The email monopolies annoy me the most when other apps assume you have gmail/apple/etc.
Notion recently launched email integration that only works with GMail, and all the marketing was basically "we added Email to Notion" instead of "we added _Gmail_ to Notion".
didacusc · 1m ago
More annoying than that is the email monopoly operators deciding any non-monopoly email is spam, effectively driving businesses into their corporate packages. As a business, you have no guarantee that if you run your email server or have a hosting company run it, you'll actually be reaching customers.
littlecranky67 · 52m ago
I ranted about this before, tailscale doesn't allow you to signup with your own username/password, they expect you to use google/facebook/microsoft accounts (or bring your own OIDC server, which is overkill if you are an individual user). As someone who got his google account blocked and got locked out of half of the internet, I can only warn anybody from ever using 3rd party logins.
div72 · 42m ago
Have you seen headscale? It's a bit of work if you don't have a selfhosting setup but it enables you to use the service without being at the whim of Tailscale.
ZeroTalent · 15m ago
Exactly. I wanted to try Superhuman.com, and they only support Gmail and Outlook. I use Fastmail.
blitzar · 1h ago
If they add Microsoft they will probably cover 99% of companies from small to medium - including practically every tech startup along with all the small creators and note taking influencers.
anal_reactor · 1h ago
I remeber even I was applying for a job but the company's spam filter automatically bounced back everything from Yahoo. Fun.
dspillett · 1h ago
In fairness, there was a time when yahoo's network was a major source of junk mail.
amelius · 45m ago
That's discrimination of people by their email address.
neilv · 36m ago
> For almost 15 years, I have run my own email server which I use for all of my non-work correspondence. I do so to keep autonomy, control, and privacy over my email and so that no big company has copies of all of my personal email. [...] A few years ago, I was surprised to find out that my friend [...] a very privacy conscious person who is [...] at the EFF — used Gmail.
Almost the exact same situation here, except my friend was once at an EFF-related organization.
I think a lot of things, like the tech industry turning into '80s Wall Street bros, wore down some of his on-principle determination. And when life got too busy, he gave up, and moved to GMail. I was very surprised to learn.
Another friend, who in school was one of those MIT student Linux hackers who had serious OPSEC as ordinary practice, once he had kids, and had to think about continuity of all the things he ran if something should happen to him, ended up moving home stuff to popular Apple and Google services.
kjellsbells · 5h ago
As I see it, the problem is that the email address has been conflated with your identity, and that is extremely problematic. It should only ever have been a somewhat transient reachability identifier. As an identity it then gets linked to concepts like authorization and trust, eg "we'll send this code to your email, because we implicitly trust that only you can see your email, and that youll always be able to get to it."
Every so often one sees a cri de coeur from someone who has learned this lesson the hard way when Google locks them out of their account, the key to their digital life evaporates, there's nothing they can do about it.
Alternative identifiers exist, eg handles on sites like HN, but they are second-order artifacts of the email as ID.
Given the stakes, then, you have to decide whether to try and control your identity by bulding your own infra for email (domain, mail server, dkim etc and a fair bit of hell), paying for someone to run the infra (eg getting a proton or fastmail address), and hoping they dont enshittify or fail, or letting Google or Microsoft control it and hoping you dont fall foul of them. All these options have drawbacks.
Side musing follows: I dont know what the solution to identity is on the Internet. A very long time ago, X.509 certs issued by quasi government authorities was mooted as part of a international directory system. I can see a future authoritarian state falling in love with this idea again, esp with the resulting lack of anonymity,..but also the ability to "kill" people on the Internet simply by revoking their cert.
EbNar · 3h ago
You don't need to reinvent the wheel to have a "somewhat safe email". Just own a personal domain and host it on migadu, mailcheap, mxroute, Zoho or any other provider.
pembrook · 3h ago
Yep, you own your domain, you own your mailbox and can take it with you anywhere once a service gets bad or dies.
The real problem comes when your email address is owned by someone else (eg. @gmail.com).
That’s the definition of lock-in.
thombles · 2h ago
The lock-in does have the bonus that it's practically impossible for someone else to take over your email address. Forgetting to update your credit card for renewal, long term afk/coma, death etc. are all issues with having your own domain and I decided to move away from that model.
drwu · 1h ago
I would bet/hope that I can live longer than most IT companies.
thombles · 42m ago
The day outlook.com goes up for open registration I think there'll be enough going on that I won't care too much about my email. :)
poincaredisk · 2h ago
It's the other way around in my opinion. With your own domain you own your identity. By ceding it to someone else you risk losing it at a whim of some algorithm or bot or by forgetting password, or getting locked out for some other reason.
tsimionescu · 1h ago
The problem is that you can't own a domain, you only lease it for a limited time. If you fail to pay the lease, you automatically lose it, and someone else can automatically get it, and there's nothing you can do about it. Domain names are worse than email providers from this point of view, since even if you lose your Gmail account, Google will typically not give it out to someone else, at least for some time.
bell-cot · 1h ago
True-ish.
