Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Less secure apps and your Google Account

support.google.com

Post reply on HN
Print view View original

151–160 of 272 posts

Re: Less secure apps and your Google Account

#151

Post by whatshisface »

dewey wrote: post #145
garblegarble wrote: post #116

Earlier quoted context omitted.

Just a reminder to everybody that Fastmail is an Australian company, and is therefore subject to Australia's TOLA / Assistance And Access. I avoid them like the plague for this reason. Having your e-mail provider compelled to work against your interests is no joke and you may not want to be in that situation.

Maybe it's just me but I don't have "Australia going to force my email provider to hand over my data" in my threat model. It's probably worth thinking about that too before hastily switching email providers. Fastmail is a solid provider, with great support and I never had a real issue with them. I give them money, they provide me a good and stable email service.

2028 headline:

"Australian intelligence services decline to comment on massive data breach."

Re: Less secure apps and your Google Account

#152

Post by belter »

So many startups implementing absurd ideas, when the best opportunity is right in front of your eyes.

Create a paid, highly reliable, highly secure, client side encrypted, email based service on a proper jurisdiction. Open source your clients and open yourself to independent audits. Be open with your customers, friendly and transparent. Earn the money...

Fastmail, Rackspace and Protonmail are good offers, but as mentioned in this thread for one reason or the other can still be improved.

Any takers?

Re: Less secure apps and your Google Account

#153

Post by cytzol »

garblegarble wrote: post #116
auslegung wrote: post #99

Earlier quoted context omitted.

You absolutely should own your own domain and use it to email somewhere besides Google. I use Fastmail but ProtonMail is great, tutanota, mailfence, etc. Getting locked out of your email is no joke you don’t want to be in that situation. I have a paid account with Fastmail and a free account with protonmail just in case something goes wrong with Fastmail I can transition my free protonmail account to paid and use it…

Just a reminder to everybody that Fastmail is an Australian company, and is therefore subject to Australia's TOLA / Assistance And Access. I avoid them like the plague for this reason. Having your e-mail provider compelled to work against your interests is no joke and you may not want to be in that situation.

> Just a reminder to everybody that Fastmail is an Australian company, and is therefore subject to Australia's TOLA / Assistance And Access. [...] Having your e-mail provider compelled to work against your interests is no joke and you may not want to be in that situation.

This is not quite true.

The TOLA bill does allow the Australian government to compel an employee to break their product's encryption — which, yes, is dumb as hell. But Fastmail does not offer end-to-end encryption. As an Australian company, they already have had to comply with a court warrant asking them to surrender data; in other words, law enforcement does not need them to install a backdoor when they already have a front door. Your comment implies that TOLA made Fastmail less secure somehow, but this has been the case long before TOLA; the existence of that bill changes nothing.

I feel like it's important to point this out, not for the sake of pedantry, but to say that if you want truly secure encrypted e-mail, you must be in control of the encryption and decryption step, rather that having a company do that for you — you can't assume you'll be safe just because your provider isn't based in Australia. It's been a while since I've looked, but I think it would be very hard to find an e-mail provider that explicitly says it won't hand over data when presented with a valid warrant.

Re: Less secure apps and your Google Account

#154

Post by browningstreet »

auslegung wrote: post #99
tomxor wrote: post #16

I've noticed gmail randomly blocks Firefox these days under the pretence of "your browser may not be secure" (i.e it doesn't persist through page refreshes), similar to how they try to make you do a captcha unless you refresh the page... I seem to have less and less control over where and how I am allowed to sign in (even thought I'm using a U2F key), and as a result I'm definitely getting pushed closer to the thresh…

You absolutely should own your own domain and use it to email somewhere besides Google. I use Fastmail but ProtonMail is great, tutanota, mailfence, etc. Getting locked out of your email is no joke you don’t want to be in that situation. I have a paid account with Fastmail and a free account with protonmail just in case something goes wrong with Fastmail I can transition my free protonmail account to paid and use it…

Step 1: just hook up a desktop mail client to your Gmail (Outlook, etc) and download all your emails locally.

That way you have a backup. And copies if your email account gets blocked.

It’s not a permanent or complete solution, but for all the people contemplating this issue, but not yet committed to switching… start with copying down your emails.

Re: Less secure apps and your Google Account

#155

Post by l72 »

amscanne wrote: post #120
andreareina wrote: post #112

Earlier quoted context omitted.

Application specific passwords require two-factor auth being on, which means either giving google your phone number or having to pay for e.g. a yubikey.

Or using a free authenticator app for time-based codes?

