Ask HN: Should we own the free stuff we pay for?

This being said, since you got a scare, maybe it's a good time you buy a 2nd domain from another registar and handle accordingly.

PS: how does one find a good domain name?

In theory, you agreed to all the ways they can screw you over when signing up. In reality of course no one can be reasonably expected to understand the full ramifications of multi-page terms of service.

I'm happy that EU is pushing this ownership argument forward. GDPR seemed unreasonable just a few years ago, now it's the new standard. I also don't think it's the final destination. We're moving towards more regulation, but that's expected in any mature industry.

However, this specific topic to me isn't as much about ownership as it's about redundancy and diversification.

Of course it's not a good idea to build your whole identity on some corporate identifier (@gmail.com, @icloud.com...). Of course your business income shouldn't be based on a single platform (e.g. youtube demonetization, facebook news). These problems could've been forseen even without the benefit of hindsight.

There's no such thing as absolute ownership anyway. Even your money or real estate belongs to you within the framework of modern banks and governments. Doesn't mean this ownership isn't meaningful, just that there are always limits and gotchas.

The most meaningful thing you can do is own as much of your digital surface area as you can. Having everything under your own domains will get the most bang for your buck. I don't bother with self-hosting, but for someone else that would be a must. Your mileage may vary.

You weren't wrong to do so, but the convenience/risk bet hasn't worked out for you. For most people it works out fine -- i.e. car driving risks.

I use a different email host, and only use user/pass logins, no social. It's fiddly, and you'll need a good password manager (not chrome) but that's the cost of not being exposed to this risk. Only you can decide if its worth it, very few people have the skills for it to even be an option.

Did you actually pay for it? With money? Or was it free?

I don’t think anything you listed a typical individual owns.

Even street addresses change.

So it's not inherently wrong to say a user of a free service should have some rights. In some situations, it's not fair to pull the rug out under people.

I think that there will come a point where we need to have independent tribunals governing the behaviour of large web services. That point will probably be reached 5 years ago.

Could I urge that posters follow the site convention of prefixing the title with with Ask HN, Tell HN, etc. for posts that don't link to an external source? There are currently two such posts in the top 30.

HN is primarily for discussing external articles, and I'd suggest that this post should have been submitted as such.

That said, I'm planning to migrate to either self hosted or a paid service which is not run by algorithms and where customer supports exist (in that regards big tech is terrible: facebook, google, paypal = worthless customer support).

I completely agree with your premise though: Ideally everyone should have their own server providing a personal site and mail and maybe even hosting a decentralised social network.

PGP is a good solution, and in general the crypto space has the right idea in my opinion. I like the idea of using cryptographic key pairs to sign messages and prove identity, but the learning curve makes it impractical for general use.

The best place to start is owning a domain you control, at least that way you can manage your own facade.

Currently i have about 10 different e-mail accounts:

  - one for development related things and communities
  - one for newsletters, various online platforms and so on
  - one for throwaway purposes, lower importance things like video game accounts
  - one for university related things (it stayed after graduation)
  - a few separate accounts (and corresponding Google account) for various phones or other devices, as necessary
  - some standby accounts if i ever need them, some from different providers to check mail denylisting
  - a personal address that's mostly for contacts through my website or my self-hosted automation messages

That said, mail servers that are easy to set up are a godsend (for example: https://github.com/docker-mailserver/docker-mailserver), as long as you also have one of the larger walled garden alternatives for public communications, should there ever be delivery problems.

It's not like Google deciding to ban all of my accounts at once (though fingerprinting, or based on IP because i don't care to set up some sort of an advanced proxy to access all of them from different VPNs) wouldn't be problematic, but this way at least the impact would be minimized.

Plus, with software like Thunderbird and something like KeePass for strong randomly generated passwords, managing everything is really low effort. Of course, this also lends itself nicely to avoiding social logins and creating a separate e-mail based account wherever applicable, for a bit more control, rather than keeping all of your eggs in the same basket.

As for those who will inevitably say that this is too hard or complicated to be practical: i invite you to try setting up your own mail server with the help of the provided link on a 5$/month VPS, things have really improved in the last few years! Of course, creating new Google accounts (or for other platforms) might be a bit more cumbersome with modern verification steps etc., but it's not like it's impossible either.

Sometimes i wish we could do the same for personal identities, e.g. a list of aliases that could be issued through some government org. for particular purposes and revoked as necessary. For example, i wouldn't want a leak of some shopping site result in my personal data being compromised in regards to my online banking or my physical address, in any capacity whatsoever.

There is really nothing you could do with a car to prompt the car maker to take it from you. And the state will only take it if you break the law in particularly dangerous ways.

When it comes to other possessions it's even harder for anyone to take them away from you. If I take a kitchen knife and stab someone with it I will go to prison for sure, but I don't think they will take the knife away. They definitely won't ban me from buying knives.

