.
    - mr_mitm 1y ago
      Even Zimmermann appeared to have given up on it. https://www.vice.com/en/article/even-the-inventor-of-pgp-doesnt-use-pgp/ https://www.vice.com/en/article/even-the-inventor-of-pgp-doe...
  - waynesonfire 1y ago
    Or, it's just too good. Why did it take so long to have encrypted DNS? Another example, https, which uses tls for secure communication still manages to leak the domain name because the Server Name Indication in the ClientHello is sent in plain text before encryption is established. The solution, ECH, is no where to be seen. The folks that read your e-mail and monitor your online presence do not want you to use these tools.
meta_ai_x 1y ago
Imagine having to live your life with this irrational paranoia that your email is so important that you make irrational decisions of making your email less secure(by trying to host it yourself), more hassle (setting personal email servers). To what end? Unless you are in the top 20,000 or so people who are actively being snopped on, it's just a waste of life to spend so much time to de-google, de-openai, de-meta, de-microsoft your life. But of course this is a highly unpopular opinion on HN, but I have yet to see a single instance of a person whose life dramatically changed because they hosted their own email server instead of just using gmail. (unless you sell those services to other paranoid people and make money)
- mtillman 1y ago
  [flagged]
- jowea 1y ago
  There are a few other reasons to degoogle than paranoia. The most obvious reason are the surprise bans.
  - alganet 1y ago
    Nope, Google is a friend. It keeps my records outside of reach of possible lower actors. If it turns out to be an enemy, then everyone's screwed either way.
    - jazzyjackson 1y ago
      No, not everyone, just random people who suffer false positives by the abuse sensing algorithms
- 9cb14c1ec0 1y ago
  > irrational decisions of making your email less secure(by trying to host it yourself) data-less attack on some very widely used open source software.
- user3939382 1y ago
jowea 1y ago
Needs to consider the other big email providers too.
- omeid2 1y ago
  Yes, Microsoft has a rather large portion of corporate and business email, a very large portion of it.
photochemsyn 1y ago
Google's products are garbage - any honest person can report on the degeneration of their services. That's what happens with monopolies over time. Google would like you to think they're a God's-eye master of reality of course... but they're not. Just another corporate flop, like IBM etc.
- shadowgovt 1y ago
  IBM stock is currently valued at $231.59 billion. Seems like a pretty nice gig, being a corporate flop.
  - TZubiri 1y ago
    That's the value of the stock, which is distinct from the quality of the product. You can make a lot of money selling bad products for a high price. (At least if they are bad for users but good for businesses)
    - shadowgovt 1y ago
      I'm sure there are different ways to compute value, but I'm having a hard time finding one where they're a flop. - cash on hand: $17 billion - revenue 2024: $62 billion - total employees: 294,000 - Fortune 500 ranking: 63rd. - total customers: hard to estimate, approx. 100,000 worldwide How are we defining 'flop' in this context? The metrics don't seem to show it.
      - TZubiri 1y ago
        Suppose they have an amazing sales team and shit software.
        shadowgovt 1y ago
        ... then they're wildly successful. It seems the key takeaway here is "You can write just-good-enough software, sell it well to people for whom it solves real problems they have, and succeed." Probably something all of us in the venture, startup, service-sector-tech space could stand to learn.
Barrin92 1y ago
I think in general treating email any other way than "everyone will eventually read your mail" makes no sense. Email communication, from forwarding to how people archive, to copy-pasting provides no security and is so brittle, just assume anything you write in an email is for public consumption. Reminds me of a post from a few years ago about encrypted mail as a security LARP (https://www.latacora.com/blog/2020/02/19/stop-using-encrypted/ https://www.latacora.com/blog/2020/02/19/stop-using-encrypte...) If you want secure messaging that nobody else will snoop on use an application dedicated to.. secure messaging. It's never what email was for and it's not how it's being used.
- cryptoz 1y ago
  I mean, for normal people that is exactly how it’s being used. Your receipts for everything are automatically emailed with all kinds of private info for example. Nobody, and I mean nobody, is expecting those receipts to be public. And since all that is in your email you reasonably expect your other email to be private as well. Email is auth now. People do not use email the way you are describing.
  - shadowgovt 1y ago
    One of the biggest issues with the way the modern internet works is that it technically works the way GP describes but people believe it works the way you describe. Even assuming all encryption is configured correctly at the endpoints so we can discount the risk of mid-transit interception and comprehension (do I assume CVS has encryption set up correctly on their outbound receipt emails? I do not...) People think it's like the postal network but it's more like the mail lands at the post office and they hand you a copy of it, while they retain the originals.
- Gigachad 1y ago
  Article is from 2014 where this was more of a valid concern. These days I don't think people send email for anything other than external communication with businesses. And only in western countries.
  - 1y ago
Congeec 1y ago
Because social media. The same goes for a phone number. If your contacts give out a phone book, your number is leaked.
- deleted 1y ago
  [deleted]
waltercool 1y ago
[dead]
kjellsbells 1y ago