OTOH - before email existed, the critical "how do we contact the real you?" identifiers were phone numbers and mailing addresses.
And if you failed to pay your phone bill, or rent, or property taxes...the exact same problem - someone else would get "your" identifier.
thombles · 43m ago
Losing access is disruptive but far less of an issue than a malicious actor getting access.
thoi4234234234 · 5h ago
Not just email - today it's almost impossible to have a decent life without a (smart) phone and being tied-in through OTP verification.
All these things have become so essential that it's shocking that it's not regulated like a utility (or even as a right given their systemic imposition).
brewdad · 3h ago
OTP verification can largely be worked around because so many sites still use SMS codes which a dumb phone can handle. Similarly, 2FA codes can be handled on a PC without requiring a smart phone. It adds hurdles but can be done.
Where it becomes challenging is situations where smart phones truly are required. When I attended college football games last fall, all tickets were e-tickets. You were required to present a QR code on your device or your ticket stored in Apple Wallet or Google Wallet. I ran into the same situation with my local theater's ticketing. You haven't lived until you've witnessed an audience with an average age of 70 try to figure out their tickets on their smartphones when they've never used them for that before nor had any notion that was even POSSIBLE.
mr_mitm · 2h ago
I don't understand why client certificates aren't way more common as a second factor. They have existed forever, are available on all platforms, they are phishing resistant (unlike OTP, and don't get me started on SMS), browsers or OSs could generate them during setup, and you could enroll them seamlessly with one click. Instead we had to invent new things like passkeys which do essentially the same thing.
You can use client certificates even with IMAP and SMTP.
poincaredisk · 2h ago
>they are phishing resistant
But can be easily stolen by malware (unless someone adds a client cert OS support? intriguing idea). But so can passkeys stored on the same device, so I don't know.
Long time ago browsers even had a widget to generate client certs natively! But it was removed, probably because of lack of use.
mr_mitm · 2h ago
All is lost the moment you have malware on your device. It can just steal the session key after authentication.
Max_aaa · 2h ago
The main reason that PGP did not catch on, as only the most tech savy were able to understand how the chain worked.
mr_mitm · 2h ago
Okay, I know that and I agree, but I wasn't talking about PGP. Client certificates are much easier to use. They can be self-signed and the whole trust issue disappears.
7bit · 2h ago
Because certificates are too complex for non-techies. Most of my sysadmin and dev colleagues have no clue how they work. Most of them have have access to SECTIGO CERTIFICATE MANAGER, a web UI to sign and issue certificates. Yet, every time someone needs a certificate, I get a call and asked the same questions over and over again.
Now expect aunt Lottie to use certificates? Yeah, sure.
mr_mitm · 2h ago
All we need is a magic button that says "enroll this browser". I'm sure aunt Lottie can handle that.
7bit · 8m ago
And yet, PGP still sucks, so it's not that easy, no?
ochrist · 2h ago
I've used several similar services, but usually you can print out the QR code and present that instead (yes, I know: you have to have a way of receiving and printing that, but you don't need to have a smart phone). This is also handy if you might run out of battery or network on your phone.
ssivark · 4h ago
> Side musing follows: I dont know what the solution to identity is on the Internet.
I was fond of how Keybase brought to life [1] identity proofs (linking and validating your different online identities) in a very easy to use platform. Pity it went away; feels like a loss for the internet.
Right, but I want to validate my identity for cases where it is important to me. I also want to prevent others from assuming my identity in cases where it doesn't really matter (until it does). My identity here is not the same identity use on Reddit. At the same time being erroneously linked to someone else's posts on Reddit because they use this username could be a real problem. At he same time, I don't necessarily want my posts here to be linked to posts at Reddit or X or wherever. Rinse and repeat across thousands of web sites.
It's a problem with no easy solutions. In part, because no two users want exactly the same solution.
genewitch · 3h ago
For example, I always use email login, never a phone number or Github or Facebag, and I barely have a presence on Google's panopticon, so never with my Google account. If a site demands it I just don't use it.
I also pay Fastmail to host my domain email, so that really helped get off Google. Yeah I gotta remember to renew every 10 years or whatever, plus $15/yr for fastmail; but what's the other option, I learn some SMTP package? No thanks.
flexagoon · 4h ago
If you don't want to link your email and your identity, you can use aliasing services like SimpleLogin. I have a separate email alias for every account, such as hackernews.ci72j@slmail.me, and only use my personal email for personal communications.
hnb2137 · 2h ago
Until slmail.me disappears and all your logins stop working and can no longer be changed.
radium3d · 3h ago
All you mentioned are better than the SSN
sshine · 3h ago
> paying for someone to run the infra (eg getting a proton or fastmail address), and hoping they dont enshittify or fail
I don’t experience them doing that. They’re email companies going strong. Maybe they get sold in some decades, and you move on. But I’ve had FastMail for one decade now, and it’s remained the same throughout. Including the minor UI bugs in their email client. But I’d much rather live with those than suddenly they’re also an AI company.
foreigner · 3h ago
This is also true for our DNA, because of companies like 23AndMe!
dumb1224 · 1h ago
Genotyping platforms are an entirely different beast I think.
thisislife2 · 5h ago
AKA, "Shadow profiling" - you can prevent it somewhat by sending Gmail users Protonmail or Tuta's password encrypted email.
type0 · 3h ago
which in many cases they just won't open and then complain about it
jowea · 6h ago
Needs to consider the other big email providers too.
omeid2 · 5h ago
Yes, Microsoft has a rather large portion of corporate and business email, a very large portion of it.
