4 ms·
The solutions are already there... there is a lack of will from the corporations to implement them. google checking gpg signature? nope. The internet is unfor
by peppermint_tea 5y ago
The solutions are already there... there is a lack of will from the corporations to implement them. google checking gpg signature? nope.
The internet is unfortunately not user-centric enough, there is much more value in sending crap html emails "only 10 hours left 50% discount" and scanning your emails than there is to provide users with secure communications.
let's all sign our emails to raise awareness of google's & outlook shortcoming
P.S : we tend not to sign our emails since it is not the standard, standard is de-facto dictated by google and outlook now.
P.P.S : seeing an unsigned email would raise suspicion if the standard was the opposite, a filter could even classify between signed and unsigned
P.P.P.S : you would only bother to verify the identity for the emails you care for
P.P.P.P.S : if you think google does not dictate the standards, feel free to point to me the part of the rfc that mention that residential ips are not valid.
- sbuk 5y agoGoogle and Gmail account for a very small amount of the global mail-flow and have even less of an impact on standards. In fact they only appear as a contributor/author on RFC8617 (ARC). No standard says, or even suggest, that “residential ips are not valid.” However, reputation is an important par of mail security. Most, if not all residential IPs won’t be sending enough mail to even register a reputation (look up your own on https://talosintelligence.com/ https://talosintelligence.com/). This is the main challenge for self-hosters. That and a significant majority of residential ISPs block SMTP traffic, for very obvious reasons. This isn’t some Google/Microsoft conspiracy. SMTP is fundamentally a plain text format that has been abused for the last 30 or so years - 30, because that’s when MIME became a thing.
- 3825 5y agoThank you for the link. I checked my duckdns.org subdomain and found that I am on a blocklist and my reputation is poor. I don’t even run SMTP. Comcast Xfinity, if that matters. Fwd/Rev DNS Match Yes Last Day Vol. 0.0 Last Month Vol. 0.0 Block Lists 1 BLOCKED IN: pbl.spamhaus.org Email Rep. Poor
- rtpg 5y agoI get weekly phishing SMSes from duckdns.org domains, probably why it’s on such a list
- peppermint_tea 5y agogoogle block residential ips. even with a specific message. not based on reputation, based on ip block. I am well aware that smtp have been abused for decades now, I run my own mail server and have no problem sending to google outlook etc. my point was only regarding blocking residential ip. google definitely does that (on top of many isp's) and it is not part of how the smtp protocol works. no conspiracy here.
- sbuk 5y agoYes, because of low/no reputation. It's a feature, not a bug.
- peppermint_tea 5y agono, because they belong to a residential ip block. it is easy to test... and the error message is without ambiguity.
- peppermint_tea 5y agojust testing now, not every residential ip it seems (I moved country and now my email go through without the message : ...belongs to a residential ip...)
- peppermint_tea 5y agoI would also challenge the "Google and Gmail account for a very small amount of the global mail-flow". 100% of the companies I worked at use office365 and Gsuite.
- deleted 5y ago[deleted]
- jcranmer 5y agoThe Gmail web client is the 2nd largest email client, at about 30% market share. The number of people who use gmail but use an email client instead of the web client is going to be much, much higher. (Especially when you include people whose clients automatically block the tracking pixels used to generate these statistics, which is sadly few of the clients). The vast majority of email routes through a few major email service providers, with gmail the largest, but MS (via O365 hosting) and Yahoo are also likely double-digit market share.
- sbuk 5y agoHow much traffic does that generate? On average, there are ~300 billion messages sent daily - the majority coming from automated services and/or bulk messaging providers. Sure, Gmail and Google Workspaces have a lot of "market share", but that is meaningless in the context of worldwide mail-flow.
- pixl97 5y agoIn this case, the context of worldwide mail flow may be a meaningless statistic. Sending messages to real individuals for purposes of commerce is going to be much more important to a companies profit, than say a script sending out a message saying "This task completed successfully" to an email address.
- xfer 5y ago> google checking gpg signature? nope Are you proposing that they mark every mail spam that's not on the contact list of user? Otherwise checking signatures doesn't do anything, spammers already use dkim.
- upofadown 5y agoOne idea would be to treat an email from someone you don't know with the normal level of suspicion for that case. The HTML would be converted to something safe for the user's browser. Image loading would be blocked. You would probably throw on a few spam points. Anything other than an introduction message gets lots of spam points. Anything that was properly signed would skip the spam process entirely.
- peppermint_tea 5y agothat makes sense, without breaking the actual mail flow
- peppermint_tea 5y agoonce you receive a message that you actually want, you could validate the signature and every subsequent communication from this sender is more likely a desired email than a spam