Can a government submit a subpoena to Gmail asking for your emails? Unlikely, they would just answer that you are not a client of theirs and as such they don't have your emails.
Can they submit a subpoena asking Google to hand over all of the emails that your clients sent or received from your address? Sure they can. It's going to be a way harder sell to the judge and the reason and burden of proof will be that much higher, as it would essentially be closer to fishing or mass surveillance. But it's something that I can see passing for cases of national security or child abuse. Nothing I would personally worry about, but I understand if you want to wear a tinfoil hat.
Semantics and nuance matter.
https://en.m.wikipedia.org/wiki/PRISM
In 2023, Google received requests for user information for about 900,000 accounts, and complied with ~80% of them, and both numbers are on the rise.
Also, I'm not sure what seems to be contradicting here. The exception that you are brining up proves the rule. If I say that humans have five fingers in each hand, will bringing up the famous case of the sixed fingered lady be relevant at all to the discussion? Especially if I worded it specifically saying that "most" humans have 5 fingers? Check my wording, I said unlikely.
The fact is, most government agencies do not have access to your emails, let's say that the NSA does, which is debatable, great, that is 0.01% of the government, and probably 0% of companies (that are not Google), unless they submitted a subpoena as part of some litigation.
Feel free to obsess about the one or two agencies that have access to emails for national security reasons, and feel free to lump it into "THE government". But I don't think you'll ever make any important nuanced cybersecurity trade offs with that attitude, you'll just want to encrypt everything until none of your users can do shit (if you have users at all, you may not even be able to get a job because you are doubtful of sending your resume to anyone, and you might be too busy configuring your own email server instead of just using gmail and doing other productive stuff.)
I'm responsible for a few of those btw. All for e-mails clearly related to malware operations, to help with the investigation. It's not like anyone cares what John Doe talks about with his grandma and Netflix support. Well, maybe some do, but that's probably 1% of that 900k.
I sleep like a baby knowing a state can submit subpoenas for my information. And I wouldn't sleep like a baby using a system that not only irreversibly encrypts contents, but neuters the admin capabilities such that it's not even possible to know the headers of messages sent, like telegram or protonmail, knowing that I would give plausible deniability by pooling with cyber and non cybercriminals.
I played around with it the other day. Installed actalis/digicert s/mime cert on client. Sent emails between the 2 addresses. Emails decrypted locally on clients but same message sent on webmail client is encrypted/unreadable (besides subject line)
Remind me: 18 months.
https://www.vice.com/en/article/even-the-inventor-of-pgp-doe...
The folks that read your e-mail and monitor your online presence do not want you to use these tools.
What's difficult is long-term key management. This is being solved in the context of Passkeys and the same infrastructure could be used for S/MIME keys.
Provisioning should become significantly easier with ACME for S/MIME, we'll see about that though.
Nothing really says it has to be difficult, even for the layperson.
To what end? Unless you are in the top 20,000 or so people who are actively being snopped on, it's just a waste of life to spend so much time to de-google, de-openai, de-meta, de-microsoft your life.
But of course this is a highly unpopular opinion on HN, but I have yet to see a single instance of a person whose life dramatically changed because they hosted their own email server instead of just using gmail. (unless you sell those services to other paranoid people and make money)
If it turns out to be an enemy, then everyone's screwed either way.
Often these measures are a rational reaction to unethical companies that don’t deserve a relationship with us however convenient that may be.
A big company wants my data, or is it just an idiot who cloned my hard drive?
Just an idiot who cloned my hard drive is the most likely scenario.
It is an absolute 100% guarantee that Google wants your data
Maybe they want it for a good cause, who knows?
Would I really trust a random interneter over a company that has a reputation to keep? You overestimate my political biases.
It decreases the odds those users will keep sending Google easy-to-digest data in the future.
This is like the 'I have nothing to hide' argument against strict privacy measures. Individual bits of your information may not have much value. But the aggregate of all your information is something else. It may yield data that you don't expect it to contain. I can easily get your health, wealth, politics, relationship and even your exact address from it even if you never mention any of it. And the ways in which they can be used against you is also something you're unlikely to consider unless you're in a profession that does it - law enforcement, insurance companies, racial profilers, PR companies, lobbyists, ...
Another issue is that you are just worried about only your own data. But if Cambridge Analytica is any lesson, its that an entire section of a population can be targeted all at once using such data. And the outcome is no less disastrous than targeting individuals.
