4 ms·

I think the author has developed too much the kind of thinking he needed to fight spam at regular e-mail companies. I think there could be multiple, relatively

I think the author has developed too much the kind of thinking he needed to fight spam at regular e-mail companies. I think there could be multiple, relatively easy methods to avoid encrypted spam. Someone here already suggested the first email being a "poke". And only if you send a poke back, would that user be allowed to send you an e-mail. The user could also have some description about him, from his profile, appear when you hover over his profile image or whatever. If you receive an e-mail say from a company you're expecting to receive email from, then you could poke back, so they can send you that email. I mean there should be ways to make it easy for people to know who's a total stranger that could be a spammer, or someone trying to reach out to them for good reasons. Then you could also have the emails under different labels by default. All the trusted e-mails would come to the regular Inbox, while the rest will go under a different label. As you said, the email provider could also see the user's reputation over time, and if he's a spammer or not. And these are just some easy solutions we can come up with almost immediately. I'm sure there can be others with a little bit more thought put into it. I certainly don't see encrypted email as some kind of "doomsday scenario" like the author predicts in the post.

chii 12y ago
This mechanism would cause so much phishing that a whole new type of war would begin based on it.
mike_hearn 12y ago
Actually the "poke" method would work and I suggested it on a different thread on that mailing list. It's the S/MIME model although these days you'd just stick an ECC key into a header and sign it with DKIM, then upgrade the clients. Doesn't have to be technically complicated. There are at least three major downsides: 1) You still leak lots of metadata and the full data of the poke including most obviously the subject line. 2) Do users understand that their spangly new "encrypted mail" actually fails to protect a lot of important data? What if they (gasp) came to rely on it? I'd want to see usability studies showing a clear understanding of what is protected and what isn't. 3) You break other features that rely on the server being able to see content, like search, and the ads that pay for all of this.
petercooper 12y ago
Google does a little of this already although the mechanism is not as direct as your version. E-mail from certain senders gains "importance" based on your interactions with that sender, such as if you'd first sent a mail to that address, if you'd ever replied to that address, if you open a certain amount of mail from that address, etc. Mail from senders considered "important" is then more likely to hit your inbox. It seems to work reasonably well, although there are some interesting ways you can game it. One I learnt from the Internet marketing world was some list builders (using legit methods, but perhaps promoting things that often get caught by spam filters) hire people or implement techniques to encourage new list signups to reply to mails sent from the same address as the list by asking them questions, etc.
DanBC 12y ago
How are pokes different to regular challenge response whitelists, and how does poking avoid the problems of CR?

chii 12y ago

This mechanism would cause so much phishing that a whole new type of war would begin based on it.

mike_hearn 12y ago

Actually the "poke" method would work and I suggested it on a different thread on that mailing list. It's the S/MIME model although these days you'd just stick an ECC key into a header and sign it with DKIM, then upgrade the clients. Doesn't have to be technically complicated. There are at least three major downsides: 1) You still leak lots of metadata and the full data of the poke including most obviously the subject line. 2) Do users understand that their spangly new "encrypted mail" actually fails to protect a lot of important data? What if they (gasp) came to rely on it? I'd want to see usability studies showing a clear understanding of what is protected and what isn't. 3) You break other features that rely on the server being able to see content, like search, and the ads that pay for all of this.

petercooper 12y ago

Google does a little of this already although the mechanism is not as direct as your version. E-mail from certain senders gains "importance" based on your interactions with that sender, such as if you'd first sent a mail to that address, if you'd ever replied to that address, if you open a certain amount of mail from that address, etc. Mail from senders considered "important" is then more likely to hit your inbox. It seems to work reasonably well, although there are some interesting ways you can game it. One I learnt from the Internet marketing world was some list builders (using legit methods, but perhaps promoting things that often get caught by spam filters) hire people or implement techniques to encourage new list signups to reply to mails sent from the same address as the list by asking them questions, etc.

DanBC 12y ago

How are pokes different to regular challenge response whitelists, and how does poking avoid the problems of CR?