As I see it, the problem is that the email address has been conflated with your identity, and that is extremely problematic. It should only ever have been a somewhat transient reachability identifier. As an identity it then gets linked to concepts like authorization and trust, eg "we'll send this code to your email, because we implicitly trust that only you can see your email, and that youll always be able to get to it." Every so often one sees a cri de coeur from someone who has learned this lesson the hard way when Google locks them out of their account, the key to their digital life evaporates, there's nothing they can do about it. Alternative identifiers exist, eg handles on sites like HN, but they are second-order artifacts of the email as ID. Given the stakes, then, you have to decide whether to try and control your identity by bulding your own infra for email (domain, mail server, dkim etc and a fair bit of hell), paying for someone to run the infra (eg getting a proton or fastmail address), and hoping they dont enshittify or fail, or letting Google or Microsoft control it and hoping you dont fall foul of them. All these options have drawbacks. Side musing follows: I dont know what the solution to identity is on the Internet. A very long time ago, X.509 certs issued by quasi government authorities was mooted as part of a international directory system. I can see a future authoritarian state falling in love with this idea again, esp with the resulting lack of anonymity,..but also the ability to "kill" people on the Internet simply by revoking their cert.
- thoi4234234234 1y ago
  Not just email - today it's almost impossible to have a decent life without a (smart) phone and being tied-in through OTP verification. All these things have become so essential that it's shocking that it's not regulated like a utility (or even as a right given their systemic imposition).
  - brewdad 1y ago
    OTP verification can largely be worked around because so many sites still use SMS codes which a dumb phone can handle. Similarly, 2FA codes can be handled on a PC without requiring a smart phone. It adds hurdles but can be done. Where it becomes challenging is situations where smart phones truly are required. When I attended college football games last fall, all tickets were e-tickets. You were required to present a QR code on your device or your ticket stored in Apple Wallet or Google Wallet. I ran into the same situation with my local theater's ticketing. You haven't lived until you've witnessed an audience with an average age of 70 try to figure out their tickets on their smartphones when they've never used them for that before nor had any notion that was even POSSIBLE.
thisislife2 1y ago
AKA, "Shadow profiling" - you can prevent it somewhat by sending Gmail users Protonmail or Tuta's password encrypted email.
- type0 1y ago
  which in many cases they just won't open and then complain about it
  - thisislife2 1y ago
    Not my experience. For example, when I rented a house, I sent some personal documents to the landlord through such password protected email and also texted them the password to their phone. The called me about it and I explained to them this was the latest "secure mail" technology, as "old email" are just like postcard mail which anyone can read. And hence "old email" technology is not secure enough when we are dealing with financial documents, and personal ids etc. I later ended up helping them create a new ProtonMail id which is what he now uses as his primary mail account.
lovelysoni03 1y ago
[dead]
0xbadcafebee 1y ago
Yeah, and also the post office has all of your mail (because they can/do scan it), and pretty much anyone can intercept SMS, only slightly harder to intercept voice calls on PSTN, and SMTP has always been unencrypted. Private databases sold to the government by corporations already have your job history, political affiliations, sexuality, etc. Most communications throughout history have not been secure. Despite this, it hasn't been abused nearly as much as it could be. I'm not sure if it's because the scale is difficult, or the technical side, or nobody thinks to suggest it to the despots. It's probably a combination of things. Ironically we tend to fear the abuse of power when it doesn't happen, and then ignore or accept it when it does happen. So the fear/hang-wringing/jumping-through-hoops seems pointless. I still believe that if you really are concerned about what you're saying, you should say it in a clandestine way. E2E encryption is like a giant red flag saying "I might be doing something shady". Asking grandma about her special cakes [when she doesn't bake] will fly under the radar unless someone is looking really hard.
- moralestapia 1y ago
  If the post office (or somebody else) reads your mail that's a federal crime. Your analogy is moot.
- vasco 1y ago
  > Despite this, it hasn't been abused nearly as much as it could be How would you classify submarines parked next to fiber optic cables slurping up data?
  - goku12 1y ago
    I hope you have a reference as to how an optic fiber cable can be tapped like that. I also hope you've seen how heavily jacketed these cables are. The cables are so sensitive to mechanical disturbances (but without interference to communication) that it can often sense itself getting shifted around. Tapping it will require a lot more than that. How do you avoid such tip offs? And as far as I know, emails are not E2E encrypted, but they are almost always encrypted in transit. Why go through all the trouble just to get encrypted data? Now I concede that all those things (OFC, TLS) may have vulnerabilities that can theoretically be exploited. But do you send such valuable information over the internet that it's worth their cost and effort to retrieve it? And if your answer is yes by some chance, would you transmit it without taking adequate security measures? In comparison, Google and the others have billions of emails simply sitting unencrypted in their storage, ready for access at zero cost. I can't see your argument contradicting the information security risk posed by these companies.