Barrin92 · 6h ago
I think in general treating email any other way than "everyone will eventually read your mail" makes no sense. Email communication, from forwarding to how people archive, to copy-pasting provides no security and is so brittle, just assume anything you write in an email is for public consumption. Reminds me of a post from a few years ago about encrypted mail as a security LARP (https://www.latacora.com/blog/2020/02/19/stop-using-encrypte...)
If you want secure messaging that nobody else will snoop on use an application dedicated to.. secure messaging. It's never what email was for and it's not how it's being used.
blitzar · 1h ago
I consider it to be like a postcard.
The words probably get read somewhere on the way to the destination and in the future someone will probably unpin the pretty picture that has been decorating the notice board, turn it over and read what is on the other side.
princevegeta89 · 6h ago
Exactly. Email is never an organized channel for communication. It only makes sense in the corporate world.
For users who don't pay for their personal email, email is nothing but a marketing channel and a very inefficient one at that. All the companies and corporations and people try to pretend to make email addresses look confidential and private. But the reality is they just see it as a way to spam you with ads and promotions and meaningless clickbait messages.
The idea of unsubscribing from emails from corporations and agencies is again just an act of pretense. 95% of the cases, it's not done in one click and involves a series of a few confusing steps. Even from a technology perspective, email is fucked and a legacy artifact as of today.
I would love to see a more secure protocol to replace it, where the recipient always has full control over all the messages that he can ever receive.
goku12 · 3h ago
> For users who don't pay for their personal email, email is nothing but a marketing channel and a very inefficient one at that.
I have a paid personal email plan on my own domain name. (Mostly to get aliases and plus addresses). It is setup very well and filters spam very efficiently, compared to some 'corporate-standard' filters on other services. But I still have to use my gmail address because most individual contacts wouldn't see my mails otherwise since they are on gmail, hotmail, etc. And for many official websites, my email addresses are 'not valid email addresses'. Granted that my TLD .space isn't an official sounding one, but it's used by exactly two types of users - people who use it as their space, and people/organizations working on space tech. So I pay, but I'm still forced to watch them spam. Honestly, I believe that email is now a captured monopoly (cartelopoly?).
> I would love to see a more secure protocol to replace it, where the recipient always has full control over all the messages that he can ever receive.
I wholeheartedly agree. Email is an awesome idea. But its age is starting to show. We need something with security and encryption built-in, much fewer moving parts (Can we integrate MTA, MDA, WebUI, spam filters, DKIM, etc into just one?), option to opt out of rich formatting (the HTML and AMP junk), dynamic updates, etc and proper spam filtering, etc. We should also have a way to disincentivize or punish big players from rejecting valid emails. Perhaps it can use HTTPS to overcome those pesky corporate reverse proxies and firewalls.
But the idea of having a domain name as a namespace for users is still precious.
theshackleford · 3h ago
> 95% of the cases, it's not done in one click and involves a series of a few confusing steps.
My experience has been the complete opposite as someone who had to it recently. Only a handful made it more arduous than a single click. I was surprised.
Gigachad · 6h ago
Article is from 2014 where this was more of a valid concern. These days I don't think people send email for anything other than external communication with businesses. And only in western countries.
kevin_thibedeau · 6h ago
The only personal electronic communication I use are the only two widely deployed federated protocols: email and SMS. Everything else involves compromises to enter a walled garden that offers no value to me.
brewdad · 3h ago
Sure but you do understand that makes you the outlier these days, right?
Most people are on Facebook Messenger or Whatsapp or Signal or a dozen similar platforms. I try to use Signal for most communications but have friends and family that won't move to it, so I also use Whatsapp or plain SMS with them.
recursive · 5h ago
My experience in 2025 must be extremely different from yours. I don't even know what alternate channels you might have in mind.
denkmoon · 4h ago
Chat. Matrix for nerds, discord for gamers and redditors, telegram for everyone else who cares and imessage/rcs for those who don’t.
cryptoz · 6h ago
I mean, for normal people that is exactly how it’s being used. Your receipts for everything are automatically emailed with all kinds of private info for example. Nobody, and I mean nobody, is expecting those receipts to be public. And since all that is in your email you reasonably expect your other email to be private as well.
Email is auth now. People do not use email the way you are describing.
shadowgovt · 5h ago
One of the biggest issues with the way the modern internet works is that it technically works the way GP describes but people believe it works the way you describe.
