Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FastMail Security Mindset

blog.fastmail.com

Post reply on HN
Print view View original

111–120 of 301 posts

Re: The FastMail Security Mindset

#111

Post by distances »

gregmac wrote: post #104
nvarsj wrote: post #94

Earlier quoted context omitted.

The problem with this is SPF reject domains. Which means your legitimately forwarded email will simply disappear into the void. Hosting your domain at something like fastmail will not have this problem.

Hmm... I suppose, but I've never not received anything I was expecting. It's possible I've just not run into anything with SPF reject rules, or that Gmail is allowing them anyway. I don't disagree it's better if fastmail (or whatever) can receive directly as it saves another MX server in the middle, but it's still doable without the end provider explicitly supporting it.

I have the same experience. I'm using a mail-forwarding service, so I can't host it with FastMail. FastMail is my third mail provider I'm forwarding to, and I'm not aware of any missed e-mail with any of them this far. Then again I guess I wouldn't be :)

Re: The FastMail Security Mindset

#112

Post by [deleted] »

ghouse wrote: post #64

I was a very happy FastMail customer until a hacker asked them to reset my password. After _incorrectly_ answering a handful of questions asked by the FastMail support, the recovery email address was changed and a password reset link sent. From there, the hacker attempted password resets on other services. Initially, FastMail was dismissive that this was a simple "mix-up" and didn't disable access to the hacker for 7…

[deleted]

Re: The FastMail Security Mindset

#113

Post by bluGill »

gst wrote: post #2

> Just as important as what we do do is what we don’t. For example, we don’t do full message encryption (e.g. PGP) in the browser. In theory it means you “don’t have to trust us”. However in reality, every time you open your email you would be trusting the code delivered to your browser. If the server were compromised, it could easily be made to return code that intercepted and sent back your password next time you l…

You can use PGP then. However using PGP well turns out to be hard. You can to have the client local (and built by a trusted source), not a web client. You have to ensure you didn't forget your private key. You have to understand how it works and what the limits are to ensure that you don't accidentally break something.

For what fastmail is doing providing PGP is the wrong answer: there is no way they can provide it safely. In particular a government can force them to replace their web PGP with a hacked version. (and some hacks can be very subtle such that you are unlikely to notice in a code review - remember we have a government's resources created it)

That isn't to say PGP is bad. PGP is better than what they offer when you use it correctly. However there are many ways to use PGP wrong which make it seem like your messages are secure, but they are in fact not. This is probably worse than not using PGP at all, at least if you know your messages are not secure you won't do anything that requires security.

Re: The FastMail Security Mindset

#114

Post by atbentley »

jnagro wrote: post #26
ta98789878 wrote: post #14

Any lawyers care to comment on this claim of theirs? It has been pointed out to us that since we have our servers in the US, we are under US jurisdiction. We do not believe this to be the case. https://blog.fastmail.com/2013/10/07/fastmails-servers-are-i... As a non-lawyer I would expect the US to be able to serve their host with a warrant to get whatever data the judge said they could have.

They are in Australia I believe, still part of the "five eyes" https://www.privacytools.io/#ukusa

Their privacy page has some notes on this

> We do not participate in, or co-operate with, any kind of blanket surveillance or monitoring. (We also point out that Australia does not have any equivalent to the US National Security Letter, so we cannot be forced to do something without being allowed to disclose it.)

So while they cannot harvest data and then share it in bulk, they can access data in individual cases and share it with law enforcement.

https://www.fastmail.com/about/privacy.html

Re: The FastMail Security Mindset

#115

Post by distances »

news_to_me wrote: post #39
ProAm wrote: post #27

Earlier quoted context omitted.

Im curious how FastMail and ProtonMail are comparison wise?

I tried out ProtonMail for just a little bit around the time I switched, and personally I found the focus on security and encryption to be at the expense of user experience.

If I recall correctly, ProtonMail was using RoundCube as the webmail interface when I was looking for a service. RoundCube was the reason I left my previous e-mail provider, so I had to give it a pass. Though now their website is showing a rather nice web UI, perhaps they've switched to a new one since then?

