Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Hostile Email Landscape

liminality.xyz

Post reply on HN
Print view View original

41–50 of 251 posts

Re: The Hostile Email Landscape

#41

Post by jimktrains2 »

seiji wrote: post #10
jimktrains2 wrote: post #4

Email has been the my last hold out from switch away from gapps completely. I don't want to have to deal with any of this, especially as I do business communication with clients via it. Email wasn't suppose to be like this, and there has to be a better way to enable non-giants to successfully deliver email.

Joke answer: the blockchain! Real answer: It comes down to trust (duh). But, how do we manage trust online? How do we manage trust in real life? Real life trust is through association of groups. But, groups online are meaningless. A "gmail user" doesn't belong to a community, they belong to The Nation of Google. How do we break down online identities into manageable, trustable communities? How do we bootstrap new com…

You joke about the blockchain, but HashCash (a similar technique to Bitcoin's Blockchain-difficulty (not the metric itself, but how it's used)) was originally conceived as a means of making email computationally costly to send. The main issue was that spammers would use botnets while normal people would be stuck taking a while sending emails (iirc).

Personally, I would like everyone to have their own rsa or ecc key. While not as expensive as HashCash, it does require more computational effort to send an encrypted email. (This precludes web portals from sending mail, but user convince seems to always trump security! :( ). Still not a great solution.

Web of Trusts are an interesting idea, but fails for the same reason not everyone has a public encryption key: bad ui, complex idea, and no one cares. I honestly think this is the way forward. If someone isn't a few hops from me, they probably don't have any business contacting me anyway -- if they really want to, a.k.a. read my blog and want to ask me a question, they can use HashCash or something else expensive to make the initial contact and slowly build up trust/reputation as we exchange emails.

In the end, everyone is always told they need to check their spam folder for false positives anyway. Maybe we should all just say "screw it" and read all our email. If some combination of the sender and subject doesn't make us think it's legit, then we can delete it.

Maybe we keep spam filters, but stop calling it a "Spam Box" and treat it like trash. Maybe we start calling it "Unknown Box" and treat it with a little skepticism instead of a dumpster.

Re: The Hostile Email Landscape

#42

Post by JoshTriplett »

cm2187 wrote: post #7

The problem is not so much the attitude of the big guys. It is that smtp is fundamentally broken. we need a better mail protocol that ensures: 1. Traffic always encrypted and content always signed 2. Guarantee that the sender is who it claims he is 3. Decorrelating the email from the domain, a lot of users are prisoners of their current provider just because the address they gave everyone ends with the provider's dom…

> Decorrelating the email from the domain, a lot of users are prisoners of their current provider just because the address they gave everyone ends with the provider's domain name, very much like it is very hard to switch bank accounts

This one seems completely uninteresting in a world in which $15/year can get you your own domain name, complete with reliable email servers, IMAP, and as many email aliases as you like at that domain. Given that, why create an entire infrastructure to "decouple" email addresses from domains?

Re: The Hostile Email Landscape

#43

Post by kakakakaren »

"half-defeating the purpose of having privacy by running my own server."

Is there even privacy in e-mail? Say I have a server that talks TLS. There's still no guarantee the other end wants to, and even if it does it's just going to store my mail on disk unencrypted anyway. Even if it's encrypted there, it has to be decrypted and read by a process to make a webpage out of it, or, to allow a client to download it, where it will probably rest unencrypted on their system. You're not getting privacy.

If you want privacy, encrypt it (pgp), or, use another protocol that is encrypted end-to-end and stays encrypted even after the recipient reads it.

Re: The Hostile Email Landscape

#45

Post by waynecochran »

teddyh wrote: post #39
waynecochran wrote: post #28

Create an email network where is would cost a penny to send email. It would be payed into bitcoin wallet of folks maintaining infrastructure. Every email would be digitally signed and encrypted. Certificate with keys would connected to email address (and bitcoin wallet). Spam would die. Go build it please.

Please read http://craphound.com/spamsolutions.txt and check all boxes that apply.

Those reasons are pretty stale. It may not work, but not for any of those reasons. I'd still be in.

