Independent email service - Where to go/how

walesrob

As others have suggested, buy your own domain. If you only need email for your domain, and not a website, then an email host like Runbox, Fastmail or Polarismail will do the job. Fastmail is about $40 a year, but has email, calendars and (soon contacts) sync across all devices, as well as the ability to pull in email from other services but if its a simple email hosting plan your after, Polarismail do a basic plan for £9 a year.

esuhl

walesrob wrote: »

As others have suggested, buy your own domain. If you only need email for your domain, and not a website, then an email host like Runbox, Fastmail or Polarismail will do the job. Fastmail is about $40 a year, but has email, calendars and (soon contacts) sync across all devices, as well as the ability to pull in email from other services but if its a simple email hosting plan your after, Polarismail do a basic plan for £9 a year.

Why not just use a free email host like GMX or GMail...?

walesrob

esuhl wrote: »

Why not just use a free email host like GMX or GMail...?

Ok, lets say GMX shut down tomorrow, you'd have to go through the hassle of getting a new email address. If you have your own domain for email, you'll never have this problem. Ok, so Gmail is unlikely to fail, but then you are still at the mercy of Google and all they intend to do with your data now and in the future. Companies like Fastmail, et al, are not interested in tracking your every move and bombarding you with targeted adverts, they just want to provide an email service only.

securityguy

walesrob wrote: »

Ok, lets say GMX shut down tomorrow, you'd have to go through the hassle of getting a new email address. I

It's perfectly possible to use a private domain with a Gmail mailbox.

esuhl

walesrob wrote: »

Ok, lets say GMX shut down tomorrow, you'd have to go through the hassle of getting a new email address. If you have your own domain for email, you'll never have this problem. Ok, so Gmail is unlikely to fail, but then you are still at the mercy of Google and all they intend to do with your data now and in the future. Companies like Fastmail, et al, are not interested in tracking your every move and bombarding you with targeted adverts, they just want to provide an email service only.

As above, if you've got your own domain and GMX goes out of business, you just sign up with another (free!) provider and point your domain there.

What's the point in paying someone like Fastmail when you could use a free host? If Fastmail goes out of business, you'd still have to re-direct emails to your domain, just as you would if you were using GMX and they went kaput.

walesrob

There are pitfalls in getting email forwarded. As an example, your domain is registered with 123-Reg, and you use the email forwarding feature. Lets say you forward emails to your account at Hotmail. From experience, this method while great as a stopgap is fraught with potential problems.

Why? Your relying on 123-Reg mail servers not to discard any emails, and then Hotmail may drop incoming mail from 123-Reg due to 'policy' (this can be sending server failing spf checks for example). Hotmail silently dropping forwarded email is well documented, and I have personally experienced this in the past to the point where I will never use a free email service again. It might be free, but its no use if its not reliable or theres a risk emails might be silently dropped. This is where email hosting reduces the risk. Your domain mail records point at the email hosting company, so, lets say you have Google Apps to handle your email. You set the DNS MX records to Google and let them handle emails, rather than relying on 123-Reg and Hotmail to forward emails back and forth.

The less hops an email has to make, the more chance it'll make it to it's intended destination. This is where email hosting excels vs forwarding from your domain host.

Don't believe me? Here's a few places that will tell you WHY forwarding is a bad idea:

https://www.nowherehosting.com/email-forwarding-bad/
http://www.nsdesign.co.uk/email-forwarding-and-why-its-a-bad-idea/
http://www.sstwebs.com/services/web-hosting/forwarding-email-is-a-bad-idea.html

Some email hosting providers frown upon emails being forwarded, and I'm betting it wont be long till the big players follow suit.

