Google has most of my email because it has all of yours (2014)

OTP verification can largely be worked around because so many sites still use SMS codes which a dumb phone can handle. Similarly, 2FA codes can be handled on a PC without requiring a smart phone. It adds hurdles but can be done.

Where it becomes challenging is situations where smart phones truly are required. When I attended college football games last fall, all tickets were e-tickets. You were required to present a QR code on your device or your ticket stored in Apple Wallet or Google Wallet. I ran into the same situation with my local theater's ticketing. You haven't lived until you've witnessed an audience with an average age of 70 try to figure out their tickets on their smartphones when they've never used them for that before nor had any notion that was even POSSIBLE.

Right, but I want to validate my identity for cases where it is important to me. I also want to prevent others from assuming my identity in cases where it doesn't really matter (until it does). My identity here is not the same identity use on Reddit. At the same time being erroneously linked to someone else's posts on Reddit because they use this username could be a real problem. At he same time, I don't necessarily want my posts here to be linked to posts at Reddit or X or wherever. Rinse and repeat across thousands of web sites.

It's a problem with no easy solutions. In part, because no two users want exactly the same solution.

I hope you have a reference as to how an optic fiber cable can be tapped like that. I also hope you've seen how heavily jacketed these cables are. The cables are so sensitive to mechanical disturbances (but without interference to communication) that it can often sense itself getting shifted around. Tapping it will require a lot more than that. How do you avoid such tip offs?

And as far as I know, emails are not E2E encrypted, but they are almost always encrypted in transit. Why go through all the trouble just to get encrypted data?

Now I concede that all those things (OFC, TLS) may have vulnerabilities that can theoretically be exploited. But do you send such valuable information over the internet that it's worth their cost and effort to retrieve it? And if your answer is yes by some chance, would you transmit it without taking adequate security measures?

In comparison, Google and the others have billions of emails simply sitting unencrypted in their storage, ready for access at zero cost. I can't see your argument contradicting the information security risk posed by these companies.

The only personal electronic communication I use are the only two widely deployed federated protocols: email and SMS. Everything else involves compromises to enter a walled garden that offers no value to me.

My experience in 2025 must be extremely different from yours. I don't even know what alternate channels you might have in mind.

> For users who don't pay for their personal email, email is nothing but a marketing channel and a very inefficient one at that.

I have a paid personal email plan on my own domain name. (Mostly to get aliases and plus addresses). It is setup very well and filters spam very efficiently, compared to some 'corporate-standard' filters on other services. But I still have to use my gmail address because most individual contacts wouldn't see my mails otherwise since they are on gmail, hotmail, etc. And for many official websites, my email addresses are 'not valid email addresses'. Granted that my TLD .space isn't an official sounding one, but it's used by exactly two types of users - people who use it as their space, and people/organizations working on space tech. So I pay, but I'm still forced to watch them spam. Honestly, I believe that email is now a captured monopoly (cartelopoly?).

> I would love to see a more secure protocol to replace it, where the recipient always has full control over all the messages that he can ever receive.

I wholeheartedly agree. Email is an awesome idea. But its age is starting to show. We need something with security and encryption built-in, much fewer moving parts (Can we integrate MTA, MDA, WebUI, spam filters, DKIM, etc into just one?), option to opt out of rich formatting (the HTML and AMP junk), dynamic updates, etc and proper spam filtering, etc. We should also have a way to disincentivize or punish big players from rejecting valid emails. Perhaps it can use HTTPS to overcome those pesky corporate reverse proxies and firewalls. But the idea of having a domain name as a namespace for users is still precious.

One of the biggest issues with the way the modern internet works is that it technically works the way GP describes but people believe it works the way you describe.

Even assuming all encryption is configured correctly at the endpoints so we can discount the risk of mid-transit interception and comprehension (do I assume CVS has encryption set up correctly on their outbound receipt emails? I do not...) People think it's like the postal network but it's more like the mail lands at the post office and they hand you a copy of it, while they retain the originals.

Indeed it is, for now.

Or, it's just too good. Why did it take so long to have encrypted DNS? Another example, https, which uses tls for secure communication still manages to leak the domain name because the Server Name Indication in the ClientHello is sent in plain text before encryption is established. The solution, ECH, is no where to be seen.

The folks that read your e-mail and monitor your online presence do not want you to use these tools.

That's the value of the stock, which is distinct from the quality of the product. You can make a lot of money selling bad products for a high price. (At least if they are bad for users but good for businesses)

Am I the one that is a decade behind the times? You are the one citing a case from 15 years ago, lol.

Also, I'm not sure what seems to be contradicting here. The exception that you are brining up proves the rule. If I say that humans have five fingers in each hand, will bringing up the famous case of the sixed fingered lady be relevant at all to the discussion? Especially if I worded it specifically saying that "most" humans have 5 fingers? Check my wording, I said unlikely.

The fact is, most government agencies do not have access to your emails, let's say that the NSA does, which is debatable, great, that is 0.01% of the government, and probably 0% of companies (that are not Google), unless they submitted a subpoena as part of some litigation.

Feel free to obsess about the one or two agencies that have access to emails for national security reasons, and feel free to lump it into "THE government". But I don't think you'll ever make any important nuanced cybersecurity trade offs with that attitude, you'll just want to encrypt everything until none of your users can do shit (if you have users at all, you may not even be able to get a job because you are doubtful of sending your resume to anyone, and you might be too busy configuring your own email server instead of just using gmail and doing other productive stuff.)