4 ms·
Email. Self-hosted. When email is sent, you check mx records of recipient, and if it is gmail, replace contents with unique link (with one-time username/passwor
by arpa 9y ago
Email. Self-hosted. When email is sent, you check mx records of recipient, and if it is gmail, replace contents with unique link (with one-time username/password) to your self-hosted http(s) server, on which your actual message resides; blacklist google by user-agent / captcha if necessary, so your message won't be leaked by preview-bots.
- lucideer 9y agoYes. This. The unique link solution is a tricky one, transmitting the credentials is a chicken egg problem. Something like keybase.io is designed to solve this kind of problem but of course not everyone uses PGP and they never will. It will remain a tricky problem.
- arpa 9y agoThe only way to transmit credentials, I believe, unfortunately, is via out-of-band communication, e.g. sms/IM/phone/face-to-face. Not exactly convenient, but if you need the message to stay secure from human adversary, it is probably the only way. If your adversary is a machine (your peer in gmail is in control of his/her account, and is not wiretapped by an actual human/you simply don't want google to feed on your emails/you are not an enemy of mossad), a captcha would probably do, along with something like we see in email verification links.