Jivesinger

If you wanted to avoid forwarding, I did come across a company called Zoho, which seems to host a limited number of email accounts for free, and I believe you can use your own domain, and it also seems to include the option of 2-factor authentication:
https://www.zoho.com/mail/zohomail-pricing2.html

I don't know much about the organisation or how reliable they are, although I did find a few reviews online:
http://www.pcworld.com/article/236722/office_365_vs_google_apps_vs_zoho_docs.html
http://www.tomsitpro.com/articles/cloud-office-suites,2-690.html
http://www.smallbiztechnology.com/archive/2013/04/best-email-service-for-small-business-gmail-zohomail-or-outlook.html/

paddyrg

esuhl wrote: »

Have you got a source for that claim? I think other free email providers like GMX are pretty good on the security front, but it would be interesting to see some evidence either way.

I'm not sure I'd want to hand over the content of all my emails to Gmail, anyway, given the ubiquitousness of Google's search engine, and the amount of information that Google will already know about you...

GMail offer 2FA, most don't. 2FA means I can give you my password and it's still no use to you without also having access to my phone in the same 60-second window. This is a significant improvement over password-only.

For those interested, 2FA on phones, you're right that it is a challenge, however what's stored on the phone isn't the password but a token, the token is/can be generated from a one-time login and isn't a heap of use to anyone as you can't log in with it. You can't even see it without forensic tools. Other apps that you chose to grant access to your Google account can be granted single use logins and passwords, without compromising the 2FA. They've thought this stuff through, and are one of the lead contributors to FIDO to harmonise increased online security systems.

People outside Google having access to your account is not really an issue (certainly needn't be if it concerns you), people inside it, or us govt agencies... well who knows?!

securityguy

paddyrg wrote: »

GMail offer 2FA, most don't. 2FA means I can give you my password and it's still no use to you without also having access to my phone in the same 60-second window. This is a significant improvement over password-only.

For those interested, 2FA on phones, you're right that it is a challenge, however what's stored on the phone isn't the password but a token, the token is/can be generated from a one-time login and isn't a heap of use to anyone as you can't log in with it.!

It's worth actually understanding the technology.

There are a family of cryptographic functions called "secure hashes". These are in essence one-way encryption: they take an input and produce an output from which you can derive no information about the input. The best theoretical model is a "random oracle": a device which examines its input, and if it's something it hasn't seen before returns a random number, otherwise returns the same number it gave the last time it saw the same input. Examples are MD5, SHA1 and the SHA256/384/512 family.

The Google authenticator works by having a secret shared between Google and your phone (how that secret gets there is another question). Your phone combines the time with the secret and hashes the result. Someone who has that hash cannot compute the secret from it. Google perform the same computation and compares the results. There's some magic to deal with the clocks being misaligned (less of a problem than it used to be) but it's pretty straightforward technology: the same (-ish: some of them used somewhat different cryptographic primitives) as the venerable SecureID tags that anyone who's used a workplace VPN will have used.

It's pretty bulletproof. The hash functions are well explored, and the way they're used for 2FA is "gentle", in that even the known weaknesses in MD5 aren't a threat to this application. Subliminal channels (ie, fiddling with the output to include a small amount of information about the secret) aren't possible. The source code is publicly available and it's easy enough to compile up yourself if you're nervous. Google could obviously leak the secret (the worry with 2FA is that unlike with passwords, the server has to hold the plaintext of the secret) but they could equally just leak your mail.

enkoda

robin58 wrote: »

What I am asking is there away to have an independent email service which I can link to me personally.

I do not want to sign up with Outlook or Gmail to have a standalone service as I find these services are to easy to hack into. Then you get submerged in :spam::spam::spam:

What I am after is a service which would give me a 'one place' to have an email account, with the ability to have multiple sub email addresses.

This has got well out of hand!:rotfl:

Ok, back on topic and to reiterate....

I don't understand why you think Outlook or Gmail are easier to hack into than any other email? They aren't. And the spam filters are excellent.

I have 2 Gmail accounts, one personal/professional and one for other stuff like forums, gaming, etc. Not only am I in control of my emails, I've kept it simple and it works faultlessly.:)