Even assuming all encryption is configured correctly at the endpoints so we can discount the risk of mid-transit interception and comprehension (do I assume CVS has encryption set up correctly on their outbound receipt emails? I do not...) People think it's like the postal network but it's more like the mail lands at the post office and they hand you a copy of it, while they retain the originals.
e2e encryption with s/mime is the answer, unless y’all think otherwise.
I played around with it the other day. Installed actalis/digicert s/mime cert on client. Sent emails between the 2 addresses. Emails decrypted locally on clients but same message sent on webmail client is encrypted/unreadable (besides subject line)
dylan604 · 6h ago
Tony the tiger says "that's grrrrreat." Now, send an e2e encrypted to another email that is not yours and see how long it takes them to understand what you sent. PGP for email has been around for a very long time, and there's a reason it is unheard of by the general public. it is a pain in the ass.
It's been going on at least as long as Year of the Linux Desktop. Stop trying to make fetch happen.
waynesonfire · 5h ago
Or, it's just too good. Why did it take so long to have encrypted DNS? Another example, https, which uses tls for secure communication still manages to leak the domain name because the Server Name Indication in the ClientHello is sent in plain text before encryption is established. The solution, ECH, is no where to be seen.
The folks that read your e-mail and monitor your online presence do not want you to use these tools.
mr_mitm · 2h ago
If e2ee became common, Google would offer a way to upload your private key or generate it for you (like proton mail does, IIRC), so you can conveniently read your mail in the web client, undermining the whole idea behind e2ee.
poincaredisk · 2h ago
Does it undermine the whole idea? You can just assume that everyone with a @gmail account may be compromised (just like people with work email don't really own their mailbox), and keep your secure communication with the others.
mr_mitm · 1h ago
I mean yeah, the point the article is making would be true non the less, so e2ee is not the answer to the problem.
paxys · 5h ago
As a bonus your emails will stay protected from the person you send them to as well.
colordrops · 6h ago
It's easier to get someone to install Signal than all of that.
photochemsyn · 6h ago
Google's products are garbage - any honest person can report on the degeneration of their services. That's what happens with monopolies over time.
Google would like you to think they're a God's-eye master of reality of course... but they're not. Just another corporate flop, like IBM etc.
shadowgovt · 5h ago
IBM stock is currently valued at $231.59 billion.
Seems like a pretty nice gig, being a corporate flop.
ZeroTalent · 10m ago
Alphabet is at a $2T market cap, and its core products like Gmail, Google Analytics, and the search engine are garbage at this point.
TZubiri · 4h ago
That's the value of the stock, which is distinct from the quality of the product. You can make a lot of money selling bad products for a high price. (At least if they are bad for users but good for businesses)
Congeec · 6h ago
Because social media. The same goes for a phone number. If your contacts give out a phone book, your number is leaked.
No comments yet
renewiltord · 7h ago
I have my personal email set to Gsuite. I hide nothing. It’s in my DNS MX. Just look it up before you send me a message on my personal. Since MX records are what you need in the first place, it’s what you should be checking. If someone wants to opt out, they are welcome to.
TZubiri · 6h ago
Only by a very wide definition of "having" your email. Having data in one of your servers means not much if it's not usable or findable.
Can a government submit a subpoena to Gmail asking for your emails? Unlikely, they would just answer that you are not a client of theirs and as such they don't have your emails.
Can they submit a subpoena asking Google to hand over all of the emails that your clients sent or received from your address? Sure they can. It's going to be a way harder sell to the judge and the reason and burden of proof will be that much higher, as it would essentially be closer to fishing or mass surveillance. But it's something that I can see passing for cases of national security or child abuse. Nothing I would personally worry about, but I understand if you want to wear a tinfoil hat.
Semantics and nuance matter.
arcanemachiner · 6h ago
What a blissfully-naive take. You're more than a decade behind the times.
>Google received requests for user information for about 900,000 accounts
I'm responsible for a few of those btw. All for e-mails clearly related to malware operations, to help with the investigation. It's not like anyone cares what John Doe talks about with his grandma and Netflix support. Well, maybe some do, but that's probably 1% of that 900k.
TZubiri · 4h ago
Am I the one that is a decade behind the times? You are the one citing a case from 15 years ago, lol.
Also, I'm not sure what seems to be contradicting here. The exception that you are brining up proves the rule. If I say that humans have five fingers in each hand, will bringing up the famous case of the sixed fingered lady be relevant at all to the discussion? Especially if I worded it specifically saying that "most" humans have 5 fingers? Check my wording, I said unlikely.
The fact is, most government agencies do not have access to your emails, let's say that the NSA does, which is debatable, great, that is 0.01% of the government, and probably 0% of companies (that are not Google), unless they submitted a subpoena as part of some litigation.
