News for hackers. Stuff that matters.
Re:The FastMail Security Mindset by 333c on Tuesday December 05, 2017 @01:37PM (#15854335)
I'm considering switching (in fact I just registered for the FastMail trial). I'm especially interested in the ability to use catchall addresses with a custom domain, which would allow me to give out an address like <[email protected]>, and thus determine who shared my email address if I start receiving spam at that address.

This is partly possible with Gmail, as you can use addresses like <[email protected]>, but not all sites support emails with a + in them.

What differences have you noticed in your year since switching? I'm especially interested in any downsides. My biggest worry about Gmail is the lack of privacy from Google.

Re:The FastMail Security Mindset by cillian64 on Tuesday December 05, 2017 @01:51PM (#15854501)
I do precisely this with Fastmail and it works a treat. Setting up Fastmail with a custom domain was a joy, I can easily filter based on the To address, and you can setup a wildcard identity so you can trivially send email from whatever name you like at your domain.

To me the only downside is the mobile app isn't quite as polished as Gmail. It doesn't work offline, and I notice occasional bugs or awkwardnesses. But it's still very usable, and I much prefer the Fastmail web interface to Gmail.

Edit: Also, the Fastmail importer didn't work very well on my large number of Gmail messages. It failed a few times and restarting it resulted in duplicate messags.

Re:The FastMail Security Mindset by 333c on Tuesday December 05, 2017 @02:06PM (#15854668)
> To me the only downside is the mobile app isn't quite as polished as Gmail. It doesn't work offline, and I notice occasional bugs or awkwardnesses. But it's still very usable, and I much prefer the Fastmail web interface to Gmail.

But FastMail supports other clients, right? I don't want to be forced to use their web interface or their app; I'm happy with the Apple-written Mail apps.

Re:The FastMail Security Mindset by polpo on Tuesday December 05, 2017 @02:12PM (#15854735)
Yes, they support SMTP and IMAP just fine. In fact, they're one of the few providers that actually support IMAP push with iOS's Mail: https://blog.fastmail.com/2016/12/21/what-we-talk-about-when...
Re:The FastMail Security Mindset by ocdtrekkie on Tuesday December 05, 2017 @02:18PM (#15854800)
This is the best part of a standards-compliant service like FastMail. Gmail is extremely challenging to use with third party clients because it's custom features aren't supported. I've long had Gmail randomly archive (in no folders) email I told it to delete via an IMAP client, or duplicate items in multiple folders (i.e. labels) or other weird behaviors.
Re:The FastMail Security Mindset by distances on Tuesday December 05, 2017 @04:20PM (#15856103)
> But FastMail supports other clients, right? I don't want to be forced to use their web interface or their app; I'm happy with the Apple-written Mail apps.

It does, but at least for me the problem is using my separate forwarding-only e-mail address instead of fastmail.com as the sender. As far as I see, I need the native app for this.

Re:The FastMail Security Mindset by brongondwana on Tuesday December 05, 2017 @08:22PM (#15857760)
FastMail.com can send via a forwarding email address. You'll need to set up authentication at FastMail so it can authenticate to the forwarding service of course.
Re:The FastMail Security Mindset by distances on Wednesday December 06, 2017 @04:52AM (#15859857)
I don't use the forwarding service to send. I use it to forward incoming mail to FastMail, and in FastMail I just fake the sender address when sending e-mail.
Re:The FastMail Security Mindset by brongondwana on Wednesday December 06, 2017 @08:21AM (#15860848)
Sadly your use-case is dying. Asymmetric mail flows are becoming harder and harder to support, as DKIM/DMARC alignment and SPF become stronger anti-spam signals, we're going to have to lock down on egress for domains which we don't have proof of control for.
Re:The FastMail Security Mindset by rbritton on Tuesday December 05, 2017 @01:39PM (#15854360)
I use aliases (FastMail's term for custom addresses that go to the same inbox) for that reason. They work very well, and I've never had any problems setting up a new one on the fly.
Re:The FastMail Security Mindset by bweis on Tuesday December 05, 2017 @01:49PM (#15854475)
I should have known they offer this sort of thing. I tried spinning up an alias in the past but was unable to find where to do so. Maybe the UI has improved since I tried ~year ago.
Re:The FastMail Security Mindset by colanderman on Tuesday December 05, 2017 @01:51PM (#15854496)
They did shuffle things around about a year ago. Aliases are under Settings, in the Admin section.
Re:The FastMail Security Mindset by MrApathy on Tuesday December 05, 2017 @07:49PM (#15857621)
I've been a FastMail customer for about four years and overall I'm really pleased with their service. Like you I have my own domain, previously used Gmail, and provide custom email addresses to every site I register with. Interesting to see who has sold my email or may have been hacked when a rogue email ends up in my inbox (hi, Sunspel!).

