Hacker News Reader

Comment by tptacek | Hacker News Reader

You seem to be relishing this takedown post. I don't want to harsh on that, since I enjoy writing a takedown as much as anyone, but I have to point out that you're attacking an argument I didn't make.

It's not my argument that people should use special secure messaging applications when they need security, and email at other times.

It's that we should stop using email pretty much altogether. Like I said: it's archaic. In the overwhelming majority of cases, a messaging application does a better job than store-and-forward email anyways. Which is why a lot of us look at our email inboxes these days and notice that most of what's in there is automated transactional stuff, with occasional cold inbound introductions that quickly transition off into some better medium.

The one thing we do still routinely use email for --- sending files to each other --- is an iredeemable security disaster that needs to end as soon as possible anyways.

View on HN

> a lot of us look at our email inboxes these days and notice that most of what's in there is automated transactional stuff, with occasional cold inbound introductions that quickly transition off into some better medium

Just wanted to point out: that's certainly not true for everyone. The overwhelming majority of my work communication is done by email, and an important part of my social communication with friends and family also is. Yes, even with long-time colleagues and friends. Not everyone is using, or wants to use, other messaging applications.

> It's that we should stop using email pretty much altogether.

Is there another communication system that is decentralized (no single point of failure, no central place where people have to register, I can run my own server and customize the client), and is also widely used?

>Just wanted to point out: that's certainly not true for everyone.

Very true. I use email for almost all my communication. It's not because I refuse to use anything else. I'm very much open to better solutions. But messengers linked to phone numbers can never be that solution for me.

Phone numbers come with way too many strings attached. They are country specifc. They can only be linked to one SIM card and one device at a time and that is almost never the device I want to use for written communication. They are subject to onerous contractual agreements and restrictions imposed by phone companies. By default, they allow everyone to call me. I don't usually want to be called on the phone.

>Is there another communication system that is decentralized (...), and is also widely used?

XMPP, maybe?

In rhe Eastern Europe XMPP is widely used for online drug purchases, even widely than telegram, which unlike XMPP requires burner phone to register.

Thanks for sharing, that's quite interesting IMO.

I don't see it as a knock against XMPP, just an interesting tidbit of information and an example of a wide-spread use case.

Moral opposition to drug use is irrelevant here, people want to get high and will find ways to do so, I think the usage of XMPP in Eastern Europe is a great example of why cryptography is important, and why everyone should have access to encryption.

The fact that telegram is used in Eastern Europe for drug purchases is very interesting as well.

It's a good thing people know how to use XMPP and can use it at will for anything they wish, including online drug purchases. Which are going to happen regardless of moral opposition, encryption centralization/decentralization, etc.

Like it or not it's a valid use case.

Is this an argument against any decentralized communications?

No, just an interesting tidbit of information regarding XMPP.

I'd argue matrix.org is a good contender for that space, federated, selfhosted and steadily growing, with megolm for end to end encryption (based on signal axolotl whatever the name is).

Not specifically to you, but want to point out that you cannot have secure + decentralized + anonymous without being subject to poisoning attacks.

And "secure" is only relative to "convenient" for the most part. Most people will sacrifice the former for the latter.

> It's that we should stop using email pretty much altogether. Like I said: it's archaic.

Claiming that some piece of software or set of protocols is archaic is probably the least persuasive way to argue against continuing use.

> [...] with occasional cold inbound introductions that quickly transition off into some better medium.

Cold inbound introductions alone are a reason for continuing plaintext email well into the future.

It's surely somewhat more persuasive than merely calling a constructively-argued position you disagree with unpersuasive.

I think it's naive to expect email to be replaced any time soon. Despite all the attempts over the years, it remains and persists. There are essentially no major ongoing efforts to replace it by any of the big players, which is what would be required.

IM is not a substitute and never will be.

Agreed. People have been trying and trying but like like traditional letters and snail mail people have been trying to replace that for years unsuccessfully as well.

There are use cases for all of the different methods and the level of security you require will usually dictate what methods you employ when it comes time to transmit any certain type of given message. The substitutes work for us based on convenience and preference and, for the most part, most people don't truly need secured end-to-end encryption for their daily correspondence (even though I personally think it would be a great habit to get into before it's an absolute requirement to ensure personal / private / public safety).

Things like Signal are steps in the right direction but I only see a few notifications a month about friends and family joining. I'm not seeing rapid enough adoption from the "every (wo)man" to indicate that the public at large sees the need for end-to-end encryption, yet. Since we already got Snowden's revelations I'm not sure that time will ever come. Frustrating, it is.

> It's that we should stop using email pretty much altogether. Like I said: it's archaic

Sorry but have you ever used Signal or any other IM to send anything longer than a few sentences? Email can be as long as you want, and it is totally appropriate when you want to write a longer document.

