Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poste.io – Complete Mail Server

poste.io

Post reply on HN
Print view View original

191–200 of 247 posts

Re: Poste.io – Complete Mail Server

#191

Post by febusravenga »

daneel_w wrote: post #94
zacharyvoase wrote: post #51

> All passwords are by default stored as salted SHA512 hash (5000 rounds). Attackers will have hard time to crack your passwords. SHA512 isn't a good choice for this, because it's optimized for fast low-memory computation. Why not use bcrypt or argon2, which are industry-accepted best practices for password hashing?

Their rationale is probably because those two don't scale very well when you want to make their efforts count, whether bcrypt's hunger for CPU or Argon2's hunger for CPU and/or RAM. Bcrypt is very capable at bogging things down when you have lots of users authenticating very frequently, which is often the case with a POP3 server. A mere 100 e-mail clients authenticating every 2 minutes on average to check for new mai…

I'm wondering, if pop/IMAP auth is so costly, why POP3/IMAP community not allow user to get session token and auth with it? Like JWT or anything with similar security properties. Both protocols are easily extensible...

Re: Poste.io – Complete Mail Server

#192

Post by Donckele »

867-5309 wrote: post #181
mjl- wrote: post #180

Earlier quoted context omitted.

Not my experience. I have run a personal mail server for about 15 years. My mail has almost always been delivered just fine. The network my mail server IP has been in a blocklist less than handful times, but this has always been temporary and resolved without my intervention (perhaps my hosting provider is on top of this). On the other hand, I'm also sending email for a client through AWS SES, and those emails are re…

>It's so annoying if mail is accepted but you don't know if it is actually seen by the recipient. that's what those embedded 1x1px images are for

Some users have embedded images disabled in email client by default.

Re: Poste.io – Complete Mail Server

#193

Post by fesc »

mittermayr wrote: post #170
foxylad wrote: post #116

Earlier quoted context omitted.

THIS. Spam is a solved problem, thanks to SPF and DKIM. But despite doing all the right things, Microsoft and Google continuously block and rate-limit delivery. Case in point: we deliver 20,000 booking confirmation emails every day, all requested by users and not spam. We have perfect Postmaster Tools metrics: absolutely zero reported spam, 100% IP reputation, high domain reputation, zero feedback loop spam, 100% enc…

Spam is only solved by the large mail providers (who have enough data to act on it within a split second). After the great Gmail exodus two years ago (when they killed then unkilled legacy domain accounts), I moved to MXRoute — and the amount of unfiltered spam I get is insane. It's a daily nuisance. I have added about 200 filter words now, blocked hundreds of e-mail addresses, but it's next to impossible to filter o…

I am using a small German email provider and I can't remember the last time I got spam.

What's even crazier is that they are so confident in their spam filter that they simply reject mails classified as spam. But that hasn't been a problem since the few years I have been using them as well.

Re: Poste.io – Complete Mail Server

#194

Post by GTP »

fuzzy2 wrote: post #184
foxylad wrote: post #116

Earlier quoted context omitted.

THIS. Spam is a solved problem, thanks to SPF and DKIM. But despite doing all the right things, Microsoft and Google continuously block and rate-limit delivery. Case in point: we deliver 20,000 booking confirmation emails every day, all requested by users and not spam. We have perfect Postmaster Tools metrics: absolutely zero reported spam, 100% IP reputation, high domain reputation, zero feedback loop spam, 100% enc…

Most spam I receive (and that continues to somehow bypass my spam filters) originates from Gmail. So no, spam is not solved, not at all. Spam is only “solved” on big providers because they mostly accept mails only from other big providers. --- I would argue that “running an independent mail server” and mass-mailing are two entirely separate concerns.

> Most spam I receive [...] originates from Gmail

> Spam is only “solved” on big providers because they mostly accept mails only from other big providers.

I would say that only accepting emails form other big providers isn't a good solution then.

Re: Poste.io – Complete Mail Server

#195

Post by andix »

perfecto_maduro wrote: post #182
andix wrote: post #37

Earlier quoted context omitted.

I just went to my cloud provider of my choosing and started to add floating IPs. After a few tries I got a good one. I went through the unblocking process once, and I decided not to do it again. Especially Microsoft gave me a hard time, they started to request documents and then let me wait a few weeks until they replied: we don’t unblock, and we don’t tell you why.

consider yourself lucky you even got a response. My IP is sparkling clean for many years now, dkim/spf etc, but gets blocked on any MS mail server. Tried appealing and heard nothing whatsoever.

