Show HN: A replacement for the email system that places security first | Hacker News Reader

Show HN: A replacement for the email system that places security first

neomsg.com

4 pointsbrianparks7 comments

This is an early-stage project that is an infrastructure play. Can be seen as a replacement for current "secure email" providers that also has a complete infrastructure attached so that as the network grows, the likelihood that you have to "log into someone else's mail infrastructure to access it" decreases. Feel free to sign up, tell friends, send messages to them, etc. (please forgive the self-signed cert)

I haven't dug in depth but the usual questions arise.

- Do you use crypto-in-browser ? If yes, still unreliable to me

- Do you generate keys on the server ? I hope not.

- If email is not used as a transport, why not use XMPP ? It already provides federation, secure communications, ad-hoc services etc...

I'd like to see a simple smtp-to-neomsg bridge they can install on their machine (right next to the other that also claimed to reinvent the email). People could then continue to use their favorite MUA. Other than that I still can't trust crypto-in-browser.

Anyway, good luck with the project, and don't fail the community by not open-sourcing your stuff !

Thanks for the comments. I don't use crypto-in-browser, nor do I generate keys on the server. I built a (very simple) protocol specifically for this purpose to avoid the issue that current email has of requiring at least 3 different protocols to handle the entire round-trip (add to that if you're doing SPAM filtering, databased user authentication, etc.). XMPP, from my brief experience with it, is well suited to "instant"-type communications, but the vast majority of "legitimate" emails are significantly more substantive than "instant" messages, so I believe the NeoMsg protocol is superior for this particular task.

As of right now, the source is not open, but it is definitely my plan to open source the building blocks (the server, the reference implementation client, the client libraries, and the web client) in an effort to reach everybody I can (some people would rather pay for hosting; some would rather host themselves and I respect that -- I ran my own SMTP/IMAP server for almost a decade)

> XMPP, from my brief experience with it, is well suited to "instant"-type communications, but the vast majority of "legitimate" emails are significantly more substantive than "instant" messages, so I believe the NeoMsg protocol is superior for this particular task.

XMPP is just a transport protocol. You can use it for pretty much everything you want. Yes, it's highly targeted towards messaging, and yes, it sucks if you want to send some binary (or even some xml). But I believe it's much easier to adapt it to your needs than start from scratch. You're tackling a very difficult problem here because you need network effect for success.

Oh and the fact that communication is or isn't substantive isn't due to XMPP: it's due to pretty much all existing clients targeting instant communication. One client I find interesting in this context is Salut à Toi [0]. Check all the features, you can do far more than just chatting:

- Use your MUA to send messages accross the XMPP network

- Use XMPP to remote control your VLC

- Play games together

You really need to see XMPP more as a (mostly) generic transport than as an IM protocol.

[0] http://sat.goffi.org/features.html

Using Firefox on Windows 8:

neomsg.com uses an invalid security certificate.

The certificate is not trusted because it is self-signed.

(Error code: sec_error_unknown_issuer)

This is no longer the case. I was using a self-signed cert temporarily.

FYI: No longer using a self-signed cert.

Reply on news.ycombinator.com