Feel free to obsess about the one or two agencies that have access to emails for national security reasons, and feel free to lump it into "THE government". But I don't think you'll ever make any important nuanced cybersecurity trade offs with that attitude, you'll just want to encrypt everything until none of your users can do shit (if you have users at all, you may not even be able to get a job because you are doubtful of sending your resume to anyone, and you might be too busy configuring your own email server instead of just using gmail and doing other productive stuff.)
0xbadcafebee · 5h ago
Yeah, and also the post office has all of your mail (because they can/do scan it), and pretty much anyone can intercept SMS, only slightly harder to intercept voice calls on PSTN, and SMTP has always been unencrypted. Private databases sold to the government by corporations already have your job history, political affiliations, sexuality, etc.
Most communications throughout history have not been secure. Despite this, it hasn't been abused nearly as much as it could be. I'm not sure if it's because the scale is difficult, or the technical side, or nobody thinks to suggest it to the despots. It's probably a combination of things. Ironically we tend to fear the abuse of power when it doesn't happen, and then ignore or accept it when it does happen. So the fear/hang-wringing/jumping-through-hoops seems pointless.
I still believe that if you really are concerned about what you're saying, you should say it in a clandestine way. E2E encryption is like a giant red flag saying "I might be doing something shady". Asking grandma about her special cakes [when she doesn't bake] will fly under the radar unless someone is looking really hard.
washmyelbows · 4h ago
the post office scans the exterior, not the contents. That is a significant difference.
Intercepting USPS mail and telephone calls are both serious federal crimes.
This isn't really a great analogy.
jraph · 4h ago
The post office and even the ISP are not as big as Google and don't have nearly as much control and data on everybody worldwide.
sebtron · 3h ago
Even though the post office can scan your mail, they don't keep a copy of all of it. They can't retroactively scan all of your communications years later. This is an enormous differencs in practice.
The same goes for intercepting SMS: unless someone has been targeting you for years, your past messages are safe.
rightbyte · 1h ago
Also ripping up envelopes and reading them in way that the receiver wont notice don't scale very well.
vasco · 4h ago
> Despite this, it hasn't been abused nearly as much as it could be
How would you classify submarines parked next to fiber optic cables slurping up data?
goku12 · 4h ago
I hope you have a reference as to how an optic fiber cable can be tapped like that. I also hope you've seen how heavily jacketed these cables are. The cables are so sensitive to mechanical disturbances (but without interference to communication) that it can often sense itself getting shifted around. Tapping it will require a lot more than that. How do you avoid such tip offs?
And as far as I know, emails are not E2E encrypted, but they are almost always encrypted in transit. Why go through all the trouble just to get encrypted data?
Now I concede that all those things (OFC, TLS) may have vulnerabilities that can theoretically be exploited. But do you send such valuable information over the internet that it's worth their cost and effort to retrieve it? And if your answer is yes by some chance, would you transmit it without taking adequate security measures?
In comparison, Google and the others have billions of emails simply sitting unencrypted in their storage, ready for access at zero cost. I can't see your argument contradicting the information security risk posed by these companies.
FirmwareBurner · 3h ago
>I hope you have a reference as to how an optic fiber cable can be tapped like that. I also hope you've seen how heavily jacketed these cables are.
LMGTFY [1][2]. I'm wondering at which point will we reach that utopic nirvana when HN and internet users in general will take the initiative and 30 seconds of their time to google something they find perplexing/unreal instead of going like "uhm, source?".
> I'm wondering at which point will we reach that utopic nirvana when HN and internet users in general will be able to google something they find perplexing/unreal before asking others to do it for them.
Look. Perhaps you should use a bit more discretion before you decide to come out all guns blazing on sarcasm and condescendation. I have some professional experience in the field - and it tells me there are many inconsistencies in your argument. And yes, I did 'the google' before typing the previous reply. I could of course be just ignorant about the latest achievements. But that's where references matter. That's all I asked for.
So here is the problem. Operation Ivy Bell happened in mid 1960s to mid 1970s. If you knew the communication infrastructure of that time, you would have realized that it was distinctly NOT optic fiber. Those came much later. But what really confirmed that doubt is that they used the induction principle of a transformer to tap the cable. That won't work on optic fibers. That's not how the EM field propagates in an OFC - they're more similar to waveguides than telephone cables.
And this distinction certainly matters here. Today's world is certainly not the same as in 60s. The sort of high-volume communication didn't exist back then. Neither did the ability to listen to or manipulate so many people all at once. Today's dangers - like the one with email messages - didn't exist back then. Back then 'cable' leaks like this used to happen. But have you heard of anything similar to Hillary's email leak or the Halloween mails?
FirmwareBurner · 3h ago
>I have some professional experience in the field [...] That won't work on optic fibers.
I'm not a professional in this field like you, but even I know that undersea fiber optic cables have actively powered repeaters/amplifiers spread across their length, so it's logical to assume those amplifiers, with their 16kW power source, generate quite some EMF at repeater points that could be picked up via side channel analysis by sophisticated and well funded state actors like US submarines equipped with dedicated surveillance equipment, as we can infer from the Snowden NSA leaks.
moralestapia · 4h ago
If the post office (or somebody else) reads your mail that's a federal crime.
