Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FastMail Security Mindset

blog.fastmail.com

Post reply on HN
Print view View original

251–260 of 301 posts

Re: The FastMail Security Mindset

#251

Post by unhammer »

julenx wrote: post #120
news_to_me wrote: post #7

Wow what a coincidence — I switched from Gmail to Fastmail exactly 1 year ago today. I couldn't be happier. I mostly use native clients, but the Web client is a joy to use, and everything I've observed about Fastmail gives me confidence in their service. I never used the Gmail-exclusive features like labels, so switching was pretty easy. I highly recommend it to anyone considering it. Keep up the good work, guys.

I've thought about switching many times, and would see myself using the web client, however I wonder if they support the "undo send" feature as GMail does. I cannot see it listed in their features page [1] at least. Can someone shed some light, please? TIA. [1] https://www.fastmail.com/help/ourservice/features.html

> JMAP will enable various long-desired features (e.g. snooze, delayed/undo send).

says chrismorgan at https://news.ycombinator.com/item?id=15856942

Re: The FastMail Security Mindset

#252

Post by lloeki »

distances wrote: post #107
morganvachon wrote: post #96

Earlier quoted context omitted.

> "Wow what a coincidence — I switched from Gmail to Fastmail exactly 1 year ago today." Same, in fact I just got my renewal notice over the weekend, which means either yesterday or today was the day I turned Gmail off for good. > "I couldn't be happier. I mostly use native clients, but the Web client is a joy to use, and everything I've observed about Fastmail gives me confidence in their service." I vastly prefer F…

> the Notes and Files apps are perfect for quick access from any device Thanks for this heads-up! I've been looking for a super-simple notes taking method that would span work, home, and mobile. I never realized FastMail has one just under my nose!

Notes even used to work with Notes.app on iOS and macOS before the latter moved to iCloud backed storage.

Re: The FastMail Security Mindset

#253

Post by brongondwana »

dannysu wrote: post #151
brongondwana wrote: post #143

Earlier quoted context omitted.

Now to write a more detailed response. If this winds up out of order later, I first posted: https://news.ycombinator.com/item?id=15856609 Again, ghouse, I'm really really sorry about what happened to your account. It was wrong and we screwed up. As other comments have already noted, it was during the transition to a new security system which was designed precisely to remove the human factor from decision making. I'm…

What I'm hearing is that the human aspect remains and there is absolutely no prevention of this happening in the future. The other response contains weasel words like "For instance, _some cases_ take 24 hours before the reset password goes into effect". Why "some cases"? Why isn't it all cases? I think we as customers deserve complete transparency on this and know what prevention will be in place.

I've had conflicting advice about complete transparency - if we give the entire algorithm, then that helps attackers find the exact surface that will get them in, so we don't publish the full ruleset we use.

Here's an example of some inputs that go into it though: we store a cryptographic token in a cookie which tells us the first time your account successfully authenticated from a computer. If we have a history of you using the same computer over multiple years, that's different than a new computer. But cookies can be cloned, so it's only a signal, not proof in itself.

If it's from the same IP address as multiple successful logins in the past, that's a signal.

We're not the only site that uses methods like this to help identify people when they've lost their password. People make mistakes. Taking a hard line "you lose your password, you lose your entire email account with all its history, and you don't get your money back either" might sound attractive to a certain demographic. They are not the bulk of our userbase. Even locking people out for 24 hours is a pretty big imposition that you want to avoid if you're really confident (algorithmically) that it's the same person.

If people in the "security is more important than easy recovery" demographic haven't turned on 2FA yet, then they certainly haven't signaled that they want things locked down in case of doubt. Even of those who HAVE turned on 2FA, you'd be surprised at how many lose one or both of their factors.

It's easy to say "I won't mess up", but people do. Which is why our post today says in bold "If that happens, you will lose access to your account permanently."

Re: The FastMail Security Mindset

#254

Post by brongondwana »

dannysu wrote: post #246
brongondwana wrote: post #241

Earlier quoted context omitted.

Which employees? At the time of this compromise, that list was all support staff as well as the technical staff in Melbourne. It is a specific role that's granted to specific people, to answer your question about having a procedure or policy. Today, that role is granted to a much more limited set of senior security staff (currently 3 people). Regular support staff can not alter security-sensitive details about accoun…

hi Bron, thank you for this response. Much clearer and I think this is what everyone wanted to see. Can I just clarify some things for peace of mind? 1) When you say regular support staff cannot alter security-sensitive details. How is that done? Do they only perform changes through a limited set of UI? 2) When you say if 2fa is enabled it goes to senior security team, is that an automated process such that support s…

1) yes, support staff have a limited UI. There is always a balance between limiting support access and having them able to provide meaningful help. I have the same level of access as a support staffer, and I still get tagged into to work on some issues (particularly calendaring issues, a lot of people have died on the hill of calendaring and I'm currently still our primary expert on some parts of it), and often I need to view people's calendars and the emails related to scheduling in order to debug their issue. The nature of the job is that many issues can only be understood and resolved "in situ". Have I mentioned yet how horrible calendaring is? Thanks for reminding me :(

The UI given to support staff doesn't have the ability to update security credentials for users because they no longer have the "can update security credentials" role like they did in 2016. I don't even have it any more.

2) front line support still see all the tickets first, and they route them as appropriate. Sure this takes longer, we don't have 24 hour coverage of senior security staff (not entirely true, we have 24 hour coverage for emergencies. Somebody forgetting their password is not an emergency in this context)

3) the security incident involving ghouse was entirely via support tickets. His description was accurate, front line support send the pro-forma "we need a bunch of these details", got back some pretty half-arsed details that didn't meet the bar of what was supposed to be provided, and helpfully made the change despite our policy. The helpfulness of humans is a major bug with any security system, and this particular human tried to be too helpful.

