So at least for .com and .net there's a responsive third party with procedures to work around failing registrars.
On the one hand, using national TLDs can be a problem if the area you live in is no longer considered part of your country (I imagine .ua owners may have that problem in the future with the way things are going). On the other hand, using TLDs like .com/.net/.ai/.io puts your domain under control of foreign law enforcement (US for .com/.net, UK for .ai/.io).
It looks like .io will change jurisdiction. Another thing to consider with regards to jurisdictions. There is a good argument for you own national TLD.
That said, a lot of ccTLDs are not that restrictive. Anyone can register a .uk for example (so, Scottish nationalists have one less thing to deal with in their plans).
In the case of Ukraine they will probably want to allow people in any territory they lost to retain .ua domains as a way of maintaining a claim (that is assuming their rules are restrictive in the first place).
Not to mention the risk that someone else takes possession of said email accounts and domains, in which case they essentially own every account you have that's bound to that email.
In fact the entire reason I stay on free email from a company I don't like is because I think it minimizes the chance I lose access to my email. My conclusion is essentially the exact opposite of the article.
A registrar banning you doesn’t remove your ownership of the domain. File a complaint with ICANN and you will get it back shortly.
was it a very distant location to head out to?
Mandatory reliance of services on other services (whether it is email, phone, or a more explicit identity provider) is generally unfortunate. I think it is best to not look for a perfectly reliable setup, as it is unachievable, but to keep in mind that they are not reliable, to have recovery plans and fallback options if possible, reduce dependence on online services, especially those depending on others. Though a personal domain name still seems more reliable to me than that of an email provider.
It also results in awkward conversations if you have to talk to staff. I had ordered some pet supplies online a while ago registered like this.
Then I go in store more recently and they ask "Do you have an account with us?", I give them that email when asked, which causes them to pause. We went around a few times of them asking what my email was, before getting a manager who thought I was doing something dodgy and decided to try looking up my account by phone number instead of email.
If you use a password manager you could obviously just put something random instead of the company name.
Even easier: I have a list of pre-generated fantasy addresses on my smartphone and can pass one to randoburgerspot on the fly.
If I could think of an unambiguous .com, .net, or .org that is a pronounceable word that wasn't registered already by 2001, I'd be maybe willing to try this again.
I keep expecting to have to explain, but the vast majority of the time people don’t ask.
(only half joking)
<yourname>+<arbitrary_str>@gmail.com
steve+randoburger@gmail.com
Migadu allowed me to use - instead, so firstname-*@ also ends up in my inbox (firstname@).
My email address at my hosted domain is like jsmith@jsmith.com, and I have a catchall so I can get mail for *@jsmith.com
Someone eventually bought jsmith.net for his business and now I get a lot of mail meant for jacob@jsmith.net sent to my jsmith.com domain.
Fortunately he uses just the one address and now I set up an autoforwarding rule to forward his jacob@ emails to him.
>Oh, and I highly recommend providers that offer a "catch-all" feature. This way, you can have one main email address and unlimited <put something here>@yourdomain.com email addresses. It's useful to have it separated, like netflix@yourdomain.com, but still receive the emails inside the same inbox.
During the process I've been marking them in a spreadsheet with their 2FA status (no 2FA, TOTP, security key, etc.) and adding their passwords to a password manager.
This is all in case I ever need to go through the migration process again for whatever reason, or if I lose/break a Yubikey, I will know what I'm signed up for, and will know where to enrol my new Yubikey(s).
It really is a massive hinge for many people that isn't even really considered, most people's entire digital lives would be uprooted if they lost access to their email for whatever reason.
Thankfully that doesn't really ever happen to most "normal" people to my knowledge, since most just use Gmail, but I know it can and has happened through account bans or such.
Wouldn't it be great if Yubico let you back-up and restore a Yubikey?
It's maddening that they haven't come up with a reasonable way to allow a purchaser to register multiple Yubikeys to enable freely restoring backups between them. (Think of if analogously to buying multiple padlocks keyed the same from the factory.)
