Your choices are:
- Run it yourself: And get eaten alive by third party anti-spam products. Maintaining a mail server is a full time job.
- Move to another large corporation (e.g. Apple, Microsoft, et al). What have you solved exactly?
- Move to a small mail provider and hope they don't go under (and you lose your x year old email address associated with tons of stuff) or have security issues because they didn't/couldn't afford the expertise.
The "least bad" option right now just seems to be to spread yourself around, so you're not too invested in any one vendor (in particular in case they ban you randomly for reasons they won't disclose or discuss).
1. Have your own domain name.
2. Use a small-ish mail provider that supports IMAP, etc.
3. Store all your emails/folders on a device (laptop, whatever). This way if the provider locks you out or goes under, it's easy to switch to another.
Has worked since what, the 80's? Personally been doing this since before Gmail existed. Ironically I chose this route precisely because the major providers (Yahoo, etc) were too unreliable for me - I had lost accounts multiple times because some of the (then) top mail providers decided to get out of the mail business and/or regressed their featureset so much that it hurt.
Of all the Internet services, this is the easiest one for someone to own.
On the other hand they are small enough to certainly be hurt by concentrated DDoS attacks as it’s been happening the last week.
Mail provider with any small provider.
Use Thunderbird, it's honestly better that it has been in maintenance-only mode for a decade and isn't being "innovated".
You can also just use an email client that downloads the emails you get, and then point your MX-records to another provider if and when your provider goes belly up.
Sounds about right. For e-mail I'm using SES for outbound on my domain, and.. of all things.. Yandex Mail for inbound. SES doesn't seem to have any problem with spam filters, Yandex OTOH, it's definitely a temporary solution, I'm only using it for POP3, but their webmail is also fairly cute. Yandex outbound is treated as spam by basically everything except Yandex
Yeah, sure, should be.
Meanwhile I've yet to actually see one in the wild, in a 20 year career, aside from one that's used on a server I know of.
Coworkers at small tech companies? Nope. Serious-business clients coming into the office? Don't see them busting out the USB stick and plugging it in to their laptops. Medium-sized tech companies? Nope.
Hell, I'd hate it even worse than phone 2fa. I lose my actual keys all the damn time. 80% of all remote controls in our house are, at any given time, vanished to some other dimension, because I have kids. The last thing I need is another tiny, super-important physical thing to lose. The only reason a cell phone is a useful object to me, and not another annoying thing I can never find, is because of "Find My".
Enabling SMS authentication for an account is a huge DOWNGRADE in security, not an increase. Cellular providers are infamously easy to socially engineer.
1)Password alone is weak. 2)Password and SMS 2fa better. 3)Password and real 2fa best. 4)Password, real 2fa, backup codes, basically just as good as best.
Google is only eliminating #1, and only requires 2fa when logging into a new device. I’m surprised HN folks are having a tough time grasping this one, in general it’s pushing people (I’d guess 90% of people would never opt into anything more than a regular password, including the parent) into #2 above.
Parent should do #4, but #2 is fine
For me, I have to consider 2FA, or in the case of my son, who doesn't want a phone, a Yubikey or similar. I don't want to live with the additional management and potential disaster of 2FA blocking his access to his email account, which is currently his gateway to university.
At work I have 2FA, but there's a whole IT/IS team to manage and unblock things (which happens, co-workers get blocked out of their email accounts regularly).
Personally, I'm hoping to convince my domain cohorts (family) to move to Protonmail or similar.
This is a good point: For many people, passwords are already too much of a hassle. 2FA is going to be just more hassle. I manage all the passwords for everyone in my family, because they just can't manage to remember theirs (even simple ones like hunter2), and they don't want to use a password manager themselves. I'm sure ours is not the only family in the world who does this. So, the burden falls on me to keep their passwords stored and secure, and tell it to them when they need it. Now add 2FA onto that pile and it's just going to be more of a hassle for me.
Now that I only have one phone, I've turned off 2FA as much as possible, because only one phone means when it breaks, I can't access my accounts, because I can't get to the 2FA tokens. No thanks.
I keep my backup codes in a plain text files in a folder on my home NAS which is encrypted on disk, and backs up through rclone (with encryption) to backblaze every night. I'm about to configure up a second NAS for redundancy because 3 2 1.
I read them, and said, no thanks; I'd rather be able to recover my accounts easily.
Yeah, but still pretty inconvenient. I migrated all my main stuff way from Google years ago, but I have a bunch of accounts I use as throwaways that will be a much bigger PITA to use.
For anyone attempting escape, rclone seems to be the only tool that supports exporting all Google Docs ever shared to the account. Google Takeout (or the equivalent GAFYD tool) worked for everything else