I've been a fastmail customer for a bit over a year and I agree.

The offerings over at https://protonmail.com/signup have been nagging me to give it a try.

I now have a reason to try and switch. I'll lose functionality found in fastmail but gain a lot in security.

Unless you have a set of objectives that are very different from what I consider "as secure as e-mail gets", please consider GSuite and not Protonmail. (I don't speak for 'tptacek, but I'm pretty sure he'd agree.)

As a corollary: if you really care, use Signal for stuff you can't say over e-mail. Whatsapp's fine too. But they solve a very different security problem than the one you need e-mail to solve, which is mostly "don't leak my emails" and also "don't reset my password for attackers who ask nicely".

Just gonna drive by mention https://landing.google.com/advancedprotection/, which is a physical-2fa-security-key-only version of gmail. To my knowledge it also disallows mail forwarding, and the account recovery procedure in the event of losing both second factors is intended to be a long process that involves proof of identity and multiple attempts to notify the account owner.

(I work on gmail, but I'm not intimately familiar with this option, other than knowing that it exists and is intended for high value targets like celebrities and politicians).

Yep. I don’t recommend it by default (most people I work with use GSuite in a work context, so recovery is normally administrator-mediated), but the fact that this exists is pretty awesome.

The pricing is very unclear from even three clicks in from that link, only that it is some sort of add on service.

I don't use it, but from what I can see, it appears to be free, apart from the keys themselves needing to be purchased.

I know that GSuite would like to differentiate its enterprise products by features, but allowing basic/business plans to force U2F would be great. Since it's also available in GCP's Cloud Identity product (which is free), I hope this is coming down the road.

That also means you cannot this account as your Android phone account without an NFC U2F token, correct?

That looks amazing. Does any other company provide anything like this?

>"Whatsapp's fine too. But they solve a very different security problem than the one you need e-mail to solve,"

Can you elaborate on this? What security problem are they trying to solve?

Sure! Signal and WhatsApp are good at having private conversations. Email is very tough to add private conversation capability to, for a variety of reasons. What you do need your mail provider (and by extension your DNS provider) to do is to not give up access to an attacker who asks nicely, because for most services, email access is account takeover.

This makes discussions about email security confusing, because most security professionals I know are thinking about a very different threat model (pop all of your services) than what a lot of people think about (confidentiality). Google is pretty good at not letting random people auth to GSuite as you. (Still turn off SMS recovery, though.)

Does that answer your question?

I get the impression that when non-security people talk about "security" these days it's almost always in the context of preventing government surveillance.

So even though Google has a great track record of keeping hackers from taking over your accounts, the news stories about them cooperating with governments makes them seem less "secure" to some people.

What's weird is when it leads to a fallacy where people trust services that are less verified and tested in terms of security just because there isn't the association with government cooperation.

This is irrational. It might be a complicated question if the foreign-jurisdiction alternatives were more secure, rather than drastically less secure. But since that's not the case, switching from Google Mail actually gets you the worst of both worlds: a mail service that is materially less secure, operating in a jurisdiction where there are literally no rules preventing USG-level adversaries from exploiting it.

Agreed. Don't throw the baby out with the bathwater.

Yes, thanks for the clarification on that point. Cheers.

You have been a customer for over a year but based on someone else's anecdote you feel the need to post a signup link for a competitor?

> This is death.

Even allowing for some hyperbole, I think this is an overreaction. I agree that they made a mistake, but we only know of one user it affected. They didn't leak an entire database of user data or expose a vulnerability for which the attack can be automated.

You've commented many times that email is inherently insecure and that (IIRC the conclusion precisely) there is little point in focusing on securing it. Instead, use a secure messaging system such as Signal. Email just isn't going to be secure. Fastmail seems to put more effort into their security than most mail providers. For example, the proxied images [0] sound fantastic and they address a threat that affects almost every email user daily.

[0] https://blog.fastmail.com/2014/09/16/better-security-and-pri...

The inherent insecurity of e-mail doesn't change the fact that popping someone's email account means popping most of their services. Therefore it makes sense to hold e-mail providers to a higher standard than a median company.

Furthermore, while we only know 1 user affected, in the rest of the thread, Fastmail has been cagey at best about answering what they feel the process is now, let alone what it was back when this incident occurred.

You're aware this is how the vast majority of email providers legacy operated right? (And sadly a few still do)

E.g. in this case likely a 2 point auth system (security question and e.g. payment details (last four of latest payment meth/etc))

Seems you're shocked that a lower tier support agent can auth this kind of request when the reality for most email hosts is that they can.

They(likely a new employee) got socialed.

Yes, they should have systems in place to prevent this from being possible in the first place; no, I do not find your incredulity genuine, albeit rational.

FastMail isn't some random legacy email provider. It's a premium one that bills itself as secure. It's not some free mailbox you got with your budget domain registrar. Hence, it's reasonable to hold them to a higher standard rather than fatalistically observing that the median email provider sucks.