> They want some statistics. Not my personal information
I can guarantee you that's wrong - after the shenanigans they pulled to force me to register my CC and to prevent its deletion. But what's more pertinent here is that statistics is a sort of mathematical summary of a raw data. And that summary changes (into a different type of information) based on the statistical analysis you do on the raw data. I don't think you need an elaboration for this. But this is precisely the reason I believe that they will keep all your personal data in their raw form for as long as their resources permit.
> Maybe they want it for a good cause, who knows?
As they say, fool me once, shame on you. Fool me twice...
Oh, BTW, when I ran my affiliate marketed website a few years ago, my highest conversion rate came from people who came from DuckDuckGo. These people are actually advertisers dream and fits a profile and target market like a T for certain products.
Some people are militant about editors, others are "discerning" (snobbish?) about operating systems or ONLY using free software. It takes all types and they help keep the world going.
It's like a high maintenance garden feature. It signals a few things about you: high technical capacity, unusual amounts of free time, unusual priorities.
data-less attack on some very widely used open source software.
- Don't use gmail
- Don't use chatGPT
- Don't use facebook
- Don't use windows
That's pretty easy if you use a Mac, and I qualify for all of those just because I don't want to use any of the above. I also don't use Twitter, so bonus!
Not that my email is of any value to anyone other than myself, but just not liking any of the services above is sufficient...
https://www.reuters.com/article/us-apple-fbi-icloud-exclusiv...
Apple puts on a good face, and I will admit I think there are probably better than the rest. But they sill put you in a walled garden that can be a little difficult to step out of.
We're now very much living in the time when this kind of thing is likely to happen, it's no longer theory or paranoia anymore. Why would powers that be stop at snooping on 20k when we can now basically do it to everyone? I mean, look at the present news cycle and think for a second.
Kind of like how individually, our little lives and our circle of boring friends doesn't amount to much, but Facebook is one of the most profitable companies in history.
The flip side is that no one person can really do anything about it. If I delete my facebook account, so what? There would need to be aggregate and mass action--against which there are so many prisoner-dilemma-esque barriers that its never going to happen.
Glad you did not include "de-apple". iCloud is now my only email provider, I moved to it many years ago. With my own domain too.
As for “Don’t be evil” disappearing from their core values? Totally normal. Just streamlining the brand, I’m sure.
And of course, I hardly know anyone who’s lost years of email, only to have Google’s famously responsive support team leap into action and do absolutely nothing to recover it.
>To what end?
Because my business is my business and not that of some corporate entity for whom I am the product to be sold.
Yeah. No.
Google would like you to think they're a God's-eye master of reality of course... but they're not. Just another corporate flop, like IBM etc.
Seems like a pretty nice gig, being a corporate flop.
- cash on hand: $17 billion
- revenue 2024: $62 billion
- total employees: 294,000
- Fortune 500 ranking: 63rd.
- total customers: hard to estimate, approx. 100,000 worldwide
How are we defining 'flop' in this context? The metrics don't seem to show it.
Probably something all of us in the venture, startup, service-sector-tech space could stand to learn.
In what sense is it garbage, and relative to what? And if it's garbage, why haven't people switched yet? I hear good things about Proton Mail; it has about 100 million users. Why aren't people leaving Gmail in droves to switch to it?
(When I was younger, I wondered the same thing. An older relative who used to own a grocery store shared his vantage point with me. Before Windows came along, things were fragmented and complex, and that made it hard for him to do his job: manage grocery inventory, sell to customers, and track the money. IBM, Microsoft, and their ilk brought to the space something that was hard to build before: integrated solutions where there was one mostly-right answer for most problems and, most importantly, you didn't have to hunt it down because it was right in front of you. This is huge for people who want their nine-to-five to be something other than "the computer itself."
Because we hackers love having our nine-to-five be "the computer itself," I think we sometimes lose sight of how few decisions people outside our ecosystem want to be making. They just want it to work. They want to pay someone to make it work. And there's a lot of money to be made in being the companies that do that.)
If you want secure messaging that nobody else will snoop on use an application dedicated to.. secure messaging. It's never what email was for and it's not how it's being used.
Email is auth now. People do not use email the way you are describing.
Even assuming all encryption is configured correctly at the endpoints so we can discount the risk of mid-transit interception and comprehension (do I assume CVS has encryption set up correctly on their outbound receipt emails? I do not...) People think it's like the postal network but it's more like the mail lands at the post office and they hand you a copy of it, while they retain the originals.
