Hacker News Reader

Comment by JumpCrisscross | Hacker News Reader

How would you search your inbox? Or filter spam?

Using metadata? Headers? Anything other than Tue email body would be nice. We still have blacklisting by IP and stuff like that.

I mean if I write a Nigerian prince email and send it to my mum, it should reach her no matter what the text says, right?

Should it reach her though? What if I hacked your account and sent it via you? Or should metadata detect that?

https://protonmail.com/blog/encrypted-email-spam-filtering/

I remember there was a recent paper that dealt with this, too, but I can't find it right now. But it basically demolished this argument that it's impossible to stop spam if the email is encrypted.

That blog post doesn't actually say anything about how they do spam filtering on encrypted emails. Everything they talk about is bog-standard spam filtering, including comparing against known spam and Bayesian filtering, both of which are impossible to do on encrypted emails. It's not clear if they're doing reputation analysis, which is the other big anti-spam measure impossible on encrypted email (I suspect it's the main component of their "we're not telling you what we're doing"). The SPF/DKIM/DMARC and blacklist checks are the only things you can reliably do on encrypted email.

They do say "In future blog posts, we will cover the challenges of preventing ProtonMail from being used by spammers and the challenges of doing spam filtering with end-to-end encrypted emails which we cannot read", but I can't find any such blog posts.

WhatsApp also had a session at F8 about e2ee spam filtering...

https://developers.facebook.com/videos/f8-2017/how-whatsapp-...

You could search and filter after decryption (there are implementation issues with both for sure, but it is technically possible).

Some type of proof‐of‐work for email addresses that have not been previously white-listed. Similar to what BitMessage does[1].

Sending emails to new/random contacts shouldn't be that easy anyway.

[1] https://bitmessage.org/bitmessage.pdf

Encrypting email to a single recipient is (a weak) proof of work.

There's a big difference between sending 10k copies of a plaintext email, and retrieving a public key and encrypting to 10k recipients - not to mention that filtering out all non signed/not-signed-by-trusted-key should be a decent start for a whitelist/greylist.

I'd be curious if anyone ever got gpg-encrypted spam?

Well, I doubt anyone gets GPG encrypted spam, because only a small number of people actually know how to decrypt GPG.

Another approach would be to have to pay the equivalent of USD 5-10 cents in some email crypto currency in order to allow an unknown sender to put their email on my inbox. If I reply or add the sender to my whitelist the fee is automatically refunded to the original sender and future messages between both parties would won't require a transaction fee any longer.

this could be done locally, it doesn't use that much processing power

It can probabky be done if you're using a email client. Webapp (like gmail)? Probably not feasible because of how much data you need to download every time.

if only they would offer that option... at least for the android client

Maybe having e2e is more important to some people than searching or spam filtering.

Personally, I'd like to have the option, but as I don't, I don't use gmail.

Homomorphic encryption is on the way! Right?

(Right?)

Reply on news.ycombinator.com