Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: World class unlimited email hosting for all your domains from $4/month

migadu.com

Post reply on HN
Print view View original

131–140 of 186 posts

Re: Show HN: World class unlimited email hosting for all your domains from $4/month

#131

Post by rovr138 »

hartator wrote: post #125
scott_karana wrote: post #121

Earlier quoted context omitted.

Yes. Password leaks, bruteforcing, and some "rubber hose" attacks can be mitigated by 2FA.

Password leaks are server-side. If they don't know how to properly hash passwords, how you can trust them to implement correctly 2FA? Bruteforcing is not realistic with even medium password strength. If by "rubber hose", you mean physically coercion, what would forbid the attackers to coerce you for your email or your phone as well? I think that the main reason 2FA has been pushed, it's for the Facebooks or the Googl…

> Or maybe I am missing something obvious?

Yes. Google and Facebook aren't the only ones.

> I think that the main reason 2FA has been pushed, it's for the Facebooks or the Google to have good reasons to get your valid email and your valid phone number.

You don't need a valid phone number to implement 2 factor authentication. There are implementations that require it, sure. But it's not the only way.

Re: Show HN: World class unlimited email hosting for all your domains from $4/month

#132

Post by samat »

dejan wrote: post #55
samat wrote: post #13

As far as I see you don't support Apple's native email push notifications, which is the exact reason I switched from Gmail to FastMail. Are you planning to implement that feature?

Thanks for the question. Unfortunately, asfik the email push notifications for Apple Mail have to be approved/implemented by the Apple team, so not much we can do there (yet). I believe FastMail was the only one besides iCloud that was approved for it.

No, there is Yahoo mail too. Did you reach out to Apple? I don't think it was apple with made the first step towards FastMail :)

Re: Show HN: World class unlimited email hosting for all your domains from $4/month

#133

Post by Spydar007 »

artemist wrote: post #14

If you are wondering about jurisdiction, according to their FAQ they are in Switzerland, and according to geoip their servers are hosted by OVH in France.

Hm, I'm rather surprised by the fact they are hosting mail servers with OVH. Most OVH servers are on several blacklists and OVH do not tend to take very kindly to people using email through their servers.

Re: Show HN: World class unlimited email hosting for all your domains from $4/month

#134

Post by smarinov »

2ion wrote: post #26

Interestingly, they use the Nodejs-based Haraka MTA instead of a more conservative choice like Postfix or Exim. I wonder what exact advantages they traded in more mature and certainly not much less performant software in for? A very good and even cheaper alternative to this service I can recommend is mailbox.org, run by German IT service specialist Heinlein. They deliver a full OpenXchange setup (mail, calendar, cont…

Yes, Posteo.de and Mailbox.org somehow seem to provide better value for less money.

Re: Show HN: World class unlimited email hosting for all your domains from $4/month

#135

Post by dejan »

protomikron wrote: post #64
dejan wrote: post #41

Earlier quoted context omitted.

Thank you for the input! I see your point and thank you for it! Honestly, we're not trying to play any marketing tricks, but rather give all help possible in order to decide whether it works for the interesting parties. Surely, we've got to trim down and brush off a lot of things. The mail going to junk is an unfortunate reality, there are never any guarantees with any mail service, and especially with new services.…

I really appreciate that and further think you are on the right track with honesty (drawbacks, etc.), as people get more and more immune to marketing bullshit. > We've already had the big ones play muscles on us several times. Without calling names, can you elaborate on that?

We've had our servers blacklisted for "low traffic" and completely legit, authenticated emails marked as Spam. Completely new IPs with 100/100 reputation were blacklisted just because they were not known from before. To get us off from their lists we were in for a web of problems. It is all rigged against the small hosters. If you are a bigger one, you can just get directly in touch. I was personally all for the idea of running own mail servers, but after the experience so far, would say good luck with that. Unfortunate though.

Re: Show HN: World class unlimited email hosting for all your domains from $4/month

#136

Post by hartator »

rovr138 wrote: post #131
hartator wrote: post #125

Earlier quoted context omitted.

