Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Best alternative to Gmail?

news.ycombinator.com

Post reply on HN
Print view View original

531–540 of 589 posts

Re: Ask HN: Best alternative to Gmail?

#531

Post by bad_user »

floatboth wrote: post #489
bad_user wrote: post #358

Earlier quoted context omitted.

I think this post from FastMail says it better than I do: https://fastmail.blog/2016/12/10/why-we-dont-offer-pgp/ Here are some arguments: 1. if it's encryption in the browser via a web interface, then it's not secure; the moment a web form asks for a password that can be used to decrypt your data, that's the moment your alarms should go off, because in spite of the claimed E2E encryption, their security might actual…

> if it's encryption in the browser via a web interface, then it's not secure Ehh… The big difference from native apps is that native apps are often signed by the developer. While with web apps, there's normally only a more "temporary" form of signing, that is, the TLS session. Assuming the app developers are better at securing their offline signing keys than TLS server keys, native apps with signatures are indeed mo…

The web isn't more audit-able.

The problem is that the web page loads on every request. This means that you, @floatboth, can be targeted with a broken client that leaks your keys next Wednesday between 13:00 and 14:00 and you'll never know it.

A native app is not something that loads every time you open it. And the binary you get is the same binary that everyone else gets and if you suspect something fishy, you still have that binary later for inspection. Compromising an app binary is not impossible mind you, as we could see with fake Apple XCode fooling Chinese developers into submitting infected apps to Apple's store, but it's much, much harder with security conscious users.

Also there's not much difference between highly compiled and obfuscated JS code and binary code. In both cases people start inspecting such apps by sniffing the outputs. Or otherwise it's not such a big jump from JS to assembly for people that do this for a living (e.g. I'm guessing anti-virus companies).

> IIRC it's also end-to-end between ProtonMail addresses or something?

It might be, but encryption that only works between ProtonMail accounts is no longer _email_. It's either a standard, or it's not email and I'm not interested in communicating only with ProtonMail users.

Re: Ask HN: Best alternative to Gmail?

#532

Post by eswoo »

splintercell wrote: post #506
bad_user wrote: post #464

Earlier quoted context omitted.

I don't want to attack EFF, I think they are on the right side, but it's just a general feeling I've got. For example when the Facebook and Cambridge Analytica scandal broke loose, that was the perfect opportunity for them to go out against private surveillance, guns blazing. Their reaction was late and with an article like " here's how to protect against Facebook tracking ", advising people to opt out in their Setti…

> For example when the Facebook and Cambridge Analytica scandal broke loose, that was the perfect opportunity for them to go out against private surveillance, guns blazing. This is a very American thing which I can imagine our European counterparts not like, that is govt (USG) is treated as an enemy because it is the most powerful entity in the world. For Europeans, it would Govt AND these mega corporations (because…

> Similarly NRA wouldn't care if you got kicked out of a movie theater for being concealed carry, but if a local city tries to ban guns in movie theaters, then NRA would step in.

Well, this isn't entirely accurate. They definitely do chafe at even private restrictions on anything gun. While I don't have time to research this right now, a quick search of "concealed carry in businesses" certainly returns some people complaining that businesses shouldn't be allowed to restrict that. And, if you dug a little deeper, I imagine the NRA would be weighing in there somewhere.

Re: Ask HN: Best alternative to Gmail?

#533

Post by bogomipz »

gknoy wrote: post #517
bogomipz wrote: post #511

Earlier quoted context omitted.

The Bill Rights are amendments "to" the Constitution, the very document that establishes the legitimacy of the government in the first place. How can you accept the legitimacy of the government and be anti-government at the same time? Even the Anti-Federalists, the group that advocated for the establishment of a Bill of Rights were not anti-government.

I take "anti-government" to mean that one is opposed to the actions that the government takes, in some situations, rather than being against the idea of the government. One can believe that a government is legitimate, while also believing that the government's power should be limited. One might argue that this idea is one of the core ideas of American government.

>"I take "anti-government" to mean that one is opposed to the actions that the government takes, in some situations, rather than being against the idea of the government."

That's silly, by that definition everyone would be anti-government then. Nobody agrees with the actions the government takes in all situations, not even within the same political party.

Re: Ask HN: Best alternative to Gmail?

#534

Post by remir »

TsomArp wrote: post #199
danpalmer wrote: post #187

Earlier quoted context omitted.

I don't feel like FastMail is that expensive for most people. Obviously, compared to free, it's expensive. But in real terms, I pay $70 every 2 years for it - works out about £25 a year for me, which is about the price of a meal out. I think that's worth it for secure and powerful email. I've never found it to be expensive.

I might be wrong, but I also think it is expensive. When I can have a 5 family plan from office365, including, word, excel, powerpoint, outlook, etc, with 1TB per account, 60 minutes of skype calls per account, etc, for 10 per month, 25 per month (for 5 people) only for email seems too expensive to me. The only thing lacking is custom email address.

Some time ago, Fastmail had a basic plan at like 10$/year for 250mb of storage and 1 alias. No Contact/Calandar sync, tho.

I thought that was a pretty good plan for most people. Unfortunately, they dropped this plan and the cheapest option is now 30$/year.

Re: Ask HN: Best alternative to Gmail?

#535

Post by brongondwana »

forapurpose wrote: post #501
brongondwana wrote: post #360

Earlier quoted context omitted.