ChrisArchitect 1y ago
Some previous discussions: (2022) https://news.ycombinator.com/item?id=33304075 https://news.ycombinator.com/item?id=33304075 (2014) https://news.ycombinator.com/item?id=7731022 https://news.ycombinator.com/item?id=7731022
foreigner 1y ago
This is also true for our DNA, because of companies like 23AndMe!
- dumb1224 1y ago
  Genotyping platforms are an entirely different beast I think.
Arcuru 1y ago
The email monopolies annoy me the most when other apps assume you have gmail/apple/etc. Notion recently launched email integration that only works with GMail, and all the marketing was basically "we added Email to Notion" instead of "we added _Gmail_ to Notion".
- anal_reactor 1y ago
  I remeber even I was applying for a job but the company's spam filter automatically bounced back everything from Yahoo. Fun.
  - dspillett 1y ago
    In fairness, there was a time when yahoo's network was a major source of junk mail.
    - amelius 1y ago
      That's discrimination of people by their email address.
      - dspillett 1y ago
        It is. But if a provider is not taking junk mail seriously, what is the alternative? There is a limit to have much effort the receiving network can be expected put into filtering yahoo ham from the yahoo spam, and a limit to even how possible it is to reliably perform that filtering. Just expecting your users to put up with the influx of junk you can't filter (without too many false positives) and putting up with the processing load of attempts to filter it, are not valid options beyond a certain point. Yahoo knew they were a problem for some time before others started blocking mail from them en-mass and did nothing, or at least nothing useful, to fix it at their end despite warnings. Also, “choice of email provider” is not a protected class in any jurisdiction that I know of.
      - dspillett 1y ago
        Also/instead (too late to edit this to the end of my previous reply): for tech jobs it is discrimination by knowledge (or lack thereof) about the industry applicants are looking for a job in, which for non-entry-level rolls is perfectly valid!
neilv 1y ago
> For almost 15 years, I have run my own email server which I use for all of my non-work correspondence. I do so to keep autonomy, control, and privacy over my email and so that no big company has copies of all of my personal email. [...] A few years ago, I was surprised to find out that my friend [...] a very privacy conscious person who is [...] at the EFF — used Gmail. Almost the exact same situation here, except my friend was once at an EFF-related organization. I think a lot of things, like the tech industry turning into '80s Wall Street bros, wore down some of his on-principle determination. And when life got too busy, he gave up, and moved to GMail. I was very surprised to learn. Another friend, who in school was one of those MIT student Linux hackers who had serious OPSEC as ordinary practice, once he had kids, and had to think about continuity of all the things he ran if something should happen to him, ended up moving home stuff to popular Apple and Google services.
- jbaber 1y ago
  This my situation: too busy to be a nerd about e-mail. Fastmail fixed it.
terminalbraid 1y ago
Tangentially this is also why email encryption is effectively impossible.
a10c 1y ago
> if all of your friends use Gmail, Google has your email anyway the last time I emailed a friend was probably 5 years ago. Email is for much more personal stuff.
snvzz 1y ago
Email is completely broken. Efforts like DIME[0] do not have anywhere the traction they should. 0. https://en.wikipedia.org/wiki/Dark_Mail_Alliance https://en.wikipedia.org/wiki/Dark_Mail_Alliance
dspillett 1y ago
An addendum for going forward from 2025: Microsoft's AI, and any malicious agent that hacks into Recall's data store¹, will in future have most of my “end-to-end encrypted” comms, because many people will be running Recall by default, perhaps without even knowing. ---- [1] Or are we trusting those dumb enough to use a completely unencrypted sqlite datastore for the initial versions, not to do something less dumb, but still dumb enough to be a security issue, in current/future versions?
mrkramer 1y ago
I care about my privacy but I use almost all of the Google's products because they are so easy to use and because they are so ubiquitous. But for people who are super worried about your privacy, did you ever refuse to send or receive an email from Gmail or some other big corp email provider e.g. Hotmail/Outlook, Yahoo etc.? For example if there was en masse boycott of Gmail and Outlook maybe people would start switching to more privacy aware email providers. Let's say that you want to contact a blogger and s/he says: "I bounce off emails from Gmail, Outlook and Yahoo, please use other more privacy friendly email providers."
shaunatfe 1y ago
[dead]
johnea 1y ago
Clearly most people just don't give a sh1t. They throw themselves gushingly at every app that oozes out from under a rock, and then they wonder how they became so economically f_cked...
CommenterPerson 1y ago
There may not be any technical solution to this? As we HN readers like to think! Would we be OK with a monopoly business opening and scanning our postal mail, and sending us junk adverts based on this? Or worse? The internet is a public utility. We need to work towards better rules. Bit like the EU is doing.
renegat0x0 1y ago
Please correct me if I am wrong. What grinds my gears about email monopoly is that you cannot create or integrate easily email client now. To access mail it is not enough to provide user & password & whatever. Things can provide access without compromising security. To access gmail? User needs to add access from some bullshit console settings, and stuff. I asked chatgpt how thunderbird is not required to do this, and it said that it has keys pregenerated, and big corpos can operate like that. I have not verified that any longer. Sounded credible. So annoying

