Hacker News Reader

Comment by IX-103 | Hacker News Reader

Can we fix email so that it provides authentication, integrity, and confidentiality protections by default? And also while we're at it make it support binary attachments so that we're not stuck wasting bandwidth and disk doing base64 for everything?

View on HN

I agree. In my opinion, the number one thing that needs to be done is to ensure that email can only be sent encrypted. I have had the following information sent unencrypted over email in recent years: 1. medical/health information. 2. sensitive personal financial information. 3. HR related information. 4. Billing information. 5. payrol information. I basically refuse to give out email to health care providers or any corporate entity because I can't be sure what they will put in plain text email. I have to carefully explain to them that email is not encrypted and I have to explain what encryption is, some get it some don't. I am also trying to get friends and family to encrypt because I am also concerned that they will put health/medical etc into the email, so far no takers on encrypting. It takes like 15-30 minutes to do it the first time and 5-10 minutes for each contact (just need to send and verify fingerprint). Email is great in that it is federated and not centrally controled, the encryption needs to get fixed. I would suggest somebody create an SMTP server that will only accept encrypted connections and will scan and reject any received email that is plain text; i.e. will not store the plain text and will issue appropriate SMTP code indicating that it is not encrypted.

The primary problem for email at this point is that it's a highly effective cyberattack channel, because it allows anyone, claiming any identity, to send you any content, without limits. This cannot be "fixed" as it's the intended function.

No one was working on an alternative that addresses this problem, so I drafted & implemented "TMTP". It also addresses a variety of other common email problems.

https://mnmnotmail.org/

https://twitter.com/mnmnotmail

why not just extend the email protocol to really support open calendars, open social networks (decentralized) and open p2p chat?

email is a nice way of addressing, but we underuse that address compared to all the balkanized post-email systems.

There are efforts in those directions:

https://delta.chat/en/ implements encrypted IM over email.

https://jmap.io/spec-calendars.html is the calendaring spec for IMAP's likely successor

https://webfinger.net/ is the (appallingly named) http protocol for finding named people such that social connections can be made and managed. Some extensions exist for services that commonly run with email that provide webfinger services.

Delta chat look very interesting, thanks for mentioning it. What are the possible downsides? Looks like a winning tech to my non-tech eyes.

It gives a lot of metadata to the email providers.

Email has nothing to do with calendars. It happened that people in offices used email and attended to a lot of meetings. Microsoft built a client/server system (Exchange) that managed both email and calendars. There were probably previous systems like that, I don't remember. We need only a calendar client now (usually on phones) even if most systems send an email notification.

Well, email is already kinda 'fixed'. You can't do much about laggards but they drop out with time.

Authentication? DKIM, check.

Integrity and confidentiality? SMTP-TLS, check.

Oh, you meant against the provider? S/MIME, check.

Base64 - irrelevant given the size limits most vendors apply to attachments. Email isn't a great file sharing system and trying to optimize it for that might be a bad idea. People use Google Drive etc links these days instead, which works better.

Reply on news.ycombinator.com