How do you enable this without first giving google your phone number? My understanding is you have to set up SMS 2 factor auth first before you can change it to TOTP.

Re: Less secure apps and your Google Account

#156

Post by Qem »

ianai wrote: post #66
lolinder wrote: post #48

Earlier quoted context omitted.

Suggestion? Start now. I moved my primary email to a custom domain a bit over a year ago, and it takes a while to slowly migrate everything over. You don't want to be doing that while under pressure from whatever it is that forces you off.

Does that handle the huge torrent of ads well? Seemingly every website and brick and mortar I've shopped at ever sends me at least one email per day.

A mail client with its local bayesian filtering works fine for me, given you take a little time to flag spam and tune the filter. I use Thunderbird.

Re: Less secure apps and your Google Account

#157

Post by tomxor »

mrtranscendence wrote: post #150
tomxor wrote: post #146

Earlier quoted context omitted.

> and will now have to bear a recurring payment of $6 monthly Is this the cost for gmail to use a custom domain? or is it a very expensive domain name spread over 12 months?

Google is phasing out free "apps for your domain" accounts, so starting in a few months it will be necessary to pay a monthly fee per user.

I see. At least you have the freedom to move email hosts though.

Re: Less secure apps and your Google Account

#158

Post by GoblinSlayer »

mrtranscendence wrote: post #134
bjt2n3904 wrote: post #111

Earlier quoted context omitted.

If you have a domain, that's just another liability for email security. Look at what NameCheap did. Imagine losing your domain for some reason -- even forgetting to renew. All your contacts need a new address now, and until then it's dropped emails. A custom domain is mostly a vanity measure. It does allow you to migrate to a new email service if your provider cancels your subscription, I suppose... But I'd rather on…

This has happened to me, briefly. I once forgot to renew and lost access to email. Luckily I was able to fix the issue quickly. I do kind of wish I had never gone down the route of using my own domain for email. I use gmail with it, and will now have to bear a recurring payment of $6 monthly (IIRC). I could move hosts but none of them are free to my knowledge, and a free service comes with its own risks anyway. Plus…

Do you really need to switch? IME most services don't really use email for anything.

Re: Less secure apps and your Google Account

#159

Post by bmarquez »

mrtranscendence wrote: post #134
bjt2n3904 wrote: post #111

Earlier quoted context omitted.

If you have a domain, that's just another liability for email security. Look at what NameCheap did. Imagine losing your domain for some reason -- even forgetting to renew. All your contacts need a new address now, and until then it's dropped emails. A custom domain is mostly a vanity measure. It does allow you to migrate to a new email service if your provider cancels your subscription, I suppose... But I'd rather on…

This has happened to me, briefly. I once forgot to renew and lost access to email. Luckily I was able to fix the issue quickly. I do kind of wish I had never gone down the route of using my own domain for email. I use gmail with it, and will now have to bear a recurring payment of $6 monthly (IIRC). I could move hosts but none of them are free to my knowledge, and a free service comes with its own risks anyway. Plus…

> It would be a royal pain to switch now.

I know it's tough (migrated off G Suite Legacy myself) but it's probably best for the long run since G Suite accounts have less consumer features (in my case, lack of play store reviews and free Google Voice) and it's unlikely to change.

There are many submissions on HN discussing alternatives. Fastmail, Protonmail, iCloud+ (I switched to this), Microsoft 365 are frequently mentioned. I think Zoho also had a free plan.

Re: Less secure apps and your Google Account

#160

Post by tzs »

einpoklum wrote: post #17

I suggest all HN readers use this opportunity to stop using Google accounts, if they haven't done so already. Potential benefits: * Better privacy (on many/most alternatives); Google will no longer read your email, store it for use by themselves and their partners, and perhaps pass a copy along to the NSA as Edward Snowden has revealed happens. * Less exposure to manipulative ads, and lower finesse of manipulation du…

> Less exposure to manipulative ads, and lower finesse of manipulation due to less data about you.

I'm no longer convinced that Google actually uses information about you to target ads. I base this on recently watching a lot of YouTube on streaming devices such as my Amazon Fire TV and my Xfinity Flex.

On my desktop I have an ad blocker and so usually do not see ads on YouTube but there are no ad blockers on those streaming boxes. I'm logged into my Google account in the YouTube apps on those boxes so Google knows it is me watching and could therefore make use of the full power of their allegedly mighty data-driven personalized ad targeting.

I've now seen hundreds of ads and they have yet to show me one that matches my interests or matches products I use and make purchasing decisions for any better than random billboards on the side of the freeway match. For the advertisers paying for those ads it was a complete waste of their money for Google to show me those ads.

Post reply on HN