8 ms·

I have two alternate recommendations: Mailpile. Despite what anyone tells you, end to end encrypted email is not possible in webmail a world [sic]. The first p

I have two alternate recommendations: Mailpile. Despite what anyone tells you, end to end encrypted email is not possible in webmail a world [sic]. The first precondition for developing a usable and forward secure email protocol is a usable mail client, and I currently believe that Mailpile is our best shot at that. From [0]: mailpile A modern, fast web-mail client I am honestly confused. It sounds like Moxie is saying a webmail client is not the answer, but then he recommends a webmail client? I'm not trying to be snarky; I'm genuinely curious. 0: http://www.mailpile.is/ http://www.mailpile.is/

philosoft 13y ago
I believe he is referring to a web-mail service hosted by a third-party having inherent insecurity. With mailpile, you run the service on your own system.
pyre 13y ago
From their IngieGogo[1]: Mailpile is free software, a web-mail program that you run on your own computer, so your data stays under your control. [1] http://www.indiegogo.com/projects/mailpile-taking-e-mail-back http://www.indiegogo.com/projects/mailpile-taking-e-mail-bac...
- bradleyjg 13y ago
  So the POP client is being built on top of an HTTP server? And I access it via a web browser pointed at localhost? Does that sound crazy to anyone else? It makes me think the authors have a hammer (i.e. web development skills) and therefore think everything is a nail (i.e. a webpage). If I have to install software anyway, I'd much rather it be a full fledged native client. One that looks, feels, installs, uninstalls, and is configured just like all the other native programs on my machine. I had such a program in the late 90s/early 2000s. It even had support for SMIME and PGP.
  - ceol 13y ago
    If you're the type of person who can actually get through the install process,[0] you're the type of person who doesn't care about having to access it via localhost. There's nothing wrong with making a web mail client this way. Many people already access mail via their browser, so this is not drastically different. It also means they don't have to develop and test three different codebases. I imagine they will get to the point of having the client wrapped for the platform so the user doesn't have to fudge around with it and can just click the icon and have it open in their browser (or the client's browser.) [0]: https://github.com/pagekite/Mailpile#setting-up-the-basic-config https://github.com/pagekite/Mailpile#setting-up-the-basic-co...
  - brl 13y ago
    You're also one XSS vulnerability away from losing all of your private communication to an attacker.
  - magic_haze 13y ago
    The biggest advantage is cross compatibility. Setting up a http server in any mainstream language is very easy, when compared to the task of creating native UIs for each OS. Look at how much hate Swing, GTK and even Mozilla's XUL got before they went to great efforts to use the native UIs.
    - rurounijones 13y ago
      Qt? I know it is not 100% native UI but "Beautiful UI" is not the main selling point of this I think.
  - simonw 13y ago
    Honestly, on a desktop I'd almost rather use an HTML/JavaScript UI than a native UI. On the machine I'm using right now have the option of using iCal, Mail.app and Twitter's native desktop client. I find myself using Google Calendar, Gmail and Twitter's website instead. Having tabs, back buttons, the ability to open things in new browser windows, the ability to bookmark and copy-and-paste links to different views of an app are all things that I like about web apps that aren't universal in native apps.
    - basch 13y ago
      My biggest fear with the "mobile" trend is losing all these navigation abilities.
aeturnum 13y ago
I am not familiar with mailpile, but I imagine it uses client-side implementation of PGP with automatic public key exchange.
moxie 13y ago
I don't think we've quite worked out the language here yet. I use "webmail" to refer to a remote hosted web interface. GMail, Yahoo Mail, Hotmail, riseup.net, etc. This is the dominant way that people access email, and it's not possible to secure well because of the "webapp crypto problem." Mailpile, on the other hand, is a locally hosted MUA that happens to use your web browser as the UI. I think it's a great idea, leveraging the UI properties of a web browser, but with everything running locally. All development of a new secure email protocol has been stymied for the past 13 years by webmail. It is not possible to provide end-to-end encryption if you don't perform that encryption on the client side, and in the webmail world there is no "client." I'm excited about Mailpile because it could be what gives us a usable local MUA, which is the precondition to deploying a nice, modern, usable, end-to-end encryption protocol.
- tnorthcutt 13y ago
  Thanks for clearing that up for me.
- rsync 13y ago
  web hosted MUA < curses client over SSH [1] [1] like pine
  - nzp 13y ago
    I agree for geeks, but not for "normal" people.
- tlrobinson 13y ago
  As I understand it, Ladar's plan for Lavabit is to open source it (and implement the Dark Mail protocol) so you can run your own instance of it... exactly like Mailpile.
  - moxie 13y ago
    There's a huge difference between running your own mail server and running a mail client. Most people are not well positioned to run their own mail server. Mailpile is an MUA, not an MTA.