Your analogy is moot.
atoav · 4h ago
> Despite this, it hasn't been abused nearly as much as it could be.
Yes, because a few decades ago a total surveilance of a population would have needed a signifikant part of the population to do the surveilance or base your surveilance on statistical chance. If you ever get the chancs to inform yourself about the way the GDR/Stasi watched its citizens before the fall of the Berlin Wall, go for it.
I previously described the recent technological advances as a shift of the above-mentioned ratio: Never in history could a dictator know more of the communications of all his citizens with less people being in on it. Never before in history could a dictator pretend the populus was on his side with less people then now.
These changed ratios already altered the face of politics, and I am pretty sure this wasn't it.
And for your grandma example: Metadata isn't encrypted nearly anywhere. If your grandmas network looks as if she makes a special, explosive kind of dough (or this ever gets mentioned anywhere), the timing of your message and whom you are sending it to might be enough for them to send you to a secret prison without due process. Correctness of such accusations is only a requirement when you don't have absolute powers and dictators will always find someone to blame, otherwise they would look weak.
FirmwareBurner · 3h ago
>Never in history could a dictator know more of the communications of all his citizens
One must be incredibly naive to think only dictators have this capability and not democratically elected governments. Just start a protest and find out just how quickly the government unlocks Godlike surveillance capabilities to be used against you. Hell, even a Tweet might do in places like UK or Germany.
They don't even have to send the police to the streets to beat you up or throw you in a van like in the USSR, they can just debank you like the trucker protestors in Canada and the problem solves itself peacefully.
Notion recently launched email integration that only works with GMail, and all the marketing was basically "we added Email to Notion" instead of "we added _Gmail_ to Notion".
Almost the exact same situation here, except my friend was once at an EFF-related organization.
I think a lot of things, like the tech industry turning into '80s Wall Street bros, wore down some of his on-principle determination. And when life got too busy, he gave up, and moved to GMail. I was very surprised to learn.
Another friend, who in school was one of those MIT student Linux hackers who had serious OPSEC as ordinary practice, once he had kids, and had to think about continuity of all the things he ran if something should happen to him, ended up moving home stuff to popular Apple and Google services.
Every so often one sees a cri de coeur from someone who has learned this lesson the hard way when Google locks them out of their account, the key to their digital life evaporates, there's nothing they can do about it.
Alternative identifiers exist, eg handles on sites like HN, but they are second-order artifacts of the email as ID.
Given the stakes, then, you have to decide whether to try and control your identity by bulding your own infra for email (domain, mail server, dkim etc and a fair bit of hell), paying for someone to run the infra (eg getting a proton or fastmail address), and hoping they dont enshittify or fail, or letting Google or Microsoft control it and hoping you dont fall foul of them. All these options have drawbacks.
Side musing follows: I dont know what the solution to identity is on the Internet. A very long time ago, X.509 certs issued by quasi government authorities was mooted as part of a international directory system. I can see a future authoritarian state falling in love with this idea again, esp with the resulting lack of anonymity,..but also the ability to "kill" people on the Internet simply by revoking their cert.
The real problem comes when your email address is owned by someone else (eg. @gmail.com).
That’s the definition of lock-in.
OTOH - before email existed, the critical "how do we contact the real you?" identifiers were phone numbers and mailing addresses.
And if you failed to pay your phone bill, or rent, or property taxes...the exact same problem - someone else would get "your" identifier.
All these things have become so essential that it's shocking that it's not regulated like a utility (or even as a right given their systemic imposition).
Where it becomes challenging is situations where smart phones truly are required. When I attended college football games last fall, all tickets were e-tickets. You were required to present a QR code on your device or your ticket stored in Apple Wallet or Google Wallet. I ran into the same situation with my local theater's ticketing. You haven't lived until you've witnessed an audience with an average age of 70 try to figure out their tickets on their smartphones when they've never used them for that before nor had any notion that was even POSSIBLE.
You can use client certificates even with IMAP and SMTP.
But can be easily stolen by malware (unless someone adds a client cert OS support? intriguing idea). But so can passkeys stored on the same device, so I don't know.
Long time ago browsers even had a widget to generate client certs natively! But it was removed, probably because of lack of use.
Now expect aunt Lottie to use certificates? Yeah, sure.
I was fond of how Keybase brought to life [1] identity proofs (linking and validating your different online identities) in a very easy to use platform. Pity it went away; feels like a loss for the internet.
[1] https://news.ycombinator.com/item?id=7453360
It's a problem with no easy solutions. In part, because no two users want exactly the same solution.
I also pay Fastmail to host my domain email, so that really helped get off Google. Yeah I gotta remember to renew every 10 years or whatever, plus $15/yr for fastmail; but what's the other option, I learn some SMTP package? No thanks.
