Comment by xoa | Hacker News Reader

Comment by xoa | Hacker News Reader

I'd absolutely love an email 2.0 with E2E encryption, but I doubt the ability of the industry/community to create something like that anymore as much as it depresses me. That email is so standard and federated despite pressure to the contrary is something of an accident of history and the time it was developed. The trend now is the opposite. It would probably also require a foundation of secured DNS which could then act as a transparent root of trust, but that hasn't been doing well either. Even a lot of "security experts" insist on stupid shit like Signal or the like being a replacement. So we'll continue to use email for highly sensitive and secure material and it'll just continue to be a window for a lot of adversaries I guess :(. It's not hard to envision a system with a few simple upgrades to make it both vastly more secure and help deal with spam at a much more root level, the pieces exist at the technology level. Yet I doubt it'll get out together and adopted. Path dependency is hard.

There's a handful of email hosting companies that have huge market share. If Microsoft and Google worked together they could implement any new email standard they want and everyone would have to follow.

Exactly. If Microsoft or Google or both wanted to create a standard for Guaranteed Delivery and pile all sorts of stuff on it, they could.

If they did it right, it might even be a good thing. But there's not really much desire/push for it, because spam got "mostly solved" well enough.

You'd want it to be a feature-add (if enabled and used, your bank can send you secure statements direct to your email box that nobody else can read, etc) so you actually gain something; but then you have the whole "Google and Microsoft have MITM themselves on almost all email" problem anyway.

>>spam got "mostly solved" well enough.

Did it though? Gmail is still having a tough time blocking all spam.

And most people with independently-run mail servers are screwed because it's "potential spam". Now you have almost no choice but to use a big tech platform if you want your email to be of any use. Which is ridiculous, and completely antithetical to a federated platform

What's wrong with Signal? It works, it moves files, I don't have to jump through filtering hoops to do so. Signal is an excellent replacement for email when you need security.

* History can't be synced into newly logged in devices

* Requires phone number

* How do I run my own server?

* Doesn't have good spam protection

* Individual messages can't be categorised into folders and/or archived, then searched by category

Signal is another walled garden actively trying to prevent decentralization. Expect that it will fail at some point in the future either due to too many users and too few money or something else.

Consider Matrix instead.

Gotta love that someone always mentions Signal when it's obviously not a replacement for email.

Agree with sibling comments, but Signal is very much ‘good enough’ for a lot of people and use cases. I was able to covert my family to Signal, including grandparents, but I could not have done that with Matrix, Wire, PGP, etc. It’s the entry point for decent encrypted chat.

This. And because it uses phone numbers, more people I know are less reluctant to switch to it.

Use Session. It's just as easy, and more secure + decentralized. So it's better in just about every way.

Historical search is de facto absent on desktop since the messages get wiped regularly.

S/MIME could work well but the CA Cert situation doesn't allow it for normal people.

Reply on news.ycombinator.com