Most people are on Facebook Messenger or Whatsapp or Signal or a dozen similar platforms. I try to use Signal for most communications but have friends and family that won't move to it, so I also use Whatsapp or plain SMS with them.
The only people who use RCS to contact me are businesses sending notifications or spam.
Unlike e-mail where I do get personal correspondence regularly.
I don't expect my experience is typical, but I don't think yours are either - we all live in bubbles.
The idea of unsubscribing from emails from corporations and agencies is again just an act of pretense. 95% of the cases, it's not done in one click and involves a series of a few confusing steps. Even from a technology perspective, email is fucked and a legacy artifact as of today.
I would love to see a more secure protocol to replace it, where the recipient always has full control over all the messages that he can ever receive.
I have a paid personal email plan on my own domain name. (Mostly to get aliases and plus addresses). It is setup very well and filters spam very efficiently, compared to some 'corporate-standard' filters on other services. But I still have to use my gmail address because most individual contacts wouldn't see my mails otherwise since they are on gmail, hotmail, etc. And for many official websites, my email addresses are 'not valid email addresses'. Granted that my TLD .space isn't an official sounding one, but it's used by exactly two types of users - people who use it as their space, and people/organizations working on space tech. So I pay, but I'm still forced to watch them spam. Honestly, I believe that email is now a captured monopoly (cartelopoly?).
> I would love to see a more secure protocol to replace it, where the recipient always has full control over all the messages that he can ever receive.
I wholeheartedly agree. Email is an awesome idea. But its age is starting to show. We need something with security and encryption built-in, much fewer moving parts (Can we integrate MTA, MDA, WebUI, spam filters, DKIM, etc into just one?), option to opt out of rich formatting (the HTML and AMP junk), dynamic updates, etc and proper spam filtering, etc. We should also have a way to disincentivize or punish big players from rejecting valid emails. Perhaps it can use HTTPS to overcome those pesky corporate reverse proxies and firewalls. But the idea of having a domain name as a namespace for users is still precious.
My experience has been the complete opposite as someone who had to it recently. Only a handful made it more arduous than a single click. I was surprised.
The words probably get read somewhere on the way to the destination and in the future someone will probably unpin the pretty picture that has been decorating the notice board, turn it over and read what is on the other side.
Every so often one sees a cri de coeur from someone who has learned this lesson the hard way when Google locks them out of their account, the key to their digital life evaporates, there's nothing they can do about it.
Alternative identifiers exist, eg handles on sites like HN, but they are second-order artifacts of the email as ID.
Given the stakes, then, you have to decide whether to try and control your identity by bulding your own infra for email (domain, mail server, dkim etc and a fair bit of hell), paying for someone to run the infra (eg getting a proton or fastmail address), and hoping they dont enshittify or fail, or letting Google or Microsoft control it and hoping you dont fall foul of them. All these options have drawbacks.
Side musing follows: I dont know what the solution to identity is on the Internet. A very long time ago, X.509 certs issued by quasi government authorities was mooted as part of a international directory system. I can see a future authoritarian state falling in love with this idea again, esp with the resulting lack of anonymity,..but also the ability to "kill" people on the Internet simply by revoking their cert.
All these things have become so essential that it's shocking that it's not regulated like a utility (or even as a right given their systemic imposition).
Where it becomes challenging is situations where smart phones truly are required. When I attended college football games last fall, all tickets were e-tickets. You were required to present a QR code on your device or your ticket stored in Apple Wallet or Google Wallet. I ran into the same situation with my local theater's ticketing. You haven't lived until you've witnessed an audience with an average age of 70 try to figure out their tickets on their smartphones when they've never used them for that before nor had any notion that was even POSSIBLE.
You can use client certificates even with IMAP and SMTP.
But can be easily stolen by malware (unless someone adds a client cert OS support? intriguing idea). But so can passkeys stored on the same device, so I don't know.
Long time ago browsers even had a widget to generate client certs natively! But it was removed, probably because of lack of use.
Now expect aunt Lottie to use certificates? Yeah, sure.
I think there are some significant limitations to client certificates as a general-purpose 2FA mechanism.
Reusing the same certificate would make you trivially trackable across the web. You could create a unique certificate for every origin, but you need a way to permanently store the certificate. That becomes a problem if you want to secure them with hardware tokens where storage is limited. Yubikey 5 series can only store a handful of certificates.
Passkeys (i.e. resident FIDO2 keys) aren't intended to be a second factor, they're intended to be the only factor but they also require storage. Yubikey 5 can only store 25 resident keys, for example.
