6 ms·

There is no fighting the future, by political processes. There is only subversion. Run your own mailserver, in your home or a semi-trusted local colo. Full dis

There is no fighting the future, by political processes. There is only subversion. Run your own mailserver, in your home or a semi-trusted local colo. Full disk encryption, fully encrypted offsite backups. Cabinet door reed switch triggers immediate power-down in the absence of a cryptographically signed override.

mindslight 10y ago
Running your own SMTP server at home is a pain in the ass, so it will never be widely adopted. I could easily move my mail server from Linode to my home connection, yet I won't. It's simply nicer to not have to worry about bouncing or delayed emails during power outage or network maintenance. And even if I did, the messages still come in plain text - we're only a few steps away from "email search" meaning "search of NSA's email records". What we've really got is a protocols/software/UI problem. The end-to-end nature of the Internet came out of engineering sense, which was necessary to bootstrap it but not necessary for its continued functioning (hence it's slide back toward centralization eg DPI gear). What we need are better protocols that explicitly protect the end-to-end principle. One should be able to have an untrusted cloud "mail server" that knows only what it needs to, passing messages to a slightly more trusted home server (your half-hardened hardware is really only protected by it's unique nature, so not scalable). A message only needs to be fully unlocked when it is being read. And the system needs to work this way out of the box with a minimum of configuring, because sysadmin work is an annoyance when you're just trying to get something done.
- anf 10y ago
  > Running your own SMTP server at home is a pain in the ass, so it will never be widely adopted. It is, but it doesn't have to be. Someone could make a <$100 device which has a power backup for running through power outages and a backup network connection via the cellular network, which should provide high enough uptime for all practical purposes. Messages between mail servers are encrypted most of the time, more and more so every year [1]. This is a technical solution for a legal problem, though. I'm not sure if I understand the system you are proposing, but email protocols seem secure enough now as they are now, it's just the third party principle that doesn't align with the obvious expectations of privacy in mail [2]. To me, it's pretty clear that my email account is like a PO box. Just because my email is held by a third party doesn't make it any less private than being delivered to my home, just as mail arriving at a "third-party" PO box isn't all that different from my mailbox. 1. https://www.google.com/transparencyreport/saferemail/ https://www.google.com/transparencyreport/saferemail/ 2. http://techcrunch.com/2014/04/30/google-will-also-stop-scanning-google-apps-inboxes-for-ads/ http://techcrunch.com/2014/04/30/google-will-also-stop-scann...
  - civilian 10y ago
    Huh. I like your PO Box analogy. We should get the USPS to run mail servers.
  - mindslight 10y ago
    It is not "a legal problem". It is a problem with legal, technical, governance (and probably more types of) approaches. If you're working on a legal solution I'll support you, just like if someone else succeeds in neutering the traitors in DC/VA, I'll cheer them on. But I am not a lawyer nor a soldier, so I'll remain focused on finding technical solutions. Protocols "seem" secure enough, because you don't seem to be focused on the technicals (which is fine, as per what I just said. Just don't nay-say). For example, even if messages are encrypted between servers, the graph of who is talking to who is still revealed to a passive adversary, and this problem only gets worse with individually-run servers.
    - anf 10y ago
      Hiding "who is talking to whom" against a global passive adversary is an active area of research and I don't know of any solution that is backwards compatible with email. Is this so of the one you are suggesting?

mindslight 10y ago

Running your own SMTP server at home is a pain in the ass, so it will never be widely adopted. I could easily move my mail server from Linode to my home connection, yet I won't. It's simply nicer to not have to worry about bouncing or delayed emails during power outage or network maintenance. And even if I did, the messages still come in plain text - we're only a few steps away from "email search" meaning "search of NSA's email records". What we've really got is a protocols/software/UI problem. The end-to-end nature of the Internet came out of engineering sense, which was necessary to bootstrap it but not necessary for its continued functioning (hence it's slide back toward centralization eg DPI gear). What we need are better protocols that explicitly protect the end-to-end principle. One should be able to have an untrusted cloud "mail server" that knows only what it needs to, passing messages to a slightly more trusted home server (your half-hardened hardware is really only protected by it's unique nature, so not scalable). A message only needs to be fully unlocked when it is being read. And the system needs to work this way out of the box with a minimum of configuring, because sysadmin work is an annoyance when you're just trying to get something done.

anf 10y ago
> Running your own SMTP server at home is a pain in the ass, so it will never be widely adopted. It is, but it doesn't have to be. Someone could make a <$100 device which has a power backup for running through power outages and a backup network connection via the cellular network, which should provide high enough uptime for all practical purposes. Messages between mail servers are encrypted most of the time, more and more so every year [1]. This is a technical solution for a legal problem, though. I'm not sure if I understand the system you are proposing, but email protocols seem secure enough now as they are now, it's just the third party principle that doesn't align with the obvious expectations of privacy in mail [2]. To me, it's pretty clear that my email account is like a PO box. Just because my email is held by a third party doesn't make it any less private than being delivered to my home, just as mail arriving at a "third-party" PO box isn't all that different from my mailbox. 1. https://www.google.com/transparencyreport/saferemail/ https://www.google.com/transparencyreport/saferemail/ 2. http://techcrunch.com/2014/04/30/google-will-also-stop-scanning-google-apps-inboxes-for-ads/ http://techcrunch.com/2014/04/30/google-will-also-stop-scann...
- civilian 10y ago
  Huh. I like your PO Box analogy. We should get the USPS to run mail servers.
- mindslight 10y ago
  It is not "a legal problem". It is a problem with legal, technical, governance (and probably more types of) approaches. If you're working on a legal solution I'll support you, just like if someone else succeeds in neutering the traitors in DC/VA, I'll cheer them on. But I am not a lawyer nor a soldier, so I'll remain focused on finding technical solutions. Protocols "seem" secure enough, because you don't seem to be focused on the technicals (which is fine, as per what I just said. Just don't nay-say). For example, even if messages are encrypted between servers, the graph of who is talking to who is still revealed to a passive adversary, and this problem only gets worse with individually-run servers.
  - anf 10y ago
    Hiding "who is talking to whom" against a global passive adversary is an active area of research and I don't know of any solution that is backwards compatible with email. Is this so of the one you are suggesting?