Is it possible that Microsoft distrusts your IP range? Some providers are known not to be very responsive to abuse reports. And then whole IP ranges get (soft) blacklisted, and individual IPs can’t be unblocked, without having a very strong case.

Re: Poste.io – Complete Mail Server

#196

Post by 867-5309 »

Donckele wrote: post #192
867-5309 wrote: post #181

Earlier quoted context omitted.

>It's so annoying if mail is accepted but you don't know if it is actually seen by the recipient. that's what those embedded 1x1px images are for

Some users have embedded images disabled in email client by default.

some users have javascript disabled, some have email clients disabled. it's not foolproof but works for the majority of users, i.e. >99%

Re: Poste.io – Complete Mail Server

#197

Post by nedt »

foxylad wrote: post #116
that_courtney wrote: post #13

I feel like this solution is optimizing the wrong problem. The bulk of work with managing a mail server (these days) isn't software setup and admin. On the receiving side, it's all the work dealing with abuse and attacks. On the sending side -- and this is the tough one -- it's getting sites to accept your email. When I finally gave up managing my own mail server (about two years ago), I found that about every six mo…

THIS. Spam is a solved problem, thanks to SPF and DKIM. But despite doing all the right things, Microsoft and Google continuously block and rate-limit delivery. Case in point: we deliver 20,000 booking confirmation emails every day, all requested by users and not spam. We have perfect Postmaster Tools metrics: absolutely zero reported spam, 100% IP reputation, high domain reputation, zero feedback loop spam, 100% enc…

Not only are the blocking. They also send bounce spam although they know with SPF record, that the original mail was send by a server that's not allowed in that domain.

Re: Poste.io – Complete Mail Server

#198

Post by PurpleRamen »

user3939382 wrote: post #25
c0l0 wrote: post #23

Earlier quoted context omitted.

Having been a part-time postmaster for more than a decade by now, I fully agree, and would even go further: Ingress spam is pretty much a solved problem if you play your cards right. ChatGPT et al. might change that again - but the mechanisms you can deploy today are very effective against the current UBE landscape. The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes.

> The _real_ problem is reliably getting your 100% legit mail into your consenting recipients' inboxes It's amazing that having someone in your address book isn't enough in many cases. Like, why?

That would demand maintaining an address book. Most mails I receive are from services which I have never written to, and I don't see a reason to extra maintain their data when I already have their mails.

Re: Poste.io – Complete Mail Server

#199

Post by ElevenLathe »

fuzzy2 wrote: post #179
ascar wrote: post #56

Earlier quoted context omitted.

> Last year I moved my mail to an old fashioned shared webhosting account at Hetzner. Very happy with it! How exactly is that solving the problem? If anyone does something remotely spammy from that ip, your mails are spam again too. And you probably got lucky that the ip you're sitting on was warm and trusted to begin with. You didn't really find a solution, the problem simply hasn't occurred yet for you or you are n…

I think you misunderstand. You cannot have a mail service on shared webhosting. It’s like 1999: Upload PHP using FTP, the end. Instead, the hosting provider will operate a mail service for you, much like Microsoft 365, G Suite and the like. They will also take care of the IP reputation, SPF, DKIM and all.

Shared hosting does not typically run an external mail service. It's just Exim or whatever running on the same box as the shared Apache.

Re: Poste.io – Complete Mail Server

#200

Post by daneel_w »

zacharyvoase wrote: post #151
daneel_w wrote: post #94

Earlier quoted context omitted.

Their rationale is probably because those two don't scale very well when you want to make their efforts count, whether bcrypt's hunger for CPU or Argon2's hunger for CPU and/or RAM. Bcrypt is very capable at bogging things down when you have lots of users authenticating very frequently, which is often the case with a POP3 server. A mere 100 e-mail clients authenticating every 2 minutes on average to check for new mai…

Well if you want passwords to be difficult to crack if an attacker gets access to the hashes, you kind of just have to deal with it.

Yes, and enforcing long passwords is the primary and most important way of dealing with it. Enforcing ridiculously high CPU/RAM use for authenticating is a cost that both sides have to pay, but in itself it doesn't solve the problem at hand.
Post reply on HN