252 points by pabs3 1y ago

I have my personal email set to Gsuite. I hide nothing. It’s in my DNS MX. Just look it up before you send me a message on my personal. Since MX records are what you need in the first place, it’s what you should be checking. If someone wants to opt out, they are welcome to.

alganet 1y ago

[flagged]

TZubiri 1y ago
huh? If I send an encrypted email to someone I trust to decrypt it, then they won't have it. I agree with the sentiment, but E2E encryption exists and is technically possible.
- alganet 1y ago
  Yeah. But that's too much paranoia even for me, a schizophrenic. If someone powerful wants your encrypted data, they will have it. It's dumb. In my case, it would make them look like fools. Not even a dick pick or secret affair to blackmail me. Just a dumb guy. I care for my privacy, but I truly have nothing of importance to hide to the point of taking those extra steps.
  - TZubiri 1y ago
    "If someone powerful wants your encrypted data, they will have it. It's dumb." But that's not at all the case, you can definitely encrypt data in a way that no one can break it. Even if you assume there's an all powerful state that can decrypt everything. There's a distribution of malicious actors with varying degrees of power, you'll at least agree that not all eavesdroppers can decrypt your comms, they most certainly will be a minority, and an infitesimally small minority at that point. You can encrypt such that you protect yourself against the 99th percentile. Regarding what you have to protect, you could be in charge of an organization, and you don't need to encrypt data yourself but consider how data is encrypted by your vendors, and when those vendors get hacked or their db's leaked, you can assess how it affects your company. Just in general, knowing the many complexities of how data is encrypted and not encrypted and accessed and leaked and subpoenad, is much more useful than the binary of "THEY" have my data or "THEY" don't
    - alganet 1y ago
      That's dumb.
      - TZubiri 1y ago
        Glad we are having a rich nuanced discussion
tasty_freeze 1y ago
If someone wants to kill you, they can. Get over it. It is silly to lock your door as even a low skilled person with right tools can break in a locked house easily.

