The Privacy Community is MAD...here's why (+ my recommendations)

Summary

The privacy-focused email service Skiff was recently acquired by Notion, forcing its users to migrate their accounts within 6 months. This highlights the risk of relying on a single service for email, a central part of online identity. The recommended solution is to use a custom domain that you own for your primary email instead of a company-provided email address. This makes it easy to switch services if needed, while still allowing you to use company inboxes. Recognize that privacy is an ongoing process, not a one-time fix.

Takeaways

• 😡 Many people are upset that Skiff, a privacy-focused email service, was acquired by Notion and is now shutting down
• 😞 Skiff users have just 6 months to migrate their email before losing access
• 🤔 The speaker doesn't know the full story behind why Skiff sold to Notion
• 🚨 There's always a risk that privacy/security services will go away somehow
• ❌ Relying solely on a service's native email address ties your identity to them
• 📧 The speaker recommends getting a custom email domain you control instead
• 🔁 Migrating custom email is easier if a service shuts down
• ✅ The speaker recommends ProtonMail as an alternative to Skiff
• 🛠 Treat privacy/security as an ongoing process, not a one-time fix
• 📝 Custom email lets you control your online identity if a service closes

Q & A

What privacy-focused email service was recently acquired by Notion?

Skiff, an open source email platform launched in 2020, was recently acquired by Notion.

Why are many privacy advocates upset about Notion's acquisition of Skiff?

Many are upset because Skiff customers now have just 6 months to migrate their email off of Skiff before their accounts are shut down, which is very disruptive.

What mistake have many email users made related to this situation?

Many users made the mistake of using their native Skiff email address as an identity to sign up for online accounts. This makes migration much harder with Skiff shutting down.

What alternative email provider does the author recommend for current Skiff users?

The author recommends ProtonMail as an alternative. They have been around over 10 years with a solid product and team.

Why does the author recommend using a custom email domain?

A custom domain gives you ownership of your email identity. If a provider goes away, you can migrate your custom domain to another provider easily.

What assurance did ProtonMail's CEO give about the possiblity of them selling?

ProtonMail's CEO Andy Yen has repeatedly stated they have no plans to ever sell the company due to how they are set up.

What are the author's 3 recommendations related to email security?

1. Current Skiff users should switch to ProtonMail. 2. Get a custom email domain that you own. 3. Recognize improving privacy/security is an ongoing process.

Why might the Skiff CEO have chosen to sell to Notion?

We don't have full details, but likely factors were financial struggles, an attractive offer from Notion, or business viability challenges.

Should existing accounts be changed to use a custom domain?

No, for existing accounts you can keep using your current emails. But going forward use the custom domain for new accounts.

What can viewers do if they want more content about privacy strategies?

The author invites viewers to subscribe to the All Things Secured channel to receive more security and privacy strategy content going forward.

Outlines

00:00

😕 Skiff being acquired and shut down frustrates privacy community

Skiff, a privacy-focused open source email platform started in 2020, was recently acquired by Notion. This has frustrated many in the privacy/tech community because email is central to people's online identity, and Skiff accounts won't automatically migrate to Notion. Users now have 6 months to migrate away, which is difficult. The CEO likely tried his best, but the realities of running a VC-backed business are challenging.

05:01

📧 Common mistakes made regarding email security and identity

Two key lessons: 1) No privacy/security service, even well-established ones, are immune to going away. Plan for services disappearing. 2) Don't use company email addresses as your online identity. Buy a custom domain that you own and control to make migrating easier in the future.

Keywords

💡privacy

Privacy refers to the ability to control what information about oneself is made available to others. It is a central theme in the video, as the speaker discusses an email platform called Skiff that was focused on user privacy but was recently acquired by another company, raising concerns. He states that for many people email is central to 'communication but identity,' so losing privacy controls over email data is very frustrating.

💡security

Security refers to protection of systems and data from unauthorized access or harm. Along with privacy, it is a main focus when evaluating email services. The speaker critiques reliance on a single email provider for your online identity, because the company could go away, be acquired, etc., threatening security.