Password leaks are server-side. If they don't know how to properly hash passwords, how you can trust them to implement correctly 2FA? Bruteforcing is not realistic with even medium password strength. If by "rubber hose", you mean physically coercion, what would forbid the attackers to coerce you for your email or your phone as well? I think that the main reason 2FA has been pushed, it's for the Facebooks or the Googl…

> Or maybe I am missing something obvious? Yes. Google and Facebook aren't the only ones. > I think that the main reason 2FA has been pushed, it's for the Facebooks or the Google to have good reasons to get your valid email and your valid phone number. You don't need a valid phone number to implement 2 factor authentication. There are implementations that require it, sure. But it's not the only way.

> Yes. Google and Facebook aren't the only ones. > You don't need a valid phone number to implement 2 factor authentication. There are implementations that require it, sure. But it's not the only way.

Are your referring to AWS Multi-Factor Authentication (MFA)? It's indeed a good implementation, but it's usage is very limited and most people are not referring to this when they are talking about 2FA.

Re: Show HN: World class unlimited email hosting for all your domains from $4/month

#137

Post by nkcmr »

dejan wrote: post #82
nkcmr wrote: post #77

Is there any plan to support two-factor authentication?

Hi, not at the moment, but we will bring it up for discussion! May I ask why do you consider it a worthy addition? Thank you!

For me personally, my email is a kingpin of my online presence. Gaining access to my email would provide overridable access to a good portion of my online accounts. Not to mention if my email was hacked by a bad actor, my identity could easily be stolen with all the emails I keep in my archives.

A motivation to Migadu as a service would be the ability to attract more enterprise customers. I know that at my company, MFA is required for all email accounts. Offering MFA would be very attractive to companies wanting to move their email over to Migadu.

Re: Show HN: World class unlimited email hosting for all your domains from $4/month

#138

Post by ce0311 »

brightball wrote: post #98
ce0311 wrote: post #60

This comes at the perfect time for me since I plan to move the mess of 4 domains with about 12 email mailboxes for projects, private and my family to a single more reliable service. Right now its on some Google Apps free tier from back when it was free and a cheapskate VPS hoster with terrible spam reputation and customer support. Just signed up for the mini plan and if it does in fact give me about 15 somewhat relia…

Seriously, take a look at Zoho.

Zoho definitely seems to offer more but at a way higher price because I'm billed by mailboxes/users it seems. Thing is all my 12 mailboxes together over 4 domains send maybe 150 mails a month overall. So low traffic, but multiple domains and mailboxes used by two or three people - simply to keep email from different places and for different purposes across 10 devices automatically sorted by mailbox. It's why I've been using a small VPS in the past but running my own mailserver is a pain to keep up to date, secure and spam free.

And Zoho has too many features I wouldn't use, I really just need a few (hopefully) reliable and (somewhat) secure IMAP capable inboxes which can be accessed by 10 different stationary and mobile devices.

Re: Show HN: World class unlimited email hosting for all your domains from $4/month

#139

Post by rovr138 »

hartator wrote: post #136
rovr138 wrote: post #131

Earlier quoted context omitted.

> Or maybe I am missing something obvious? Yes. Google and Facebook aren't the only ones. > I think that the main reason 2FA has been pushed, it's for the Facebooks or the Google to have good reasons to get your valid email and your valid phone number. You don't need a valid phone number to implement 2 factor authentication. There are implementations that require it, sure. But it's not the only way.

> Yes. Google and Facebook aren't the only ones. > You don't need a valid phone number to implement 2 factor authentication. There are implementations that require it, sure. But it's not the only way. Are your referring to AWS Multi-Factor Authentication (MFA)? It's indeed a good implementation, but it's usage is very limited and most people are not referring to this when they are talking about 2FA.

It could be a myriad of things.

- A physical device that you need to plug in

- A physical device that generates a token

- It could also be a token that gets sent to your phone or email and you input (like Facebook, Google, banks)

- An action you need to perform on another device (another bank)

- Google Authenticator (and other authenticator apps)

- I have also seen a message encrypted with your GPG public key that you decrypt and submit.

I have seen all of the above in different circumstances. The only one I have never seen is biometrics and it's usually because of the cost. Also, you can't change chop your finger of so it's harder to recall if there are issues unlike the rest.

> most people are not referring to this when they are talking about 2FA.

I only know what I have seen and have worked with.

I use Authenticator for SSH'ing into servers. My banks send me a code or I need to launch their app (CapitalOne) on my phone. My business account had a physical device that generated a token that I had to input in order to login. I have used software in the past that required a key. GPG I have seen in some questionable sites when crawling them.

Post reply on HN