8 ms·

Raise your hand if you feel like this is an unwarranted breach of privacy, but you have a gmail account and heavily depend on Google services. <ashamed>Raises

by fny 11y ago

Raise your hand if you feel like this is an unwarranted breach of privacy, but you have a gmail account and heavily depend on Google services. <ashamed>Raises own hand.</ashamed> I was so trusting and willing to give away my emails to Google when I was a kid (despite being fully aware of their intentions), but now, even though privacy infringements from all these other companies disturb me, I'm still a hypocritical sheep in Google's herd. Time to make some pretty heavy changes...

dade_ 11y ago
It takes planning and plenty of work, but I have almost completed migration to my own domain and away from gmail. I wish I had done it sooner, everyone needs to make their own place on the net. No need to be a serf.
- innguest 11y ago
  Are you hosting your own email server?
  - ironsides 11y ago
    and if you are rolling your own are you having any issues with spf or spam flags?
    - spc476 11y ago
      I run my own email server [1] using Postfix. I use greylisting [2][3] and it easily stops 50% of all spam. I looked into adding SPF, but decided against it as the effective rate was too low [4]. I've also recently looked at RBL [5] and while there were a few false positives (enough that I decided against immediately adding it) what it did catch was quite impressive [6]. Oddly enough, if I simply drop email addressed to my domain registration email [7] that is NOT from my registrar, then the amount of spam I receive would drop about 70%. But frankly, with the greylisting, the spam that does get through is easy enough to deal with. And I'm the only person who uses my domain for email. [1] I started in the web hosting business in '96 or '97 so this is pretty much old hat for me. [2] Definition: http://projects.puremagic.com/greylisting/ http://projects.puremagic.com/greylisting/ [3] Software I use: http://www.x-grey.com/ http://www.x-grey.com/ [4] http://boston.conman.org/2015/04/12.1 http://boston.conman.org/2015/04/12.1 [5] http://en.wikipedia.org/wiki/DNSBL http://en.wikipedia.org/wiki/DNSBL [6] http://boston.conman.org/2015/05/11.1 http://boston.conman.org/2015/05/11.1 [7] Yeah, I don't bother with the privacy settings on the domain registration.
      - JimDabell 11y ago
        I think ironsides was referring to sending email, not receiving it. Sending email from a mail server without a good reputation can often land your email in spam filters these days. It's all very well saying that the amount of spam you get is manageable, but that doesn't really matter if your own outgoing email becomes unreliable because you aren't using a recognised provider.
        ironsides 11y ago
        Jim, what can we do to increase the odds of our email reaching the intended destination on self-hosted domains?
        spc476 11y ago
        I'm not Jim, but what I've done is: 1) have a valid PTR record for the email server. 2) Set up SPF records. 3) Just run email on it. If you do run a webserver on the same server, DON'T RUN PHP! In my experience [1] the single most abused attack vector on webservers is PHP and about 60% of the time it's abused to install spam sending software on the server and that leads to the IP address getting marked as a spammer. [1] About fifteen years in web-hosting.
        e12e 11y ago
        This is sadly true. With just greylisting, spam isn't much of a problem. I get some spam, most of it to an address leaked from the adobe-hack (I don't drop mail to it, I just keep the few spam emails that get through greylisting, for possible future use for training a bayesian spam filter), and some sent to my publicly registered company email (mandated by law in Norway). It's unfortunately pretty hard to tell the difference between people being slow to reply to mails to gmail addresses, and google flagging your mail as spam for no discernibly good reason. Anecdotally they don't care about anyone other than gmail users, so there's not much to do about it other than a) give up on the idea that gmail interops with standard email, b) hope that more people move away from gmail, or c) just tell people that you don't care that your email is filtered as spam because they're using an email provider (gmail) that doesn't deal well with email.
