[larrys]

"You had two step verification, or not?"

Upvoted you but...

A company offers a free service. "Your aunt" does know know or understand the need for "two step verification" nor do almost certainly a large percentage of people using gmail.

This idea that companies resolve themselves of all responsibility to provide reasonable customer support for a free product with such wide adoption is ridiculous. Google derives benefit from the relationship regardless of the fact that the service is free.

[fixermark]

The fact that "your aunt" can access the Internet at all without some moral equivalent of a driver's license is testament to the fact that our societies have balanced the freedom of information made available by accessing the Internet with the individual's responsibility to understand the basics of the tools of accessing said Internet.

... and stories such as this are the consequence we shall have for taking the Libertarian solution. Not that I disagree with the solution taken! I just have a hard time swallowing the argument that it's always the provider's responsibility to account for total user ignorance at all times. A solution has been provided for this attack vector, and if the end-user chooses not to use it then perhaps at some point the onus is on the end-user.

(Or perhaps Google should just make 2FA mandatory for everyone, "your aunt" included).

[27182818284]

>"Your aunt" does know know or understand the need for "two step verification"

I wonder more and more if we need to make it mandatory in some form, but maybe more formal. Like you can use your phone, but also here is a plastic, officially-sealed set of codes we'll mail to you at a verified address just in case.

[nmridul]

>>> officially-sealed set of codes we'll mail to you at a verified address just in case.

And then people would start crying ... "google now wants to know your home address .... "

[finnjohnsen2]

Yea but technical strong people like yourself are always able to handle themselves better in all aspects of computing.

This is why you end up fixing your aunts printer. And why you have a more secure e-mail account than her. And why you can handle backing up your photos.... etc

It's not Google's fault entirely.

[larrys]

"but technical strong people like yourself"

I like the sound of that. I actually have run my own mail servers since the mid 90's [1] but I am more of a business guy who knows computers than a strong technical guy the way that I see it. I don't use gmail (for anything important I do use it for unimportant things) I don't like the idea of my mail sitting on their servers.

[1] Actually if you include non internet mail dates back to the mid 80's on a Unix system V.

[finnjohnsen2]

How do you deal with spam when self hosting?

[larrys]

I don't filter any spam at all.

I have found it helpful and have done deals with people that would normally be considered spammers. Wish I could provide details but let's just say that some people who spam actually are legitimate buyers of certain products or services and respond quite well to reply emails.

How much spam do I get and have to go through? Easily 3000 messages per day. You will have to trust me when I say I have not regretted not doing any filtering in terms of what I do [1]

[1] And no I do not sell a product or service to spammers...

[kazinator]

I self-host my own mail server, and deal with spam amazingly well. I deal with it so well that I'm able to have "old school" public mailing lists that don't require registration in order to post.

There are various options for dealing with spam, if you're doing it by yourself.

My number one defense is a simple DNS check. SMTP servers that do not have valid and matching forward and reverse DNS are almost always spammers, with very little false positive identification. Spammers almost never have a server whose reverse DNS address is a domain name that resolves back to the same IP. Most of the time when spammers do have such a thing is when they compromise someone else's (e.g. Yahoo or whatever).

After that, it's a few DNS-based checks of black-listing databases.

Then some pieces of custom logic in the Exim configuration.

Of course, SPF: if the apparent sender's domain publishes an SPF record, I check it to see whether the server connecting is authorized to handle mail for that sender.

Finally, I also have scripts that monitor the mail server's log and implement IP banning (like fail2ban but home brewed). For instance, if the server reports suspicious SMTP commands, this will be ferreted out of the log in real-time and turned into an iptables-based ban that stays in effect for some time.

Oh, plus I have geographic banning in effect. Periodically, I download the latest IP netblock list from ARIN and other autonomous systems and block certain parts of the world (e.g. China) from connecting to my port 25.

[mpnordland]

spamassasin, or like me, dspam.