Have you used Signal recently? It’s quite robust IMO, from texting to calling and everything in between. My initial reaction to the GP post was not unlike yours, but as I read on I find myself agreeing with him. Going through my email records, a vast number as he said, are automated or transactional. The only real exceptions are from older relatives sending Facebook crap, or occasional indications to and from friends who don’t use messaging apps to read a particular article or study.

Worse it’s pretty much impossible to teach people don’t want to learn how to try and make email less insecure. By contrast I found it very easy to turn people onto Signal and similar applications.

Yes, I've used Signal and other messengers, including "IM's", to send things longer than a sentence. And, when I send email to people, if I have something more complicated than a paragraph or two to send, I make an actual document anyways. So what's your argument?

Here is something that I have a need of pretty often, but don't know how to do in things outside email (Whatsapp, Signal, etc): a point by point interleaving of the original message and the reply; for instance in a technical argument.

I could do this in Slack, but unlike email this is not even close to being universally supported.

For such technical discussions, I prefer an issue tracker, wiki, or forum. It should be a centralized searchable archive and not hidden in personal mailboxes.

Sure, you can use email as an interface to an issue tracker. Debian is probably the most prominent example. That is worse than anything web-based in my opinion.

That answer isn't workable for those of us in shorter term projects which lack that sort of infrastructure. The need remains for a flexible messaging system to take over for those kinds of messages that need some permanence. It sounds like what people familiar with email workflow want is the email a document interface so we have something tho point to after the fact. I don't think anything else does that though Wire may at some point.

How often do you send emails longer than a few sentences?

I don't really see a problem with long messages on Signal. The only annoyance is that the desktop clients are always browser-based (Electron or website or plugin).

> How often do you send emails longer than a few sentences?

Actually every single day, and not just once. Maybe I am an outlier?

Yes, you can write as long a message as you want with signal. There are desktop clients. You can attach files. Or voice messages. Or use it to call them. Or video chat them. It’s a crazy robust full featured incredibly secure communications system.

It's a centralized system, with a single point of failure, and you cannot use it without a phone number.

Then use Matrix or wait for Wire to open-source and federate, but securing email has failed for decades now.

> There are desktop clients

You mean the ones with Electron, using 5% of your CPU idle, requiring you to have first registered your smartphone with it before it can even work? That's not what I call a functional desktop client.

I don’t know a single person who uses the desktop client, and there’s the rub: it’s fine if I can perfectly render a 1000 word essay on my huge monitor, but not one of my friends will want to read it on their mobile screen.

I’m pretty sure I want a big searchable archive, though. That doesn’t seem compatible with most of these security-oriented message schemes.

Protonmail seems to pull it off. Though at the moment encryption only works inside their system. They are actively working to implement the ability to send secure messages to people outside their service with GPG, though. I believe the CEO said it’d be ready by early 2018.

Please correct me if I'm wrong, but they don't let you search in a protected manner.

They enable searching of data they keep unprotected (the metadata so to speak)

And proton mail bridge seems to be an "offline" (i.e. offline to them) email search engine that you run yourself, so it downloads your emails, and makes them fully searchable, but to do that, is also keeping them in an insecure state.

compare to

https://www.cs.columbia.edu/~angelos/Papers/2007/SSARES_ACSA...

and

http://sprout.ics.uci.edu/pubs/05628733.pdf

The local stuff isn’t necessarily insecure (depending on your paranoia level). The security of your computer system is totally unrelated to the encryption of your mail - even with GPG most people are keeping their private key on the same system they use to read their mail. Full disk encryption with something like Veracrypt or bitlocker or file vault or LUKS should be more than enough to keep your decrypted emails safe when you are not using your computer.

My guess is that bridge is run as a service. i.e. you make reuests via web site which are encrypted with local javascript (so that proton mail can't interpose), protonmail forwards to the service user runs which provides an encrypted response which local javascript then decrypts and displays.

In that case, you have to run a service that is always running that is effectively keeping the e-mails available in the clear. Is it better security than keeping them in the clear on a central server? sure. But is it really any different than running my own smtp/imap/webmail server on aws without encrypting any emails which I access? In practice it would seem to be a similar threat model and I'm not convinced many would view that to be particularly secure, just a tad more private.

I can search full text of my email on Protonmail.

At least I'm pretty sure that's what I'm doing.

Pretty sure you're searching the "metadata", who, when, subject

https://protonmail.com/support/knowledge-base/search/

Hrm. In which case, the metadata searching has proved fairly useful.

In the longer term / larger scale, it's not going to be sufficient though.

I have colleagues and students that don't use smart phones. As much as I agree with your sentiment, the unfortunate truth is that right now there isn't a good drop in replacement that we could move to.