I'd prefer to be able to just set the same DKEK on the devices myself. Failing that I'd settle for Yubico being the arbiter. It would make the devices substantially more useful and less scary in loss / destruction scenarios.
It is possible, using a cryptocurrency hardware wallet allowing to install tiny apps on the hardware wallets. These wallets are meant to initialized by a "seed" and there's a protocol to easily write down that seed (a list of words, all coming from a dictionary of 2048 words and the list of words contains a checksum in [part of] the last word).
Now from that seed, cryptocurrencies hardware wallet can derive any secret. And it's possible to derive a secret that's used like Yubikey.
So as long as you have your "seed" backed up somewhere, you can duplicate your 2FA key.
I did test the old U2F version, pre FIDO2/webauthn, using early Ledger Nano hardware wallets and it worked.
I think there's now a more recent version available but haven't checked that. A Ledger Nano S Plus, from their website, costs 70 EUR / 80 USD. I'd say it's not too pricey to try it and see if it could suit you. Check their available apps first and see if there's one that can simulate a Yubikey (or a similar 2FA security key).
I know HN loves to hate on cryptocurrencies but I'd say that at least the crypo-bros got the "you cannot trust your computer" part right. The attack surface of a cryptocurrency hardware wallet is not only minimal: it's minimal on purpose, built on the premises that computers were not devices to be trusted. They're literally built with the idea that they can be used on a compromised computer and you should still be safe, so there's that.
Step 1 : go with the one company that's known worldwide for abusive & permanent bans with no recourse.
This post is a bit too generic, but it's true that using your own domain for mailing is the best solution to avoid getting locked out. Although you need to pick a good registrar, too...
The saddest thing though is that in some ways Gmail is harder to hack into than some registrars. I remember a postmortem write-up from a guy who had his personal domain easily hijacked by social engineering someone at the domain registrar, which then served as the foothold of a larger identity theft attack against him. Google, by virtue of simply not even doing customer service, is much harder to social engineer, so the author of that piece pointed out that ironically if he'd put more of his eggs in the GOOG basket, he'd have been safer.
1. 1 custom domain (<simple-word-or-two>.com): this will be used for friends, family and any online accounts that know me IRL.
Use Fastmail masked addresses with my custom domain where it makes sense like an online account for amazon.
2. 1 custom domain (<online-nickname>.xyz): this will be used for a blog, professional IRL interviews, correspondence, github.
Use Fastmail masked addresses with my custom domain where it makes sense.
3. Masked emails using fastmail.com: for online accounts that are ephemeral, random newsletter signups etc. Don't want to associate any of my custom domains or IRL identity. Don't care if these are portable.
My main goals are:
- Separate my online identity/alias used for my blog (2) from gov entities, banks etc (1).
- for more anonymity/privacy use the fastmail.com domain with masked addresses to blend in with others on this domain.
I'd love feedback and to read what you do if you want to share :)
The only thing that I would add is that I prefer to "salt" my single-purpose email addresses with a bunch of random characters to prevent enumeration attacks, since it would be trivial to figure out the email address that I use for different services by just guessing. If I used amazon@domain.net, I might also use uber@domain.net, etc. Adding a salt prevents this from happening.
I got banned by .xyz once. I did manage to get it cleared up, but being banned by the TLD itself is pretty unpleasant. It's hard to even figure out that's what happened. And then I had to "prove" I was no longer distributing malware, with a list of what things I'd done to clean up the site and prevent further malware distribution - which was difficult as I was never distributing malware to begin with. Just a static website for a wordle variant, no ads or other 3rd party content.
It certainly does not get around the ...if your account gets banned maybe the forwards will still work... concept but in general something like https://github.com/joeyates/imap-backup to backup your email and then add them to a typical backup process with your other files works well.
1. Email providers need to be required to forward your email to your new address for a year if you ever lose your email for any reason.
2. Domain registrars need to save your domain name for a year and allow you ample time to reregister if you ever let it lapse for any reason.
Then use mail client instead of webmail. I use thunderbird and have multiple boxes I just backup Thunderbird profiles folder to my NAS.
