Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A realization of why email is critical infrastructure for the Internet

utcc.utoronto.ca

Post reply on HN
Print view View original

221–230 of 255 posts

Re: A realization of why email is critical infrastructure for the Internet

#221

Post by magpi3 »

networkimprov wrote: post #213
magpi3 wrote: post #74

Earlier quoted context omitted.

It really is about incentives. When the government and universities were the primary agents influencing the internet, open protocols were favored I presume because they incentivized the decentralization that the internet was created for. Now private corporations are the primary agents of change, and they are driven by very different incentives. When was the last time you heard of a company based around open protocols…

And yet none of those corporations has displaced email, despite the fact that it has become a universal cyberattack channel, with a stagnant UX that doesn't address most real-world use cases for email! I saw a need for a safer, better, decentralized protocol for email, so I drafted one (TMTP) and implemented client & server. More at: https://mnmnotmail.org/ & https://twitter.com/mnmnotmail Related protocol projects i…

> I saw a need for a safer, better, decentralized protocol for email, so I drafted one (TMTP) and implemented client & server.

We definitely do, and then we need big, heavy corporate advocates for this new protocol. That second part is the rub. I would argue that every company embraced email early only because proprietary formats that locked customers into a platform weren't yet a thing. Now that they are, it is so much harder to propose that we all "just get along" with shared protocols.

Your work looks very interesting and I applaud you for taking this on. I will take a look. I am not entirely pessimistic. Have you thought about building a company around it?

Re: A realization of why email is critical infrastructure for the Internet

#222

Post by encryptluks2 »

shukantpal wrote: post #196
encryptluks2 wrote: post #164

Earlier quoted context omitted.

Domains are still controlled by the government.

That's true, but the government is still further away from control; besides, web3 is bringing decentralized DNS (see Handshake Protocol) to fix that.

Until they make it easy to bridge decentralized DNS queries with regular DNS even on mobile phones (without using a middleman) but apps that run and do this for users, then no web3 is not bringing decentralized email. Also, email providers would need to bridge decentralized DNS and it is in their interests not to. So Gmail, Outlook, etc which most companies have migrated to will not support it.

Re: A realization of why email is critical infrastructure for the Internet

#223

Post by rjzzleep »

AnthonyMouse wrote: post #214
rjzzleep wrote: post #211

Earlier quoted context omitted.

> This is the biggest flaw in the design No, it's solid design. It's a very simple safe primitive. You can build endless infrastructure on top of it. Similar to subkeys. For example a lot of businesses use Smart-ID on top of that. You need to tie the smartid stuff to your PKI identity. But after that you can just use that as identity. https://www.smart-id.com/

> It's a very simple safe primitive. You can build endless infrastructure on top of it. It has nothing to do with the primitive. Someone will find a flaw in the implementation, or human flaws in the bureaucracy that administers it. And building infrastructure on top of it is the flaw. These things should all be independent of one another.

The flaw right now is that you guys believe that all online identity needs to be decoupled from the online identity. There are a couple things you guys dismiss or don't think about:

1. Contrary to systems such as the German one this identity system actually has a working upgrade and revokation path. The German one was is assuming that it's safe by design and the identity being fixed. The German ID keys don't have a revokation system and they don't expire either.

2. The baltic system has expiry's on these private keys. They are authenticated against your physical government issued ID with background checks being done by the current existing police/interpol infrastructure.

These private keys are not isolated from your identity. You receive them from government institutions that use the exist physical identity infrastructure.

The problem with people here is that they want the digital identity to be completely self contained. I get that sentiment and I don't disagree with it, but it's a completely different goal from what is being solved here.

This solves - in a much better fashion - what a lot of "crypto" fanatics want governments to use.

Re: A realization of why email is critical infrastructure for the Internet

#224

Post by networkimprov »

magpi3 wrote: post #221
networkimprov wrote: post #213

Earlier quoted context omitted.

And yet none of those corporations has displaced email, despite the fact that it has become a universal cyberattack channel, with a stagnant UX that doesn't address most real-world use cases for email! I saw a need for a safer, better, decentralized protocol for email, so I drafted one (TMTP) and implemented client & server. More at: https://mnmnotmail.org/ & https://twitter.com/mnmnotmail Related protocol projects i…

> I saw a need for a safer, better, decentralized protocol for email, so I drafted one (TMTP) and implemented client & server. We definitely do, and then we need big, heavy corporate advocates for this new protocol. That second part is the rub. I would argue that every company embraced email early only because proprietary formats that locked customers into a platform weren't yet a thing. Now that they are, it is so m…

I have sketched a plan for a venture, for which I'd need co-founders (e.g. mobile app code & UX expertise) -- feel free to reach out via Twitter @mnmnotmail (link above).

Those big corporate advocates necessary for the success of a new email protocol are fortunately not the major email hosting players! See the mnm FAQ #2 for a plausible adoption path.

Re: A realization of why email is critical infrastructure for the Internet

#225

Post by Jenda_ »

Another insane feature of WhatsApp (besides using phone number for an internet service) is that it only runs on Android and iOS (the web client is only some kind of "remote access" to the app, which requires the app to constantly run).