Non-resident FIDO2 keys (previously U2F) are what's traditionally used for 2FA. The hardware token derives key material from its master key and credential ID provided by the browser and the server, so it doesn't require any storage.
When you want to use another browser or reinstall one, just re-enroll the new one. Ten one time recovery keys act as an alternative second factor, just like it's commonly done now.
I'm not saying there aren't any tradeoffs at all, but in my opinion they're minor when compared to OTPs, SMS or Yubikeys. Not nearly enough downsides to explain why no major services supports client certs.
I see you are suffering from something that always happened to me when championing them: they were so unknown that people assumed you meant PGP…sigh.
I so hate this. I have repeatedly seen PDFs containing nothing but a QR code and text like "not valid if printed" - this is truly silly. QR codes were created to form a bridge between the physical and the digital world, exactly so people can print them out. If you want it to be digital-only for some reason, use NFC or Bluetooth or whatever.
I was fond of how Keybase brought to life [1] identity proofs (linking and validating your different online identities) in a very easy to use platform. Pity it went away; feels like a loss for the internet.
It's a problem with no easy solutions. In part, because no two users want exactly the same solution.
I also pay Fastmail to host my domain email, so that really helped get off Google. Yeah I gotta remember to renew every 10 years or whatever, plus $15/yr for fastmail; but what's the other option, I learn some SMTP package? No thanks.
It's pretty sweet.
The real problem comes when your email address is owned by someone else (eg. @gmail.com).
That’s the definition of lock-in.
OTOH - before email existed, the critical "how do we contact the real you?" identifiers were phone numbers and mailing addresses.
And if you failed to pay your phone bill, or rent, or property taxes...the exact same problem - someone else would get "your" identifier.
Traditionally, for anything that's even slightly important, either your physical presence ultimately acted as your identity, or significant legal liability protected the non-physical identity (that is, if a court sends an important letter to you at some address, someone else who moved in to that address faces significant legal penalties if they open that letter).
In contrast, many domain providers will resell your domain in a heartbeat once you miss a payment deadline. And then the buyer can do whatever they want with emails sent to that domain, since there's no such thing as identity theft when your domain is your identity. In the case of a mailing address, it's not an identity at all, which is why non-junk mail will also have a recipient line.
and passport.com, which was their SSO login system
Migrating DNS providers is a pain - recently done it twice. Transfer itself is reasonable with most providers. Importing/exporting a BIND-formatted zone file is sometimes unheard of, as is setting custom TTL; you'll have to go through a stupid form. One provider tries to hold your hand so tightly it won't let you set CAA with iodef, only issue/issuewild.
Migrating email is a pain. Yes! You can just point your MX elsewhere, and that is brilliant. You still want to copy over all your email, and given IMAP has won, if you don't have a recent backup (who does back up their email?), losing your old account sucks.
Fixing up your email clients is also troublesome. You can't just CNAME smtp.yourdomain.com to smtp.example.com, because that's nuts, so changing providers from example.com to beispiel.de requires a couple more dances; provider docs also suck, and email clients usually fail a dozen times before you can find the right incantation. You could set up your own autodiscover, but that requires an HTTPS server.
Yes there are providers that sell a full package and do all the initial setup for you, but that's not the point of owning your domain.
Yeah, I sometimes do sysadmin stuff for fun. None of this is fun.
That's my entire point. Contrast this process with buying an app on your phone. Insert coin, done; vs insert coin, battle a dragon.
> [...] they should be straightforward for anyone who has reasonably solid command line chops.
That's my entire point. I've been familiar with the command line since before I could write with a pen, and I still dislike doing any of that stuff.
> Once you've moved over to your own domain and your own server/software, you're done--you don't have to do it over and over.
That's my entire point. You don't have to, until you do.
I back up my email (some of it going back to 1996) twice a day. I lost several months worth of emails a few years back. That won't happen again.
I don’t experience them doing that. They’re email companies going strong. Maybe they get sold in some decades, and you move on. But I’ve had FastMail for one decade now, and it’s remained the same throughout. Including the minor UI bugs in their email client. But I’d much rather live with those than suddenly they’re also an AI company.
Most communications throughout history have not been secure. Despite this, it hasn't been abused nearly as much as it could be. I'm not sure if it's because the scale is difficult, or the technical side, or nobody thinks to suggest it to the despots. It's probably a combination of things. Ironically we tend to fear the abuse of power when it doesn't happen, and then ignore or accept it when it does happen. So the fear/hang-wringing/jumping-through-hoops seems pointless.
