Hacker News new | ask | show | jobs
by eminent101 565 days ago
How does that work in practice? I mean I may keep my data at multiple places. But my government, my hospitals, my utility accounts, they all want my email address to send me OTPs, password reset links and such things that are necessary to prove my digital identity.

How do I spread this risk and make it manageable? I have to give them some email address and I fear losing access to my email. And yes, I can lose my email address even if I have my email on my own domain. There are many failure modes for losing domain names. So how do I manage this risk?

3 comments

I have secondary account recovery for everything and secondary accounts for everything. If email one doesn't work, my phone and second email does. Where OP went wrong was not updating their phone number when it changed. There's not a lot to be done at that point.
Just looking at emails: your choices are to trust someone else's domain -- likely gmail -- or own your own domain + some kind of forwarding or 3rd party mail service.

For gmail, you risk account lockout like OP is experiencing. You can mitigate the risk with more recovery options at account.google.com like backup codes.

For a service other than gmail, I think the risks of lockout without customer service to help might possibly be less., especially if its paid like fastmail. If you do pay you have the risk of not wanting to pay anymore, or forgetting to pay, and if you don't pay you also have the risk of the service going away. I suppose the service going away is ok.

I for one am pretty confident google will keep gmail running as well as possible, so I see other services as a bit more risk there.

If you own the domain, you have paid for it and risk someone stealing it or grabbing it when you forget to pay. You can mitigate the risk by choosing a registrar with good security, paying for a longer term or not forgetting, eg a quarterly reminder to review your domain names. You also need to be able to access your registrar account. You can choose registrars you get other services from, like AWS Route 53 if you use amazon for anything, or Cloudflare for VPN, and mitigate the risk of non-payment or non-access because access and payment will be done more frequently.

Using your own domain is also more moving parts, decisions, setup, etc. So you risk more things going wrong or fatigue over all the maintenance taking over. How you weigh the monetary and complexity cost of using a domain name for email compared to the upside of control, having a personal site at your own name, etc.

With government and hospitals you can just reregister in meatspace.