4 ms·

It's largely overlooked that the success of Slack & MS Teams is partly due to the cybercrime portal that email has become. IOW, you don't get phished in your or

It's largely overlooked that the success of Slack & MS Teams is partly due to the cybercrime portal that email has become. IOW, you don't get phished in your org's Slack chats. To prevent phishing, any chat service will suffice; an open protocol isn't necessary, as you don't intend to engage with ppl outside your org. The essential problem IMO is how to replace SMTP. No one has proposed and implemented an alternative, to my knowledge. So I decided to[1]. The current draft omits federation (although I wouldn't rule it out in all cases yet). [1] https://github.com/networkimprov/mnm/blob/master/Protocol.md https://github.com/networkimprov/mnm/blob/master/Protocol.md

megous 6y ago
Why would you replace it? Will not disabling all public un-authenticated submissions on your mail server suffice? You can also prevent delivery to outside world (and error out on submission so that users are notified) if you really like. Result will be your own private mail server. And you can keep using all the normal MUA's on desktop and mobile.
- throwaway201103 6y ago
  Yes I'm old enough to remember when organizations had email but it was internal-only. Probably less for security reasons at the time than that they simply didn't have an internet provider. There were also mainframe-based email systems that were internal to that network.
- networkimprov 6y ago
  Changing your SMTP server configuration that way would break things, so the question is whether to set up a new, company-internal SMTP server, and give your employees new addresses there. But that won't quickly stop the phishing, because your ppl still need to get email via the public network from clients and suppliers. Setting up a new server isn't easy unless you hire an outside service provider, and if you're willing to do that, Slack et al offer a nicer UX than the well known email/webmail clients. Orgs with sufficient IT resources commonly do run internal SMTP servers.
  - megous 6y ago
    I meant that as a suggestion compared to designing a new protocol.
u801e 6y ago
> To prevent phishing, any chat service will suffice; an open protocol isn't necessary, as you don't intend to engage with ppl outside your org. The same could be accomplished with email if you only allow connections to the SMTP and IMAP server from within the corporate network. That is, nothing external can connect to those servers, which is fine if it's only used for internal communication.
dathinab 6y ago
No, EMail has fundamentally bad UX for a lot of use case slack and similar are used for. > problem IMO is how to replace SMTP. Sadly SMTP is probably one of the parts of Mail which have aged best. Enforcing the usage of some (currently by design optional) features wrt. authentication and similar at the cost of backwards compatibility and you have all you need from the delivery protocol. BUT: - IMAP and similar is much worse. - Mail bodies are a big mess it's always fascinating for me that mail interoperability works at all in practice (again you can clean it up a lot, theoretically, but backwards compatibility would be gone). - DMARC, DKIM and SPIF which handle mail authenticity have a lot of rough corners and again for backward compatibility are optional. Again it's not to hard to improve on but would brake backwards compatibility. The main reason mail still matters is because it's backwards compatibility, not just with older software but also with new software still using old patterns because of the (relative to the gain) insane amount of work you need to put into all kinds of mail related components. But then exactly that backwards compatibility is what. (Yes, I have read the "Why TMTP?" link and I have written software for many parts around mail including SMTP, and mail encoding. The idea that SMTP is at the root of the problem seems to me very strange. Especially given that like I mentioned literally every other part of mail is worse then SMTP by multiple degrees...) EDIT: Just to prevent misunderstandings one core feature of mail is the separation of mail delivery and mail authenticity, in the sense that you don't need the mailman to prove the authenticity of a mail. At most the legal/correct/authentic delivery.
- ska 6y ago
  > No, EMail has fundamentally bad UX for a lot of use case slack and similar are used for. The opposite is also true.
- networkimprov 6y ago
  By "replace SMTP" I mean the whole email protocol stack, not only SMTP. I'm not proposing to replace it for all situations overnight; of course SMTP etc will be used for decades. TMTP also covers most IMAP/POP use cases. And it allows short, plain-text messages (see Ping) to make first contact with others -- necessary when that server has less restrictive membership requirements. Authenticity is a double-edged sword. For certain confidential content, you want the recipient to know that it originated with the sender, but you don't want anyone else to know that in the event the content is leaked or stolen. I believe the extinction of email for person-to-person & app-to-person correspondence is a foregone conclusion, due principally to phishing. The question is what should we do now, and the answer is clearly not chatrooms (which are of course useful in certain circumstances).
layer8 6y ago
Email is not a chat system, and chat systems are unsuitable for asynchronous long-form threadful discussions. There is some overlap, but combined they form a spectrum of communication modes so wide that it can‘t be covered by a single UI.
- u801e 6y ago
  I would argue that email is not suitable for asynchronous long-form threadful discussions. The limitation that email has is that if you're not part of that conversation from the beginning, you'll have to piece it together from previous quoted material. One email like protocol that properly handles this is NNTP.
  - networkimprov 6y ago
    I agree with both of you, and TMTP supports adding people to a thread after it starts (see PostNotify).
    - u801e 6y ago
      I'm not finding much about TMTP or postnotify with a search through Google. Could you link to some resources?
      - networkimprov 6y ago
        I've only just begun publicizing it, after getting the client & server implementations to a point where folks can evaluate them. Protocol: https://github.com/networkimprov/mnm/blob/master/Protocol.md https://github.com/networkimprov/mnm/blob/master/Protocol.md Why TMTP? https://mnmnotmail.org/rationale.html https://mnmnotmail.org/rationale.html Follow: https://twitter.com/mnmnotmail https://twitter.com/mnmnotmail
  - layer8 6y ago
    True regarding the late-comer aspect, although it is less of an issue when using mailing lists with an archive. In the past, when lacking an archive I also just asked another participant to send me the earlier discussion in mbox format, which was easily accomplished with the unix MUAs of the time. Regarding the actual modes of discussion I was thinking of though, usenet and email are mostly the same.
baudehlo 6y ago
I used to work in anti spam and we would call these FUSSPs. https://www.rhyolite.com/anti-spam/you-might-be.html https://www.rhyolite.com/anti-spam/you-might-be.html
- networkimprov 6y ago
  TL;DR: Thousands of brilliant minds have tried to fix email for decades, and realized it can't be done! Ahem, I'm trying to bury email, not save it -- not unlike Slack :-)
thesuitonym 6y ago
You're making some fundamental assumptions about federation that I think are completely wrong. Are you telling me that you never need to communicate with anyone outside of your organization? How do you intend to receive invoices? How will you communicate with outside vendors? Sorry, but you need some text-based way of communicating with people and email is the best way, that's why it's survived so long despite being problematic. If you have internal, asynchronous chat, why would you need internal email? Sorry my dude, but business runs on email. Saying lets get rid of it is as naïve as saying lets get rid of Excel. It's just not going to happen.
- networkimprov 6y ago
  There are two ways to communicate with ppl outside your org without federation (this is covered on the website): 1) Set up a second TMTP service where customers and/or suppliers can create accounts, along with employees who need to interact with them. 2) Have some employees join a third-party service which is open to all involved in your field. There is a risk of phishing in this case, but: . a) anyone you haven't previously contacted is limited to short, plain-text communications to you (see Ping in protocol), and . b) such third-party services would typically charge a fee to members and impose a small cost per-ping, and . c) you know that you're dealing with unknown entities with possibly malicious intent. TMTP clients support active logins to accounts on any number of TMTP servers, just as browsers support multiple active connections to websites.