TZubiri 1y ago

Only by a very wide definition of "having" your email. Having data in one of your servers means not much if it's not usable or findable. Can a government submit a subpoena to Gmail asking for your emails? Unlikely, they would just answer that you are not a client of theirs and as such they don't have your emails. Can they submit a subpoena asking Google to hand over all of the emails that your clients sent or received from your address? Sure they can. It's going to be a way harder sell to the judge and the reason and burden of proof will be that much higher, as it would essentially be closer to fishing or mass surveillance. But it's something that I can see passing for cases of national security or child abuse. Nothing I would personally worry about, but I understand if you want to wear a tinfoil hat. Semantics and nuance matter.

arcanemachiner 1y ago
What a blissfully-naive take. You're more than a decade behind the times. https://en.m.wikipedia.org/wiki/PRISM https://en.m.wikipedia.org/wiki/PRISM In 2023, Google received requests for user information for about 900,000 accounts, and complied with ~80% of them, and both numbers are on the rise. https://transparencyreport.google.com/user-data/overview https://transparencyreport.google.com/user-data/overview
- TZubiri 1y ago
  Am I the one that is a decade behind the times? You are the one citing a case from 15 years ago, lol. Also, I'm not sure what seems to be contradicting here. The exception that you are brining up proves the rule. If I say that humans have five fingers in each hand, will bringing up the famous case of the sixed fingered lady be relevant at all to the discussion? Especially if I worded it specifically saying that "most" humans have 5 fingers? Check my wording, I said unlikely. The fact is, most government agencies do not have access to your emails, let's say that the NSA does, which is debatable, great, that is 0.01% of the government, and probably 0% of companies (that are not Google), unless they submitted a subpoena as part of some litigation. Feel free to obsess about the one or two agencies that have access to emails for national security reasons, and feel free to lump it into "THE government". But I don't think you'll ever make any important nuanced cybersecurity trade offs with that attitude, you'll just want to encrypt everything until none of your users can do shit (if you have users at all, you may not even be able to get a job because you are doubtful of sending your resume to anyone, and you might be too busy configuring your own email server instead of just using gmail and doing other productive stuff.)

xyst 1y ago

e2e encryption with s/mime is the answer, unless y’all think otherwise. I played around with it the other day. Installed actalis/digicert s/mime cert on client. Sent emails between the 2 addresses. Emails decrypted locally on clients but same message sent on webmail client is encrypted/unreadable (besides subject line)

dylan604 1y ago
Tony the tiger says "that's grrrrreat." Now, send an e2e encrypted to another email that is not yours and see how long it takes them to understand what you sent. PGP for email has been around for a very long time, and there's a reason it is unheard of by the general public. it is a pain in the ass.
- spacedcowboy 1y ago
  Indeed it is, for now.
  - brewdad 1y ago
    It's been going on at least as long as Year of the Linux Desktop. Stop trying to make fetch happen.
    - spacedcowboy 1y ago
      Yeah, well, I might know something you don’t :) Remind me: 18 months.
  - mr_mitm 1y ago
    Even Zimmermann appeared to have given up on it. https://www.vice.com/en/article/even-the-inventor-of-pgp-doesnt-use-pgp/ https://www.vice.com/en/article/even-the-inventor-of-pgp-doe...
- waynesonfire 1y ago
  Or, it's just too good. Why did it take so long to have encrypted DNS? Another example, https, which uses tls for secure communication still manages to leak the domain name because the Server Name Indication in the ClientHello is sent in plain text before encryption is established. The solution, ECH, is no where to be seen. The folks that read your e-mail and monitor your online presence do not want you to use these tools.

meta_ai_x 1y ago

Imagine having to live your life with this irrational paranoia that your email is so important that you make irrational decisions of making your email less secure(by trying to host it yourself), more hassle (setting personal email servers). To what end? Unless you are in the top 20,000 or so people who are actively being snopped on, it's just a waste of life to spend so much time to de-google, de-openai, de-meta, de-microsoft your life. But of course this is a highly unpopular opinion on HN, but I have yet to see a single instance of a person whose life dramatically changed because they hosted their own email server instead of just using gmail. (unless you sell those services to other paranoid people and make money)

mtillman 1y ago
[flagged]
jowea 1y ago
There are a few other reasons to degoogle than paranoia. The most obvious reason are the surprise bans.
- alganet 1y ago
  Nope, Google is a friend. It keeps my records outside of reach of possible lower actors. If it turns out to be an enemy, then everyone's screwed either way.
  - jazzyjackson 1y ago
    No, not everyone, just random people who suffer false positives by the abuse sensing algorithms
9cb14c1ec0 1y ago
> irrational decisions of making your email less secure(by trying to host it yourself) data-less attack on some very widely used open source software.
user3939382 1y ago

jowea 1y ago

Needs to consider the other big email providers too.