I actually run Android-x86 VM on a server because of WhatsApp, which I need for work. And it has some problems, for example to allow the browser to access the app, you need to scan a QR code - but I did not find a webcam emulator (think: v4l2-loopback on normal Linux) for Android or a way to emulate a webcam in VirtualBox or Qemu, so I need to copy the VM image to a computer with physical webcam, scan the code by pointing the webcam to the screen, and then copy it back to the server. WTF.

Or am I missing something? How do people without smartphones use WhatsApp (for communicating on a computer)?

Re: A realization of why email is critical infrastructure for the Internet

#226

Post by AnthonyMouse »

rjzzleep wrote: post #223
AnthonyMouse wrote: post #214

Earlier quoted context omitted.

> It's a very simple safe primitive. You can build endless infrastructure on top of it. It has nothing to do with the primitive. Someone will find a flaw in the implementation, or human flaws in the bureaucracy that administers it. And building infrastructure on top of it is the flaw. These things should all be independent of one another.

The flaw right now is that you guys believe that all online identity needs to be decoupled from the online identity. There are a couple things you guys dismiss or don't think about: 1. Contrary to systems such as the German one this identity system actually has a working upgrade and revokation path. The German one was is assuming that it's safe by design and the identity being fixed. The German ID keys don't have a r…

> Contrary to systems such as the German one this identity system actually has a working upgrade and revokation path.

Systems without this are even more broken, but this is hardly the main problem.

The problem is that with a system like this, if you can compromise one person, you can compromise them totally. You compromise every part of their life that uses this system instead of just one when it's isolated from the others.

And if you can compromise that system itself, even temporarily, you can compromise everyone that comprehensively at once. Everyone's health records, stolen. Bank accounts drained. Trade secrets published or sold to foreign competitors.

Canceling their credentials after the fact doesn't undo all the damage.

> These private keys are not isolated from your identity. You receive them from government institutions that use the exist physical identity infrastructure.

In most cases this is a liability rather than an asset. It's only useful if you for some reason need to prove your physical government identity, e.g. so you can vote. But those few things can use the same process you use to bootstrap into this identity system to begin with.

If all you want to do is sign into a website or acquire a book or a contraceptive or travel, having that tied to your government identity is bad.

Re: A realization of why email is critical infrastructure for the Internet

#227

Post by Jenda_ »

twobitshifter wrote: post #112
cpach wrote: post #28

Earlier quoted context omitted.

I’m not convinced that XMPP is actually such a great protocol. (I used it for many years.)

Do we know how great the centralized protocols are?

They are "great" from the perspective that the non-tech-savvy user somehow can get into using these. This did not work for XMPP (they need to learn that they need to pick a provider and a client; then they need to deal with entering the credentials into the client; then they need to solve problems like history synchronization and access from multiple devices; and finally voice/video/filesharing over XMPP is a disaster).

Re: A realization of why email is critical infrastructure for the Internet

#228

Post by marcosdumay »

mcdonje wrote: post #215
marcosdumay wrote: post #208

Earlier quoted context omitted.

That's because the US has a low amount of corruption on the positions that face the public. It's also because most of those lists are ordered by a "perception index", that is the kind of bullshit that increases if your government does an awareness program and if corruption fighting gets on the news.

So, ironically, corruption reduction efforts can raise a country's rank on such lists.

Exactly. Not only "can", but will on almost every case. Some times I wonder if it's on purpose.

Re: A realization of why email is critical infrastructure for the Internet

#229

Post by KennyBlanken »

derbOac wrote: post #154
EvanAnderson wrote: post #120

Earlier quoted context omitted.

I still have a vague hope that the United States Postal Service could be "pivoted" into being a PKI provider and distribute physical tokens to citizens. They already have substantial procedures and infrastructure for verifying identity. There would be problems, to be sure, but I'd much rather get my ubiquitous PKI for citizens from the USPS than the banks or "tech giants".

I'd like to see the USPS expanded to become a public / municipal ISP of sorts. If you read about the history of the institution, this is really what was intended in its constitutional incorporation. It really wasn't about physical mail per se, and you can't hold the founders accountable to something that was outside the realm of imagination at the time. There's all sorts of information-structural things that are in t…

My main reservation with the USPS becoming an ISP lies in its investigative powers and long history of politically driven, unconstitutional use of its police force. Namely suppressing socialist newsletters, pornography, and the like.

I'm guessing most Americans do not realize that going back more than a decade, the USPS has scanned and stored imagery and metadata for every single piece of mail that passes through their automated sorting machines.

Look closely at the images they email you of mail coming into your mailbox and you'll notice that very often, the scans reveal the nature of the documents inside even without messing with contrast/levels.

Re: A realization of why email is critical infrastructure for the Internet

#230

Post by Bud »

spc476 wrote: post #192
Bud wrote: post #150

Earlier quoted context omitted.

You're not paying attention to the salaries part, though. Look at the pay for members of the House and Senate, in real dollars, over the last 50 years. Also pay attention to how much stupid noise there is about how members of Congress are supposedly overpaid. The pay for all US Senators combined (under $18M) is less than half of what LeBron James makes (over $41M) in salary alone in a year.

But until relatively recently (2018 perhaps?) Congress was legally allowed to profit with insider trading (probably due to Article I, section 6, paragraph 1 of the Constitution).

Sure. My point is that we should pay Congress more so that they have less incentive for wrongdoing of various kinds.
Post reply on HN