Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Future of Email

fastmail.com

Post reply on HN
Print view View original

171–180 of 217 posts

Re: The Future of Email

#171

Post by zikduruqe »

marysol5 wrote: post #155
zikduruqe wrote: post #86

Earlier quoted context omitted.

> Easy vbezhenar, this is your grandmother. I just got an email from you with a bunch of gobbledygook and I can't read it. /s If it were that easy, everyone would be doing it.

I used to always use GPG, had my keys listed on keybase, which cross references my social media and websites to validate they're me. And there already is the first problem, how do you get and trust a public key? Key servers are chock full of fake keys. Just search Linus Torvalds on there... But even then, the sheer amount of people who'd complain and wonder what the block of base64 data was at the bottom of the e-mai…

I use GnuPG daily and mandate that everyone in our organization do the same. As part of the onboarding process, I have a doc explaining how to install GnuPG, generate keys and how to share their public key in a specific place in our network.

Once you force people to do it, it is not terrible once they get the hang of it.

Re: The Future of Email

#173

Post by sgc »

jprjr_ wrote: post #125
timwis wrote: post #113

I read this article and was surprised when I reached the end because the whole thing felt like it was setting the stage for some announcement or new thing. But nothing came..? Forgive me if I'm being thick but what was the takeaway?

That was how I felt. "The Future of Email", from Fastmail - I immediately assumed some big announcement. It's basically "you need to pass DMARC now" which has been true for 2 years. It also goes into how authentication helps stop spoofed domains which yes, is true. But in my opinion the biggest problem isn't spoofed domains at all. Attackers will figure out how to make your payment platform (PayPal, Stripe, etc) send…

I thought the most interesting part of the post was that they have an mcp endpoint for bring-your-own agents, and they won't be force feeding ai on anybody. In the security context of the post, they mean that you are responsible if your ai is duped into falling a victim, or tricked to send malicious mail.

Re: The Future of Email

#174

Post by jcranmer »

marysol5 wrote: post #140
jcranmer wrote: post #128

Earlier quoted context omitted.

In 2026, pushing for encryption of emails is a sign that you care more about box-checking requirements rather than actual security practices. Encrypted email sounds good--it's encrypted, how can that be bad?--but when you actually work through various threats and see what encrypted email protects against, it's really not much compared to the status quo, and encrypted email also turns out to lose a lot of features. Ke…

>Or spam processing--no one's come up with a workable solution here, especially given the vast amount of spam that never hits an email folder The origins of "Bitcoin" was actually a PoW system to send e-mail to a server!

So Hashcash was, as far as I'm aware, the first PoW system ever developed, but I'm not aware of it ever actually being deployed as an antispam measure. And indeed, the history of bitcoin also demonstrates why Hashcash would have ultimately failed as a spam-prevention measure: bitcoin can only be effectively mined by large, dedicated farms (or just outright stealing others' resources). There is no clearing price for compute that would have let regular people (especially those on anemic hardware, think "feature phone in Africa") send email while prohibiting people with access to large resources (e.g., botfarms) from mass email.

Re: The Future of Email

#175

Post by aag »

the_bear wrote: post #84
sverhagen wrote: post #2

I find it hard to judge how much, if at all, this will help, but I'm all for email being more secure, to the point that organizations (banks, governments, insurance companies) stop creating walled-email alternatives: please log in to our secure message center, where you can only see our messages poorly formatted, and for a short time, until we permanently delete them . I like that my Inbox is a somewhat-searchable, h…

Those "message centers" aren't just about security, they're also about compliance. For example, insurance companies need to be HIPAA-compliant which requires that they can only send health-related info to other HIPAA-compliant systems, which means signing a BAA (a contract) with those other systems. There's no way to do that with email (your insurance company can't sign a contract with every potential email host in t…

So much work is done for HIPAA compliance, and then the only authentication required is a birth date.

Re: The Future of Email

#177

Post by havaloc »

I really like Fastmail, but I wish they offered a lightweight AI feature. Their filtering system is unmatched, yet I’d love a basic, privacy-focused AI filter powered by a small, private model they run.

For example, I could set rules like “if an email looks like a promotion, move it to the promotions folder.” I could roll my own MCP server sure, but that’s not the direction I want to go.

Re: The Future of Email

#178

Post by BatteryMountain »

We will end up with a situation where all interactions with computers (remote systems), including email, will need an initial step to pair/exchange keys, much like ssh. So when the bank wants to send me email, they can only do so if they have my public key. We should try to make this as frictionless as possible. Or, we generate semi-random email addresses that are short-lived, so that each company I interact with get their own unguesable email address.

Either way, we are getting to a point where offline-2FA will be mandatory for all auth systems and when interacting with another party, it will need something like the above to be sure you are dealing with the correct company.

Re: The Future of Email

#179

Post by BatteryMountain »

ruslan wrote: post #159

> The second is AI assistance: tools that summarize your inbox, surface action items, draft replies, and in some cases take actions on your behalf. That is the most evil part. Finally we will have bots talking to bots, no human in the loop. All email problems can be solved with GPG, but that ruins Fastmail and other email services business, as they won't be able to read and analyze their users' emails. No ads, no sel…

Preach. Exactly.

We will eventually be forced down this path though, be patient! Upfront key exchange in-person will be the only way left to prove comms are real. GPG is just one path but someone will come along and make it easy on organizational level.

Re: The Future of Email

#180

Post by BatteryMountain »

eggbrain wrote: post #80

I feel we need a "proof of work by human" for emails. Something that could be signed that attests that someone took the time to write the email, not just sent a template / used AI to auto-generate a personal looking email, etc. Sure that could be gamed as well (have an AI write characters one by one to look more human-like), but taking more time usually is a fairly good blocker for spammers / salespersons / etc.

I want to give my bank my public key (preferable at a branch), so that ANY comms coming from them I can prove it came from them as.
Post reply on HN