omeid2 1y ago
Yes, Microsoft has a rather large portion of corporate and business email, a very large portion of it.

photochemsyn 1y ago

Google's products are garbage - any honest person can report on the degeneration of their services. That's what happens with monopolies over time. Google would like you to think they're a God's-eye master of reality of course... but they're not. Just another corporate flop, like IBM etc.

shadowgovt 1y ago
IBM stock is currently valued at $231.59 billion. Seems like a pretty nice gig, being a corporate flop.
- TZubiri 1y ago
  That's the value of the stock, which is distinct from the quality of the product. You can make a lot of money selling bad products for a high price. (At least if they are bad for users but good for businesses)
  - shadowgovt 1y ago
    I'm sure there are different ways to compute value, but I'm having a hard time finding one where they're a flop. - cash on hand: $17 billion - revenue 2024: $62 billion - total employees: 294,000 - Fortune 500 ranking: 63rd. - total customers: hard to estimate, approx. 100,000 worldwide How are we defining 'flop' in this context? The metrics don't seem to show it.
    - TZubiri 1y ago
      Suppose they have an amazing sales team and shit software.
      - shadowgovt 1y ago
        ... then they're wildly successful. It seems the key takeaway here is "You can write just-good-enough software, sell it well to people for whom it solves real problems they have, and succeed." Probably something all of us in the venture, startup, service-sector-tech space could stand to learn.

Barrin92 1y ago

I think in general treating email any other way than "everyone will eventually read your mail" makes no sense. Email communication, from forwarding to how people archive, to copy-pasting provides no security and is so brittle, just assume anything you write in an email is for public consumption. Reminds me of a post from a few years ago about encrypted mail as a security LARP (https://www.latacora.com/blog/2020/02/19/stop-using-encrypted/ https://www.latacora.com/blog/2020/02/19/stop-using-encrypte...) If you want secure messaging that nobody else will snoop on use an application dedicated to.. secure messaging. It's never what email was for and it's not how it's being used.

cryptoz 1y ago
I mean, for normal people that is exactly how it’s being used. Your receipts for everything are automatically emailed with all kinds of private info for example. Nobody, and I mean nobody, is expecting those receipts to be public. And since all that is in your email you reasonably expect your other email to be private as well. Email is auth now. People do not use email the way you are describing.
- shadowgovt 1y ago
  One of the biggest issues with the way the modern internet works is that it technically works the way GP describes but people believe it works the way you describe. Even assuming all encryption is configured correctly at the endpoints so we can discount the risk of mid-transit interception and comprehension (do I assume CVS has encryption set up correctly on their outbound receipt emails? I do not...) People think it's like the postal network but it's more like the mail lands at the post office and they hand you a copy of it, while they retain the originals.
Gigachad 1y ago
Article is from 2014 where this was more of a valid concern. These days I don't think people send email for anything other than external communication with businesses. And only in western countries.
- 1y ago

Congeec 1y ago

Because social media. The same goes for a phone number. If your contacts give out a phone book, your number is leaked.

deleted 1y ago
[deleted]

waltercool 1y ago

[dead]

kjellsbells 1y ago

As I see it, the problem is that the email address has been conflated with your identity, and that is extremely problematic. It should only ever have been a somewhat transient reachability identifier. As an identity it then gets linked to concepts like authorization and trust, eg "we'll send this code to your email, because we implicitly trust that only you can see your email, and that youll always be able to get to it." Every so often one sees a cri de coeur from someone who has learned this lesson the hard way when Google locks them out of their account, the key to their digital life evaporates, there's nothing they can do about it. Alternative identifiers exist, eg handles on sites like HN, but they are second-order artifacts of the email as ID. Given the stakes, then, you have to decide whether to try and control your identity by bulding your own infra for email (domain, mail server, dkim etc and a fair bit of hell), paying for someone to run the infra (eg getting a proton or fastmail address), and hoping they dont enshittify or fail, or letting Google or Microsoft control it and hoping you dont fall foul of them. All these options have drawbacks. Side musing follows: I dont know what the solution to identity is on the Internet. A very long time ago, X.509 certs issued by quasi government authorities was mooted as part of a international directory system. I can see a future authoritarian state falling in love with this idea again, esp with the resulting lack of anonymity,..but also the ability to "kill" people on the Internet simply by revoking their cert.