I have one issue with FastMail that I didn't have with Gmail. Every few days/weeks I'll get a wave of backspatter from someone spoofing my domain to spam. I've researched and it doesn't look like there's anything I can do about this. Most of the backspatter ends up in my spam folder, but not all of it does. I don't know if Gmail automatically removed backspatter -- not even sending it to my spam folder -- or if this only started after I transferred my domain.

Re:The FastMail Security Mindset by 333c on Tuesday December 05, 2017 @07:56PM (#15857662)
By backspatter, do you mean things like message bounce alerts? Or replies from the people who received spam messages spoofed from your address?
Re:The FastMail Security Mindset by MrApathy on Tuesday December 05, 2017 @09:31PM (#15858031)
Backscatter is (I think) when the target server of a spam mail bounces the email back to me, the rightful owner of the domain, typically because the address is not valid (though I sometimes also get out-of-office messages or mailbox full errors).

It works like this: the spammer forges their headers to make it look like the from address is under my domain. My domain has DKIM/SPF set up, so a good recipient will compare the email to the authentication records, see they don't match, and then trash the email. But there are still a lot of mail servers out there that don't have that set up, so they accept the email as valid, process it, then return it to me when the account doesn't exist on their server. Like I said, annoying, but not a lot I can do other than set up rules to trash messages with a subject of "Undelivered Mail Returned to Sender."

Re:The FastMail Security Mindset by toast0 on Tuesday December 05, 2017 @11:12PM (#15858418)
Did you also setup DMARC? I've had good luck with that to reduce the amount of backscatter. Although some recipients don't check it, those that do will fast fail anything coming in that doesn't pass SPF or DKIM.
Re:The FastMail Security Mindset by gregmac on Tuesday December 05, 2017 @02:44PM (#15855098)
> which would allow me to give out an address like <[email protected]>, and thus determine who shared my email address if I start receiving spam at that address.

I've been doing this for over 15 years, but with a much simpler setup: I just forward it to another account, which for the last 10-ish years has been an @gmail address. The mails show up in my Gmail inbox as From: the original sender and To: the custom domain.

As a caution: don't forward a top-level domain. You'll get all kinds of dictionary-style spam attacks and it becomes flooded with noise. Instead, use a sub-domain, so you get for example <*@something.mydomain.tld>.

Re:The FastMail Security Mindset by PuffinBlue on Tuesday December 05, 2017 @02:52PM (#15855168)
> As a caution: don't forward a top-level domain.

Nice tip, I'll implement that for my setup. I had to stop a catchall on a TLD for the reason you mention and it'll be trivial to switch to a sub-domain. Thanks.

Re:The FastMail Security Mindset by nvarsj on Tuesday December 05, 2017 @03:40PM (#15855629)
The problem with this is SPF reject domains. Which means your legitimately forwarded email will simply disappear into the void. Hosting your domain at something like fastmail will not have this problem.
Re:The FastMail Security Mindset by gregmac on Tuesday December 05, 2017 @04:07PM (#15855988)
Hmm... I suppose, but I've never not received anything I was expecting. It's possible I've just not run into anything with SPF reject rules, or that Gmail is allowing them anyway.

I don't disagree it's better if fastmail (or whatever) can receive directly as it saves another MX server in the middle, but it's still doable without the end provider explicitly supporting it.

Re:The FastMail Security Mindset by distances on Tuesday December 05, 2017 @04:23PM (#15856141)
I have the same experience. I'm using a mail-forwarding service, so I can't host it with FastMail. FastMail is my third mail provider I'm forwarding to, and I'm not aware of any missed e-mail with any of them this far. Then again I guess I wouldn't be :)
Re:The FastMail Security Mindset by carussell on Tuesday December 05, 2017 @02:56PM (#15855208)
I used Fastmail for a few years. I switched last spring due to two interactions through support channels that left me really despising the apparent company culture, attitudes about intellectual honesty, and general jerkishness.