    - marcosdumay 11y ago
      I run my email server (it actually does not provide any extra privacy, as it's on a linode), and 99% of the time, no, I don't have problems with spf and spam flags. (In fact, spf is great, I don't get the blame of sending spam anymore since I've set it.) There's an odd email server here and there that suspects anything that isn't gmail, there was even a mail server once that required me to prove I exist, but those are very few, and normally single user installations. The secret is that besides not sending spam, you must receive email. If you don't get enough email, other servers start suspecting you. And, of course, there are configuration problems - since I'm writing my own mail server, I get a few of them, but even on standard software you have to make sure you set it correctly.
zxyzzxxx 11y ago
For most people it is just search and email. Replacing email is easy, but search is harder since only Google has really accurate and relevant results( besides other giants that also snoop ). The best way to replace search is to use engines that respect privacy and if you need relevant results, those that convey Google's results to you.
- mirimir 11y ago
  Use https://search.disconnect.me/ https://search.disconnect.me/ . You can use Bing, DuckDuckgo, Google or Yahoo as the search engine. "We don’t collect any of your personal info, including your IP address, other than information you voluntarily provide." See https://disconnect.me/privacy https://disconnect.me/privacy .
  - ajays 11y ago
    If too many people use this site, Google (and probably others too) will ban the IP.
    - FlaceBook 11y ago
      I doubt it. Even if Google can't use the data they're getting from searches done via that service to target ads to specific people, they're still getting valuable data on what people search for generally.
- saurik 11y ago
  Replacing email should be easy, but a surprising number of people, even tech people (which makes no sense at all as they should know better), not only use Gmail for their email storage but also for their email address, and so can never entirely extricate themselves from Gmail.
- dredmorbius 11y ago
  Search is the easier: DDG. I've been using it all-but-exclusively for nearly three years solid (and another couple on-and-off before). I do still make use of some Google special collections (Scholar, Books), and for time-bound searches (really wish DDG would support those). Email took me a while longer to sort, but while I have a primary personal account somewhere safe, anonymous / pseudonymous accounts were harder to provision. Yahoo and Microsoft both throw barriers (phone confirmation required) in the way. I ended up with an inbox.com account, like that.
mgraczyk 11y ago
> despite being fully aware of their intentions Those being....? Google earns its revenue by selling ads. They make more money when they show you ads that are likely to earn your business for the advertiser. Is it really so horrendous for Google to use information about you to show you ads for products you are more likely to purchase? Or are you concerned about something else?
- caseysoftware 11y ago
  Their stated goal is to "organize the world's information" but notice there's never a qualifier of the world's public information. While they've been able to determine a ton of information about social circles from interactions (gmail, voice, gchat, hangouts), the real understanding comes from G+ where we've categorized our contacts. Odds are you have circles that represent locations, employers, family, friends, clubs, etc. By analyzing those groupings, they can determine the relationships that aren't obvious just from the interactions. Now, combine that with the previous information and they know when you're talking with someone from HR from another company and how closely that company is linked to yours via shared/common circles. Sounds like a opportunity to sell an ad for 401k rollovers. :)
- fny 11y ago