Apart from the "users lose their passwords all the fricking time" problem (seriously, before we implemented https://fastmail.blog/2017/12/06/security-account-recovery/ , lost password was always in the top 3 most common support requests of the week report) Impementing per-message-encryption would turn us into a dumb blob store. The whole point of FastMail is the value add - fast search, ability to deal with a lot of…

Thanks; it's very helpful to know the ins and outs from a practitioner. I am confused by a couple of them: > if your provider get a subpoena or gets hacked, then a push request will make your device connect with the password, and boom - access granted If the message is decrypted only on my device, then that wouldn't matter. I'm guessing endpoint decryption is not what you (or maybe the GP) are talking about, but I do…

> If the message is decrypted only on my device, then that wouldn't matter. I'm guessing endpoint decryption is not what you (or maybe the GP) are talking about, but I don't know what you mean.

Oh yeah, sure - if you only decrypt on your device, then that's reasonable. We could encrypt to a public key on delivery. There's services that do that, but FastMail isn't interested in being one of those services. The tradeoffs mean we could do very little. Certainly not a webmail service.

> what's an app password

https://www.fastmail.com/help/clients/apppassword.html

It's a password that's created by the server and used on only one app. So if you lose your device, you can disable that one password only. Also, there's no chance that you'll reuse it across sites, so it can't leak from other services because you won't be using it there.

It's also limited to just the protocols that are used on that device, so can't be used to reset your password or payment details or install forwarding rules, etc.

> Why not do the processing then - spam filtering, build a search index of hash values, etc.? Then permanently (from the server's perspective) encrypt the old, stored messages

If you can search for keywords and find maching message blobs, that's nearly as good as having plaintext access. If was encrypted to only the endpoint, the usual issues of "you need to download the entire database to search your email" apply, and of course we're doing very little.

> How do the end-to-end secure messaging applications, such as Signal, handle those issues, if anyone knows?

They're not designed to be your long term memory, which simplifies things a lot. You basically lose access to your history. Which might be find if you don't care about the past, but that's not how I see email. Email is your electronic memory, and encryption+lost password means that nobody can get at your memories, not even you!

Re: Ask HN: Best alternative to Gmail?

#536

Post by brongondwana »

fovc wrote: post #430
lvillani wrote: post #86

FastMail. It's one of the few third party hosts to support push email on iOS with the native Mail app (it's a custom protocol based on APNS), since Mail doesn't implement IMAP IDLE [1]. They are also the main sponsors behind the JMAP protocol [2] and some open source projects such as the Cyrus IMAP server. [1]: https://fastmail.blog/2016/12/21/what-we-talk-about-when-we-... [2]: https://jmap.io

Just to provide some balance to the feedback: I've been using FastMail for 2 years and am mostly "meh" on it. My issues are with the web interface (which is largely why I use them instead of running my own server): - No delay send/undo send. Allegedly in the works for ages - Very buggy editor. Randomly slows to a crawl while composing, scrolls up and down erratically - Cannot handle very long threads very well. (sinc…

Thanks for the feedback - I've passed that to the product team. We're busy working on the JMAP replacement web interface, which has a fair bit rewritten.

Re: Ask HN: Best alternative to Gmail?

#537

Post by vidanay »

TsomArp wrote: post #324
pmorici wrote: post #239

Earlier quoted context omitted.

The Fastmail pricing tiers are $3, $5, and $9 per month which is $36, $60, and $108 per year respectively. If you look at their primary competition their prices are on par or slightly better. Here is a sampling... Google G Suite: $5, $10, and $25 per month per user. Microsoft: $4, $8, or $12.50 per month per user. ZOHO: $3, $7 per month per user billed yearly. [0] https://gsuite.google.com/pricing.html [1] https://pr…

Office365 family costs 10 per month for 5 users, with office desktop and web, with 1TB of space per user, and 60 minutes of skype per user...

And unfortunately, they don't offer custom domain support.

Re: Ask HN: Best alternative to Gmail?

#538

Post by pbhjpbhj »

gsich wrote: post #502
pbhjpbhj wrote: post #428

Earlier quoted context omitted.

>You can even host your own email server // As long as you don't want deliverability to Gmail or Outlook addresses. Though you can pay for Outlook deliverability it seems. They're very pinickety about allowing mail through from self-hosted or even low-traffic shared hosting IME [albeit limited].

You can self host and deliver to those addresses. Without troubles.

I've had no end of trouble. I'm not the only one according to reports from others online.

Re: Ask HN: Best alternative to Gmail?

#539

Post by brongondwana »

bogomipz wrote: post #451
fovc wrote: post #430

Earlier quoted context omitted.

Just to provide some balance to the feedback: I've been using FastMail for 2 years and am mostly "meh" on it. My issues are with the web interface (which is largely why I use them instead of running my own server): - No delay send/undo send. Allegedly in the works for ages - Very buggy editor. Randomly slows to a crawl while composing, scrolls up and down erratically - Cannot handle very long threads very well. (sinc…

Good to know, thanks. Can you say how is the search functionality and indexing on the inbox on Fastmail?

Our search is built on top of the Xapian search engine. We blogged about the underlying tech a while ago. You can sign up a free trial and have a play pretty easily.

https://fastmail.blog/2014/12/01/email-search-system/

Post reply on HN