Comment by intransigent | Hacker News Reader

Comment by intransigent | Hacker News Reader

Parent Full thread

Patterns:

  The email message contents say the sender
  is joe@example.com but the originating
  mail server is owned by advertiser-d00dz.net
  and was routed through cdns and isps that 
  example.com is not known to operate, based
  on a wide swath of reliable analytics from
  several million other messages previously 
  processed and known to be legit example.com
  messages.

Those are patterns that very large email providers know about.

But if you are running your own mail server, and using squirrel mail, you, a lone individual cannot analyze mass traffic patterns.

One Ring To Rule Them All:

  Everyone only uses gmail, and there is no 
  other provider, resulting in monoculture,
  and we all get spied on, not just by the 
  NSA, but The Corporation too, but at least 
  there's no spam. That last guy that tried 
  spamming was turned into soylent green.

As for pixels, uh, images don't automatically load for all people. I haven't permitted a banner image to load in eons.

I also don't visit links that I cannot understand, especially for domains I don't recognize, but that's because I know better.

Yes, yes, cookies, web mail, javascript, event bubbling and capturing, hovering, ajax, json, oh noes. I get it. We get it. We all get it. But grandma does not.

Google's big, sure, but they're not the only show in town (comscore's yearly thing is pretty easy to google0.

The patterns bit isn't really how this works. There are no real analytics being done on the messages coming in from example.com to check if it's from 'the same place as it normally is' in that manner. It would require enormous resources and that problem was solved by SPF way back in the 00's (or before).

Your Example.com will usually delegate a subdomain (dns) to a big mailer (like mailchimp, sendgrid, j33t-haxx0rz.ru or whoever) if they're going to be doing a lot of mails. The delegate will create/maintain a load TXT record (that's SPF) which is really just a list of hostnames (like 'mailer1.foo_emailcompany.com') which then have sort of proved that they are authorized to send mail as foo.example.com. The mailservers at google or wherever which then recieve these will lookup the txt records for the sender as part of their spam scoring mech during the mail arrival, and will use it as part of the scoring mech (but not the complete one).

Your big mail proivders will be using 1000's of IPs to do a single mailing at times, so there is really no other way this sort of thing can work. DKIM uses a similar approach but utilizes signing to get there..

edit: also, probably <1% of people don't/won't view images in their mails, which is sort of the point here regardless of what we personally do......

> also, probably <1% of people don't/won't view images in their mails, which is sort of the point here regardless of what we personally do......

I mean, I just use hotmail. Have done for 15 years probably. If Microsoft judge the email to be dubious they won't load any of the non text content unless I tell them to.

I assume that google or yahoo or whatever other email host does the same thing.

Whoa. I'm really not even sure if that's satire or not which is pretty good going..

Such a statement, here of all places, really has to be; but maybe I've been awake for too long and, as a result my faith in general sanity has run too low for me to be totally sure you don't actually mean it...

Bravo at least for making me question myself before replying!

On the off chance you're being genuine.. Ye.. Wha.. Yo.. Er. Christ. I mean. Aww.. Er. Really? Er. head pat.. And I guess, err, sorry... Things are much, much worse than you imagine and we should all be paying more attention to where this is going.

No. The premise of what if we only had a single monolithic email service, run by a single corporation as a public utility.

Not gmail specifically. Insert any named service into that role as placeholder. Yahoo, hotmail, gandi.net.

That entity becomes The One Ring, when they control the monopoly, and can read everyone's mail.

I would have thought my euphemism was obvious, but gee, I guess not.

Oh, I'm just talking about how things work at the moment with tracking etc (source: I built a system which does this sort of thing on a decent scale).

Maybe we'll get to cyberpunk distopia you describe later tho :}

That 'what if', btw, is actual reality these days if you replace 'corporation' with 'government'.

While any given provider might get huge, the distributed nature of this thing we made really means the only folks who can realistically obtain the sort of 'total' power which such a monopoly would create are the state actors; and they're already doing this. We all watch the news, right?

It seems like we're talking about different things, or maybe I'm just not really getting your point. The problems we have are not this theoretical push towards massively powerful orgs (which is a thing, sure) -- but the govts which are inside all of these guys.

Either way, we're too late to do much about it I guess.

I'll be over there with the tinfoil hat and no social media accounts :P

Reply on news.ycombinator.com