I still believe that if you really are concerned about what you're saying, you should say it in a clandestine way. E2E encryption is like a giant red flag saying "I might be doing something shady". Asking grandma about her special cakes [when she doesn't bake] will fly under the radar unless someone is looking really hard.
Your analogy is moot.
How would you classify submarines parked next to fiber optic cables slurping up data?
And as far as I know, emails are not E2E encrypted, but they are almost always encrypted in transit. Why go through all the trouble just to get encrypted data?
Now I concede that all those things (OFC, TLS) may have vulnerabilities that can theoretically be exploited. But do you send such valuable information over the internet that it's worth their cost and effort to retrieve it? And if your answer is yes by some chance, would you transmit it without taking adequate security measures?
In comparison, Google and the others have billions of emails simply sitting unencrypted in their storage, ready for access at zero cost. I can't see your argument contradicting the information security risk posed by these companies.
LMGTFY [1][2]. I'm wondering at which point will we reach that utopic nirvana when HN and internet users in general will take the initiative and 30 seconds of their time to google something they find perplexing/unreal instead of going like "uhm, source?".
[1] https://en.wikipedia.org/wiki/Operation_Ivy_Bells
[2] https://www.nytimes.com/2005/02/20/politics/new-nuclear-sub-...
Look. Perhaps you should use a bit more discretion before you decide to come out all guns blazing on sarcasm and condescendation. I have some professional experience in the field - and it tells me there are many inconsistencies in your argument. And yes, I did 'the google' before typing the previous reply. I could of course be just ignorant about the latest achievements. But that's where references matter. That's all I asked for.
So here is the problem. Operation Ivy Bell happened in mid 1960s to mid 1970s. If you knew the communication infrastructure of that time, you would have realized that it was distinctly NOT optic fiber. Those came much later. But what really confirmed that doubt is that they used the induction principle of a transformer to tap the cable. That won't work on optic fibers. That's not how the EM field propagates in an OFC - they're more similar to waveguides than telephone cables.
And this distinction certainly matters here. Today's world is certainly not the same as in 60s. The sort of high-volume communication didn't exist back then. Neither did the ability to listen to or manipulate so many people all at once. Today's dangers - like the one with email messages - didn't exist back then. Back then 'cable' leaks like this used to happen. But have you heard of anything similar to Hillary's email leak or the Halloween mails?
I'm not a professional in this field like you, but even I know that undersea fiber optic cables have actively powered repeaters/amplifiers spread across their length, so it's logical to assume those amplifiers, with their 16kW power source, generate quite some EMF at repeater points that could be picked up via side channel analysis by sophisticated and well funded state actors like US submarines equipped with dedicated surveillance equipment, as we can infer from the Snowden NSA leaks.
Yes, because a few decades ago a total surveilance of a population would have needed a signifikant part of the population to do the surveilance or base your surveilance on statistical chance. If you ever get the chancs to inform yourself about the way the GDR/Stasi watched its citizens before the fall of the Berlin Wall, go for it.
I previously described the recent technological advances as a shift of the above-mentioned ratio: Never in history could a dictator know more of the communications of all his citizens with less people being in on it. Never before in history could a dictator pretend the populus was on his side with less people then now.
These changed ratios already altered the face of politics, and I am pretty sure this wasn't it.
And for your grandma example: Metadata isn't encrypted nearly anywhere. If your grandmas network looks as if she makes a special, explosive kind of dough (or this ever gets mentioned anywhere), the timing of your message and whom you are sending it to might be enough for them to send you to a secret prison without due process. Correctness of such accusations is only a requirement when you don't have absolute powers and dictators will always find someone to blame, otherwise they would look weak.
One must be incredibly naive to think only dictators have this capability and not democratically elected governments. Just start a protest and find out just how quickly the government unlocks Godlike surveillance capabilities to be used against you. Hell, even a Tweet might do in places like UK or Germany.
They don't even have to send the police to the streets to beat you up or throw you in a van like in the USSR, they can just debank you like the trucker protestors in Canada and the problem solves itself peacefully.
> Please respond to the strongest plausible interpretation of what someone says, not a weaker one that's easier to criticize. Assume good faith.
If someone uses a specific term (dictator), that does not automatically impyly they think the broader term (any government) doesn't apply. If I say "all dogs do eventually die" that does not imply I think that all other animals are immortal. This is basic logic.
