> The trouble is that opens another attack vector. This story[1] (previously discussed on HN[2]) comes to the opposite conclusion.

> Who is right? Is there a consensus in the security community?

There might not be one best answer. There have been many other stories on HN of people loosing access to their Gmail accounts, and having no recourse with Google to regain access.

My gut feel is the best any of us can do is to set up our digital lives so that our accounts are "misaligned" to make it more difficult to use social engineering to pivot between them. For instance, in the story you linked, they key to an actual attack was a shared credit card number between Paypal and Godaddy that was used for verification. Ignoring the fact of how stupid it is to use just 4 digits for such a task, it would have made that path more difficult for the attacker if he'd used a dedicated card for Godaddy (given his domains were valuable enough to him that they could be used to extort a $50k twitter handle from him). Having different, secret, email addresses/domains attached to important accounts could also provide a stumbling block.

But it's also worth noting that much of the attacker's planned attack failed, and he only succeeded in the end through extortion.

Unfortunately we rely on registrars for too many things nowadays, which is probably as bad as our enormous trust on commercial certificate authorities.

This is the only correct response to this problem, and it needs to be seen more prominently.

E-mail in 2020 is not secure against a motivated attacker. It doesn't matter how secure and woke your provider is, when:

1. Everyone you talk on an e-mail thread gets a copy of the entire e-mail thread, to do whatever they want with.

2. You can't control the present and future security of other people's providers, or the present and future security of the computing devices they use to read the e-mail you send them.

Now, if you want to LARP, you can try setting up a mailing list for your friends who only use secure providers (For whatever definition of secure you want to use), and only limit your use of a single e-mail address to that mailing list. Great. Go for it. Write a blog post about it, even. But that's not going to solve the fundamental problems of #1 and #2 for the rest of the world.

Now, if you actually want security (as opposed to 'I want to LARP at security'), take a page from conspiracies in the financial sector, and don't use e-mail for any conversations that you'd like to remain secure.

Securing e-mail is a waste of time. It can't be secured, because of 50 years of social expectations about how e-mail should behave. (Other people retain copies of your e-mails, and other people can choose which provider services their address.) You can spend that effort on trying to secure a different communication protocol, which does not have those 50 years of social expectations, and that will probably lose to e-mail (Because those two security holes provide users with value, and when it comes to value versus security, security will lose every time.)

They're not willing to pay because they don't know that you can buy domains in the first place. Most of the time when I tell someone my first@lastname.com they're like ...and that'd be @gmail.com?

Have you considered registering a brand new related email that doesn't have the negative association with it?

My company name was too long, so we registered a domain for our email that was just our initials and it was nicer to type, and really easy to set up.

Yahoo, really? I get a lot of false positives w/ them.

For CardDAV, there's options to do a regular one time import, but it's not setup to sync.

For CalDAV, many people use the Fastmail web interface with other calendars by syncing them (https://www.fastmail.com/help/calendar/sync.html?).

Awesome clients? For android try ninemail (if you are calling android default email client awsome you wont come to your breath for next 2 weeks ;). For web you have gazillion of them, from roundcube to horde and nextcloud plugin (anyway, its just a user interface, protocols are standardised (mostly IMAP beeing used for accessing mail and any client supporting it can read emails). But yep. It is for self hosted people. And I think that everyone in 2020 should be self hosted (I thought that in 2000 too but it is just getting worse, everyone locking himself into some vendor jail, one way or another).

>Does anyone else have this?

Everyone has this. It's called IMAP.

All email clients (non-web) do the same thing (including sync). And you can plug imap/smtp into almost every email client.

As for the gmail web client, various services are providing similar interfaces on their email service.

I don't know about Proton, but right now I cannot think of anything missing from FastMail that exist in Gmail -- they even support label now. The clients are better than Gmail, IMO.

If you are focused on privacy, you probably aren't using a client app. Browsers are the way to go, particularly on mobile devices. They allow you to more easily prevent data being stored on the device. The simple presence of an app evidences that you have an account with that service whereas a browser, absent bookmarks, reveals nothing. I don't hesitate to unlock my phone for airport checks. They aren't going to find anything, nor be able to say I have an account anywhere.

(A great thing about HN is that you don't need to have an account in order to read articles. So I can bookmark it on my phone without worry.)

Doesn't most server support STARTTLS by now?

>Since SMTP transfers things unencrypted

But that's false. They're encrypted with TLS. It's just not end to end encrypted.

Or you could just ditch Gmail and all of Google's shady practices.

There is clearly some merit to Proton Mail's privacy claims. Even Google goes out of their way to try to scrape data from ProtonMail: https://old.reddit.com/r/ProtonMail/comments/9yl94k/never_co...