  That was my though exactly when I started, but I've realized that Google gains a greater power than showing tailored ads. Google remembers who I was better than I do, knows everything that I do today, and can probably guess who I will become. They have the power to shape the information I see and influence me to do things that will drive their bottom line with unparalleled precision. We're really giving Google the power to read our minds: are you comfortable with that? Aside from that, I'm vaguely concerned about keeping everything about me so centralized. There's too much to lose too easily if someone manages to hack me despite the 2FA and insane passwords.
  - mgraczyk 11y ago
    I'm a little biased because I currently work at Google (not on anything related to ads or user data). Still, I am comfortable with giving Google enough information to understand and predict my behavior. The more I learn about the company from the inside, the more I trust them to do the right thing with my personal information to prioritize my quality of life over their bottom line. My perception is that Google genuinely believes that if they create high quality products that improve their user's lives, the revenue will follow. As for centralization, I agree that it is good to diversify for robustness and security. Still I trust Google's security measures more than I would trust my own if I were to set up email servers myself. Plus now that Google properties have U2F support and Chrome autogenerates passwords, I don't mind putting all my security eggs in the Google basket.
FlaceBook 11y ago
I have around 10 gmail accounts, each of which only receives random junk from various sites and mailing lists. I create compressed, encrypted archives that contain only random data, and use them to fill my "drive". Google is welcome to analyze as much of that as they want.
- madez 11y ago
  That behaviour is damaging. What is your reasoning and justification for it?
  - cherry_su 11y ago
    Why is it damaging?
  - FlaceBook 11y ago
    Because it upsets people like you. It's also the way I personally choose to protest the corporate and government surveillance state we're living in.
  - Beltiras 11y ago
    It actually isn't. Sometimes data has too much purity. Noise can actually help.
    - pdkl95 11y ago
      db poisoning can help, but just having an account (10 is even worse) inflates their numbers and strengthens the perception that people should use gmail. A long time ago, before the PC, market share perceptions lead to the idea that "Nobody got fired for buying IBM". It was a very effective trump card a salesman could use with managers to scare them away from the competition. In the PC era, "Nobody got fired for buying Microsoft" was abused in the same way. This is really just a consequence of Metcalfe's Law-style network effects, which is why it is usually a bad idea to use anything that is known to be a problem; even if you use it maliciously, just the fact that someone gets to legitimately claims they have a larger clientèle becomes an additional barrier in the path of any competitor.
Animats 11y ago
I've never been able to understand why anyone with a clue uses Gmail. I just have all my devices sync to an IMAP server provided by an ISP. Android phones have a perfectly good IMAP client. No ads, reasonably good spam filtering, and reasonably good search capability.
- cm2187 11y ago
  To me that's even worse. You are stuck with your ISP. What if you move home to a place where this ISP isn't available? There are commercial email providers in jurisdictions that do respect privacy. And it usually only costs the price of a couple of coffees per year.
  - timthorn 11y ago
    You're not locked in if you own the DNS registration.
    - Nullabillity 11y ago
      You're still depending on the ISP's archives.
      - TheOtherHobbes 11y ago
        Building your own Postfix server isn't hard. (It's certainly not easy, but it's not too hard either.) If you're paying someone for hosting anyway it's a few days of extra work from a cold start to set up a server on Linode or Digital Ocean and become your own ISP/hosting co.
        kuschku 11y ago
        Remember that Digital Oceans’ ToS allow them to access "all and any information" in case they "consider it necessary".
    - e12e 11y ago