You're probably considering switching based on your mail needs, so this might not apply to you, however:

In addition to mail, Fastmail also advertises[1] their plans come with their FastMail Files feature. It can be used for one-off file sharing (akin to Google Drive) and even static site hosting (explained in their support docs[2]). However, I learned from the CEO's comments in my support ticket that they're apparently overprovisioned and don't expect everyone to actually use the storage included with their plans.

I just took a cursory look at their landing and pricing pages and see they aren't touting Files loudly right now. (My initial thought is a hope that they took my remarks to heart from the thread that led to my decision to leave, when I said they should "go tone down the hosted storage aspect of your marketing". However, given that the promotional blog post from [1] occurred within the month that followed my comment, I suspect not.) The blog posts and Fastmail documentation[3] about the Files feature are still available, of course, whether or not it's still on the landing page.

This itself would have been only slightly disappointing, but the bad taste came from the passive aggressive responses in the support thread, that this was the same sort of attitude adopted in a previous (unrelated) support thread from a couple years ago, and that in this most recent incident, they decided to go on the offensive and compare using the 25GB storage space for making backups to abuse. (Their choice example being someone trying to abuse an ISP's lax limits on DNS to tunnel IP over it.) I half expect someone to show up here to try and apply a layer of spin in exactly the same way. Bonus points if they ignore my actual use case, try to make it out as if I was trying to do something I wasn't, and then call me the "disingenuous" one again.

1. https://blog.fastmail.com/2017/03/29/faster-files/

2. https://www.fastmail.com/help/files/website.html

3. https://www.fastmail.com/help/files/usage.html

Re:The FastMail Security Mindset by eridius on Tuesday December 05, 2017 @06:43PM (#15857270)
> However, I learned from the CEO's comments in my support ticket that they're apparently overprovisioned and don't expect everyone to actually use the storage included with their plans.

Isn't that true for every file hosting service everywhere? Most people only use a fraction of their available storage, so there's no need to actually provision enough space for everyone to use 100% of their quota. Doing so would be a waste of space.

Re:The FastMail Security Mindset by vladus2000 on Tuesday December 05, 2017 @01:46PM (#15854436)
I switched about 6 months ago. I love having the catchall address although I had that when google managed my custom email domain as well. The web interface is really fast as it does operations in the background so it is really responsive, even at times when your internet connection is spotty. The only real downside is that the phone app (at least the android one) wasn't that good, I currently just use IMAP and k9 mail instead which works well enough.

I did use inbox before (and I still get some email to my gmail account) and it does have nice features like snooze that I miss. But on the whole I am happy with my choice to use fast mail.

I should also add that I seem to get slightly more junk mail than I did before, but it is close and hard to tell, I have not had a real email marked as spam yet, which did happen from time to time with gmail, so this isn't a complaint, just an observation.

Re:The FastMail Security Mindset by JosephRedfern on Tuesday December 05, 2017 @01:38PM (#15854349)
I'm not suggesting (at all) that you use them over FastMail, but GSuite also supports catch-all email addresses.
Re:The FastMail Security Mindset by ehPReth on Tuesday December 05, 2017 @01:53PM (#15854529)
Indeed - but replying from an arbitrary address is one big downside of G Suite’s implementation. In FastMail you can add <star>[0]@example.com as an identity. Selecting this when composing an email allows you to edit the localpart entirely. Similarly, when replying to an email sent to your catch-all and you have an <star>@ identity for the hostname FastMail will automatically set your from address for you.

In Gmail (with G Suite) one has to manually add every identity they may wish to reply from - there’s no <star>@ option. Additionally, it’s impossible to hide your real email address/Google Account address. It’ll always be disclosed in the email headers unlike FastMail.

I’d love if G Suite would make such a workflow easier..

[0] escape characters don’t seem to work here, <star> refers to what’d you think it does

Re:The FastMail Security Mindset by Chaebixi on Tuesday December 05, 2017 @05:21PM (#15856592)
Selecting this when composing an email allows you to edit the localpart entirely. Similarly, when replying to an email sent to your catch-all and you have an <star>@ identity for the hostname FastMail will automatically set your from address for you.

I didn't know that, but it's fantastic news! I was doing things the awkward "gmail" way.

