Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A Hacker's Replacement for Gmail

dbpmail.net

Post reply on HN
Print view View original

181–190 of 218 posts

Re: A Hacker's Replacement for Gmail

#181

Post by kybernetikos »

Domenic_S wrote: post #177
kybernetikos wrote: post #97

Earlier quoted context omitted.

I've been experimenting with encrypting using bitcoin addresses, publishing keys with gravatar and sending encrypted messages as links as a way of trying to make all this stuff easier and more accessible. If you're interested in my proof of concept, it's http://kybernetikos.github.io/VisualSecrecy/

Linking bitcoin address to email address doesn't sound like a step forward in privacy...

Depends what you want to use it for. Anyway, you can have multiple bitcoin addresses for different purposes.

On top of that, while I wouldn't rely on this cryptographically, the relationship is one-way. Gravatar links email addresses to gravatar images, but it's not intended to link in the other direction, so the same is true for any information stored in the gravatar.

You can use my system to reply with encrypted text to a comment on a blog post without knowing the email address of the person you're replying to, only their gravatar image.

Re: A Hacker's Replacement for Gmail

#182

Post by [deleted] »

brongondwana wrote: post #104
dbpatterson wrote: post #10

Earlier quoted context omitted.

OP here. Fastmail had 4 out of my required 5 features. I used it for a while. I'm still a paying customer (I paid for a bunch of years). Tags were a deal breaker. It's just not sufficient for how I want to organize things.

I'm going to raise this in our next meeting (Tuesday) and see if there's a way we can have IMAP flags exposed somehow. Along with fast cross-folder searching on flags, we could quite easily implement virtual folders per flag - which I think fills your use-case perfectly. The difficult parts are: 1) UI 2) limits. We have a hard limit of 128 "user flags" because it's in 4 x 32 bit fields in a fixed-width data format. S…

[deleted]

Re: A Hacker's Replacement for Gmail

#183

Post by mhurron »

kansface wrote: post #160
moxie wrote: post #29

Earlier quoted context omitted.

I've been hosting my own mail since 1996. It's actually one of the easier services to self-host: 1) SMTP was developed for unreliable environments. If you have problems with uptime, your incoming email will bounce around for 5 days before it gets dropped. So assuming you can get your SMTP server running one day out of five, you shouldn't be in danger of losing anything. 2) Contemporary daemons like postfix and doveco…

Sure, it takes 30 seconds to install postfix, but in practice, email is stupidly hard to admin because of spam. You may be able to send email easily, but a large percentage will be blocked as spam unless you use a well know relay even if you do everything right. Similarly, you will also be fighting a flood of spam in the other direction.

Inbound spam : greylisting as stated elsewhere.

Outbound : Use a smarthost.

I host my own mail. I use OpenBSD as my Firewall/Router so it was a simple decision to use the spamd daemon on it for greylisting. The SMTP destination sits on a CentOS machine behind the OpenBSD gateway. I see a spam message maybe once every week or two. I have also used MailScanner to do SpamAssassin and virus scanning of received mail at places I have worked. The spam count went down so far I had people ask me if the mail server was down. A little bit of verification showed we weren't loosing legitimate mail, users were just getting so much spam they thought that was normal.

A smarthost solves your outgoing problem. I can't send direct from my home connection because it is a residential IP and that is going to be blacklisted all over the place. I could use my IPS's SMTP server, hell you could use GMail if you wanted. I however, use a VPS I pay for. My SMTP server logs in (password) over a TLS connection (preshared certificates). It only relays for my mail server because of that.

You don't need to use a well known relay, you just don't relay from a blacklisted IP. Don't leave an open relay and don't send directly from a residential IP block and you probably don't have to worry, unless you start sending spam.

http://www.mxtoolbox.com/blacklists.aspx has various tools to give you a view into how other mail servers will view your hosts.

Re: A Hacker's Replacement for Gmail

#184

Post by dfc »

cbr wrote: post #132
spudlyo wrote: post #45

Earlier quoted context omitted.

Hats off to ya. I used to view setting up your own email services as a rite of passage for any UNIX admin worth their salt. SMTP was one of the first services I ever got working on my home Linux box, and I had to do it with Sendmail and the goddamn Bat book. Nowadays it's a bit easier.

It's easier now, in that we have good well-documented software, but the external environment has changed. While other servers used to just accept the email you sent, spam countermeasures have gotten complex enough that if you just follow the postfix installation guide you're going to have a lot of your outbound smtp filtered.

