Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

JMAP – a better way to email

blog.fastmail.com

Post reply on HN
Print view View original

81–90 of 116 posts

Re: JMAP – a better way to email

#81

Post by uaygsfdbzf »

robn_fastmail wrote: post #46
davexunit wrote: post #45

Earlier quoted context omitted.

>key distribution GPG key servers?

And how do you trust those? And if I'm a brand new user, how do I get my key in there? All the moving parts probably exist, but so far no one has pulled it together into something that a random person off the street can use. Its not the problem JMAP is trying to solve.

You don't need to trust the keyservers since you verify the fingerprints of downloaded keys against the fingerprints given to you in person.

The keyserver protocol includes commands to include keys in the keyserver network. How you send keys depends on the UI of the tool you use, geeks will do this:

gpg --keyserver --send-keys

Re: JMAP – a better way to email

#82

Post by uaygsfdbzf »

brongondwana wrote: post #67
mikhailt wrote: post #61

Earlier quoted context omitted.

No, I'm not assuming anything and didn't even say anything like that. My point is that using SSL on its own as the only line of defense should not be an excuse not to have anything else. It's like saying my apartment doesn't have a spec for a security system nor a safe because the lock on the door does enough of a job to secure it. Also, a widely studied protocol spec means nothing. The bugs are from the humans codin…

If SSL is broken, you are - as many people have noticed, screwed. JMAP itself is entirely encryption layer agnostic. It's transport layer agnostic. JMAP over HTTPS is definitely going to be the first layer, but we're looking at websockets with interest as well. If you were insane, you could do JMAP over XMPP, or JMAP over email. That would be neatly recursive...

In case you hadn't noticed, the authenticity model of SSL was an afterthought and is completely broken. I recommend listening to Moxie's talk about this:

https://www.youtube.com/watch?v=pDmj_xe7EIQ http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...

Re: JMAP – a better way to email

#84

Post by aroman »

mike-cardwell wrote: post #83

I understand you guys use and contribute to Cyrus. Is there a JMAP interface planned for Cyrus? Or for any other mail servers, like Dovecot?

from the article itself:

"Finally, we know IMAP, SMTP and the DAVs aren’t going away any time soon. No protocol will succeed unless it provides an upgrade path from where we are now, and a compelling reason to switch. We will provide a proxy which can talk to existing servers and present them over JMAP."

Re: JMAP – a better way to email

#85

Post by aroman »

sukh wrote: post #74
veb wrote: post #56

Earlier quoted context omitted.

Ha. I'm the same, every time I read about them I want to make the jump - but I'm not reliant on any of those, except mail fortunately. I just haven't quite done it yet. From people I've spoken to, everyone praises Fastmail... seems like we all need that extra push.

Less than pleasant first experience. Card failed, reason never communicated clearly enough. Very slow and archaic support.

Archaic?

Re: JMAP – a better way to email

#86

Post by illumen »

robn_fastmail wrote: post #52
groby_b wrote: post #51

Earlier quoted context omitted.

So am I. From looking at http://jmap.io/spec.html#authentication , it looks like the password will be transmitted in plain text. (See the text below the 200 response) That makes me extremely queasy. Yes, HTTPS theoretically provides transport layer security, but a single breach of transport layer security results in the attackers permanent access to your mail. I.e. run a MITM attack in a coffee shop, snoop up JMAP pa…

If you read the spec closely, you'll note that it provides support for arbitrary challenge/response auth mechanisms. Its conceptually the same as SASL in that respect. Yes, we're assuming a secure transport. Most of the internet currently does. Most of the passwords you send over encrypted channels right now are plaintext. This is not something we're trying to solve with JMAP (if it even needs solving, which is debat…

Plain text passwords. No amount of blablabla can excuse that.

Plain text passwords.

Re: JMAP – a better way to email

#87

Post by icebraining »

uaygsfdbzf wrote: post #82
brongondwana wrote: post #67

Earlier quoted context omitted.

If SSL is broken, you are - as many people have noticed, screwed. JMAP itself is entirely encryption layer agnostic. It's transport layer agnostic. JMAP over HTTPS is definitely going to be the first layer, but we're looking at websockets with interest as well. If you were insane, you could do JMAP over XMPP, or JMAP over email. That would be neatly recursive...

In case you hadn't noticed, the authenticity model of SSL was an afterthought and is completely broken. I recommend listening to Moxie's talk about this: https://www.youtube.com/watch?v=pDmj_xe7EIQ http://www.thoughtcrime.org/blog/ssl-and-the-future-of-authe...

I don't think that's very relevant for this use case, though - JMAP is clearly intended for use by custom clients, not browsers, and those can use SSL with a completely different model from the CA scheme, including bundling certs for the most popular providers (similar to HSTS preload lists).

Re: JMAP – a better way to email

#88

Post by robn_fastmail »

mike-cardwell wrote: post #83

I understand you guys use and contribute to Cyrus. Is there a JMAP interface planned for Cyrus? Or for any other mail servers, like Dovecot?

We're working on a proxy that will work with any IMAP server that of course will work with Cyrus. I think its likely that we'll look into building support directly into Cyrus at some point but we don't have any concrete plans yet.

Re: JMAP – a better way to email

#89

Post by robn_fastmail »

uaygsfdbzf wrote: post #81
robn_fastmail wrote: post #46

Earlier quoted context omitted.

And how do you trust those? And if I'm a brand new user, how do I get my key in there? All the moving parts probably exist, but so far no one has pulled it together into something that a random person off the street can use. Its not the problem JMAP is trying to solve.

You don't need to trust the keyservers since you verify the fingerprints of downloaded keys against the fingerprints given to you in person. The keyserver protocol includes commands to include keys in the keyserver network. How you send keys depends on the UI of the tool you use, geeks will do this: gpg --keyserver --send-keys

Right. I'm a little rusty on the details. My point stands - key distribution is not a solved problem for the average user.

Re: JMAP – a better way to email

#90

Post by robn_fastmail »

illumen wrote: post #86
robn_fastmail wrote: post #52

Earlier quoted context omitted.

If you read the spec closely, you'll note that it provides support for arbitrary challenge/response auth mechanisms. Its conceptually the same as SASL in that respect. Yes, we're assuming a secure transport. Most of the internet currently does. Most of the passwords you send over encrypted channels right now are plaintext. This is not something we're trying to solve with JMAP (if it even needs solving, which is debat…

Plain text passwords. No amount of blablabla can excuse that. Plain text passwords.

So all those services you use right now where you type in a password. How exactly are those passwords transmitted to the server?
Post reply on HN