4) The senior security team also use a UI. Operationally, they all have the ability to write code that directly changes things under the hood, but that code also has an audit trail and goes through review. It's always quicker and easier to use the UI, so that's what they do.

The UI is not just available to those three people, it's also available to anybody who has a multi-user account and needs to administer their own users. It's still a standard part of our system, just restricted in who can use it at an "any arbitrary Fastmail customer" level.

Re: The FastMail Security Mindset

#255

Post by brongondwana »

dboreham wrote: post #4
BCM43 wrote: post #3

Earlier quoted context omitted.

For most providers, like Protonmail, the decryption password is the same as your login password. I'm curious what scenario you see allowing someone other than the provider to get access to your mailbox but not also your decryption key.

That could happen via a breach of the provider's servers, or through dumpster diving for a discarded drive that the provider didn't properly wipe (in the case the data wasn't also encrypted at rest).

Email at FastMail is encrypted at rest in this sense (full drive encryption).

It's not encrypted with a separate password per-user. We don't see any security benefits there, given that every user logs in almost every day, and if they have linked a device (many of our users use IMAP from mobile clients) they will connect and sync every time there's an update.

Which changes the vector to "hack server, passively monitor for a couple of hours, gain access". The logical backflips and single-minded security outlook required to consider that significantly different from "hack server, gain access" are the kind of security theater we studiously avoid.

Full disk encryption is a clear win with no significant downsides (slightly higher CPU consumption). Per-user encryption while still providing a full email service is not a clear win, and it has significantly higher downsides.

Re: The FastMail Security Mindset

#256

Post by Santosh83 »

Jd wrote: post #249
joshuamorton wrote: post #214

Earlier quoted context omitted.

Just gonna drive by mention https://landing.google.com/advancedprotection/ , which is a physical-2fa-security-key-only version of gmail. To my knowledge it also disallows mail forwarding, and the account recovery procedure in the event of losing both second factors is intended to be a long process that involves proof of identity and multiple attempts to notify the account owner. (I work on gmail, but I'm not intimate…

The pricing is very unclear from even three clicks in from that link, only that it is some sort of add on service.

I don't use it, but from what I can see, it appears to be free, apart from the keys themselves needing to be purchased.

Re: The FastMail Security Mindset

#257

Post by brongondwana »

dvcrn wrote: post #231
brongondwana wrote: post #143

Earlier quoted context omitted.

Now to write a more detailed response. If this winds up out of order later, I first posted: https://news.ycombinator.com/item?id=15856609 Again, ghouse, I'm really really sorry about what happened to your account. It was wrong and we screwed up. As other comments have already noted, it was during the transition to a new security system which was designed precisely to remove the human factor from decision making. I'm…

Please consider adding a option to never ever allow recovering of the account without password, similar to how gandi does it. My email account / domain is my central hub for all my accounts. All of them can be taken over through fastmail (with the exception of my domain and other extremely crucial services) if an attacker happens to obtain access to it. I want to have the security that this attack can not happen to m…

I'm assuming you have 2FA turned on already.

It sounds from what you're saying like you (and at least a few other hacker news posters) want is an even stricter "no seriously, I promise I won't ever screw up" mode.

We try not to have those kinds of modes, because (for example):

https://ianix.com/pub/dnssec-outages.html

It turns out, black and white security models lead to massive losses of availability when people screw them up - and people do. Though I have to confess to being amazed to see Tony Finch amongst the recent "oops". NASA is maybe not so much of a surprise.

Having said that - if there's enough demand, that would be a worthwhile feature. Accounts that aren't being used are cheap for us to run, and that flag would make the security team's job really easy - just say "no, go find your own way in" without having to review anything!

Re: The FastMail Security Mindset

#258

Post by js2 »

brongondwana wrote: post #245
js2 wrote: post #165

Earlier quoted context omitted.

I'm a FastMail customer. Your response is troubling to me in that it didn't answer most of tptacek's questions. It's troubling enough for me to start looking at other email providers. :-( I would like FM to provide something akin to Google's advanced protection program. Those of us who are careful not to lose our login credentials should not have to suffer a weak recovery process for the convenience of those who do.…

I have now responded in more detail - at the time I was busy trying to spread the love around, and also support my team as they dealt with the support requests and digesting the response on here. Check out the longer response here: https://news.ycombinator.com/item?id=15859024

Thank you for the additional clarity. I apologize for not being more patient in allowing you to reply.

Re: The FastMail Security Mindset

#259

Post by werid »

enraged_camel wrote: post #90

The simple reason I haven't switched email providers: all my online accounts, as well as many offline ones, are tied to my gmail account. Yes, I can set up forwarding, but that defeats the purpose of switching providers IMO (for me, the purpose would be to move away from Google completely ). I don't want Google to read any of my emails period, so forwarding is not a sufficient solution.

I did the switch a few years ago. I setup forwarding after importing all my emails from gmail, then i spent months changing email on services whenever i used them. eventually you finish and can stop the forwarding or close the gmail account completely.

Re: The FastMail Security Mindset

#260

Post by callahad »

Stratoscope wrote: post #127
terraforming wrote: post #122

Earlier quoted context omitted.

Please tag me when they answer. (does HN have tags/notifications?)

> does HN have tags/notifications? No, but if you visit your Threads page (link at the top of every page) you can see any replies to any of your comments. There's nothing special that marks a new reply, though. I have a habit of upvoting nearly every reply anyone makes to any comment of mine, as a way of thanking them for the comment. This also happens to help when I skim my Threads page, since it's easy to spot comm…

Dan Grossman's http://www.hnreplies.com/ works wonders
Post reply on HN