Signal is drop in for WhatsApp and I can tell everyone I talk to on WhatsApp to just contact me on Signal instead. What do I tell people to move to from EMail?

I'm a bit late to this, but check out keybase chat. You can sign up on desktop / mobile / whatever you like, and desktop users can even drag and drop to a folder on their computer to share files (with like a 250gb per person limit right now I think), so that gets you a lot of the functionality of email right there.

WhatsApp is an ok substitute for Email in my opinion.

Sure, it is not open source and but federated. Signal, Wire, Matrix, etc should catch up in the next years.

What do you need from Email that a messenger lacks?

By far the most important: A desktop client that works without a smart-phone.

Identity management that is not smart-phone/phone-number based.

Better UI for long form messages, including citing previous lines.

Better support for adding people to ongoing conversations.

UI for conversations per topic rather than per person.

Mailing lists, and the ability to filter them to different folders (or equivalent UI elements).

Functioning as a searchable database of documents I have received. (Important detail: Attachments aren't independent messages: They are attached to often long form messages that describe their content).

Basically, WhatsApp does a subset of what EMail does but dramatically better and encrypted. But that covers only half of my email usage at most.

> that covers only half of my email usage at most

Yes, I guess that is the way forward. Split email into a set of different applications. Maybe one of them will take over the rest at some point.

I guess you only use a cellphone then.

Whatsapp desktop/web is terribly slow and requires your cellphone to be on at all times. Also, you cannot have whatsapp desktop/web active on more than one computer at any time.

Also, I do have several identities (work, leisure, even one-offs for website registration/communications) and no, I don't want to give my personal cell number to everyone.

> Whatsapp desktop/web is terribly slow and requires your cellphone to be on at all times.

They have a rather sound reason for the cellphone requirement, though. It's because the messages are stored only there and the desktop/web application is just a gateway to your phone.

https://faq.whatsapp.com/en/web/28080002

This seems like a more secure way to do it than what the others do, which is to store the messages in their servers.

Yes, but it means it will never be an email replacement.

The people without smartphones that I work with can use email.

I can get to my email anywhere, everywhere, whether I have a phone or not.

Of course that may be considered an anti-feature from the point of view of security, but it explains why IM apps can not replace email.

> What do you need from Email that a messenger lacks?

Discussion threads. Say I work on two different projects with the same colleague, or that I am also friends with a coworker and do things together outside of work. In whatsapp the different topics would all be mixed together into a big mess. With email I can just reply to a particular thread.

Huh, i think you've just identified (for me at least) the crux of the issue.

What messaging system other than email allows for topic based discussion? I guess you could abuse groups to donsomething similar, but its not wuite the same.

The underlying one person to one person philosophy of messaging apps is infuriating for organised discussion over time. It makes finding info discussed harder too.

Does anyone have any suggestions for messaging apps that don't put person to person front and center but topic discussion like email?

(You might argue the last point i made there, but go and make two separately stored discussions with the same person on whatsapp or signal or wharever... I'll wait).

>Does anyone have any suggestions for messaging apps that don't put person to person front and center but topic discussion like email?

IRC, Riot (Matrix in general), Slack, Discord, Rocket.Chat. There are quite a few.

I'm partial to Matrix, personally - you can invite a few friends for a room, and naming that room/setting a topic are optional, so either use case is fairly natural.

Hmm, not really. All those apps fall into the trap of following a UX design where it's all about a group or person and the conversation within.

IRC is channels, Slack is channels, Riot seems to just basically be IRC, Discord is another take on the same genre.

None of them give you what email gives you.

With email there's not a person or group in sight in the UX, save for perhaps a 'from' entry in the thread list. It's all about info. I can start 100 conversations with the same person and have those threads organised into a timeline separately from each other. I can then also arrange them into arbitrary collections.

I can possibly achieve something sort of like this by abusing groups or channels in these other apps, but then what? I just get a sidebar full of the things - what do I do with them? Can I search them and the info within from a global panel? Can I organise them into folders? Copy them to other accounts with a simple drag and drop?

Email has quite a different focus than all those apps you mentioned which is probably why nothing has replaced it.

I prefer Telegram now but this should work in Whatsapp as well:

Just create a group for each context and name them properly.

In consideration of the fact WhatApp is owned by a single company (facebook), which gets all the metadata, how is it federated?

> Which is why a lot of us look at our email inboxes these days and notice that most of what's in there is automated transactional stuff, with occasional cold inbound introductions that quickly transition off into some better medium.

If e-mail was gone tomorrow, where do you think all those automated transactional stuff would go? It won't disappear; suddenly, every business you pass will try to add itself to your contact list on $secure_im_of_choice, and you'll have just about the same volume of spam as on e-mail, just as a condition of being able to do any kind of business on-line.

Reply on news.ycombinator.com