Yeah I completely agree this is something that needs consideration. I do have an email address with my own domain but for security reasons any accounts I create are tied to my gmail address. I've known too many people who have had personal domain email addresses intercepted, particularly through compromised domain/DNS settings. One simple MX record adjustment could mean every single bank account, social media profile, etc. all can be taken over.

> I do have an email address with my own domain but for security reasons any accounts I create are tied to my gmail address. I've known too many people who have had personal domain email addresses intercepted, particularly through compromised domain/DNS settings.

If your Gmail account is lost or compromised, good luck getting any help from Google; while G Suite support is decent, free Gmail account users are basically on their own.

Ask HN: Lost $400k USD in a deleted email, how contact a Gmail engineer? https://news.ycombinator.com/item?id=14452969

Ask HN: What to do about a wrongly shut down GMail account? https://news.ycombinator.com/item?id=2033474

Another account lost in the Google void – how many are there? https://news.ycombinator.com/item?id=17745761

Professor who refused to use other genders pronouns, was banned by Google https://news.ycombinator.com/item?id=14905384

To be fair here, two of these are obvious user error.

In the Etherium case, he deleted the email and wanted to get it back 2 full years later. The only way he would have recovered from this would have been to take meticulous backups (and test them regularly). I would expect any 3rd party provider to honor my wish to delete data, especially 2 years down the line (and, in fact, they are probably legally required to do so).

In the "lost in the Google void" situation, the user set up 2fa but lost all access to their 2nd factors. I don't see any reasonable recourse to this, as any "solution" Google implements would undermine the entire purpose of 2fa.

The remaining two are obvious issues with Google's service. The "gender pronoun" one is a bit odd because gender pronouns don't seem to have anything to do with the account closure (there's speculation that he was mass-reported to exploit their abuse response systems).

Is it more likely that your DNS host or domain registrar could be compromised or that Google might shut you out of your account? There's risks with either decision, personally I put more trust that my Google account will be there than in my registrar's security.

How does using gmail address compromised DNS? I mean if they compromise your DNS it doesn't matter who is hosting your email, they just point the MX at a different service.

Sorry, you're probably talking about using the @gmail.com domain where you wouldn't have to worry about DNS. I was thinking about custom domains in G-Suite.

Yeah I'm referring to an @gmail.com address. I'm pretty confident in Google's ability to secure that.

Are you able to link to some info on how email could be compromised this way? I'd be interested to learn how to secure my domain.

Whoever hosts your DNS is the weak point. Account and login security with whoever they are is critical.

DNS as well as registrar, which may be two different entities. You can either change the MX with the DNS host, or you can change the nameserver with the registrar.

> One simple MX record adjustment

Not sure if it's simple but how do you intend to protect against DNS record hacks?

google does the protecting against dns record attacks on gmail.com

"How?" is not the unanswerable question for them and for that domain, that it is for you & me and you&me.com

ProtonMail's security is formidable, but the messages are encrypted in such a way as to not be searchable.

If security is your concern and long-term search isn't, consider giving them a go. Great mobile app, too.

Their "end-to-end" encryption claims as well as their schtick about being hosted in Switzerland make it abundantly clear that I will never trust their security. I would go so far as to use almost any other major email provider over ProtonMail.

Could you be more specific about these 2 issues you have?

I mean, of course the actual transit of the email from the sender to your inbox is out of their control, but after that client-side decryption is entirely feasible.

And what is wrong with hosting in Switzerland? Switzerland has very strong privacy laws.

Sorry, can you go into more detail? I don't understand your concern.

No OP, perhaps one could think they make such a big thing about security to try to attract lucrative accounts, which they then have backdoors into.

As you can't verify their claims, all you can do is trust. If you want end-to-end encryption you should be gpg encrypting every mail, not relying on the unverifiable word on a provider. Any provider worth its salt will know that, thus wouldn't actually advertise an insecure (as verify can't be done) system as a secure one.

I think you might be misinformed - their security is based on client-side encryption which is open source. See:

- https://protonmail.com/blog/protonmail-open-source-crytograp...

- https://protonmail.com/blog/protonmail-secure-email-open-sou...

You don't have to trust any of their server code - you only have to trust that the JavaScript blob they send you is actually the same as the open source version. This is the same threat model as trusting Signal from the App store instead of side-loading it yourself.

As has been frequently pointed out, they could choose one account and serve that account a different webpage just once, and harvest their password in order to decrypt all their email in perpetuity. This would be a trivial change that would certainly go unnoticed.

I fail to see how this is any worse than any of their competition, which does server side encryption. At least with ProtonMail there is the chance of them being caught serving backdoored client-side pages - with server-side you would never know.

I feel like the hate is a case of people thinking not being perfect is worse than being average or bad.

If protonmail is billed as a pgp replacement, then people will think it is reasonable to use protonmail's encryption instead of 'offline' encryption, when that's not the case at all.

A version of ProtonMail with the application hosted locally, and no auto-updates, would fulfill your requirements I believe.

I don't really like them anymore (for similar reasons), but I don't know as I would put all other providers over them. Certainly, I think they're miles better than gmail.

I'll bite.. Please explain further

Well, you could argue that your mail is safe from everyone except one.

I’m not really sure if Google is more likely to fuck me over than any external actor, but it doesn’t feel right.

What's the point of having great security if you don't own the data?

Neither Tavis Ormandy nor Google have a good track record when it comes to pragmatic security. Google's business model is incompatible with proper security. Chances are that you know Tavis from him being arrogant on project zero so everyone who runs old versions of something, like all the millions of insecure android handsets, can get owned by script kiddies. People have been listing alternatives, but the whole point of giving something like gmail away for free is so there won't be any real alternatives. It isn't like it is going to make a difference either way, since Google's position in the market mean most people won't switch.