Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Hostile Email Landscape

liminality.xyz

Post reply on HN
Print view View original

71–80 of 251 posts

Re: The Hostile Email Landscape

#71

Post by grey-area »

jimktrains2 wrote: post #27
gruez wrote: post #5

Earlier quoted context omitted.

something like EV certificates for smtp servers?

That proves I own the domain to some extent. Don't DKIM records do the same? For the purposes of anti-spam, a cert doesn't do anything except prove that you showed some CA that you own the domain (which can be done and is done in other ways currently).

At present SMTP is so broken that arbitrary servers are allowed to send mail for any domain, with fake headers, there is no proper verification of sending server or sending identity, the mail is accepted (along with legitimate mail), and put in spam folders (sometimes, as is real mail sometimes). SPF/DKIM are an attempt to solve that of course, but they are not enforced rigorously or universally, and tactics like IP reputation and email content sniffing still seem to be widely used too (the problem reported in the article). Compared to the web, email seems pretty behind on verifying server identity.

Re: The Hostile Email Landscape

#72

Post by dredmorbius »

codecamper wrote: post #30

Here is an almost related story: I am in italy and was waiting for an email from the local Apple store to tell me my macbook's repair was complete. After 6 days waiting, I called the store. They said the computer had been ready for a few days. I checked the spam folder. Gmail had plopped the apple email into the spam folder. Gmail's reason was that the email was in a foreign language, Italian. Didn't matter that the…

Google's killed access to various accounts of mine at different times for:

1. Accessing an account one time over Tor. Subsequent reconnect attempts from the same device I'd previously used, same IP, etc., failed. Took a couple of weeks to get back.

2. Accessing accounts from different IPs while travelling. Ultimately ending up at the same IP as one of the email accounts I'd previously corresponded heavily with.

3. Accessing accounts from new device(s). Old (Android) devices could access email but not Web-based account recovery tools.

"Who are you" is the most expensive question in technology. No matter how you get it wrong, you're fucked.

https://www.reddit.com/r/dredmorbius/comments/3mo7l6/that_go...

Re: The Hostile Email Landscape

#73

Post by tobias3 »

waynecochran wrote: post #28

Create an email network where is would cost a penny to send email. It would be payed into bitcoin wallet of folks maintaining infrastructure. Every email would be digitally signed and encrypted. Certificate with keys would connected to email address (and bitcoin wallet). Spam would die. Go build it please.

Thats actually a good idea. You don't even have to make it a fixed value. The receiver uses how much money was paid as a (spam) signal.

The bitcoin transaction can just go to /dev/null with a hash of the message as data, so don't have to pay somebody ( ;) ) and you cannot track who sent data to whom via tracking the bitcoin transactions.

Re: The Hostile Email Landscape

#74

Post by ams6110 »

nabla9 wrote: post #59
sjackso wrote: post #16

I've run into similar issues with a similar setup. It's frustrating. You can convince gmail user A to whitelist your messages, and so they'll get through to user A, but gmail user B probably still won't see messages from you unless you tell him to dig them out of the spam trap. And your messages to A might still be classified as spam if they have attachments or hyperlinks in them. (Even if you've been corresponding w…

http://cr.yp.to/im2000.html Internet Mail 2000 IM2000 is a project to design a new Internet mail infrastructure around the following concept: Mail storage is the sender's responsibility.

Because spammers can't afford a couple of TB of disk space?

Re: The Hostile Email Landscape

#75

Post by jimktrains2 »

thetmkay wrote: post #63
jimktrains2 wrote: post #47

Earlier quoted context omitted.

SMTP can use TLS, though, right? It doesn't _have_ to use STARTTLS? You _could_ use SNI. My concern is that it doesn't get you anywhere. phishing sites can and do get TLS/SSL certificates. The process isn't particularly difficult or labour intensive if you own the domain. As far as spam goes, so what? This only proves I'm talking to the server I intended to, not that it's a reputable and upstanding member of the serv…

What about EV itself? Currently there's no EV equivalent for individuals, but it would be a step forward.

If I can't reasonably get it, then how is it a step forward?

Re: The Hostile Email Landscape

#76

Post by Rexxar »

waynecochran wrote: post #28

Create an email network where is would cost a penny to send email. It would be payed into bitcoin wallet of folks maintaining infrastructure. Every email would be digitally signed and encrypted. Certificate with keys would connected to email address (and bitcoin wallet). Spam would die. Go build it please.

Ask Bill Gates : http://www.cnet.com/forums/discussions/bill-gates-proposes-c...

Re: The Hostile Email Landscape

#77

Post by gaius »

dredmorbius wrote: post #53
gaius wrote: post #50

Earlier quoted context omitted.

We had a better system back in the day: X.400.

Howso? The X protocols have typically struck me as grossly overdesigned and complicated.

More overcomplicated than the complex system of headers and whitelists trying to bolt some basic security and authenticity features onto SMTP?

The latter didn't win because it was "better" just because it was easier to implement. Like a car with no brakes or seatbelts.

Re: The Hostile Email Landscape

#78

Post by tete »

I think it's exaggerated. I am happily running a private mail server on a tiny vserver. My emails get through to whomever I might mail and I do so a lot.

I once heard that my email got flagged as spam.

Of course, if you don't set up your mail server correctly it might be that it's flagged as spam, but it's not really harder than setting up various other things correctly.

It sounds like it was set up correctly by the author. Most people use SpamAssassin, also big companies do. So it should be good.

Maybe the network itself wasn't considered to be good by the mentioned big companies.

Re: The Hostile Email Landscape

#79

Post by jimktrains2 »

grey-area wrote: post #71
jimktrains2 wrote: post #27

Earlier quoted context omitted.

That proves I own the domain to some extent. Don't DKIM records do the same? For the purposes of anti-spam, a cert doesn't do anything except prove that you showed some CA that you own the domain (which can be done and is done in other ways currently).

At present SMTP is so broken that arbitrary servers are allowed to send mail for any domain, with fake headers, there is no proper verification of sending server or sending identity, the mail is accepted (along with legitimate mail), and put in spam folders (sometimes, as is real mail sometimes). SPF/DKIM are an attempt to solve that of course, but they are not enforced rigorously or universally, and tactics like IP…

Yes, that's my point. It doesn't really solve any issues that SPF/DKIM don't already solve -- pointing to certs isn't a new solution, it's a rehash of the same solution.

And yes, the concept of relays should disappear along with much of the other cruft SMTP brings. (And while we're at it, can we fix/replace IMAP, or at least make the spec say that message ids are eternal and can't be invalidated?)

Re: The Hostile Email Landscape

#80

Post by joosters »

krschultz wrote: post #19
cm2187 wrote: post #7

The problem is not so much the attitude of the big guys. It is that smtp is fundamentally broken. we need a better mail protocol that ensures: 1. Traffic always encrypted and content always signed 2. Guarantee that the sender is who it claims he is 3. Decorrelating the email from the domain, a lot of users are prisoners of their current provider just because the address they gave everyone ends with the provider's dom…

"3 and 4 would require a sort of token system" Not to get all handwavey, but I think this is why some people are super excited about bitcoin becoming 'part of the internet'. There are definitely some areas where we need a concept of identity & trust, and bitcoin seems like one of the first truly distributed ways of doing it.

I doubt it. No-one wants to pay to send an email. Even if they did, it'd involve waiting 10+ minutes for a payment to go through and limit the global email rate to a maximum of 5 messages per second. Bitcoin is not a good fit.
Post reply on HN