But when it's a digital service, even something as crucial as a banking service, it's seen as normal that you can lose them for posting offensive things on twitter. Perhaps it's because we haven't had these digital services for long enough to consider them as really belonging to us, so we accept that they can be taken away at the slightest provocation.

That helps you ‘own’ who you are, but doesn’t stop someone like Google from refusing to work with you in case they think you’re a spammer (though your DID can provide enough evidence that you aren’t).

Do NOT send everything to gmail via forward. Every bit of spam you forward is going to count against your domain name. I had someone who did this on a community server and it wrecked our rating for a while.

Instead, have gmail pick up your email via pop3. This will avoid the "spam origin/relay" problem of forwarding.

We should own our own stuff. Your email is your own data. No company should have the right to arbitrarily destroy or block your access to your data. Whether that service is free or paid for is irrelevant; offering a service for free isn't a license to rob and destroy.

I've argued this point multiple times (e.g [0]). Business who host your data should treat your data as your property and take responsibility for it. They don't have right to destroy it or put it through a virtual shredder any more than your landlord or car service should take your property to the junkyard.

I also consider it a security issue [1]; if you can't access your data (or worse: it's gone all of a sudden), security has failed. No, destroying data isn't the same as securing it. Google has poor security. Security should protect your data and your access to it.

[0] https://news.ycombinator.com/item?id=30242824

[1] https://news.ycombinator.com/item?id=30055397

Unfortunately law seemingly hasn't quite caught up with the idea of digital property.

Notice that Google's automatic suspensions may very well be illegal under GDPR. This was discussed here recently [2]. Having been rejected a credit card application (an example of a decision that should't be made automatically, under GDPR [3]) and lost access to a gmail account, I can say the latter was much worse.

[2] https://news.ycombinator.com/item?id=30138669

[3] https://news.ycombinator.com/item?id=30140312

I host my own email these days, and I am my own domain registrar. If someone wants to take away my domain, they have to take it up with my government.

Here is where I am heading (having given the matter much thought and some testing, trial and error)

Free Gmail/Cal account as I enjoy the software

My own custom domains with any registrar

Paid Fastmail account storing all my emails to all my domains/aliases at Fastmail

All Fastmail messages forwarded to Gmail

Mail from Gmail sent through Fastmail's smtp servers

This gives me the mail/cal app I like and the freedom to move. I don't have a problem with paid. Google are forcing Workspace on me when all I want is email with custom domains.

For full porting, there's a long road ahead, starting with regulating domain names, which email addresses depend on. However, as long as the domain name _de facto_ remains in the possession of the original provider, this is technically possible, already.

Email address porting might even be possible without a persistent domain/DNS entry. After phone numbers get ported, the _sender_ (of sms, or a call) caches the new routing, and the original carrier doesn't know the ported phone number is getting a call in the new carrier's network. I'd be interested in discussing this sort of thing for well established internet services (such a central authority already exists, ICANN, but perhaps legislators can come up with a non-US authority for emails)

There's a lot of scenarios where you wouldn't want purchase of service to transfer ownership. People providing services have rights too. You don't get to do whatever you want with their brand, trademark, copyright. And you don't get to expect more service than is promised, or that you won't have your service taken away if the service owner doesn't want to deal with you anymore.

So you ask, well how can I be protected as a user of services? And the answer is: competition, being an informed consumer, and the occasional regulation.

> Do we own our identities? Do we own our phone numbers, emails, handles, PO boxes, addresses?

Those are all great examples of why there is no simple answer.

You do not own your phone number, but you do have the right to transfer it between carriers, thanks to regulation. You don't own your own email address, but you can rent a domain name and do what you want with your email address while you're renting the domain. You don't own your handle unless it is your real name and you go to court to protect it. You don't own a PO box, but you can rent it while you pay for it.

Ownership is often just a matter of possession. Who possesses your email address? Who possesses your PO box? Hell, who possesses your house? The land it's on? The access people have to it? The impact it has on neighbors?

Identity and ownership are complex ideas that are involved in many different levels of our society. As much as people want it to be simple, it just isn't. And the world is not going to get less complicated.

I signed up to Quora with my Facebook account, back in the day. Deleted Facebook in 2013 and lost access to my Quora account, with no possible way to recover it.

I haven't used a social login since. In my case, it was fairly harmless, but it made me realise how dangerous social login is. Every time there's a signup, I look for "signup with email". It's the safer option. And if you can, use your own domain for email (Google's paid email offering supports this, as does Fastmail and countless other email providers). That way if your email provider decides to flip you off, you switch DNS records and you're up and running somewhere else, and everything keeps on running.

But: If you don't have a copy of emails then you lose all saved emails, so make sure you have a backup strategy in place.