6 ms·

Tbh I wish SMTP had died a long time ago. It's the reason email is so terribly broken. We can't trust a sender is who they say they are. We can't stop spammers,

Tbh I wish SMTP had died a long time ago. It's the reason email is so terribly broken. We can't trust a sender is who they say they are. We can't stop spammers, we can't hide personal info, there is no e2e encryption. As a result everyone is afraid of clicking on links and companies no longer send confidential info through it. It's just a fancy notification service now ("there's a message waiting for you at our portal" crap). I understand why they do it but it's really poor UX having to log into portals just to read a message. Of all the original internet protocols, SMTP is the ice that needs replacement the most IMO.

rglullis 4y ago
If there is one practice that I'd like to see more encouraged, it would be for websites to start giving other forms of account verification beyond "we will send you an email". Zoom bought keybase, why couldn't push for a "login with keybase"? Why can't sites send a link via matrix/xmpp/whatsapp/signal message? The only service I've used so far doing it is njal.la.
- l72 4y ago
  I prefer email but why can’t it be encrypted. Why can’t I log into my bank and optionally upload my pgp public key?
  - TillE 4y ago
    Because given the rest of the software ecosystem available, maybe 0.01% of their customers would ever use such a feature. It's way easier to just properly secure website logins with any number of 2FA methods, and rely on good old TLS for your encryption.
layer8 4y ago
In spite of all the valid criticism, we still got lucky that we ended up having this nonproprietary, decentralized, universally supported medium called email. A large number of businesses still (and will continue) to run on email, as does a certain subset of open source and other projects (using mailing lists). > companies no longer send confidential info through it. It depends, B2B absolutely still do.
- GekkePrutser 4y ago
  > In spite of all the valid criticism, we still got lucky that we ended up having this nonproprietary, decentralized, universally supported medium called email. A large number of businesses still (and will continue) to run on email, as does a certain subset of open source and other projects (using mailing lists). What I meant was that Email as a whole should be overhauled, though SMTP is by far the weakest link there. All the kludges and workarounds like DMARC, SPF etc don't fix the issues, and this is why so many companies are inventing the wheel. For example, Microsoft won't let your server deliver mail to them if you don't have enough 'reputation', meaning you must send a certain number of emails that are not spam. Otherwise you will find yourself in the doghouse (I've commented on this more detailed before). Even if you never sent spam in your entire life and your server isn't on any blocklist! SMTP is decentralised yes and that is a great thing. But such measures like MS are doing totally undermine this decentralisation. And it will continue to do so, it's already super hard to run your own small-time server for the issues mentioned below. This decentralisation is already disappearing. It's time for a new protocol that is ready for the future. > It depends, B2B absolutely still do. They do for now because people involved in sales are usually hungry for business and don't care about the risks. They want to have low barriers for the customers, which is understandable. However there are significant risks depending on how the customer does their mail. We're on O365 and comms with other companies that are also on that are obviously pretty secure because they never go unencrypted through the public internet. Again a point that Microsoft (and Google) make into a selling point for their services, further undermining decentralisation. We in the cybersecurity realm are imposing rules, e.g. any confidential info must be shared through secure filesharing. But it's hard to avoid this happening.
  - asciident 4y ago
    I'm generally wary of suggestions to overhaul a working long-lasting sociotechnical system. Everything that has been around for decades is patches on patches. The the world wide web, ipv4, IRC, the US constitution, the telephone system, email, were all developed in older times, and as times change, they develop flaws which need (ugly) patches. That's a sign that they're successful, that no one company has come and replaced it and then killed it when things got inconvenient. Think about the opposite situations: Google Groups replaced Usenet, and now it's completely dead; Google Reader took a lot of marketshare from RSS and almost killed it when they shut it down. So let's not hastily destroy the only online communication system we have left, that's not controlled by a mega tech company.
cryptonector 4y ago
SMTP doesn't really prevent end-to-end crypto for email. There's a lot of reasons why that's hard that have nothing to do with SMTP: - multiple devices sharing a mailbox - store in plaintext? - if store in ciphertext, how to index, search? - how to share decryption, signing keys among devices? - how to enroll devices? - how to exchange keys? These problems are easier to solve for IM because it's interactive, not store-and-forward.
- GekkePrutser 4y ago
  It doesn't prevent it, no. But the protocol for email as a whole should incorporate it in a simple manner. In terms of "End to End" I would consider the user the endpoint, not the device. There's many techniques that can make that happen. But this is more on the receiver side of course. PGP is obviously not simple. S/MIME is also not simple. This is why nobody bothers using either (though S/MIME is used internally within a lot of corporations).
  - cryptonector 4y ago
    The only way I can see of retrofitting end-to-end encryption into email is to use DNSSEC / DANE. But this will require new MUAs. DANE for SMTP, however, has created pretty good email security -- hop-by-hop, yes, but it's much better than before.
    - tptacek 4y ago
      If all you care about is hop-by-hop security, you can accomplish that without DANE (which requires a forklift upgrade of DNS records across the Internet to work) --- this is why Microsoft and Google came up with MTA-STS.