philosoft 13y ago

I believe he is referring to a web-mail service hosted by a third-party having inherent insecurity. With mailpile, you run the service on your own system.

pyre 13y ago

From their IngieGogo[1]: Mailpile is free software, a web-mail program that you run on your own computer, so your data stays under your control. [1] http://www.indiegogo.com/projects/mailpile-taking-e-mail-back http://www.indiegogo.com/projects/mailpile-taking-e-mail-bac...

bradleyjg 13y ago
So the POP client is being built on top of an HTTP server? And I access it via a web browser pointed at localhost? Does that sound crazy to anyone else? It makes me think the authors have a hammer (i.e. web development skills) and therefore think everything is a nail (i.e. a webpage). If I have to install software anyway, I'd much rather it be a full fledged native client. One that looks, feels, installs, uninstalls, and is configured just like all the other native programs on my machine. I had such a program in the late 90s/early 2000s. It even had support for SMIME and PGP.
- ceol 13y ago
  If you're the type of person who can actually get through the install process,[0] you're the type of person who doesn't care about having to access it via localhost. There's nothing wrong with making a web mail client this way. Many people already access mail via their browser, so this is not drastically different. It also means they don't have to develop and test three different codebases. I imagine they will get to the point of having the client wrapped for the platform so the user doesn't have to fudge around with it and can just click the icon and have it open in their browser (or the client's browser.) [0]: https://github.com/pagekite/Mailpile#setting-up-the-basic-config https://github.com/pagekite/Mailpile#setting-up-the-basic-co...
- brl 13y ago
  You're also one XSS vulnerability away from losing all of your private communication to an attacker.
- magic_haze 13y ago
  The biggest advantage is cross compatibility. Setting up a http server in any mainstream language is very easy, when compared to the task of creating native UIs for each OS. Look at how much hate Swing, GTK and even Mozilla's XUL got before they went to great efforts to use the native UIs.
  - rurounijones 13y ago
    Qt? I know it is not 100% native UI but "Beautiful UI" is not the main selling point of this I think.
- simonw 13y ago
  Honestly, on a desktop I'd almost rather use an HTML/JavaScript UI than a native UI. On the machine I'm using right now have the option of using iCal, Mail.app and Twitter's native desktop client. I find myself using Google Calendar, Gmail and Twitter's website instead. Having tabs, back buttons, the ability to open things in new browser windows, the ability to bookmark and copy-and-paste links to different views of an app are all things that I like about web apps that aren't universal in native apps.
  - basch 13y ago
    My biggest fear with the "mobile" trend is losing all these navigation abilities.

aeturnum 13y ago

I am not familiar with mailpile, but I imagine it uses client-side implementation of PGP with automatic public key exchange.

moxie 13y ago

I don't think we've quite worked out the language here yet. I use "webmail" to refer to a remote hosted web interface. GMail, Yahoo Mail, Hotmail, riseup.net, etc. This is the dominant way that people access email, and it's not possible to secure well because of the "webapp crypto problem." Mailpile, on the other hand, is a locally hosted MUA that happens to use your web browser as the UI. I think it's a great idea, leveraging the UI properties of a web browser, but with everything running locally. All development of a new secure email protocol has been stymied for the past 13 years by webmail. It is not possible to provide end-to-end encryption if you don't perform that encryption on the client side, and in the webmail world there is no "client." I'm excited about Mailpile because it could be what gives us a usable local MUA, which is the precondition to deploying a nice, modern, usable, end-to-end encryption protocol.

tnorthcutt 13y ago
Thanks for clearing that up for me.
rsync 13y ago
web hosted MUA < curses client over SSH [1] [1] like pine
- nzp 13y ago
  I agree for geeks, but not for "normal" people.
tlrobinson 13y ago
As I understand it, Ladar's plan for Lavabit is to open source it (and implement the Dark Mail protocol) so you can run your own instance of it... exactly like Mailpile.
- moxie 13y ago
  There's a huge difference between running your own mail server and running a mail client. Most people are not well positioned to run their own mail server. Mailpile is an MUA, not an MTA.