Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google has most of my email because it has all of yours (2014)

mako.cc

Post reply on HN
Print view View original

21–30 of 56 posts

Re: Google has most of my email because it has all of yours (2014)

#21

Post by scintill76 »

irixusr wrote: post #6
bluecmd wrote: post #4

Earlier quoted context omitted.

Spam is also a problem. How do you do spam detection if you cannot read the message?

A few years (almost two decades!!!) when the filters weren't as good I read a proposal to make an email system that charges $0.01 to the sender. Spammers would be bankrupt. It was difficult to implement and up against an already entrenched tech. With Bitcoin I've been thinking of that idea again. Could a payment system on top of existing email be created? The receiver of the email could get the senders penny and Bitc…

Or use Hashcash, which is a proof-of-work algorithm created for anti-DoS and anti-spam, and the inspiration of Bitcoin's mining algorithm.

It's possible the botnets are strong enough to create Hashcash or mine Bitcoin and still spam enough to annoy us... and it would probably take either Google, Yahoo, or Microsoft announcing they would stop accepting legacy emails (where "legacy" could just be ones without Hashcash or BTC), for anyone to make a change.

Re: Google has most of my email because it has all of yours (2014)

#22

Post by mtgx »

bluecmd wrote: post #4
trjordan wrote: post #3

Earlier quoted context omitted.

Most systems never found a good way to encrypt data at rest. You either have to let the user manage the keys / passphrase, giving up things like search and password recovery, or you have to manage the keys in a service, which doesn't provide privacy from the service that manages the keys.

Spam is also a problem. How do you do spam detection if you cannot read the message?

Client-side.

Re: Google has most of my email because it has all of yours (2014)

#24

Post by derefr »

irixusr wrote: post #11
derefr wrote: post #10

Earlier quoted context omitted.

It could be even more convenient, if it only charged for unauthorized contacts. Emails back and forth between friends/coworkers? No charge. Email newsletter you signed up for? One-time cost to them to send you the opt-in message. Random spammers? Never get authorized; have to pay every time. It would also put a slight amount of friction in place for contacting people out-of-the-blue (when e.g. sending fan-mail to fam…

You're assuming people want to be contacted by people in their address list :D For me there's an annoying aunt who periodically send the latest get-mad-at-this email. Or, how many times do we receive a mass email from friends who use CC instead of BCC and then we're flooded by everyone's replies? If you're in my address book, then you should be charged more!

The difference, I think, is that you can at least apply individual filtering to the problems of annoying aunts and mass-emailing friends, of the same sort as you see with Facebook's "remain friends but unfollow" option.

Spam is hard because there's no manual filter you can write that targets "everyone you don't know", without removing the ability to be reached-out-to by real people who have a genuine desire to tell you something you care to hear.

Re: Google has most of my email because it has all of yours (2014)

#25

Post by bad_user »

irixusr wrote: post #6
bluecmd wrote: post #4

Earlier quoted context omitted.

Spam is also a problem. How do you do spam detection if you cannot read the message?

A few years (almost two decades!!!) when the filters weren't as good I read a proposal to make an email system that charges $0.01 to the sender. Spammers would be bankrupt. It was difficult to implement and up against an already entrenched tech. With Bitcoin I've been thinking of that idea again. Could a payment system on top of existing email be created? The receiver of the email could get the senders penny and Bitc…

SMS messages are somewhere around $0.01 to $0.04 for sending in bulk, depending on region. Doesn't stop spammers.

And a fee will also never, ever fly for email, being not a matter of entrenched tech, but rather one of artificial scarcity, being the reason for why SMS is dying.

Re: Google has most of my email because it has all of yours (2014)

#26

Post by scintill76 »

superuser2 wrote: post #14
kodablah wrote: post #5

Earlier quoted context omitted.

As mentioned by other posters, it opposes convenience too much. I say it's unfortunate that SMTP/IMAP was not made easy/free enough to self-host. I understand cost, uptime, and admin challenges, I am just saying these communication mechanisms will continue to be centralized while there is financial incentive to make them better and appeal to the masses.

Self-hosting is not a solution, in particular because it simply pushes the "entity you have to trust" from Google to your VPS provider or residential ISP.

A reply disagreeing got deleted, but in case anyone else is wondering, you're trusting your ISP because SMTP's STARTTLS, the most standardized, widespread email "encryption", is basically worthless[1] if you're really paranoid. It's not required, so if you try to require it you're going to be unable to receive/deliver some email. It's negotiated over plaintext, so ISPs in between can just make the two servers think each other doesn't use it. I believe there's also some confusion in the standard, or at least widespread bad implementations, about how to verify the certificate, so an attacker can probably MITM the cert too.

You can of course encrypt the mail yourself with GPG etc, but that would make self-hosting, the topic of this sub-thread, less relevant, and nobody but your fellow cryptonerds will do it.

[1] https://blog.filippo.io/the-sad-state-of-smtp-encryption/

Re: Google has most of my email because it has all of yours (2014)

#27

Post by dredmorbius »

bluecmd wrote: post #4
trjordan wrote: post #3

Earlier quoted context omitted.

Most systems never found a good way to encrypt data at rest. You either have to let the user manage the keys / passphrase, giving up things like search and password recovery, or you have to manage the keys in a service, which doesn't provide privacy from the service that manages the keys.

Spam is also a problem. How do you do spam detection if you cannot read the message?

Most spam isn't encrypted. The overhead's too high.

Behavioral methods might still work, particularly whitelisting/greylisting. Whitelisted senders will be passed, greylisted ones filtered. Spam can still be filtered locally with a key, if necessary, though that misses the leverage of delivery-time notification.

A notify-and-fetch dynamic might also work. Rather than delivering messages at send time, a notification that there is a message is sent, an on its strength, the message is later requested. Spammers have a much larger mail storage problem. Whitelisted senders might have mail delivered automatically. And collaborative spam filtering could mark and downrate spammer reputations before many recipients get to requesting the message, sparing them the spam.

Greylisting / teergrubing / delayed receipt (even just 1-2 retry intervals) cuts down much on spam as well.

Play the costs.

There are also distributed anonymous reputation systems, designed mostly for Tor / Web, though similar concepts for email might work. FAUST and Fair Anonymity:

https://gnunet.org/node/1704

http://arxiv.org/pdf/1412.4707v1.pdf

Re: Google has most of my email because it has all of yours (2014)

#28

Post by Panino »

bluecmd wrote: post #4
trjordan wrote: post #3

Earlier quoted context omitted.

Most systems never found a good way to encrypt data at rest. You either have to let the user manage the keys / passphrase, giving up things like search and password recovery, or you have to manage the keys in a service, which doesn't provide privacy from the service that manages the keys.

Spam is also a problem. How do you do spam detection if you cannot read the message?

A Spamhaus DNSBL alone drops 99% of spam with almost no FPs. Add DROP, fullbogons, and greylisting to increase the percentage further. None of these methods read the message body, and there are plenty of other options as well. I self-host and receive about 5 spam messages per year, all without looking at the message body.

Re: Google has most of my email because it has all of yours (2014)

#29

Post by Animats »

My incoming mail goes through SpamAssassin at the IMAP server, which does a decent job. All my mail addresses are public on web sites, so there's a lot of junk filtered out.

My phone also uses the IMAP server, so I don't need any Google services. It's an Android phone, but it's never been logged into Google, wasn't bought from a carrier, and many of the built-in Google apps have been removed. (Hint: when you start up a new Android phone, and it wants you to log into Google, click "Later". Then remove the "Google One Time Startup" app to shut up that message.)

This isn't a security thing; it's to block ads.

Re: Google has most of my email because it has all of yours (2014)

#30

Post by [deleted] »

irixusr wrote: post #6
bluecmd wrote: post #4

Earlier quoted context omitted.

Spam is also a problem. How do you do spam detection if you cannot read the message?

A few years (almost two decades!!!) when the filters weren't as good I read a proposal to make an email system that charges $0.01 to the sender. Spammers would be bankrupt. It was difficult to implement and up against an already entrenched tech. With Bitcoin I've been thinking of that idea again. Could a payment system on top of existing email be created? The receiver of the email could get the senders penny and Bitc…

[deleted]
Post reply on HN