So, you can use social login (OpenID Connect in reailty), as an automated form filler and add your password, so your account will be effectively won't depend on that provider anymore.

I use a lot of services like that.

I think the whole point is not having to create yet another password.

One solution to all of this is to have some kind of durable identity verification that the user controls and can use everywhere. There are serious challenges with that of course, which is why we don't have it yet.

That's the fallacy. You're always creating a new password. Only its storage location is changing. You can store a password in a variety of ways and places. When you use a social login, you're using a time limited password stored in the OIDC provider. And if you lose your account there, you lose all your passwords.

Also, you can store your passwords in OS key chains (Linux, macOS), browser password managers (Mozilla Lockwise/Firefox), in myriad of other online/offline password managers, on a text file or paper.

Many sites allow you to "reset" your password for an account created with a social login. However, if you created an account with Google OIDC and lose access to your GMail account, that's another matter.

A secured password manager is the superior option, especially since you would not compromise every service in case your password is known by third parties.

So they are always in my password manager, and that part of life is good.

However, I always sign-up with an e-mail directly if possible, and don't use OIDC login pathways. If I had to use or was lazy during registration, I change my password immediately, so I can use an e-mail/password/2FA path.

I connect all my logins with my (custom-domain) E-mail and also do regular IMAP backups of my E-mails. I run Thunderbird once a week and sync all mails.

Ideally one goes in life forcing failures to be uncorrelated, but that's extra work. Anyway forcing them to be correlated is also extra work, so just don't.

But you're far less likely to ever have any issues with your domain name provider, because you literally only have your domain with them, and don't interact with them outside of that.

I would say if you want to be extra safe, your domain provider would NOT be your hosting provider. Because you can lose your hosting, too, and we've seen stories like that here a few times.

I'd love to have webmail on my own domain, hosted by someone else, and with ads on the side. Those ads should generate ~$20 per user per year (after all, they can be targeted based on emails I'm sending and receiving, and I'll be looking at them many minutes every day - the perfect combination for high revenue ads).

With $20/user/year, there should be no difficulty paying the hosting costs of such a mail server and staff to look after it.

I'll tell you why: because you are not worth that much to advertisers. If you are so cheap to the point of asking to get your data harvested, chances are you never going to be a high-value customer.

But if you are so dumb as to not know your data us harvested, you are a great gullible idiot, er, I mean customer.

I don't think logic holds any water. There is no rational 'free market' reason you can't sell your data, it's just logistically too difficult to deal with millions of individual 'sellers' istead of paying $supplier to get all of it at once.

2) Even if the data is being harvested, doesn't mean that there is any morality in trying to get a share of the profits. That doesn't make you smart, it makes you a cheap accomplice.

3) "free market" would apply only if all exchanged data were offered by those that own the data, and if they could determine how and when the data could be used. GDPR has shown already that some sites would rather not serve their sites to European citizens than comply with data regulations. You can bet that the intersection of high-value prospects who would be interested in selling their data for some meager dollars/year is very, very small.

You can buy discounted TVs (and in some places they are the only TVs you can buy), which clearly have advertisements on them that others do not.

When more people wake up my bet is they will be accustomed to advertising, they will just want better advertising. And if one can get paid for receiving short-form entertainment with relevant product information, with appropriate branding I bet there is a market.

Brave's model has shown that you can have a ad distribution system that gives more power to the users, the ads are still relevant, fraud is much more easily detected and it can still reward the users for their attention.

With zero knowledge proofs, you can even have a system where the advertisers only get to show ads for those that match certain criteria, but no personal data needs to be given away.

If you are working on anything that depends on direct exploitation of user data, I urge to go back to the drawing board and seriously consider the morality of it.

No one is set up to explicitly monetize your data with consent. It doesn’t seem like a bad idea once society catches up with it.

Monetizing users' attention is enough.

Look at the Brave model. People get paid for the ads, no personal data is exchanged.

Though I think “high-value bit of cattle” or “high-value mark” are closer to how the stalking side of the advertising industry sees us!

It looks like Zoho might have a free plan too but I've never tried it https://www.zoho.com/mail/zohomail-pricing.html

ImprovMX also does email routing for free along with webhooks and such

Been using Zoho for many years, switched from my free grandfathered Google Apps account to Zoho around 2014.

In GMail (and using Google Domains to host my DNS) I've configured this by inputting various settings as per the guide here:

https://support.google.com/mail/answer/22370?hl=en

The key relevant step is: "For school or work accounts, enter the SMTP server (for example, smtp.gmail.com or smtp.yourschool.edu) and the username and password on that account."

Is that kind of thing supported with Cloudflare?

Unfortunately I doubt that would work. Any email solution hoping to get significant use will need to be able to send as well as receive and/or store & organise, because if someone is needing to run their own send route elsewhere they'll run their own receive route there too, and any free email solution that allows sending will be abused in any way possible by junk mailers and other scammy types.

It would be a constant fight to keep the service off black-lists and dealing with the backlash from:

* people blocked rightly because of service abuse

* people blocked because of a false positive in what-ever automated checks you do (the admin involved in doing all the checks manually will be excessive enough that it can't all be done manually)

* those who are inconvenienced by the service, even temporarily, being on a blacklist

And that mass of spammers such a service will attract will be worthless: they'll have everything quickly automated and won't even glance at a single one of the adverts.

> With $20/user/year, there should be no difficulty paying the hosting costs

I doubt $20/user/year would cover it unless you get a decent number of subscribers. And I doubt there would be enough people who would sign up for this, who are not already using gmail or similar big providers that already exist or mail provision included with their web hosting or domain registration service.

Of course my gut reaction could be quite wrong here: why don't you give it a go? If you are right then there is a market to corner that no one else is looking at yet so you could make it big.

Except the domain renewal fees, it's free.

If Gmail blocks me, I can readdress the forwarding to hotmail or usa.net or whatever.

If they cant make it work, why would anyone else have more success by offering even more features for free?

And if you're already buying a domain name then why not just pay for the email account too?

I'd like to self host data and webmail and pay somebody else manage the headache of delivering and receiving.

Get your custom domain, create a mail user with Fastmail: [email protected]

Set things up nicely (do read the docs), particularly look at catchalls, wildcards and aliases

Give out separate email addresses to each and every service you use: [email protected]

Bonus: You can easily send emails back from each address you give out and if you create a label called "service" for the example above, mail coming to that address will be automatically labelled without needing to create a rule.

I used to use spamgourmet and used to get some resistance from sites using misguided email validation considering it a spam service (oh the irony) - now with Fastmail, everything just works.

Did the same but lost my Spotify account. Needless to say, but I haven’t used Spotify since then..