megous 6y ago

Why would you replace it? Will not disabling all public un-authenticated submissions on your mail server suffice? You can also prevent delivery to outside world (and error out on submission so that users are notified) if you really like. Result will be your own private mail server. And you can keep using all the normal MUA's on desktop and mobile.

throwaway201103 6y ago
Yes I'm old enough to remember when organizations had email but it was internal-only. Probably less for security reasons at the time than that they simply didn't have an internet provider. There were also mainframe-based email systems that were internal to that network.
networkimprov 6y ago
Changing your SMTP server configuration that way would break things, so the question is whether to set up a new, company-internal SMTP server, and give your employees new addresses there. But that won't quickly stop the phishing, because your ppl still need to get email via the public network from clients and suppliers. Setting up a new server isn't easy unless you hire an outside service provider, and if you're willing to do that, Slack et al offer a nicer UX than the well known email/webmail clients. Orgs with sufficient IT resources commonly do run internal SMTP servers.
- megous 6y ago
  I meant that as a suggestion compared to designing a new protocol.

u801e 6y ago

> To prevent phishing, any chat service will suffice; an open protocol isn't necessary, as you don't intend to engage with ppl outside your org. The same could be accomplished with email if you only allow connections to the SMTP and IMAP server from within the corporate network. That is, nothing external can connect to those servers, which is fine if it's only used for internal communication.

