7 ms·
Hope this increases the chance of E2E encryption
by VMG 9y ago
Hope this increases the chance of E2E encryption
- JumpCrisscross 9y agoHow would you search your inbox? Or filter spam?
- tareqak 9y agoYou could search and filter after decryption (there are implementation issues with both for sure, but it is technically possible).
- keganunderwood 9y agoUsing metadata? Headers? Anything other than Tue email body would be nice. We still have blacklisting by IP and stuff like that. I mean if I write a Nigerian prince email and send it to my mum, it should reach her no matter what the text says, right?
- softawre 9y agoShould it reach her though? What if I hacked your account and sent it via you? Or should metadata detect that?
- keganunderwood 9y agoUsing metadata? Headers? Anything other than Tue email body would be nice. We still have blacklisting by IP and stuff like that. I mean if I write a Nigerian prince email and send it to my mum, it should reach her no matter what the text says, right?
- CaptSpify 9y agoMaybe having e2e is more important to some people than searching or spam filtering. Personally, I'd like to have the option, but as I don't, I don't use gmail.
- jMyles 9y agoHomomorphic encryption is on the way! Right? (Right?)
- mtgx 9y agohttps://protonmail.com/blog/encrypted-email-spam-filtering/ https://protonmail.com/blog/encrypted-email-spam-filtering/ I remember there was a recent paper that dealt with this, too, but I can't find it right now. But it basically demolished this argument that it's impossible to stop spam if the email is encrypted.
- jcranmer 9y agoThat blog post doesn't actually say anything about how they do spam filtering on encrypted emails. Everything they talk about is bog-standard spam filtering, including comparing against known spam and Bayesian filtering, both of which are impossible to do on encrypted emails. It's not clear if they're doing reputation analysis, which is the other big anti-spam measure impossible on encrypted email (I suspect it's the main component of their "we're not telling you what we're doing"). The SPF/DKIM/DMARC and blacklist checks are the only things you can reliably do on encrypted email. They do say "In future blog posts, we will cover the challenges of preventing ProtonMail from being used by spammers and the challenges of doing spam filtering with end-to-end encrypted emails which we cannot read", but I can't find any such blog posts.
- Propen 9y agoWhatsApp also had a session at F8 about e2ee spam filtering... https://developers.facebook.com/videos/f8-2017/how-whatsapp-reduced-spam-for-over-1-billion-people/ https://developers.facebook.com/videos/f8-2017/how-whatsapp-...
- zeep 9y agothis could be done locally, it doesn't use that much processing power
- sebastian 9y agoSome type of proof‐of‐work for email addresses that have not been previously white-listed. Similar to what BitMessage does[1]. Sending emails to new/random contacts shouldn't be that easy anyway. [1] https://bitmessage.org/bitmessage.pdf https://bitmessage.org/bitmessage.pdf
- e12e 9y agoEncrypting email to a single recipient is (a weak) proof of work. There's a big difference between sending 10k copies of a plaintext email, and retrieving a public key and encrypting to 10k recipients - not to mention that filtering out all non signed/not-signed-by-trusted-key should be a decent start for a whitelist/greylist. I'd be curious if anyone ever got gpg-encrypted spam?
- ATsch 9y agoWell, I doubt anyone gets GPG encrypted spam, because only a small number of people actually know how to decrypt GPG.
- sebastian 9y agoAnother approach would be to have to pay the equivalent of USD 5-10 cents in some email crypto currency in order to allow an unknown sender to put their email on my inbox. If I reply or add the sender to my whitelist the fee is automatically refunded to the original sender and future messages between both parties would won't require a transaction fee any longer.