thoi4234234234 1y ago
Not just email - today it's almost impossible to have a decent life without a (smart) phone and being tied-in through OTP verification. All these things have become so essential that it's shocking that it's not regulated like a utility (or even as a right given their systemic imposition).
- brewdad 1y ago
  OTP verification can largely be worked around because so many sites still use SMS codes which a dumb phone can handle. Similarly, 2FA codes can be handled on a PC without requiring a smart phone. It adds hurdles but can be done. Where it becomes challenging is situations where smart phones truly are required. When I attended college football games last fall, all tickets were e-tickets. You were required to present a QR code on your device or your ticket stored in Apple Wallet or Google Wallet. I ran into the same situation with my local theater's ticketing. You haven't lived until you've witnessed an audience with an average age of 70 try to figure out their tickets on their smartphones when they've never used them for that before nor had any notion that was even POSSIBLE.

thisislife2 1y ago

AKA, "Shadow profiling" - you can prevent it somewhat by sending Gmail users Protonmail or Tuta's password encrypted email.

type0 1y ago
which in many cases they just won't open and then complain about it
- thisislife2 1y ago
  Not my experience. For example, when I rented a house, I sent some personal documents to the landlord through such password protected email and also texted them the password to their phone. The called me about it and I explained to them this was the latest "secure mail" technology, as "old email" are just like postcard mail which anyone can read. And hence "old email" technology is not secure enough when we are dealing with financial documents, and personal ids etc. I later ended up helping them create a new ProtonMail id which is what he now uses as his primary mail account.

lovelysoni03 1y ago

[dead]

0xbadcafebee 1y ago

Yeah, and also the post office has all of your mail (because they can/do scan it), and pretty much anyone can intercept SMS, only slightly harder to intercept voice calls on PSTN, and SMTP has always been unencrypted. Private databases sold to the government by corporations already have your job history, political affiliations, sexuality, etc. Most communications throughout history have not been secure. Despite this, it hasn't been abused nearly as much as it could be. I'm not sure if it's because the scale is difficult, or the technical side, or nobody thinks to suggest it to the despots. It's probably a combination of things. Ironically we tend to fear the abuse of power when it doesn't happen, and then ignore or accept it when it does happen. So the fear/hang-wringing/jumping-through-hoops seems pointless. I still believe that if you really are concerned about what you're saying, you should say it in a clandestine way. E2E encryption is like a giant red flag saying "I might be doing something shady". Asking grandma about her special cakes [when she doesn't bake] will fly under the radar unless someone is looking really hard.

moralestapia 1y ago
If the post office (or somebody else) reads your mail that's a federal crime. Your analogy is moot.
vasco 1y ago
> Despite this, it hasn't been abused nearly as much as it could be How would you classify submarines parked next to fiber optic cables slurping up data?
- goku12 1y ago
  I hope you have a reference as to how an optic fiber cable can be tapped like that. I also hope you've seen how heavily jacketed these cables are. The cables are so sensitive to mechanical disturbances (but without interference to communication) that it can often sense itself getting shifted around. Tapping it will require a lot more than that. How do you avoid such tip offs? And as far as I know, emails are not E2E encrypted, but they are almost always encrypted in transit. Why go through all the trouble just to get encrypted data? Now I concede that all those things (OFC, TLS) may have vulnerabilities that can theoretically be exploited. But do you send such valuable information over the internet that it's worth their cost and effort to retrieve it? And if your answer is yes by some chance, would you transmit it without taking adequate security measures? In comparison, Google and the others have billions of emails simply sitting unencrypted in their storage, ready for access at zero cost. I can't see your argument contradicting the information security risk posed by these companies.

ChrisArchitect 1y ago

Some previous discussions: (2022) https://news.ycombinator.com/item?id=33304075 https://news.ycombinator.com/item?id=33304075 (2014) https://news.ycombinator.com/item?id=7731022 https://news.ycombinator.com/item?id=7731022

foreigner 1y ago

This is also true for our DNA, because of companies like 23AndMe!

dumb1224 1y ago
Genotyping platforms are an entirely different beast I think.

