121–130 of 258 posts
It is a bit overkill, but the closest you can get to owning your online identity is to "own" your own domain. sarcastiquotes used because you don't really own a domain you only rent it. I run my own mail server because I am a sys-admin and running a mail-server is something I do for fun. but the amount of agency you gain once you have a domain is staggering. people without a domain are pretty much second class net ci…
It is a bit overkill, but the closest you can get to owning your online identity is to "own" your own domain. sarcastiquotes used because you don't really own a domain you only rent it. I run my own mail server because I am a sys-admin and running a mail-server is something I do for fun. but the amount of agency you gain once you have a domain is staggering. people without a domain are pretty much second class net ci…
> I wish municipality offered domains, for example: you move to St Louis you would get name.stlouis.mo.us this would give you the same agency online that a mail address gets you offline. Australia kinda does this with their `.id.au` second level domains for 'Individuals (by real name or common alias)' Not many folks use it or know about it.
The solution I hope for: A crypto based toplevel domain like the Ethereum Name Service. But with a twist: If I lose my private key, the domain is not lost, but locked for 3 months and nobody, not even the registry can move it. After the 3 months, if I stay "silent" and not confirm my ownership via my private key, the registry can move the domain. The registry should have this process: During these 3 months, I have to…
Earlier quoted context omitted.
I run my own mail server as well, on my own domain, own server, physically present in my home. It's increasingly becoming a hassle.. Especially sending mail from a "consumer" line is tricky, they block outgoing port 25 and no longer really provide a relay host for you to go through either.. I basically had to infiltrate my current ISP to get access to people in netops and gaslight them into configuring reverse-dns an…
> Nation states absolutely should provide and host, e-mail accounts for their citizens Because nation states are well known for producing usable software at a reasonable cost to tax payers? IRL this would cost billions and everyone under 60 would forward their gov’t mail to gmail.
Well, actually - yes? My country has lots of problems, but government-issued software is surprisingly good. I would have trust issues however after it came up, that they used Pegasus very liberally.
Earlier quoted context omitted.
I run my own email server too, many will not because of fear of missconfiguring it- and in some respect they are correct, first thing I have done wrong 11-ish years ago was to make my server an open relay which was cought in 5 minutes from setting up and luckily I figured it out 5 minutes later. No big deal, I love postfix and dovecot :)
This is my fear. It's not really the running or configuring that scares me, it's the unceremonious bouncing/filtering at the other end. I have run some mailers (postfix) for some clients who didn't want to spring for a MAAS provider, I would to my knowledge, set up everything correctly with SPF, DMARC, DKIM, stuff would still land in the spam folder half the time. Maybe still my mistake, maybe over eager receivers, m…
A common problem with new mail setups is the receiving end marking your messages down because the domain is newly registered, as this is seen (correctly in some cases) as a potential spam flag. Nothing you can do about that one except double-check you SPF & DKIM config and wait.
One of many gotchas with hosting your own mail. I still consider it to have been with doing so all these years.
Then there is the wide spread practice of tying identity to a single email address that may be used to reset passwords. There is no good technical reason to limit it just one email address or indeed just email addresses; that's just a historical quirk that gets mindlessly copied by world + dog when they spin up a new service because of the mistaken belief widely held by non technical product managers that that just is how things are done. Only a minority of websites provide 2FA, which enhances security but does not solve the root problem of people not owning their identity. Changing your email address is not a feature that is commonly supported either. Whatever email address you pick when you signup is what you are stuck with.
If your email provider shuts you down, you lose the ability to reset passwords, receive notifications, etc.
IMHO the way out of this mess is to start making multi modal signins more common. Some companies already do this but it is not a widespread practice. Simply encourage users the ability to add multiple ways of authenticating themselves. Phone number based authentication, device based authentication (using e.g. QR codes), public key based authentication (ssh or otherwise), social media account based verification, etc. are all viable strategies to authenticate. And why have just one? Combined with 2FA this makes for a much more durable account ownership. It can also remove a lot of onboarding friction as you don't actually need users to provide a lot of information about themselves.
A lot of the reasons for this not being so common has to do with a misguided notion of big trillion dollar companies wanting to "own" the relation with their users. So Google will not allow people to use their MS owned identities to sign in or vice versa. Even though both implement variations of OpenID 2.0 and generally have a large overlap in terms of how they implement security technically. It's a simple matter of ownership. They own you. They consider you their property. Your identity is theirs to control. This is the notion that needs to be challenged for this to ever be resolved.
Imagine that citizenship worked like that. It doesn't of course. But imagine. There would be a lot of stateless citizens no longer able to prove who they are because gmail shut them down or whatever. That would be unacceptable of course. Banks can't get away with that either. A passport is all you need to reclaim ownership of your bank accounts. And in case of your death, a death certificate and some paper work from a notary is good enough for your surviving relatives. Online identity should be just as strong. People confuse the means of authentication with the actual identity.
State-funded email with E2EE. Every citizen gets an email address. You don't have to use it (and it will probably suck compared to competitors), but you'll have it as a permanent fallback address. And presumably it will come with some legal protections and due process.
Given that many countries already use national id systems for age verification if you say want to buy booze online i always wanted a vault for every citizen, with healthcare, education, banking services, an email, maybe even a personal domain thrown in. Have one api for it that every company can hook into for verification. The amount of physical disparate papwerwork you have to still do for these things is incredibly…
Earlier quoted context omitted.
I run my own mail server as well, on my own domain, own server, physically present in my home. It's increasingly becoming a hassle.. Especially sending mail from a "consumer" line is tricky, they block outgoing port 25 and no longer really provide a relay host for you to go through either.. I basically had to infiltrate my current ISP to get access to people in netops and gaslight them into configuring reverse-dns an…
> Nation states absolutely should provide and host, e-mail accounts for their citizens Because nation states are well known for producing usable software at a reasonable cost to tax payers? IRL this would cost billions and everyone under 60 would forward their gov’t mail to gmail.
And this is why, back in 2007, I registered my own domain, and signed up for then-free Google Apps for Your Domain (then GSuite, Google Workspaces, whatever they're calling it now). Earlier this year I moved my email to Fastmail, and I can move it elsewhere if I want to, with zero disruption or downtime. I really wish email providers would make custom domains either the default, or a very obvious option when signing…
Even if it was cost-effective for Google (which I doubt), it's not going to happen because it would mean that, to be effective, Google would have to allow you to transfer it out of their hands (to change your provider) and thus, it would also mean that you could basically use Gmail to hold domains for free.