I have not experienced the troubles you mention with postfix defaults (actually debian's postfix defaults). Can you think of some examples to be on the look out for?

Re: A Hacker's Replacement for Gmail

#185

Post by dfc »

old-gregg wrote: post #157
cbr wrote: post #132

Earlier quoted context omitted.

It's easier now, in that we have good well-documented software, but the external environment has changed. While other servers used to just accept the email you sent, spam countermeasures have gotten complex enough that if you just follow the postfix installation guide you're going to have a lot of your outbound smtp filtered.

Grab a free account at mailgun.com and configure it as your outgoing SMTP relay. You'll get an IP address for your outbound traffic which is "clean", monitored and registered with a ton of ESPs. You can also use Mailgun as a proxy for your incoming mails as well, for spam filtering or custom routing purposes.

Full-Disclosure: The comment above was made by the co-founder / CEO of mailgun.

Re: A Hacker's Replacement for Gmail

#186

Post by magicalist »

just2n wrote: post #170

I did this for a long time, but it's really annoying: 1. If your provider goes down, you lose mail. 2. If you are conversing with people who are using an insecure mailer, such as gmail, Yahoo, etc (which is probably > 99.9% of all e-mail users), your e-mail is still accessible to the NSA, or to some Fortune 100 advertising company. 3. It's only a matter of time before the "big dogs" in email abuse the position and de…

> It's only a matter of time before the "big dogs" in email abuse the position and decide who is and isn't allowed to send/receive email outside of their little oligarchy, either on their own or at the behest of governments.

Uh, what? We have the tools today. TLS to your mail server, PGP for your email content.

SMTP is already a highly distributed system that is controlled by no single entity. If the big email providers decide to block all the little players, making your own message passing system (with blackjack and hookers) and convincing everyone to come use it is many steps more work beyond just staying on SMTP and convincing everyone to stop using the big email providers. Then at least you don't have to develop new protocols, you don't have to develop new clients, and you don't have to convince people to use them (but still, good luck with that first step).

How about instead we just make email encryption a whole lot easier to use and promote email providers that aren't beholden to court orders (aka probable cause must be demonstrated at a minimum)?

Meanwhile we can work on reforming the security apparatus in the US because 'reasonable expectation of privacy" most definitely includes all the geographical locations I access my email account from, amongst many other things, so should require a warrant.

Re: A Hacker's Replacement for Gmail

#187

Post by comex »

cabalamat wrote: post #136
cwp wrote: post #57

I ran a set up similar to this for many years. It's not that hard, for those with a little unix experience. As moxie mentions, email is very forgiving—you have to break it badly and leave it broken for a long time before you start to lose messages. What eventually drove me to GMail was spam. I tried a bunch of different filters, and never found one with good-enough accuracy. Finally I decided that the independence an…

> As far as I can tell, Gmail is 100% accurate. My experience is I've had a few false negatives and false positives. Gmail is still very good though, and any replacement, if it is to be widely used, needs to solve the spam problem. If each message had to be separately encrypted for each receiver, would this add much to a spammer's costs? I'm guessing it would, but not by enough to make spam uneconomic. A better solut…

Fun fact: Bitcoin's proof-of-work algorithm is based on Hashcash, which was an anti-spam measure along those lines: a message contains a partial hash brute-force that takes the sender about a second of CPU time to compute (and depends on the recipient). But it didn't take off, and is problematic when spammers have vast amounts of CPU resources in the form of botnets.

Re: A Hacker's Replacement for Gmail

#188

Post by comex »

bigiain wrote: post #60
mbell wrote: post #34

Earlier quoted context omitted.

What? Have you been following this topic at all? Exactly where are these convincing arguments that google is sending all e-mail to the NSA? Links? Data? Do you have anything that supports this at all? There is the telephone stuff that was leaked, which has been well known since 2006 [0]. But, where is this miraculous evidence that google is handing everything over to the NSA? [0] http://yahoo.usatoday.com/news/washin…

Yeah, I've been following, with the point of view of someone explicitly not protected by your 4th amendment rights. (I'm assuming, possibly incorrectly, that you're a US citizen?) As a "non-US person", I read all the "We disclose user data to government in accordance with the law" explanations from Google/Apple/Yahoo/Facebook et al - as saying "Oh, you want our data from that guy in Australia? Sure, that's 'in accord…