Arcuru 1y ago

The email monopolies annoy me the most when other apps assume you have gmail/apple/etc. Notion recently launched email integration that only works with GMail, and all the marketing was basically "we added Email to Notion" instead of "we added _Gmail_ to Notion".

anal_reactor 1y ago
I remeber even I was applying for a job but the company's spam filter automatically bounced back everything from Yahoo. Fun.
- dspillett 1y ago
  In fairness, there was a time when yahoo's network was a major source of junk mail.
  - amelius 1y ago
    That's discrimination of people by their email address.
    - dspillett 1y ago
      It is. But if a provider is not taking junk mail seriously, what is the alternative? There is a limit to have much effort the receiving network can be expected put into filtering yahoo ham from the yahoo spam, and a limit to even how possible it is to reliably perform that filtering. Just expecting your users to put up with the influx of junk you can't filter (without too many false positives) and putting up with the processing load of attempts to filter it, are not valid options beyond a certain point. Yahoo knew they were a problem for some time before others started blocking mail from them en-mass and did nothing, or at least nothing useful, to fix it at their end despite warnings. Also, “choice of email provider” is not a protected class in any jurisdiction that I know of.
    - dspillett 1y ago
      Also/instead (too late to edit this to the end of my previous reply): for tech jobs it is discrimination by knowledge (or lack thereof) about the industry applicants are looking for a job in, which for non-entry-level rolls is perfectly valid!

neilv 1y ago

> For almost 15 years, I have run my own email server which I use for all of my non-work correspondence. I do so to keep autonomy, control, and privacy over my email and so that no big company has copies of all of my personal email. [...] A few years ago, I was surprised to find out that my friend [...] a very privacy conscious person who is [...] at the EFF — used Gmail. Almost the exact same situation here, except my friend was once at an EFF-related organization. I think a lot of things, like the tech industry turning into '80s Wall Street bros, wore down some of his on-principle determination. And when life got too busy, he gave up, and moved to GMail. I was very surprised to learn. Another friend, who in school was one of those MIT student Linux hackers who had serious OPSEC as ordinary practice, once he had kids, and had to think about continuity of all the things he ran if something should happen to him, ended up moving home stuff to popular Apple and Google services.

jbaber 1y ago
This my situation: too busy to be a nerd about e-mail. Fastmail fixed it.

terminalbraid 1y ago

Tangentially this is also why email encryption is effectively impossible.

a10c 1y ago

> if all of your friends use Gmail, Google has your email anyway the last time I emailed a friend was probably 5 years ago. Email is for much more personal stuff.

snvzz 1y ago

Email is completely broken. Efforts like DIME[0] do not have anywhere the traction they should. 0. https://en.wikipedia.org/wiki/Dark_Mail_Alliance https://en.wikipedia.org/wiki/Dark_Mail_Alliance

dspillett 1y ago

An addendum for going forward from 2025: Microsoft's AI, and any malicious agent that hacks into Recall's data store¹, will in future have most of my “end-to-end encrypted” comms, because many people will be running Recall by default, perhaps without even knowing. ---- [1] Or are we trusting those dumb enough to use a completely unencrypted sqlite datastore for the initial versions, not to do something less dumb, but still dumb enough to be a security issue, in current/future versions?

mrkramer 1y ago

I care about my privacy but I use almost all of the Google's products because they are so easy to use and because they are so ubiquitous. But for people who are super worried about your privacy, did you ever refuse to send or receive an email from Gmail or some other big corp email provider e.g. Hotmail/Outlook, Yahoo etc.? For example if there was en masse boycott of Gmail and Outlook maybe people would start switching to more privacy aware email providers. Let's say that you want to contact a blogger and s/he says: "I bounce off emails from Gmail, Outlook and Yahoo, please use other more privacy friendly email providers."

shaunatfe 1y ago

[dead]

johnea 1y ago

Clearly most people just don't give a sh1t. They throw themselves gushingly at every app that oozes out from under a rock, and then they wonder how they became so economically f_cked...

CommenterPerson 1y ago

There may not be any technical solution to this? As we HN readers like to think! Would we be OK with a monopoly business opening and scanning our postal mail, and sending us junk adverts based on this? Or worse? The internet is a public utility. We need to work towards better rules. Bit like the EU is doing.

renegat0x0 1y ago

Please correct me if I am wrong. What grinds my gears about email monopoly is that you cannot create or integrate easily email client now. To access mail it is not enough to provide user & password & whatever. Things can provide access without compromising security. To access gmail? User needs to add access from some bullshit console settings, and stuff. I asked chatgpt how thunderbird is not required to do this, and it said that it has keys pregenerated, and big corpos can operate like that. I have not verified that any longer. Sounded credible. So annoying