Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ik.me: a free email address for life developed and hosted in Switzerland

infomaniak.com

Post reply on HN
Print view View original

111–120 of 157 posts

Re: Ik.me: a free email address for life developed and hosted in Switzerland

#111

Post by rmkrmk »

1_player wrote: post #107
systemvoltage wrote: post #66

Earlier quoted context omitted.

FastMail is an amazing company. Their UI is old school and packs a punch. Their mobile app is fantastic . They also invented some new JSON based email standard: https://jmap.io/

Mobile app is serviceable, not fantastic. On iOS if you tap on an email notification it'll just open the app showing some old email, not the one I just clicked. Why? That said, I'm a very happy paying customer.

since fastmail supports push via the default iOS mail.app for a while now I just deleted their own app

Re: Ik.me: a free email address for life developed and hosted in Switzerland

#112

Post by crossroadsguy »

chewzerita wrote: post #71
systemvoltage wrote: post #45

Folks - pay $5/month for Fastmail, Migadu, ProtonMail, or self host + your own domain name. Companies like this come and go, it’s a good chance you’ll still own the domain name. There is no such thing as free. They’ll nag you for hosting on their site. UI will degrade over time. Something will give, if not now, at some point in the future. Lifetime is a bold claim. I’m being cynical but this smells like an attempt to…

I pay the $\approx$ 1 USD a month for Posteo, but after reading about Migadu, I might decide to switch over. Their pro/con page[1] is extremely refreshing. I know this doesn't really matter, but the whole design of their site is very attractive to me following the brutalist/minimalist style (see also miniflux[2] or lobsters[3]). [1] https://www.migadu.com/procon/ [2] https://miniflux.app/ [3] https://lobste.rs/ EDIT:…

https://www.migadu.com/procon/#we-do-not-offer-email-at-our-...

> Our whole service was built around the premise of giving email liberties back to the users, not taking them away. We refuse to fence users and lock them in.

This is a very interesting take! I completely agree with it. While it may not work for many but one of the biggest mistake I made was I've used @mailbox.org extensively. But I am making an active effort to change that and remove it from use completely.

This is kind of a hidden lock in. Because there's no free email service unlike Tutanota where you can keep using email on their domain in reduced capacity.

Same for Posteo. It just doesn't make sense.

I will eventually move away from Mailbox. I will be watching Migadu. Though 20/day out can be limiting. Though it's rare I've sent 20 mails per day but there has been days when I did.

> https://www.migadu.com/procon/#no-mailbox-2fa-yet

I do not agree with the tone here. Yes, IMAP doesn't support 2FA but I'd want the Migadu control panel interface to be protected by 2FA. I like how Mailbox has handled it.

Re: Ik.me: a free email address for life developed and hosted in Switzerland

#113

Post by crossroadsguy »

omnimus wrote: post #83
systemvoltage wrote: post #45

Folks - pay $5/month for Fastmail, Migadu, ProtonMail, or self host + your own domain name. Companies like this come and go, it’s a good chance you’ll still own the domain name. There is no such thing as free. They’ll nag you for hosting on their site. UI will degrade over time. Something will give, if not now, at some point in the future. Lifetime is a bold claim. I’m being cynical but this smells like an attempt to…

Also german ones mailbox.org, posteo, tutanota and norwegian runbox. Mailbox has been around since early 90s ive been happy user for a longtime. You make good point that Swiss (German also) laws should protect your privacy more than US laws. That includes fastmail and icloud.

I would advise everyone to stay away from services that also provide and allow use of an email address on their (provider) domains i.e. user-name@service-provider.tld (e.g. name@mailbox.org) but don't have any free tier (even the bare minimum). So the moment you stop paying you are cut off and if you had been using email on their domain you might be less inclined to migrate away even if better competitors are around at better prices.

So, mailbox.org (my current mail host), posteo (they don't even allow custom domain!) and the like should be avoided. It's nothing but lock-in.

Because you will eventually start using it. the domain sounds very easy and tempting and it is easy to tell someone @mailbox.org rather than @.com.

Re: Ik.me: a free email address for life developed and hosted in Switzerland

#115

Post by 90red »

dt3ft wrote: post #21

"This offer is currently only available in Switzerland and requires a swiss phone number." As such, this should not be on HN.

If we could source a single disposable virtual Swiss number we could all use it, if the service doesn't ban the number after so many uses. I'll be sure to update if I find one, everything I've seen is stale.

Re: Ik.me: a free email address for life developed and hosted in Switzerland

#116

Post by 90red »

alexmingoia wrote: post #41

Email will never be secure, since it is not end-to-end encrypted. Regardless of the service you use, your data is sitting on a server available in plaintext to someone who has the keys. We need to move on from email.

Agreed. Even with GPG/PGP it only goes so far and leaves plenty of metadata in the clear.

Re: Ik.me: a free email address for life developed and hosted in Switzerland

#117

Post by PaulKeeble »

noncoml wrote: post #40

No matter what you use for hosting, make sure your email address is on a domain name you own.