Though I'd agree that non-US persons have reasons to be concerned, you moved the goal posts. It may not be particularly difficult for the NSA to get your data from Google services if they decide to target you specifically, but Google has explicitly denied broadly sending over data from some significant fraction of users, as you suggested in your previous post:

http://googleblog.blogspot.com/2013/06/what.html

Re: A Hacker's Replacement for Gmail

#189

Post by richdougherty »

dmix wrote: post #142
richdougherty wrote: post #53

It would be incredibly useful if there was a mail service that received email over SMTP, encrypted it straight away with a public key, then just dumped the encrypted email into a general-purpose online storage solution (e.g. an S3 bucket). That would IMO provide a good base for encrypted client-side apps to build on top of. Open source would better be able address the problem of writing a client once the money needed…

Countermail does this: https://countermail.com/

I was imagining an even lower level service. I guess that CounterMail must store unencrypted email headers in order to serve IMAP, right?

I was thinking something that just manages the problem of being online 24/7 to receive email. This (and possibly sending email) is the only thing that can't be done completely client side. A service like I was thinking of would just accept messages, immediately encrypt them (headers and all) with an RSA key and then dump them into some third party online storage system (maybe sending a notification over XMPP too).

The rest of the email pipeline could then be run completely client-side. I'm talking about doing everything client side: spam filtering, sorting into folders or tagging, running email rules, indexing, and of course viewing and reading email. (A clever filesystem/database would need to be layered on top of the online storage system to manage the state of the pipeline and provide fast indexes.)

For maximum ease of use the client-side app could even be a rich Gmail-like JavaScript app that stores private keys locally and but stores most data remotely (e.g. uses S3 directly via CORS).

This would all allow hackers like us to build interesting (but still encrypted) email services without having to worry about infrastructure. That's something I don't want to manage anyway!

Also the barrier to entry of writing a Gmail clone would be much lower because you could do at almost zero cost. Since you don't have to receive email or manage storage your service would mostly be static JavaScript containing the client-side logic. Most - even all - of the service could just be served on a CDN.

Re: A Hacker's Replacement for Gmail

#190

Post by bigiain »

comex wrote: post #188
bigiain wrote: post #60

Earlier quoted context omitted.

Yeah, I've been following, with the point of view of someone explicitly not protected by your 4th amendment rights. (I'm assuming, possibly incorrectly, that you're a US citizen?) As a "non-US person", I read all the "We disclose user data to government in accordance with the law" explanations from Google/Apple/Yahoo/Facebook et al - as saying "Oh, you want our data from that guy in Australia? Sure, that's 'in accord…

Though I'd agree that non-US persons have reasons to be concerned, you moved the goal posts. It may not be particularly difficult for the NSA to get your data from Google services if they decide to target you specifically, but Google has explicitly denied broadly sending over data from some significant fraction of users, as you suggested in your previous post: http://googleblog.blogspot.com/2013/06/what.html

Maybe - but I'm reading it with the suspicion of someone who's just having been served a wake-up call on the exact nature of a friendship, and finding it's a lot less mutually respectful than expected.

I still see that "Second, we provide user data to governments only in accordance with the law." glaring out at me from the middle of that denial.

My suspicious mind now reads phrases like " … and frequently pushes back when requests are overly broad or don’t follow the correct process" and "Press reports that suggest that Google is providing open-ended access to our users’ data are false, period", as saying "so long as 'correct process' includes a FISA rubber stamp, and that '(claims of) open-ended access to our users' can only be true if it includes all domestic US users" - then sure, we can say that while still handing over _all_ data on non-US users -it's still _technically_ true.

This is for me, kinda like when someone you thought was a close friend gets married and doesn't invite you to the wedding - nothing's actually changed, but you now view everything differently. Right now I've got that "Oh, _that's_ how it is huh? I guess that explains a few things, I wish I'd known earlier…" feeling - complete with that sense of foolishness for ever having thought things were different.

It might be paranoid - or it might just be pragmatic. Either way, things _are_ different now. I just didn't get invited to The US's wedding, while Apple, Google, Yahoo, Amazon, Skype, TeamViewer, PayPal, eBay, Digital Ocean, Linode, Rackspace, Dropbox, Evernote, Trello, Freshbooks, and a bunch of others all did. Now I have to re-evaluate all those relationships too.

How paranoid is it to wonder if I can trust 1Password any more?

Post reply on HN