Re:The FastMail Security Mindset by dvcrn on Wednesday December 06, 2017 @12:09AM (#15858701)
Speaking of which, do you know of any mail client (on iOS or Mac) that supports this? I am using the web interface for replying on most emails because of exactly this feature
Re:The FastMail Security Mindset by ehPReth on Wednesday December 06, 2017 @11:57AM (#15862634)
Unsure, sorry. I use their iOS app (https://itunes.apple.com/us/app/fastmail-email-calendar/id93...) for mobile and their web interface elsewhere
Re:The FastMail Security Mindset by JustSomeNobody on Tuesday December 05, 2017 @01:42PM (#15854397)
I have my mail hosted at Zoho and they support this.

Edit: Simply throwing this out there in case Fastmail doesn't and you're looking for alternatives. Not shilling for Zoho.

Re:The FastMail Security Mindset by 333c on Tuesday December 05, 2017 @02:12PM (#15854739)
Looks interesting. It seems (from a quick look) like it tries to be a replacement for a lot of Google products, including Docs. It's nice to see that Google and Microsoft have smaller competitors in this area.

Personally, I'm only interested in email. But thanks for letting me know about other options!

Re:The FastMail Security Mindset by ProAm on Tuesday December 05, 2017 @01:53PM (#15854525)
Im curious how FastMail and ProtonMail are comparison wise?
Re:The FastMail Security Mindset by news_to_me on Tuesday December 05, 2017 @02:01PM (#15854622)
I tried out ProtonMail for just a little bit around the time I switched, and personally I found the focus on security and encryption to be at the expense of user experience.
Re:The FastMail Security Mindset by distances on Tuesday December 05, 2017 @04:29PM (#15856187)
If I recall correctly, ProtonMail was using RoundCube as the webmail interface when I was looking for a service. RoundCube was the reason I left my previous e-mail provider, so I had to give it a pass. Though now their website is showing a rather nice web UI, perhaps they've switched to a new one since then?
Re:The FastMail Security Mindset by bartbutler on Tuesday December 05, 2017 @05:15PM (#15856553)
We have never used RoundCube in the project's history. You must be thinking of someone else.
Re:The FastMail Security Mindset by sp4rki on Tuesday December 05, 2017 @08:49PM (#15857863)
I'm gonna piggyback on your comment to ask a question I'm not clear on. Am I correct in that if I don't set a recovery email there is absolutely no way for anyone to get access to my account unless they get my password? If that were to happen I could recover my account by proving to you I am who I say I am (perhaps gov ID plus DNS records), but my previous email will be forever encrypted?

I ask because that is what I want. I want my account to autodestruct if compromised and when recovered I want to be assured that all my personal data has been safeguarded by effectively throwing away the key into the depths of Mordor.

Re:The FastMail Security Mindset by distances on Tuesday December 05, 2017 @05:27PM (#15856640)
Thanks for the clarification, must indeed be mixing you up with another service!
Re:The FastMail Security Mindset by carussell on Tuesday December 05, 2017 @05:45PM (#15856785)
You might be thinking up riseup.net. They use Roundcube, they target a similar audience, and both have a cryptopunk-ish slant.
Re:The FastMail Security Mindset by distances on Tuesday December 05, 2017 @05:58PM (#15856893)
I had a quick look -- I was thinking of Posteo. I think they aren't aiming for the exact same customer segment, but I think of both as a small Central European service that values privacy.
Re:The FastMail Security Mindset by arkades on Tuesday December 05, 2017 @04:51PM (#15856354)
I’ve only tried ProtonMail’s iOS client, but have found it to be very easy to use.
Re:The FastMail Security Mindset by terraforming on Tuesday December 05, 2017 @03:21PM (#15855429)
Do not forget about tutanota.com. I prefer them to protonmail since they're much cheaper and feature wise are pretty much the same.
Re:The FastMail Security Mindset by news_to_me on Tuesday December 05, 2017 @02:06PM (#15854667)
I haven't had any downsides at all, for my use cases. I've heard from a few folks that lack of "labels" is a bummer (if you rely on them in Gmail), and their mobile clients aren't quite as good (though I've never used them).
Re:The FastMail Security Mindset by blfr on Tuesday December 05, 2017 @01:53PM (#15854528)
G Suite (formerly Google Apps) supports wild cards so you can use Gmail with [email protected].