If you buy the domain through a company like Gandi you also get some free email storage and webmail as well. It isn't great but for the cost of a domain name you can get 5 mailboxes and it is quite a good deal. When you outgrow it host it with whoever you want and transition your mail storage.

Having your own domain gives you a lot of options to move your email around to the best deal and hosting at the time, companies are going to come and go and if you utilise free email a domain in front of it will avoid having to change 500 accounts on the internet when you inevitably have to move.

Re: Ik.me: a free email address for life developed and hosted in Switzerland

#118

Post by dejan »

crossroadsguy wrote: post #112
chewzerita wrote: post #71

Earlier quoted context omitted.

I pay the $\approx$ 1 USD a month for Posteo, but after reading about Migadu, I might decide to switch over. Their pro/con page[1] is extremely refreshing. I know this doesn't really matter, but the whole design of their site is very attractive to me following the brutalist/minimalist style (see also miniflux[2] or lobsters[3]). [1] https://www.migadu.com/procon/ [2] https://miniflux.app/ [3] https://lobste.rs/ EDIT:…

https://www.migadu.com/procon/#we-do-not-offer-email-at-our-... > Our whole service was built around the premise of giving email liberties back to the users, not taking them away. We refuse to fence users and lock them in. This is a very interesting take! I completely agree with it. While it may not work for many but one of the biggest mistake I made was I've used @mailbox.org extensively. But I am making an active e…

The control panel does have 2FA via TOTP and Yubikey already. Webauthn is coming. We're working on a solution for the mailbox 2FA, hence the (yet).

Re: Ik.me: a free email address for life developed and hosted in Switzerland

#119

Post by dejan »

Fnoord wrote: post #90
monkin wrote: post #60

Earlier quoted context omitted.

+1 for Migadu or ProtonMail, both offer great service, but Migadu with $19 yearly plan and amount of features is just incomparable to any other service.

ProtonMail (and ProtonVPN, ...) is unrealistically expensive. Posteo [1] runs on green energy, and does support TOTP (in constrast to Migadu). 12 EUR/year. [1] https://posteo.de

Posteo is not very transparent there. They do not mention SMTP/IMAP/POP access on their 2FA docs. 2FA is not supported by any email client for generic IMAP/POP/SMTP[1]. Just think of that experience, providing a token on every sync or sending. This is why we sometimes take such a harsh stand in our copy. You need to tell users about these things and not throw marketing BS counting on information asymmetry.

We (Migadu) do support TOTP + Yubikey on the admin account. We also support TOTP on the webmail just like Posteo does. However, we call that B.S. ourselves and are working on a real solution for mailboxes.

If you do setup 2FA on Posteo, how is your e.g. IMAP access protected? They most likely offer an app-specific password which is very different than 2FA. We do those too, they are called _identities_ in our context.

We have a long and bumpy road behind and ahead of us, but one thing we made clear on day one is that we will not B.S. users. Email is not perfect, it has serious conceptual issues due its age, but one should not go about it as "there we fixed it!" (Hey hey.com!)

[1] https://security.stackexchange.com/questions/173807/does-ima...

Re: Ik.me: a free email address for life developed and hosted in Switzerland

#120

Post by Fnoord »

dejan wrote: post #119
Fnoord wrote: post #90

Earlier quoted context omitted.

ProtonMail (and ProtonVPN, ...) is unrealistically expensive. Posteo [1] runs on green energy, and does support TOTP (in constrast to Migadu). 12 EUR/year. [1] https://posteo.de

Posteo is not very transparent there. They do not mention SMTP/IMAP/POP access on their 2FA docs. 2FA is not supported by any email client for generic IMAP/POP/SMTP[1]. Just think of that experience, providing a token on every sync or sending. This is why we sometimes take such a harsh stand in our copy. You need to tell users about these things and not throw marketing BS counting on information asymmetry. We (Migadu…

> You have been mislead by Posteo intentionally it seems.

I don't like such tone.

TL;DR I didn't verify how Posteo's TOTP works.

FWIW, I've never used Posteo; I have some German friends who are happy with it. I'm staying local, using Soverin as my primary e-mail provider.

The reason for using a token for authorization is that the user can revoke the token (e.g. when device is lost), instead of having to change their password. These are indeed not TOTP because they are not time-based, nor do they depend on another factor (ie. password); they replace that factor. It is indeed dishonest to call such MFA/2FA.

Its perfectly possible to get IMAP to work with TOTP though. For example, you can use PAM to authenticate, and PAM can use TOTP or FIDO2 (ignoring the issues with PAM every major OS barring OpenBSD uses it). We use something similar for OpenVPN because of requirement of ISO 27k1.

I don't trust webmail at all because I don't audit the JavaScript. Nor can I verify that every visit. Same issue with OpenPGP.js. Then again, I also don't trust e-mail authenticity because the protocol is broken by design, and nobody has come up with a suitable alternative. Which is why I wouldn't pay much for it; as I would not and do not use it much, since its fundamentally broken. For example, at rest and at transit there is not enough data integrity/authenticity.

A lot of people are using a weak password as first factor, btw. Do you protect against such?

Post reply on HN