A light Google search tells me that it is possible with several different providers to pay for up to 10 years in advance. Still, the exact same issues can happen at the 10 years and 1 day mark! How do large corporations handle this problem? Do they have a special contract where the domain register will always keep the domain registered, then bill the corporation directly? That seems like a business venture with juicy margins.
In before:
* running your own mail is too much of a burden
* I used to host my own mail but I couldn’t figure out DNS or used a bad IP or something and Microsoft/Gmail won’t accept my mail
* if “they” want to ban you they will just seize your domain or kick down your door and shoot your dog
* it’s good that they can ban you from your email because I don’t like spam
Edit: lol, I was not in fact “in before” the comment about domain seizures. Unbelievable.
For most people, who are not doing anything shady/controversial with their domain and are using a .com or .net domain (which are price regulated by ICANN), are not using a shady registrar and will always have the cash on hand to renew as needed, the answer will be Google and co.
Its a good idea to set up auto-renew on a credit card, so you can be sure it will go through and you won't forget to renew it.
Most domain registrars will at least have some customer support.
But good luck getting support for a free gmail account.
You don't have to go with a major mail hosting service to prevent deliverability issues. Any one of the hundreds of thousands of small local hosting providers should do. I've been with two tiny, local, "boutique" hosters for over 20 years and never noticed any issues. I also have it on good authority that entirely self-hosted e-mail is not as tricky as some like to claim. Set up your SPF, DKIM, and DMARC properly, and obviously don't send any spam or be an open relay, and even Google and Microsoft should have no worries doing business with you. Heck, if abuse scores were that important, Google and Microsoft would be the first hosts anyone would ban.
Also, catch-all is a terrible idea. I used to do it in the mid-2000s. Think about your current spam levels and multiply it by a thousand when every spammer can try jack@, john@, joe@, etc., and everything is delivered. Add to that all the spammers that use something@your-domain as a fake sender, so you get all the non-delivery reports. Ugh.
I used to do this to track leaks and non-consensual passing on of my address (the old registering at Company X with company-x@). This worked a few times, but after a few years I noticed that the amount of breaches and leaks soon make it useless. At this point, according to HaveIBeenPwned, most of the addresses I ever used have been in 20+ leaks each. It just not worth the effort anymore.
As a bonus, if you install notmuch you get quick offline searches and can "mine" your email with shell scripts (or easily share it with sam altman if you're into that kind of thing).
(Alternatively, if you prefer being GUI, just install Thunderbird – this can also download your full imap and give you local search. You don't even have to use Thunderbird for it to be useful as a backup; it's probably the easiest way to quickly become more independent from google randomly deciding your account should be locked, which does happen.)
If I host my blog, assuming I actually start making posts, on GitHub with a custom domain, when I die then the domain will likely expire and the blog is no longer accessible. If I keep it with my GitHub .io url, it’ll be there for as long as the account is there.
The author makes a good point, your email address is (arguably) more important than your home address. Perhaps there already are, but I hope for better safeguards against these kinds of attacks.
1. Specific known compromised TO addresses are sent to devnull.
2. Specific FROM senders are whitelisted.
3. Three or sometimes four heuristics engines evaluate. If any of them pass the mail, it goes to a separate new-senders inbox. I thus get maybe a dozen spam messages per week in that box - and five figures of messages rejected.
I used to tweak it a lot, now I just occasionally add another FROM address to the whitelist.
We need a law that just like you are required to let people drop from a mailing list, there's a law requiring one ack or click on a link to join a list. I always get on legit lists that will stop once I request. But in a month I get 100+ new lists often sending me 10-50 messages a day.
2) in case of hard to remember address, what do you do if asked to write it down with no access to your records? (It happened to me once before)
About once a month I go and drop myself from the latest lists. There are many magazines and whatnot where you can sign someone up for 100+ mails a day. Only a very few of them send you a message you have to ack to start the flood. Most just start the firehose without checking.
I'd like to hear what other people do to address this.
Not sure what's the best way to handle this, I had my gmail account since the early days and it's baked into so many important accounts. It definitely crosses my mind what it'd be really difficult if I were blocked out somehow.
Also when you pick an email provider, pick one with a good privacy policy.