Re: The FastMail Security Mindset

#116

Post by bgrohman »

kareemm wrote: post #52
news_to_me wrote: post #7

Wow what a coincidence — I switched from Gmail to Fastmail exactly 1 year ago today. I couldn't be happier. I mostly use native clients, but the Web client is a joy to use, and everything I've observed about Fastmail gives me confidence in their service. I never used the Gmail-exclusive features like labels, so switching was pretty easy. I highly recommend it to anyone considering it. Keep up the good work, guys.

Interesting. I switched a little over a year ago too. I like not being the product but find the web client painful. Specifically: 1. No Send and Archive 2. Sending is slooow. E.g. compose email, hit Send, wait several seconds, go back to Inbox. Gmail is instantaneous. 3. Hitting Reply is SLOOOOW to bring up the Reply pane. Fastmail does a POST that takes from 500ms to 5000ms (usually on the lower end but even that is…

Hmm, that’s odd. In my experience, FastMail’s web app is much faster than Gmail. I also tend to like that the FastMail web app is simple in comparison to Gmail - fewer things to slow it down or break, and few things for me to ignore :)

Re: The FastMail Security Mindset

#117

Post by bluGill »

ta98789878 wrote: post #14

Any lawyers care to comment on this claim of theirs? It has been pointed out to us that since we have our servers in the US, we are under US jurisdiction. We do not believe this to be the case. https://blog.fastmail.com/2013/10/07/fastmails-servers-are-i... As a non-lawyer I would expect the US to be able to serve their host with a warrant to get whatever data the judge said they could have.

They can get the data, but the data is encrypted so there isn't much that can be done. (unless they can guess your password, which is possible but hard).

At the very least, anything that the US would try would be noticed by someone who is not subject to US gag orders. Potentially they can get Australia to provide those orders, but now it is an international thing, which is more difficult than the US going alone.

Re: The FastMail Security Mindset

#118

Post by tptacek »

ghouse wrote: post #64

I was a very happy FastMail customer until a hacker asked them to reset my password. After _incorrectly_ answering a handful of questions asked by the FastMail support, the recovery email address was changed and a password reset link sent. From there, the hacker attempted password resets on other services. Initially, FastMail was dismissive that this was a simple "mix-up" and didn't disable access to the hacker for 7…

This is death. Your email provider absolutely cannot under any circumstances have this vulnerability. Wow.

Just the idea that there's a human in the process making subjective decisions about security questions and answers that can, on their own recognizance, change a recovery email address. Forget the immediate mistake that one rep made, and go down a couple levels deeper into the company policy design mistakes at play here.

Thank you for relating this.

Re: The FastMail Security Mindset

#119

Post by justcreated »

amdavidson wrote: post #98
mfgmfg wrote: post #51

I use FastMail and love it, but I've noticed that if I use SMTP, it leaks my IP address in the email headers, whereas using the web client does not.

That's how RFC2822 defines the email headers. That's not a leak, that's just how email works. When you send from the web app it uses that client as the originator.

This would be one of the cases the same text talks about "when users misunderstand the security characteristics". The journalist example can be used, but instead of checking an image sending a reply to the e-mail.

I'm unsure how many journalists know that their replies using an e-mail client will send their ip address, neither if they can understand why there is a difference between the mail client and their web interface.

I only know one organisation using fastmail services today, and I asked if they knew about this today, which of course they didn't. There surely are reasons to not break the RFC as gmail and others did, but the expectations from users need to be addressed somehow

Re: The FastMail Security Mindset

#120

Post by julenx »

news_to_me wrote: post #7

Wow what a coincidence — I switched from Gmail to Fastmail exactly 1 year ago today. I couldn't be happier. I mostly use native clients, but the Web client is a joy to use, and everything I've observed about Fastmail gives me confidence in their service. I never used the Gmail-exclusive features like labels, so switching was pretty easy. I highly recommend it to anyone considering it. Keep up the good work, guys.

I've thought about switching many times, and would see myself using the web client, however I wonder if they support the "undo send" feature as GMail does. I cannot see it listed in their features page [1] at least. Can someone shed some light, please? TIA.

[1] https://www.fastmail.com/help/ourservice/features.html

Post reply on HN