And btw. I agree with your statements about democratically elected governments not being immune to abuse of surveilance power.
The same goes for intercepting SMS: unless someone has been targeting you for years, your past messages are safe.
Intercepting USPS mail and telephone calls are both serious federal crimes.
This isn't really a great analogy.
Notion recently launched email integration that only works with GMail, and all the marketing was basically "we added Email to Notion" instead of "we added _Gmail_ to Notion".
There is a limit to have much effort the receiving network can be expected put into filtering yahoo ham from the yahoo spam, and a limit to even how possible it is to reliably perform that filtering. Just expecting your users to put up with the influx of junk you can't filter (without too many false positives) and putting up with the processing load of attempts to filter it, are not valid options beyond a certain point. Yahoo knew they were a problem for some time before others started blocking mail from them en-mass and did nothing, or at least nothing useful, to fix it at their end despite warnings.
Also, “choice of email provider” is not a protected class in any jurisdiction that I know of.
But I do agree with you on your point; once you lose your Google account, you lose a lot more - including your personal TS network, which may include offsite devices, grandparents' PC, etc.
Unfortunately your TS account is also heavily tied to the chosen ID provider, I don't think you can change it at all (even if you go thru support). I would prefer to be able to link two IDs to a single TS account (e.g. Google and Apple), perhaps be able unlink the one I don't want anymore. I see a security concern in there (you either have a weak link, or you can't unlink an account you don't control anymore), but it would still be nice.
I thought you could, but there's one exception (that I can't recall). If you signed up with that specific OIDC provider, you can't switch but you can with the other stock OIDC providers.
Say again please? How did you get locked out of so much I ask? I use one gmail account for mostly unimportant emailing and as a dumping ground for email signups that later spam you to death with "promotions". That's about it, and I'm able to use a hell of a lot more than "half the internet".
I'm honestly curious about the mechanics of how and why one could let aving, or losing, a google account affect them so much.
Had the same problems myself so decided to build a product I actually needed.
Case in point a bit further down in the comments: https://news.ycombinator.com/item?id=43902653
It's very easily possible for both to be true, there is a "fight spam" reason and there is also a "monopoly" reason, and of course unless you very stupid you never mention the second.
The worst I've ever had was gmail refusing to accept a ~50MB zip file as an attachment. And you know what? I'm not even mad about that one, that's totally fair.
one thing: given that gmail is free includes forwarding and all-but-unlimited storage, I work around these limitations with a (free) new gmail account that I use for notion etc.
(this issue also affects Advanced Protection gmail users, who are often blocked from various integrations... the workaround is to create a gmail account for those and setup bi-directional filtering/forwarding...)
Almost the exact same situation here, except my friend was once at an EFF-related organization.
I think a lot of things, like the tech industry turning into '80s Wall Street bros, wore down some of his on-principle determination. And when life got too busy, he gave up, and moved to GMail. I was very surprised to learn.
Another friend, who in school was one of those MIT student Linux hackers who had serious OPSEC as ordinary practice, once he had kids, and had to think about continuity of all the things he ran if something should happen to him, ended up moving home stuff to popular Apple and Google services.
the last time I emailed a friend was probably 5 years ago. Email is for much more personal stuff.
Efforts like DIME[0] do not have anywhere the traction they should.
----
[1] Or are we trusting those dumb enough to use a completely unencrypted sqlite datastore for the initial versions, not to do something less dumb, but still dumb enough to be a security issue, in current/future versions?
For example if there was en masse boycott of Gmail and Outlook maybe people would start switching to more privacy aware email providers. Let's say that you want to contact a blogger and s/he says: "I bounce off emails from Gmail, Outlook and Yahoo, please use other more privacy friendly email providers."
They throw themselves gushingly at every app that oozes out from under a rock, and then they wonder how they became so economically f_cked...
Would we be OK with a monopoly business opening and scanning our postal mail, and sending us junk adverts based on this? Or worse?
The internet is a public utility. We need to work towards better rules. Bit like the EU is doing.
What grinds my gears about email monopoly is that you cannot create or integrate easily email client now.
To access mail it is not enough to provide user & password & whatever. Things can provide access without compromising security.
To access gmail? User needs to add access from some bullshit console settings, and stuff. I asked chatgpt how thunderbird is not required to do this, and it said that it has keys pregenerated, and big corpos can operate like that. I have not verified that any longer. Sounded credible. So annoying
renewiltord•9mo ago