rglullis 4y ago

If there is one practice that I'd like to see more encouraged, it would be for websites to start giving other forms of account verification beyond "we will send you an email". Zoom bought keybase, why couldn't push for a "login with keybase"? Why can't sites send a link via matrix/xmpp/whatsapp/signal message? The only service I've used so far doing it is njal.la.

l72 4y ago
I prefer email but why can’t it be encrypted. Why can’t I log into my bank and optionally upload my pgp public key?
- TillE 4y ago
  Because given the rest of the software ecosystem available, maybe 0.01% of their customers would ever use such a feature. It's way easier to just properly secure website logins with any number of 2FA methods, and rely on good old TLS for your encryption.

layer8 4y ago

In spite of all the valid criticism, we still got lucky that we ended up having this nonproprietary, decentralized, universally supported medium called email. A large number of businesses still (and will continue) to run on email, as does a certain subset of open source and other projects (using mailing lists). > companies no longer send confidential info through it. It depends, B2B absolutely still do.

GekkePrutser 4y ago
> In spite of all the valid criticism, we still got lucky that we ended up having this nonproprietary, decentralized, universally supported medium called email. A large number of businesses still (and will continue) to run on email, as does a certain subset of open source and other projects (using mailing lists). What I meant was that Email as a whole should be overhauled, though SMTP is by far the weakest link there. All the kludges and workarounds like DMARC, SPF etc don't fix the issues, and this is why so many companies are inventing the wheel. For example, Microsoft won't let your server deliver mail to them if you don't have enough 'reputation', meaning you must send a certain number of emails that are not spam. Otherwise you will find yourself in the doghouse (I've commented on this more detailed before). Even if you never sent spam in your entire life and your server isn't on any blocklist! SMTP is decentralised yes and that is a great thing. But such measures like MS are doing totally undermine this decentralisation. And it will continue to do so, it's already super hard to run your own small-time server for the issues mentioned below. This decentralisation is already disappearing. It's time for a new protocol that is ready for the future. > It depends, B2B absolutely still do. They do for now because people involved in sales are usually hungry for business and don't care about the risks. They want to have low barriers for the customers, which is understandable. However there are significant risks depending on how the customer does their mail. We're on O365 and comms with other companies that are also on that are obviously pretty secure because they never go unencrypted through the public internet. Again a point that Microsoft (and Google) make into a selling point for their services, further undermining decentralisation. We in the cybersecurity realm are imposing rules, e.g. any confidential info must be shared through secure filesharing. But it's hard to avoid this happening.
- asciident 4y ago
  I'm generally wary of suggestions to overhaul a working long-lasting sociotechnical system. Everything that has been around for decades is patches on patches. The the world wide web, ipv4, IRC, the US constitution, the telephone system, email, were all developed in older times, and as times change, they develop flaws which need (ugly) patches. That's a sign that they're successful, that no one company has come and replaced it and then killed it when things got inconvenient. Think about the opposite situations: Google Groups replaced Usenet, and now it's completely dead; Google Reader took a lot of marketshare from RSS and almost killed it when they shut it down. So let's not hastily destroy the only online communication system we have left, that's not controlled by a mega tech company.

cryptonector 4y ago

SMTP doesn't really prevent end-to-end crypto for email. There's a lot of reasons why that's hard that have nothing to do with SMTP: - multiple devices sharing a mailbox - store in plaintext? - if store in ciphertext, how to index, search? - how to share decryption, signing keys among devices? - how to enroll devices? - how to exchange keys? These problems are easier to solve for IM because it's interactive, not store-and-forward.

GekkePrutser 4y ago
It doesn't prevent it, no. But the protocol for email as a whole should incorporate it in a simple manner. In terms of "End to End" I would consider the user the endpoint, not the device. There's many techniques that can make that happen. But this is more on the receiver side of course. PGP is obviously not simple. S/MIME is also not simple. This is why nobody bothers using either (though S/MIME is used internally within a lot of corporations).
- cryptonector 4y ago
  The only way I can see of retrofitting end-to-end encryption into email is to use DNSSEC / DANE. But this will require new MUAs. DANE for SMTP, however, has created pretty good email security -- hop-by-hop, yes, but it's much better than before.
  - tptacek 4y ago
    If all you care about is hop-by-hop security, you can accomplish that without DANE (which requires a forklift upgrade of DNS records across the Internet to work) --- this is why Microsoft and Google came up with MTA-STS.