by fny 11y ago

dade_ 11y ago

It takes planning and plenty of work, but I have almost completed migration to my own domain and away from gmail. I wish I had done it sooner, everyone needs to make their own place on the net. No need to be a serf.

innguest 11y ago
Are you hosting your own email server?
- ironsides 11y ago
  and if you are rolling your own are you having any issues with spf or spam flags?
  - spc476 11y ago
    I run my own email server [1] using Postfix. I use greylisting [2][3] and it easily stops 50% of all spam. I looked into adding SPF, but decided against it as the effective rate was too low [4]. I've also recently looked at RBL [5] and while there were a few false positives (enough that I decided against immediately adding it) what it did catch was quite impressive [6]. Oddly enough, if I simply drop email addressed to my domain registration email [7] that is NOT from my registrar, then the amount of spam I receive would drop about 70%. But frankly, with the greylisting, the spam that does get through is easy enough to deal with. And I'm the only person who uses my domain for email. [1] I started in the web hosting business in '96 or '97 so this is pretty much old hat for me. [2] Definition: http://projects.puremagic.com/greylisting/ http://projects.puremagic.com/greylisting/ [3] Software I use: http://www.x-grey.com/ http://www.x-grey.com/ [4] http://boston.conman.org/2015/04/12.1 http://boston.conman.org/2015/04/12.1 [5] http://en.wikipedia.org/wiki/DNSBL http://en.wikipedia.org/wiki/DNSBL [6] http://boston.conman.org/2015/05/11.1 http://boston.conman.org/2015/05/11.1 [7] Yeah, I don't bother with the privacy settings on the domain registration.
    - JimDabell 11y ago
      I think ironsides was referring to sending email, not receiving it. Sending email from a mail server without a good reputation can often land your email in spam filters these days. It's all very well saying that the amount of spam you get is manageable, but that doesn't really matter if your own outgoing email becomes unreliable because you aren't using a recognised provider.
      - ironsides 11y ago
        Jim, what can we do to increase the odds of our email reaching the intended destination on self-hosted domains?
        spc476 11y ago
        I'm not Jim, but what I've done is: 1) have a valid PTR record for the email server. 2) Set up SPF records. 3) Just run email on it. If you do run a webserver on the same server, DON'T RUN PHP! In my experience [1] the single most abused attack vector on webservers is PHP and about 60% of the time it's abused to install spam sending software on the server and that leads to the IP address getting marked as a spammer. [1] About fifteen years in web-hosting.
      - e12e 11y ago
        This is sadly true. With just greylisting, spam isn't much of a problem. I get some spam, most of it to an address leaked from the adobe-hack (I don't drop mail to it, I just keep the few spam emails that get through greylisting, for possible future use for training a bayesian spam filter), and some sent to my publicly registered company email (mandated by law in Norway). It's unfortunately pretty hard to tell the difference between people being slow to reply to mails to gmail addresses, and google flagging your mail as spam for no discernibly good reason. Anecdotally they don't care about anyone other than gmail users, so there's not much to do about it other than a) give up on the idea that gmail interops with standard email, b) hope that more people move away from gmail, or c) just tell people that you don't care that your email is filtered as spam because they're using an email provider (gmail) that doesn't deal well with email.
  - marcosdumay 11y ago
    I run my email server (it actually does not provide any extra privacy, as it's on a linode), and 99% of the time, no, I don't have problems with spf and spam flags. (In fact, spf is great, I don't get the blame of sending spam anymore since I've set it.) There's an odd email server here and there that suspects anything that isn't gmail, there was even a mail server once that required me to prove I exist, but those are very few, and normally single user installations. The secret is that besides not sending spam, you must receive email. If you don't get enough email, other servers start suspecting you. And, of course, there are configuration problems - since I'm writing my own mail server, I get a few of them, but even on standard software you have to make sure you set it correctly.

zxyzzxxx 11y ago

For most people it is just search and email. Replacing email is easy, but search is harder since only Google has really accurate and relevant results( besides other giants that also snoop ). The best way to replace search is to use engines that respect privacy and if you need relevant results, those that convey Google's results to you.

mirimir 11y ago
Use https://search.disconnect.me/ https://search.disconnect.me/ . You can use Bing, DuckDuckgo, Google or Yahoo as the search engine. "We don’t collect any of your personal info, including your IP address, other than information you voluntarily provide." See https://disconnect.me/privacy https://disconnect.me/privacy .
- ajays 11y ago
  If too many people use this site, Google (and probably others too) will ban the IP.
  - FlaceBook 11y ago
    I doubt it. Even if Google can't use the data they're getting from searches done via that service to target ads to specific people, they're still getting valuable data on what people search for generally.
saurik 11y ago
Replacing email should be easy, but a surprising number of people, even tech people (which makes no sense at all as they should know better), not only use Gmail for their email storage but also for their email address, and so can never entirely extricate themselves from Gmail.
dredmorbius 11y ago
Search is the easier: DDG. I've been using it all-but-exclusively for nearly three years solid (and another couple on-and-off before). I do still make use of some Google special collections (Scholar, Books), and for time-bound searches (really wish DDG would support those). Email took me a while longer to sort, but while I have a primary personal account somewhere safe, anonymous / pseudonymous accounts were harder to provision. Yahoo and Microsoft both throw barriers (phone confirmation required) in the way. I ended up with an inbox.com account, like that.

mgraczyk 11y ago

> despite being fully aware of their intentions Those being....? Google earns its revenue by selling ads. They make more money when they show you ads that are likely to earn your business for the advertiser. Is it really so horrendous for Google to use information about you to show you ads for products you are more likely to purchase? Or are you concerned about something else?