💡email migration

Email migration refers to moving your email account and messages from one provider or platform to another. The speaker emphasizes how difficult this can be, especially if you have used an email address tied to a provider (e.g. @skiff.com) to create accounts across the Internet.

💡online identity

Online identity means the digital 'self' you establish across websites, services, etc, often via your email address username. Relying solely on an email tied to one provider puts this identity at risk if that company closes.

💡custom domain

A custom domain is a personalized URL you purchase to use as your email address hosted on a provider's servers (e.g. [email protected] via Gmail). The speaker recommends this so you control your identity and can switch email providers easily.

💡ProtonMail

ProtonMail is an encrypted, privacy-focused email provider recommended by the speaker as an alternative for current Skiff users. He has visited their offices and believes they are committed to privacy unlike some tech giants.

💡account migration

Account migration means moving your login credentials and history from one online service to another. The speaker notes how if you sign up for accounts across the web using an email tied to one provider, migration gets incredibly difficult if you lose access.

💡VC funding

VC or venture capital funding refers to startups receiving major investments from external firms, often forcing fast growth. The speaker acknowledges this may have impacted Skiff's decisions around the acquisition despite their privacy commitments.

💡email alias

An email alias gives you an alternate email address that forwards received messages to your real inbox. The speaker recommends using these or throwaway accounts sometimes for privacy.

💡GDPR

GDPR or General Data Protection Regulation is a strong personal data privacy law in Europe. While not directly referenced, the speaker's visit to Switzerland-based ProtonMail's offices hints at GDPR's impact.

Highlights

Skiff was a privacy focused open source email platform started in 2020 and acquired by Notion in 2024.

People are frustrated about the Notion acquisition because email is central to communication and online identity.

Skiff customers now have 6 months to migrate their email away before accounts are shut down.

We don't yet know the full story behind why Skiff sold to Notion.

There's always a risk that privacy and security services will go away, so have a backup plan.

Don't build your online identity around a single email provider's domain.

Use a custom domain for your email instead of relying on a company's domain.

Current Skiff users should consider migrating to a provider like ProtonMail.

A custom domain only costs about $15 per year but gives you control.

You can set up a custom domain with any major email provider.

Think of privacy and security as an ongoing process, not a one-time fix.

Keep using email aliases and secondary accounts, but have a custom domain as your primary.

Custom email gives you choices and control if a provider goes away.

Let me know if you like these unscripted, practical videos on privacy strategies.

Subscribe if you want more security and privacy advice videos.

Transcripts

Something happened last week that got a whole lot of people in the privacy and

tech community really mad. I want to explain what that was,

give you some of my thoughts. But most importantly,

I want to share with you the one mistake that I'm noticing a lot of people are

making with their email security that this whole ordeal has brought to light.

Now, if you've never heard of Skiff before,

they are a privacy focused open source email platform that was started in

2020.

It was publicly launched in 2021 and most recently it was acquired by Notion in

2024. Now, the reason that so many people are mad about this Notion acquisition,

I don't think it has as much to do with the fact that it was a VC backed company

that was then sold off like so many other VC companies are,

even though that has something to do with it. I think it's more about the fact

that we're dealing with email,

which for many of us is a central form of not just communication but identity.

It's how we log into all of these different accounts that we create online.

So when you take that away, and it's so much harder to migrate our email,

that is why people are frustrated. So let me back up for just a moment.

If you were a Skiff customer,

you now have six months to migrate all of your email away from Skiff.

Now that they've been acquired by Notion,

none of the accounts that were with Skiff are going to be migrated automatically

into Notion. So whatever notion decides to do with this technology,

your account is not going to automatically be created for that.

So now you have the responsibility over the next six months to move everything

away from Skiff. Now, here's some of my thoughts. You see,

I've had a couple of conversations over the past year with Andrew Milch,

who's the CEO of Skiff. I believe he's now going to be working with Notion.

