Free Schnail Mail for life

I don't know why this still surprises people, or why Google is being singled out here. Information is transmitted by copying. Every provider has to look at and analyze your messages if they want to do clever things to them, like let you search your archived mail server-side. Even if they don't do anything with your messages themselves, they're still compelled by the government to parse through it all. Nothing is safe.

Whenever anyone asks me to explain how the Internet works, I don't talk about tubes or connected servers, because thinking your message is "in" a pipe is a broken abstraction; it makes people imagine nothing sees or touches your messages until they arrive at the destination. Instead, the mental model I encourage people to have for Internet is that "each packet is like a message stuck to a big public message board." Privacy is not the default; it's a public system, and privacy is something you have to actively create on top of it (via encryption, onion-routing, etc.)

The problem with email is that we've arrived at a monoculture. TLS-enabled email is pretty secure if nobody can compromise either of the two ends (or, well, the intermediaries). Since everyone uses Gmail, it's trivial to just get everyone's email, since one of the two ends is pretty much guaranteed to be there.

If we move to a system where everyone has their own mail server, or at least one mail server for a few people, that system will be much harder to snoop on.

Google is singled out due to the humans behind the corporate facade complying, no one forced them to.

I would hate to reduce it to binary but things like installation of proxy hardware (Blue Coat[1]) to monitor with or court orders for conscription of local hardware are. Without people collaborating along with the US government, then people... wouldn't be collaborating. Those within the USG would be forced towards alternative routes such as those detailed in the PRISM slides.

Bonus: Security creates insecurity, all this logging and data collection creates more data. This data, which Snowden's Booz Allen Hamilton has shown[2], can be leaked. As an example a look into the Blue Coat logs leaked[3] from Assad's Syria by extraordinary esoteric activists Telecomix[4] reveals followers of Christianity along with homosexuals intently monitored.

Bonus Caution: I wouldn't touch the Booz or HBGary leaks unless you like federal prosecution for assisting in dissemination of data on the profiteering collaborators[5].

[1] http://www.bluecoat.com/

[2] https://thepiratebay.sx/torrent/6533009/Military_Meltdown_Mo...

[3] http://bluesmote.com/

[4] http://www.theguardian.com/technology/2011/jul/07/telecomix-...

[5] http://motherboard.vice.com/blog/the-doj-is-suing-barrett-br...

This is just a re-hash of Microsoft's Scroogled campaign (http://www.scroogled.com). Just as with scroogled, the comparison of a human reading your mail with a machine analysing the contents in order to provide focussed advertising results in a complete loss of credibility.

In my opinion, this kind of argument is demagoguery and ignores practical security concerns.

For the average person, which is more likely?

(1) A hacker taking over their email account to get bank info, etc.

(2) Some nebulous threat from Google having too much information about you.

Google and Gmail offer some of the best security controls and threat detection of any webmail provider that I've seen (pioneered two-factor authentication for email, warn you about strange sign-in activity on your account, allow you to kill other sessions, etc.).

If the outcome of this kind of article is people move to less secure email because of some intangible threat, I think it's a net harm. Gmail is still the best choice for my mom.

I wrote about this more than a year ago at greater length on my blog: http://www.maxmasnick.com/2012/02/12/gmail_paranoia/ and there's more discussion on HN at https://news.ycombinator.com/item?id=3582609

My point is that any post criticizing Gmail for it's business model should also consider what is realistically a problem in the actual world (hacking) and hopefully offer some advice on what to do about it. I'm not sure this kind of "Google reads all your email and it's terrible. Full stop." post is very helpful.

Ok, a couple more things to preempt the inevitable trolling:

(1) Government snooping is a separate issue, but as far as I know there are no major email providers that a non-technical person can use that aren't vulnerable. We sorely need easy-to-use, widely used email encryption. Google isn't likely to do this because it would be counter to their business model, and this _is_ a problem.

(2) I don't use Gmail myself, but not because they are algorithmically reading my email. I switched (to FastMail) because I don't like the design direction of the Gmail UX, the FastMail UX is substantially faster, and the support is better (i.e. it exists). However, given that the average webmail user (a) doesn't want to pay for email and (b) is going to use one of the most popular services by default, I still think Gmail is a good choice.