caseysoftware 11y ago
Their stated goal is to "organize the world's information" but notice there's never a qualifier of the world's public information. While they've been able to determine a ton of information about social circles from interactions (gmail, voice, gchat, hangouts), the real understanding comes from G+ where we've categorized our contacts. Odds are you have circles that represent locations, employers, family, friends, clubs, etc. By analyzing those groupings, they can determine the relationships that aren't obvious just from the interactions. Now, combine that with the previous information and they know when you're talking with someone from HR from another company and how closely that company is linked to yours via shared/common circles. Sounds like a opportunity to sell an ad for 401k rollovers. :)
fny 11y ago
That was my though exactly when I started, but I've realized that Google gains a greater power than showing tailored ads. Google remembers who I was better than I do, knows everything that I do today, and can probably guess who I will become. They have the power to shape the information I see and influence me to do things that will drive their bottom line with unparalleled precision. We're really giving Google the power to read our minds: are you comfortable with that? Aside from that, I'm vaguely concerned about keeping everything about me so centralized. There's too much to lose too easily if someone manages to hack me despite the 2FA and insane passwords.
- mgraczyk 11y ago
  I'm a little biased because I currently work at Google (not on anything related to ads or user data). Still, I am comfortable with giving Google enough information to understand and predict my behavior. The more I learn about the company from the inside, the more I trust them to do the right thing with my personal information to prioritize my quality of life over their bottom line. My perception is that Google genuinely believes that if they create high quality products that improve their user's lives, the revenue will follow. As for centralization, I agree that it is good to diversify for robustness and security. Still I trust Google's security measures more than I would trust my own if I were to set up email servers myself. Plus now that Google properties have U2F support and Chrome autogenerates passwords, I don't mind putting all my security eggs in the Google basket.

FlaceBook 11y ago

I have around 10 gmail accounts, each of which only receives random junk from various sites and mailing lists. I create compressed, encrypted archives that contain only random data, and use them to fill my "drive". Google is welcome to analyze as much of that as they want.

madez 11y ago
That behaviour is damaging. What is your reasoning and justification for it?
- cherry_su 11y ago
  Why is it damaging?
- FlaceBook 11y ago
  Because it upsets people like you. It's also the way I personally choose to protest the corporate and government surveillance state we're living in.
- Beltiras 11y ago
  It actually isn't. Sometimes data has too much purity. Noise can actually help.
  - pdkl95 11y ago
    db poisoning can help, but just having an account (10 is even worse) inflates their numbers and strengthens the perception that people should use gmail. A long time ago, before the PC, market share perceptions lead to the idea that "Nobody got fired for buying IBM". It was a very effective trump card a salesman could use with managers to scare them away from the competition. In the PC era, "Nobody got fired for buying Microsoft" was abused in the same way. This is really just a consequence of Metcalfe's Law-style network effects, which is why it is usually a bad idea to use anything that is known to be a problem; even if you use it maliciously, just the fact that someone gets to legitimately claims they have a larger clientèle becomes an additional barrier in the path of any competitor.

Animats 11y ago

I've never been able to understand why anyone with a clue uses Gmail. I just have all my devices sync to an IMAP server provided by an ISP. Android phones have a perfectly good IMAP client. No ads, reasonably good spam filtering, and reasonably good search capability.

cm2187 11y ago
To me that's even worse. You are stuck with your ISP. What if you move home to a place where this ISP isn't available? There are commercial email providers in jurisdictions that do respect privacy. And it usually only costs the price of a couple of coffees per year.
- timthorn 11y ago
  You're not locked in if you own the DNS registration.
  - Nullabillity 11y ago
    You're still depending on the ISP's archives.
    - TheOtherHobbes 11y ago
      Building your own Postfix server isn't hard. (It's certainly not easy, but it's not too hard either.) If you're paying someone for hosting anyway it's a few days of extra work from a cold start to set up a server on Linode or Digital Ocean and become your own ISP/hosting co.
      - kuschku 11y ago
        Remember that Digital Oceans’ ToS allow them to access "all and any information" in case they "consider it necessary".
  - e12e 11y ago