I don’t experience them doing that. They’re email companies going strong. Maybe they get sold in some decades, and you move on. But I’ve had FastMail for one decade now, and it’s remained the same throughout. Including the minor UI bugs in their email client. But I’d much rather live with those than suddenly they’re also an AI company.
If you want secure messaging that nobody else will snoop on use an application dedicated to.. secure messaging. It's never what email was for and it's not how it's being used.
The words probably get read somewhere on the way to the destination and in the future someone will probably unpin the pretty picture that has been decorating the notice board, turn it over and read what is on the other side.
The idea of unsubscribing from emails from corporations and agencies is again just an act of pretense. 95% of the cases, it's not done in one click and involves a series of a few confusing steps. Even from a technology perspective, email is fucked and a legacy artifact as of today.
I would love to see a more secure protocol to replace it, where the recipient always has full control over all the messages that he can ever receive.
I have a paid personal email plan on my own domain name. (Mostly to get aliases and plus addresses). It is setup very well and filters spam very efficiently, compared to some 'corporate-standard' filters on other services. But I still have to use my gmail address because most individual contacts wouldn't see my mails otherwise since they are on gmail, hotmail, etc. And for many official websites, my email addresses are 'not valid email addresses'. Granted that my TLD .space isn't an official sounding one, but it's used by exactly two types of users - people who use it as their space, and people/organizations working on space tech. So I pay, but I'm still forced to watch them spam. Honestly, I believe that email is now a captured monopoly (cartelopoly?).
> I would love to see a more secure protocol to replace it, where the recipient always has full control over all the messages that he can ever receive.
I wholeheartedly agree. Email is an awesome idea. But its age is starting to show. We need something with security and encryption built-in, much fewer moving parts (Can we integrate MTA, MDA, WebUI, spam filters, DKIM, etc into just one?), option to opt out of rich formatting (the HTML and AMP junk), dynamic updates, etc and proper spam filtering, etc. We should also have a way to disincentivize or punish big players from rejecting valid emails. Perhaps it can use HTTPS to overcome those pesky corporate reverse proxies and firewalls. But the idea of having a domain name as a namespace for users is still precious.
My experience has been the complete opposite as someone who had to it recently. Only a handful made it more arduous than a single click. I was surprised.
Most people are on Facebook Messenger or Whatsapp or Signal or a dozen similar platforms. I try to use Signal for most communications but have friends and family that won't move to it, so I also use Whatsapp or plain SMS with them.
Email is auth now. People do not use email the way you are describing.
Even assuming all encryption is configured correctly at the endpoints so we can discount the risk of mid-transit interception and comprehension (do I assume CVS has encryption set up correctly on their outbound receipt emails? I do not...) People think it's like the postal network but it's more like the mail lands at the post office and they hand you a copy of it, while they retain the originals.
(2022) https://news.ycombinator.com/item?id=33304075
(2014) https://news.ycombinator.com/item?id=7731022
I played around with it the other day. Installed actalis/digicert s/mime cert on client. Sent emails between the 2 addresses. Emails decrypted locally on clients but same message sent on webmail client is encrypted/unreadable (besides subject line)
https://www.vice.com/en/article/even-the-inventor-of-pgp-doe...
The folks that read your e-mail and monitor your online presence do not want you to use these tools.
Google would like you to think they're a God's-eye master of reality of course... but they're not. Just another corporate flop, like IBM etc.
Seems like a pretty nice gig, being a corporate flop.
No comments yet
Can a government submit a subpoena to Gmail asking for your emails? Unlikely, they would just answer that you are not a client of theirs and as such they don't have your emails.
Can they submit a subpoena asking Google to hand over all of the emails that your clients sent or received from your address? Sure they can. It's going to be a way harder sell to the judge and the reason and burden of proof will be that much higher, as it would essentially be closer to fishing or mass surveillance. But it's something that I can see passing for cases of national security or child abuse. Nothing I would personally worry about, but I understand if you want to wear a tinfoil hat.
Semantics and nuance matter.
https://en.m.wikipedia.org/wiki/PRISM
In 2023, Google received requests for user information for about 900,000 accounts, and complied with ~80% of them, and both numbers are on the rise.
https://transparencyreport.google.com/user-data/overview
I'm responsible for a few of those btw. All for e-mails clearly related to malware operations, to help with the investigation. It's not like anyone cares what John Doe talks about with his grandma and Netflix support. Well, maybe some do, but that's probably 1% of that 900k.
Also, I'm not sure what seems to be contradicting here. The exception that you are brining up proves the rule. If I say that humans have five fingers in each hand, will bringing up the famous case of the sixed fingered lady be relevant at all to the discussion? Especially if I worded it specifically saying that "most" humans have 5 fingers? Check my wording, I said unlikely.
The fact is, most government agencies do not have access to your emails, let's say that the NSA does, which is debatable, great, that is 0.01% of the government, and probably 0% of companies (that are not Google), unless they submitted a subpoena as part of some litigation.