I'm not entirely sure about that, but here's the thing, he's a great guy.

He is super smart and incredibly talented,

and I have zero doubt that he did everything in his power

to try to make Skiff work as a standalone company.

I also know from running my own business how incredibly difficult that is,

especially if you've got VC backed funding and I don't have that.

So that's an additional pressure on top to make things work at a much shorter

timeframe. Now,

does that mean that I'm happy that they sold to Notion that they're shutting

down all of their services and forcing users to migrate away in six months?

Absolutely not. And I empathize with any of you that are having to go through

this right now. But we also don't yet know what was happening behind the scenes.

What was the health of the company, the financials?

What was the offer given by notion? And frankly, we may never know,

but I'm trying to reserve judgment because we don't know all of these things.

And this is a big part of the equation as to why S Skiff was sold to Notion.

I think there are two things that we can learn from this though.

One being a mistake that many of us have made. The first is this,

no matter what privacy and security services you're using,

and no matter how long they've been active,

there's always a risk that they will go out of business,

that they will be acquired or that something else will happen that will render

those services ineffective. Yes, that is super frustrating,

but it's also a reality that we all have to deal with.

And you need to be able to understand when you're going in and using one of

these services, what does it look like if that service were to go away?

And this is especially true for email,

which leads me to my second point about the mistake I've been seeing a lot of

people make with their email.

Whether you are using Gmail or Outlook or Yahoo or even Privacy alternatives

like Proton Mail or Tota,

when you use an email as an identity to create all of these accounts online,

if you use the native email address for each of these companies,

you are trusting that they are going to be around for the long haul. Now,

that might be a good bet for companies like Microsoft and Google,

but what about all these other companies? I've personally visited the proton

offices in Switzerland and seen the hundreds of people that work diligently to

create an amazing security product that they have.

And I've talked with Andy Yen, their CEO,

who said time and again that they have no plans to sell.

That's not how the company was set up. However,

the mistake I see people make is that they are relying on these company

URLs to build their entire online identity.

Users who adopted [email protected] email address for their online identity

are going to find it so much harder to migrate away because now it's more than

just migrating.

Now they have to go into all of these accounts and change the email,

and sometimes that's really, really hard to do.

The alternative that I recommend is having a custom URL for your email I use

at all Things secured for this company.

I have a personal custom URL that I use and I set that up with proton

mail so that even though I'm using proton mail's inbox,

the email address is one that I own. And if I needed to, I could easily migrate,

migrate that away elsewhere to some other email provider.

If I rely on at Proton mail or at Skiff or even at Gmail,

I am relying too much on those companies as opposed to owning the email address

that people are using to send and receive communications to me at the end of the

day. Here are my three recommendations. First, if you are a current Skiff user,

I suggest you head on to something like Proton Mail.

They've been around for over 10 years. They've produced great products,

I trust them, and I've been and visited their offices.

They have a great team that is producing an excellent product. Second,

consider buying a custom URL. It's really not that expensive,

an average of about $15 a year.

And every single one of these email providers will allow you to set up that

custom domain as your primary email address. So whether that's Google with Gmail

Outlook or even proton mail,

you can set up your own custom domain and have all of those emails come into

that inbox while still using the company domain as well. And finally,

number three,

recognize that most things having to do with privacy and security are a process.

I don't think that once you set up this custom domain for your email that you

need to go through and change everything, go back through all of your accounts.

It just means that from now on you have an email address that you own.

That you can take with you wherever you want to go.

You can still use a throwaway Gmail account or an email alias or even the native

proton mail email that they give you,

but now you have a choice and you have one that you own.

And I think that's really important when we consider the security of our email

and what it would take to move away if something like Skiff were to happen to

anybody else. I hope that makes sense.

I don't normally do these kind of unscripted videos,

so you can let me know what you think in the comments below.

And if you do like these kind of videos that help you think through your

security and privacy strategy,

make sure you subscribe to all Things Secured because I've got a lot more of

this stuff coming up.