Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Fair and decent email providers?

news.ycombinator.com

Post reply on HN
Print view View original

11–18 of 18 posts

Re: Ask HN: Fair and decent email providers?

#11

Post by tptacek »

ics wrote: post #10
tptacek wrote: post #7

It's funny that people would flee from Gmail to other third-party mail providers out of privacy concerns, because it suggests they think their biggest privacy concerns are the NSA. But that's not true; in practice, you have much more to fear from criminals than the government; you can use simple means/motive/opportunity reasoning to arrive at this conclusion. Meanwhile: no mail provider in the world has invested more…

Admittedly I was asking this here primarily for small business suggestions– I certainly wouldn't expect a simple provider switch to pull the wool over the NSA's eyes. It's a silly thought for a business anyway, where the only people you might be trying to hide from are your competitors. As you said, for practical security Google's offerings are likely top notch and it gives me no qualms having some accounts with them…

How do you know that you aren't some trivial but obscure SQL injectable HTTP POST away from losing all your mail on that provider? Because I gave you a reason to believe you don't have to worry about that on Google Mail.

Re: Ask HN: Fair and decent email providers?

#12

Post by ics »

tptacek wrote: post #11
ics wrote: post #10

Earlier quoted context omitted.

Admittedly I was asking this here primarily for small business suggestions– I certainly wouldn't expect a simple provider switch to pull the wool over the NSA's eyes. It's a silly thought for a business anyway, where the only people you might be trying to hide from are your competitors. As you said, for practical security Google's offerings are likely top notch and it gives me no qualms having some accounts with them…

How do you know that you aren't some trivial but obscure SQL injectable HTTP POST away from losing all your mail on that provider? Because I gave you a reason to believe you don't have to worry about that on Google Mail.

First off, I can't really fathom why anyone (businesses!) wouldn't keep good offline backups of their email of all things. But it's a fair point– data loss isn't the only threat and Google is not lacking in engineering talent or money. Still, wouldn't their threats scale with their services and number of users? I don't care for any of the features that come with a Google account (really, just mail) but if an attacker found an exploit in any of the services attached to an account things wouldn't be so swell. To some degree the only reason I asked this question in the first place is because admittedly I cannot provide any specific counterargument to what you just stated. I was hoping others might, but I certainly appreciate your weighing in either way. If you really think that Google is the best way to go for practical security (do you use them for Matasano/Cryptopals/...?) then I'll keep them on the top of my list, but it's still out of my price range without significant restructuring. Perhaps I was too hopeful about finding the tarsnap of email or something. Ahh, well.

Re: Ask HN: Fair and decent email providers?

#13

Post by [deleted] »

ics wrote: post #12
tptacek wrote: post #11

Earlier quoted context omitted.

How do you know that you aren't some trivial but obscure SQL injectable HTTP POST away from losing all your mail on that provider? Because I gave you a reason to believe you don't have to worry about that on Google Mail.

First off, I can't really fathom why anyone (businesses!) wouldn't keep good offline backups of their email of all things. But it's a fair point– data loss isn't the only threat and Google is not lacking in engineering talent or money. Still, wouldn't their threats scale with their services and number of users? I don't care for any of the features that come with a Google account (really, just mail) but if an attacker…

[deleted]

Re: Ask HN: Fair and decent email providers?

#14

Post by tptacek »

ics wrote: post #12
tptacek wrote: post #11

Earlier quoted context omitted.

How do you know that you aren't some trivial but obscure SQL injectable HTTP POST away from losing all your mail on that provider? Because I gave you a reason to believe you don't have to worry about that on Google Mail.

First off, I can't really fathom why anyone (businesses!) wouldn't keep good offline backups of their email of all things. But it's a fair point– data loss isn't the only threat and Google is not lacking in engineering talent or money. Still, wouldn't their threats scale with their services and number of users? I don't care for any of the features that come with a Google account (really, just mail) but if an attacker…

Still, wouldn't their threats scale with their services and number of users?

No! This is almost never true!

Re: Ask HN: Fair and decent email providers?

#15

Post by rdouble »

fastmail.fm is great. I've used them for a decade.

The downside to me is their spam filter is not as good as gmail.

I read my email in a local client so I can't comment on the web interface.

That said, far less of my communication is done via email these days. Like, almost nil. It's almost gotten to the point where I don't need email at all. It's mainly a repository for online receipts. I'm toying with the idea of killing my fastmail account and just using my gmail account for receipts.

Re: Ask HN: Fair and decent email providers?

#16

Post by ics »

tptacek wrote: post #14
ics wrote: post #12

Earlier quoted context omitted.

First off, I can't really fathom why anyone (businesses!) wouldn't keep good offline backups of their email of all things. But it's a fair point– data loss isn't the only threat and Google is not lacking in engineering talent or money. Still, wouldn't their threats scale with their services and number of users? I don't care for any of the features that come with a Google account (really, just mail) but if an attacker…

Still, wouldn't their threats scale with their services and number of users? No! This is almost never true!

No? I didn't mean that they're just a bigger target. Are you saying there is no additional threat (whether XSS, HTTP, SQL or whatever) to the system when YouTube, Google+, Gmail, etc. are all being developed by different teams with different timelines etc? Of course they must have pretty sound security practices in addition to frequent coordinated reviews, but I can't imagine that makes things any easier.

Re: Ask HN: Fair and decent email providers?

#17

Post by tptacek »

ics wrote: post #16
tptacek wrote: post #14

Earlier quoted context omitted.

Still, wouldn't their threats scale with their services and number of users? No! This is almost never true!

No? I didn't mean that they're just a bigger target. Are you saying there is no additional threat (whether XSS, HTTP, SQL or whatever) to the system when YouTube, Google+, Gmail, etc. are all being developed by different teams with different timelines etc? Of course they must have pretty sound security practices in addition to frequent coordinated reviews, but I can't imagine that makes things any easier .

Yes, I am saying that you are at vastly less risk of losing your data to an SQLI flaw on Google Mail than you are on some small competitor to Google Mail. I am saying exactly the thing you seem to be surprised I'm saying, and if you ask any 5 other software security practitioners the same question, at least 4 of them will say the same thing (I'd actually be surprised if 5 didn't).

Re: Ask HN: Fair and decent email providers?

#18

Post by ics »

tptacek wrote: post #17
ics wrote: post #16

Earlier quoted context omitted.

No? I didn't mean that they're just a bigger target. Are you saying there is no additional threat (whether XSS, HTTP, SQL or whatever) to the system when YouTube, Google+, Gmail, etc. are all being developed by different teams with different timelines etc? Of course they must have pretty sound security practices in addition to frequent coordinated reviews, but I can't imagine that makes things any easier .

Yes, I am saying that you are at vastly less risk of losing your data to an SQLI flaw on Google Mail than you are on some small competitor to Google Mail. I am saying exactly the thing you seem to be surprised I'm saying, and if you ask any 5 other software security practitioners the same question, at least 4 of them will say the same thing (I'd actually be surprised if 5 didn't).

Very well then. Practically speaking I'm much more concerned with spear-phishing on Google services than what we're discussing, but I'm glad you took the time to make your points. I won't hold my breath for them to introduce more flexible plans any time soon though... (As a sidebar, MS Office365 looks to be about the same thing, but not much different than Google on price/plans.)
Post reply on HN