dathinab 6y ago

No, EMail has fundamentally bad UX for a lot of use case slack and similar are used for. > problem IMO is how to replace SMTP. Sadly SMTP is probably one of the parts of Mail which have aged best. Enforcing the usage of some (currently by design optional) features wrt. authentication and similar at the cost of backwards compatibility and you have all you need from the delivery protocol. BUT: - IMAP and similar is much worse. - Mail bodies are a big mess it's always fascinating for me that mail interoperability works at all in practice (again you can clean it up a lot, theoretically, but backwards compatibility would be gone). - DMARC, DKIM and SPIF which handle mail authenticity have a lot of rough corners and again for backward compatibility are optional. Again it's not to hard to improve on but would brake backwards compatibility. The main reason mail still matters is because it's backwards compatibility, not just with older software but also with new software still using old patterns because of the (relative to the gain) insane amount of work you need to put into all kinds of mail related components. But then exactly that backwards compatibility is what. (Yes, I have read the "Why TMTP?" link and I have written software for many parts around mail including SMTP, and mail encoding. The idea that SMTP is at the root of the problem seems to me very strange. Especially given that like I mentioned literally every other part of mail is worse then SMTP by multiple degrees...) EDIT: Just to prevent misunderstandings one core feature of mail is the separation of mail delivery and mail authenticity, in the sense that you don't need the mailman to prove the authenticity of a mail. At most the legal/correct/authentic delivery.

ska 6y ago
> No, EMail has fundamentally bad UX for a lot of use case slack and similar are used for. The opposite is also true.
networkimprov 6y ago
By "replace SMTP" I mean the whole email protocol stack, not only SMTP. I'm not proposing to replace it for all situations overnight; of course SMTP etc will be used for decades. TMTP also covers most IMAP/POP use cases. And it allows short, plain-text messages (see Ping) to make first contact with others -- necessary when that server has less restrictive membership requirements. Authenticity is a double-edged sword. For certain confidential content, you want the recipient to know that it originated with the sender, but you don't want anyone else to know that in the event the content is leaked or stolen. I believe the extinction of email for person-to-person & app-to-person correspondence is a foregone conclusion, due principally to phishing. The question is what should we do now, and the answer is clearly not chatrooms (which are of course useful in certain circumstances).

layer8 6y ago

Email is not a chat system, and chat systems are unsuitable for asynchronous long-form threadful discussions. There is some overlap, but combined they form a spectrum of communication modes so wide that it can‘t be covered by a single UI.

u801e 6y ago
I would argue that email is not suitable for asynchronous long-form threadful discussions. The limitation that email has is that if you're not part of that conversation from the beginning, you'll have to piece it together from previous quoted material. One email like protocol that properly handles this is NNTP.
- networkimprov 6y ago
  I agree with both of you, and TMTP supports adding people to a thread after it starts (see PostNotify).
  - u801e 6y ago
    I'm not finding much about TMTP or postnotify with a search through Google. Could you link to some resources?
    - networkimprov 6y ago
      I've only just begun publicizing it, after getting the client & server implementations to a point where folks can evaluate them. Protocol: https://github.com/networkimprov/mnm/blob/master/Protocol.md https://github.com/networkimprov/mnm/blob/master/Protocol.md Why TMTP? https://mnmnotmail.org/rationale.html https://mnmnotmail.org/rationale.html Follow: https://twitter.com/mnmnotmail https://twitter.com/mnmnotmail
- layer8 6y ago
  True regarding the late-comer aspect, although it is less of an issue when using mailing lists with an archive. In the past, when lacking an archive I also just asked another participant to send me the earlier discussion in mbox format, which was easily accomplished with the unix MUAs of the time. Regarding the actual modes of discussion I was thinking of though, usenet and email are mostly the same.

baudehlo 6y ago

I used to work in anti spam and we would call these FUSSPs. https://www.rhyolite.com/anti-spam/you-might-be.html https://www.rhyolite.com/anti-spam/you-might-be.html

networkimprov 6y ago
TL;DR: Thousands of brilliant minds have tried to fix email for decades, and realized it can't be done! Ahem, I'm trying to bury email, not save it -- not unlike Slack :-)

thesuitonym 6y ago

You're making some fundamental assumptions about federation that I think are completely wrong. Are you telling me that you never need to communicate with anyone outside of your organization? How do you intend to receive invoices? How will you communicate with outside vendors? Sorry, but you need some text-based way of communicating with people and email is the best way, that's why it's survived so long despite being problematic. If you have internal, asynchronous chat, why would you need internal email? Sorry my dude, but business runs on email. Saying lets get rid of it is as naïve as saying lets get rid of Excel. It's just not going to happen.

networkimprov 6y ago
There are two ways to communicate with ppl outside your org without federation (this is covered on the website): 1) Set up a second TMTP service where customers and/or suppliers can create accounts, along with employees who need to interact with them. 2) Have some employees join a third-party service which is open to all involved in your field. There is a risk of phishing in this case, but: . a) anyone you haven't previously contacted is limited to short, plain-text communications to you (see Ping in protocol), and . b) such third-party services would typically charge a fee to members and impose a small cost per-ping, and . c) you know that you're dealing with unknown entities with possibly malicious intent. TMTP clients support active logins to accounts on any number of TMTP servers, just as browsers support multiple active connections to websites.