Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Modern Anti-Spam and E2E Crypto (2014)

moderncrypto.org

Post reply on HN
Print view View original

21–30 of 49 posts

Re: Modern Anti-Spam and E2E Crypto (2014)

#21

Post by bascule »

quantumtremor wrote: post #19
bascule wrote: post #13

Earlier quoted context omitted.

No, I didn't mean FHE, because FHE does not meet the criteria given in the post, namely that it must happen as quickly as possible and cannot rely on the liveness of the client. The OP practically rules out schemes that involve looping in the client.

What? With FHE the client just gets an additional encrypted metadata that is the encryption of whether the attached file is spam or not. No looping required, whereas your functional encryption scheme seems to necessitate the client being "live."

One of the requirements given in the OP (the one I was referencing in my previous post) is that the server can tell spam from non-spam without the client being online. The FHE solution doesn't work for this requirement.

The functional encryption scheme only requires a client to bootstrap it. Once the client has calculated the appropriate function based on their private key, they can give it to the server, who can thereafter apply it to incoming emails regardless of whether the client is online or offline.

Re: Modern Anti-Spam and E2E Crypto (2014)

#22

Post by dochtman »

tempestn wrote: post #12

This tangentially relates to something I was thinking about yesterday. Does anyone have a sense of how difficult it would be to create a service that scans your gmail spam folder and categorizes the contents into 'definitely spam' and 'maybe spam'? I'm probably somewhat of an edge case, but I get over 100 spam emails per day in my spam folder. Almost none make it through to my inbox. However, every month, one or two…

I had similar problems. On top of that, I forward my email through my own server to GMail (so I control the domain, but can use the GMail ecosystem as UX), and this was posing problems because GMail would greylist my server quite a bit for sending in too much spam.

I now run rspamd on my own server, which does a pretty great job. With properly training the bayes filters it has, I now receive on the order of 3 spam messages per day in GMail. Actually, rspamd seems to have fewer false positives than the GMail spam filter -- I guess this could be because it has more information as the original receiver, though?

Getting these results did take some very limited tweaking of the rspamd configuration; I lowered the treshold for what's "definitely" spam (that is, just gets discarded), and I bumped the weight of the BAYES_SPAM rule.

Re: Modern Anti-Spam and E2E Crypto (2014)

#23

Post by quantumtremor »

bascule wrote: post #21
quantumtremor wrote: post #19

Earlier quoted context omitted.

What? With FHE the client just gets an additional encrypted metadata that is the encryption of whether the attached file is spam or not. No looping required, whereas your functional encryption scheme seems to necessitate the client being "live."

One of the requirements given in the OP (the one I was referencing in my previous post) is that the server can tell spam from non-spam without the client being online. The FHE solution doesn't work for this requirement. The functional encryption scheme only requires a client to bootstrap it. Once the client has calculated the appropriate function based on their private key, they can give it to the server, who can the…

Okay so to fix mine: create a circuit that decrypts a ciphertext using the private key, returning 1, 0, or Bottom depending if it's an encryption of spam marking or not, or not valid, and run it through iO. So both solutions still require iO...

Re: Modern Anti-Spam and E2E Crypto (2014)

#24

Post by emilburzo »

dochtman wrote: post #22
tempestn wrote: post #12

This tangentially relates to something I was thinking about yesterday. Does anyone have a sense of how difficult it would be to create a service that scans your gmail spam folder and categorizes the contents into 'definitely spam' and 'maybe spam'? I'm probably somewhat of an edge case, but I get over 100 spam emails per day in my spam folder. Almost none make it through to my inbox. However, every month, one or two…

I had similar problems. On top of that, I forward my email through my own server to GMail (so I control the domain, but can use the GMail ecosystem as UX), and this was posing problems because GMail would greylist my server quite a bit for sending in too much spam. I now run rspamd on my own server, which does a pretty great job. With properly training the bayes filters it has, I now receive on the order of 3 spam me…

Just wondering, do you have SRS setup on your email server?

I ask because I had the same problem, with the same setup (own domain forwarding to gmail), adding SRS (besides the obvious SPF/DKIM/DMARC) has really improved things for me.

Re: Modern Anti-Spam and E2E Crypto (2014)

#26

Post by tempestn »

dochtman wrote: post #22
tempestn wrote: post #12

This tangentially relates to something I was thinking about yesterday. Does anyone have a sense of how difficult it would be to create a service that scans your gmail spam folder and categorizes the contents into 'definitely spam' and 'maybe spam'? I'm probably somewhat of an edge case, but I get over 100 spam emails per day in my spam folder. Almost none make it through to my inbox. However, every month, one or two…

I had similar problems. On top of that, I forward my email through my own server to GMail (so I control the domain, but can use the GMail ecosystem as UX), and this was posing problems because GMail would greylist my server quite a bit for sending in too much spam. I now run rspamd on my own server, which does a pretty great job. With properly training the bayes filters it has, I now receive on the order of 3 spam me…

Actually, that's the exact situation I'm in as well. So to clarify, the spam that gets through rspamd lands in gmail's spam folder, so you still need to manually check that, but all the obviously-spam stuff has been cut out before it ever got to gmail (solving both your problems). Sounds like exactly what I asked for!

Interesting your mention about being grey-listed too. How did you determine that happened? Presumably the same thing could happen to me as well.

Guess I should also check out SRS as mentioned by emilburzo.

Re: Modern Anti-Spam and E2E Crypto (2014)

#27

Post by algesten »

> The other reason it sucks is that it confuses bulk mail with spam. This is a very common confusion. Lots of companies send vast amounts of mail that users want to receive. Think Facebook, for example.

I challenge this. In 2016 I think most companies don't need to rely on massive bulk mails anymore.

But then I always hated all forms of marketing...

Re: Modern Anti-Spam and E2E Crypto (2014)

#28

Post by rocqua »

One of the issues mentioned is that bulk mail and spam are not necessarily the same thing. However, bulk mail much less use for e2e than directed mail.

Personalized bulk mail (e.g. bulk mail with a small personalized offer) is an issue here. For that, partial encryption seems like a nice solution. As the template remains plaintext, reputation can include the template. As such, you could levy a lower 'tax' on such email as opposed to fully confidential email.

Re: Modern Anti-Spam and E2E Crypto (2014)

#29

Post by duncan_bayne »

This was sad to read:

> Botnets appeared as a way to get around RBLs, and in response spam fighters mapped out the internet to create a "policy block list" - ranges of IPs that were assigned to residential connections and thus should not be sending any email at all.

Your residential connection might not, but mine does.

Re: Modern Anti-Spam and E2E Crypto (2014)

#30

Post by dochtman »

emilburzo wrote: post #24
dochtman wrote: post #22

Earlier quoted context omitted.

I had similar problems. On top of that, I forward my email through my own server to GMail (so I control the domain, but can use the GMail ecosystem as UX), and this was posing problems because GMail would greylist my server quite a bit for sending in too much spam. I now run rspamd on my own server, which does a pretty great job. With properly training the bayes filters it has, I now receive on the order of 3 spam me…

Just wondering, do you have SRS setup on your email server? I ask because I had the same problem, with the same setup (own domain forwarding to gmail), adding SRS (besides the obvious SPF/DKIM/DMARC) has really improved things for me.

Yeah, I have postsrsd set up now, although I only set it up after setting up rspamd.

I'm not sure why it would improve things without also setting up a spam filter? In that case, you're just lowering the reputation of your own server by passing on a lot of spam while acting as if you sent it.

Post reply on HN