Feel free to obsess about the one or two agencies that have access to emails for national security reasons, and feel free to lump it into "THE government". But I don't think you'll ever make any important nuanced cybersecurity trade offs with that attitude, you'll just want to encrypt everything until none of your users can do shit (if you have users at all, you may not even be able to get a job because you are doubtful of sending your resume to anyone, and you might be too busy configuring your own email server instead of just using gmail and doing other productive stuff.)
Most communications throughout history have not been secure. Despite this, it hasn't been abused nearly as much as it could be. I'm not sure if it's because the scale is difficult, or the technical side, or nobody thinks to suggest it to the despots. It's probably a combination of things. Ironically we tend to fear the abuse of power when it doesn't happen, and then ignore or accept it when it does happen. So the fear/hang-wringing/jumping-through-hoops seems pointless.
I still believe that if you really are concerned about what you're saying, you should say it in a clandestine way. E2E encryption is like a giant red flag saying "I might be doing something shady". Asking grandma about her special cakes [when she doesn't bake] will fly under the radar unless someone is looking really hard.
Intercepting USPS mail and telephone calls are both serious federal crimes.
This isn't really a great analogy.
The same goes for intercepting SMS: unless someone has been targeting you for years, your past messages are safe.
How would you classify submarines parked next to fiber optic cables slurping up data?
And as far as I know, emails are not E2E encrypted, but they are almost always encrypted in transit. Why go through all the trouble just to get encrypted data?
Now I concede that all those things (OFC, TLS) may have vulnerabilities that can theoretically be exploited. But do you send such valuable information over the internet that it's worth their cost and effort to retrieve it? And if your answer is yes by some chance, would you transmit it without taking adequate security measures?
In comparison, Google and the others have billions of emails simply sitting unencrypted in their storage, ready for access at zero cost. I can't see your argument contradicting the information security risk posed by these companies.
LMGTFY [1][2]. I'm wondering at which point will we reach that utopic nirvana when HN and internet users in general will take the initiative and 30 seconds of their time to google something they find perplexing/unreal instead of going like "uhm, source?".
[1] https://en.wikipedia.org/wiki/Operation_Ivy_Bells
[2] https://www.nytimes.com/2005/02/20/politics/new-nuclear-sub-...
Look. Perhaps you should use a bit more discretion before you decide to come out all guns blazing on sarcasm and condescendation. I have some professional experience in the field - and it tells me there are many inconsistencies in your argument. And yes, I did 'the google' before typing the previous reply. I could of course be just ignorant about the latest achievements. But that's where references matter. That's all I asked for.
So here is the problem. Operation Ivy Bell happened in mid 1960s to mid 1970s. If you knew the communication infrastructure of that time, you would have realized that it was distinctly NOT optic fiber. Those came much later. But what really confirmed that doubt is that they used the induction principle of a transformer to tap the cable. That won't work on optic fibers. That's not how the EM field propagates in an OFC - they're more similar to waveguides than telephone cables.
And this distinction certainly matters here. Today's world is certainly not the same as in 60s. The sort of high-volume communication didn't exist back then. Neither did the ability to listen to or manipulate so many people all at once. Today's dangers - like the one with email messages - didn't exist back then. Back then 'cable' leaks like this used to happen. But have you heard of anything similar to Hillary's email leak or the Halloween mails?
I'm not a professional in this field like you, but even I know that undersea fiber optic cables have actively powered repeaters/amplifiers spread across their length, so it's logical to assume those amplifiers, with their 16kW power source, generate quite some EMF at repeater points that could be picked up via side channel analysis by sophisticated and well funded state actors like US submarines equipped with dedicated surveillance equipment, as we can infer from the Snowden NSA leaks.
Your analogy is moot.
Yes, because a few decades ago a total surveilance of a population would have needed a signifikant part of the population to do the surveilance or base your surveilance on statistical chance. If you ever get the chancs to inform yourself about the way the GDR/Stasi watched its citizens before the fall of the Berlin Wall, go for it.
I previously described the recent technological advances as a shift of the above-mentioned ratio: Never in history could a dictator know more of the communications of all his citizens with less people being in on it. Never before in history could a dictator pretend the populus was on his side with less people then now.
These changed ratios already altered the face of politics, and I am pretty sure this wasn't it.
And for your grandma example: Metadata isn't encrypted nearly anywhere. If your grandmas network looks as if she makes a special, explosive kind of dough (or this ever gets mentioned anywhere), the timing of your message and whom you are sending it to might be enough for them to send you to a secret prison without due process. Correctness of such accusations is only a requirement when you don't have absolute powers and dictators will always find someone to blame, otherwise they would look weak.
One must be incredibly naive to think only dictators have this capability and not democratically elected governments. Just start a protest and find out just how quickly the government unlocks Godlike surveillance capabilities to be used against you. Hell, even a Tweet might do in places like UK or Germany.
They don't even have to send the police to the streets to beat you up or throw you in a van like in the USSR, they can just debank you like the trucker protestors in Canada and the problem solves itself peacefully.