Re: The Hostile Email Landscape

#46

Post by JoshTriplett »

unclebucknasty wrote: post #36
sjackso wrote: post #16

I've run into similar issues with a similar setup. It's frustrating. You can convince gmail user A to whitelist your messages, and so they'll get through to user A, but gmail user B probably still won't see messages from you unless you tell him to dig them out of the spam trap. And your messages to A might still be classified as spam if they have attachments or hyperlinks in them. (Even if you've been corresponding w…

The email deliverability issues we have had as a legitimate business are insane. Moving to an ESP years ago has helped, but it's far from perfect. I've wondered how a small business without the tech resources could manage this. For instance, several months back some of our account holders suddenly stopped receiving important account info as well as newsletters from us. Tracked it down to a third party filtering servi…

> Consulted counsel and the next step was to send a cease and desist, followed by an injunction on the grounds of tortious interference. Then, just as suddenly, our emails started going through again.

Dangerous path to go down; because so many spammers throw around legal threats too, doing so can get you on a different set of blacklists.

Re: The Hostile Email Landscape

#47

Post by jimktrains2 »

geofft wrote: post #15
ryan-c wrote: post #8

Earlier quoted context omitted.

Certificates for SMTP servers are meaningless without DNSSEC because crossdomain email servers are a thing.

Crossdomain web hosts are also a thing, and HTTPS works fine. (Sometimes with particularly hilarious definitions of "fine", like CloudFlare's former practice of putting dozens of customers' websites in the same certificate, via subject alternative names.) If you're worried about the fact that your mail host and web host can now impersonate each other, we can just define a new X.509 extension for "I can only be used f…

SMTP can use TLS, though, right? It doesn't _have_ to use STARTTLS? You _could_ use SNI.

My concern is that it doesn't get you anywhere. phishing sites can and do get TLS/SSL certificates. The process isn't particularly difficult or labour intensive if you own the domain. As far as spam goes, so what? This only proves I'm talking to the server I intended to, not that it's a reputable and upstanding member of the server society.

Re: The Hostile Email Landscape

#48

Post by vezzy-fnord »

wesleytodd wrote: post #18
cm2187 wrote: post #7

The problem is not so much the attitude of the big guys. It is that smtp is fundamentally broken. we need a better mail protocol that ensures: 1. Traffic always encrypted and content always signed 2. Guarantee that the sender is who it claims he is 3. Decorrelating the email from the domain, a lot of users are prisoners of their current provider just because the address they gave everyone ends with the provider's dom…

Maybe something like this? https://github.com/ssbc https://github.com/ssbc/secure-scuttlebutt https://github.com/ssbc/scuttlebot

Or djb's IM2000 (later fleshed out by JdeBP): http://homepage.ntlworld.com/jonathan.deboynepollard/Proposa...

That might have since fallen out of favor, I'm unsure.

Re: The Hostile Email Landscape

#49

Post by waynecochran »

adamrt wrote: post #31
waynecochran wrote: post #28

Create an email network where is would cost a penny to send email. It would be payed into bitcoin wallet of folks maintaining infrastructure. Every email would be digitally signed and encrypted. Certificate with keys would connected to email address (and bitcoin wallet). Spam would die. Go build it please.

I think that is an interesting idea, but my first reaction is that it wouldn't end spam. In the US there is a much larger cost associated with sending physical spam in the US (stamps). But there seems to be unlimited physical spam still. Maybe it would just become more targeted?

Probably not end spam completely, but reduce it to a point it wouldn't be noticable.

In any case, I would love to only send/receive encrypted/signed email. I don't think the problems are technical.

Re: The Hostile Email Landscape

#50

Post by gaius »

cm2187 wrote: post #7

The problem is not so much the attitude of the big guys. It is that smtp is fundamentally broken. we need a better mail protocol that ensures: 1. Traffic always encrypted and content always signed 2. Guarantee that the sender is who it claims he is 3. Decorrelating the email from the domain, a lot of users are prisoners of their current provider just because the address they gave everyone ends with the provider's dom…

We had a better system back in the day: X.400.
Post reply on HN