Personal email domains makes you very identifiable just by lookung at your domain.
Using aliasing services (e.g. Mozilla Relay, Addy.io, etc.) with their default address generation ensures your email address itself does not disclose your domains when the eventual data breach occurs.
Plus catch-all addresses makes you an easy target for spam by sending to any email address on that domain vs need to know specific email address on typical email services.
There's a chance forwarding is better than fetching. I once had a Gmail account stolen, and account recovery was locked for some reason, but email forwarding had been set up and I was still able to get all emails the address received.
In case it's relevant, I happen to use Fastmail now and their "mail fetch" feature involves imap.
Before SPF and the like, it used to be trivial to also send email with a different From address (like your existing Gmail address) from your own server, but that’s not the case anymore.
They can also serve as a sort of snapshot of a certain point in time that’s very effective at jogging your memory. I’ve had occasions where old emails reminded me of things that happened that I’d nearly forgotten or conflated details about.
Are there registrars that let you walk in with a physical ID to proof you are you in case your email gets compromised and they get access to the registrar? Any experience with that?
Why bet on that instead of doing it the other way around (i.e. making the self-operated mail server the primary that forwards to the service provider inbox), or at least practicing doing so by pointing the MX records accordingly?
The forwarding MX would need to support things like ARC and DKIM, though, or the forwarded emails themselves run a high risk of getting dropped as spam by the third-party provider.
What I’m slowly doing is staggering my addresses by importance - trying to separate personal from all the spam / registration / etc.
Saying that it’s probably been years since I used email to actually message someone.
(alternatives for other OS: https://alternativeto.net/software/mailsteward/)
Then I put the database on multiple backup locations regularly.
Another thing, some people do not already know: If you don't need a throwaway-adress for some services, and you just want to make your mailbox more structured, you can use '+' before the '@' to add another word to your email adress.
Like: your.name+randomName@gmail.com
The +randomName will be ignored and the emails are received at your.name@gmail.com. But most Servers (I use) will put a '[randomName]' before the subject of the received email. Which can be quite handy for handling your emails. Even more, if the company uses multiple different adresses to send you emails.
I've switched 3 years ago to a hosted forwarding service forwardemail.net
Pros:
* Allows to switch email providers if needed
* Allows to forward email to multiple providers
* Allows to store backups of emails
* Allows to have emails on multiple domains for different contexts (personal/professional/projects/etc.)
* Allows to have different email addresses per service. If you get spam on that email address you can just stop forwarding emails for it.
* Allows to have reliable mail rules based on the email address
* Allows also to send emails from multiple addressses
* Most spam is filtered before it reaches the inbox
* Open source
* Would be easy to switch to a different email forwarding service if needed (or self host it).
* Excellent track record over 8+ years
Cons:
* They have the potential to snoop on your emails. Any service that's really important would have 2FA enabled, so I accept the risk.
* They have the potential to send emails on your behalf - again, they've earned my trust, so I accept the risk for that.
* Add another point possible failure. So far I haven't noticed any issues with it.
* There's greylisting that delays emails for 5 minutes if they are not on the whitelist, which affects some of less common sending services.
* In very rare cases, some services ban registering with a forwarding email addresses.
* You need to make sure you don't lose your domain. I renew it 5 years before expiry with a reputable domain registrar (NameCheap).
Overall, it's been working great for me.
The contractual requirements that ICANN imposes upon registrars. They can’t just take your domain for any old reason. The rules are fairly well defined and registrars can lose their accreditation if they do not follow them.
https://www.icann.org/en/contracted-parties/accredited-regis...
This is not sufficient. Even your domain can be seized. There is no way for any service dependent on the DNS System to be irrevocably owned.
All you need to do is get an ISO-3166-1 alpha-2 code issued for you, and then never change your name, and you're golden.
https://en.wikipedia.org/wiki/Top-level_domain#Historical_do...
Substitute “criminal activity” with “someone with power that doesn’t like what you’re doing”.
Consider the eBay stalking scandal [1] and ask if those doing the stalking would be willing to bribe or coerce someone to seize the blogger’s domain.
