Hacker News new | past | comments | ask | show | jobs | submit login

Apart from mandating TLS, what's wrong with email?

FTP I agree - SFTP is an existing better option.




Email protocol is so dated people can only keep patching with hacks.

It may look like it's working from users' point of view but check how encoding is handled, it's a mess and then why is there still no widely deployed end to end encryption for such a core protocol?

Also DNS and domain is broken too. There's no point using UDP which only brings security problems and still no decent way to encrypt which domain you're querying through your browser and see how domain is governed by a structure which make crappy rules like who owns new TLD and you get some absurd "base" price for each domains instead of something more transparent and public. I wish if you write a book, you could easily have 'some-title.book' or when releasing a movie, you could get 'some-title.movie' but somehow it went wrong and no one can fix it.

Lack of improvements on the security on these points make me wonder if agencies just want to keep them dated so they can tap into people's communication easily instead of making the world a better place where everything is p2p encrypted.


For DNS: D-PRIVE protocols including DoH and DoT prevent eavesdroppers seeing your queries or tampering with them. DNSSEC lets your client ensure the answers you see are genuine.

For hiding hostnames eSNI is under development. Cloudflare with a recent Firefox nightly lets you see this for yourself.


There is no reason DNS should be centralized. DoH and DoT create concentrators that can break the privacy of many people (that's one of the reasons people don't use them: why should I care if my ISP can read my queries when the alternative is making those queries on my ISP servers?)

(That said, DoH solves a very important, but different problem that is: I want to provide a service with authenticity assurances, but DNSSEC is broken for the users, what can I do? Not many people seem interested on providing that kind of service.)


Of all the complaints I have about email, encoding handling is not really one of them. Everybody decided long ago to ignore binarybody, and just send everything base64 encoded. I really think the result is much simpler than HTTP.


The "encoding" here is I think charset encoding, not MIME encoding. The determination of charsets is basically a game of roulette; the last time I looked, only somewhere around the region of 40% of messages actually adhered to the charset they declared themselves as. A classic (and simple) error case is people who write Windows-1252 and then call it ISO-8859-1, not realizing that there actually is a difference between the two.

(Email could use a better binary encoding for attachments than base64, though, since transports are basically 100% 8-bit safe, even if not binary safe. Usenet went with yEnc, which IETF balked at in what is a case of perfect being an enemy of the good).


Email was actually the first network protocol to successfully deal with this problem, by creating the standard that every other protocol uses today to declare your encoding. But broken clients will send broken messages, like they do in any protocol.

I have seen plenty of web sites broken by it too, and it's a problem when moving files between Linux and Windows.

(And yes, things would be better if people standardized on binarybody instead of 7bitmime. unfortunately, the Microsoft server announces its support everywhere, but it's broken, so nobody can rely on that one extension (an inside parenthesis, there is a work-around that works everywhere, but it goes against the standard).)


Charset encoding is definitely a pain everywhere. Email's specific problem is that the charset is essentially mandatory in terms of labeling, but the label is often incorrect. The light at the end of the tunnel is that there is general agreement that the future of charsets is "use UTF-8 everywhere," so it's just a matter of waiting a century to kill off all the legacy stuff.


> why is there still no widely deployed end to end encryption for such a core protocol?

Perfectionism & cert vendors / CA mafia.


In most ways, other messaging technologies are superior in user interface and ease of use. The only real advantage of e-mail is its universal nature. I keep hoping we get an open source server that can federate just like e-mail, has a decent client on a couple of platforms, can handle calendars, and has some form of greeting to ask permission to send messages to a specific address (obviously override-able by a sysadmin on a "two people on same server" basis).

I have been playing with workflows lately (in relation to agents) and wonder if that would be an e-mail replacement.


Most people now expect one protocol (ala ActiveSync) to combine their contacts/calendar/notes, provide push notifications, send email, etc, all in one protocol, sort of like a universal PIM protocol (ActiveSync is patent encumbered and largely driven by Microsoft). Luckily JMAP by fastmail looks promising in this regard.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: