Title: F-mail Date: 2013-07-10 20:31
I hope that after reading this you will help me help our people ensure their right to private communication. Please share my opinions and ideas with as many people as you like.
Now the NSA and PRISM revelations has given techies a unique oppertunity to raise the issue and suggest a better e-mail system.
Let us get a bit more technical. E-mail is broken because no matter how you encrypt it you will always reveal meta data that is enough to tell who you talk to, when, about what subject, and how often - and if you encrypt it you send a very clear signal to whoever is watching. We need to solve those problems.
E-mail reveals:
- The receivers actual e-mail address
- The senders IP address, and therefore location and often identity.
- The senders e-mail client, and therefore often the operating system
- The senders apparent address, which in practis is correct if you want a reply
- The time the email was sent
- The subject of the e-mail
If the service hosting your e-mail is cooperating with whoever is looking for this information they will often be able to tell when you received and therefore read a given e-mail. Because the e-mail system is very naive in its basic implementation of SMTP and POP3. Spam has become a huge issue.
The F-mail system will reveal
- The receivers hashed address
- The digital cost of sending the f-mail (therefore whether it is bulk mail or important mail)
- All encrypted f-mails available in the system
The system will be compatible with current software and transparent to the users and their email clients. It is very important that the change to F-mail is without friction for the average user. So let me tell you how we solve this problem.
For the F-mail network to be compatible with current software, we will build adapters which decorate the F-mail network with POP3 outputs and SMTP inputs using TLS. But since the format and architecture will be Open Source I image that direct clients will be written for f-mail, so that the direct user does not have to rely on third party gateways which could be insecure.
The f-mail system uses asymmetric encryption to secure the mail data and headers. Everything but the receivers address and the digital cost of the message will be encrypted.
The data will be transported by using a p2p data replication technology, such as bit torrent. Nodes will be a mix of all the input and output gateways in the network, and participants using clients directly. It will be the responsibility of input gateways to place the encrypted data in the network, and make sure it is available. The intention is for the nodes in the system to share data among them at random, as we know it from TOR relays, so that mail data is spread across several nodes and therefore there is no way to be sure who originally placed the data into the network with intention to send it or who retrieved it with the intention of reading it. Of course if a large share of the nodes are investigated, it will be possible to deduct when the data first entered into the network and from where.
Spam will be combated by forcing all emails to be pay a digital fee. Do not worry. No actual money will leave your pocket when you send en e-mail. This concept is known as proof-of-work. The idea is that the computer which produces the e-mail data the first time, will solve a mathematical problem which requires brute force. The problems complexity can be adjusted, to prove that the sender did little or a lot of work, which will be used to measure how important the mail is. Bulk mail will be sent with proof of easier work than private email simply because if you are sending 10'000 F-mails, and it takes your computer say 3 seconds to solve the puzzle for standard priority mail, you would not be willing to dedicate that much computer time, so you would sent it with proof of less work. The complexity of the proof is an obvious way of filtering e-mail without having to analyze the content or origin. I suggest using the hash-crash algorithm which is also implemented in the bitcoin network.
The asymmetric encryption will be supported by a key directory infrastructure and freely available encryption solutions. I suggest using PGP as it is trusted and mature, also it is based on a web of trust instead of a chain of trust.
The SMTP adapter used as the input will look up the receivers public key, encrypt the F-mail according to the format, and hash the receivers address so that the receiver and proof of work is all that is visible, it will then push the mail out onto the F-mail network. If the public key can not be found, the SMTPserver will either decline to send the mail, or relay it onto the old transparent e-mail network, depending on security settings. This will be a hard balance to strike correctly. I suggest that for emails which are allowed to enter the old transparent e-mail network, the subject readable content should begin with "unsecure: ", to instruct the SMTP server that it can relay it, and to clarify to the receiver that this e-mail is unsecure.
The POP3 adapter will have a local copy of the users private key, protected by symmetric encryption and an old school password. The adapter will retrieve e-mail from the f-mail network, after it has hashed the receivers address.
I suggest that when an F-mail is sent, the sender address is changed to address+[seed]@domain.tld, in order for the hash to be different, so that it is only the initial e-mail in the thread that can be attributed to the receiver. The mail client will have to keep track of which conversation addresses it has in use in order to retrieve mail for them later.
I emphasize that we should use current technologies to ensure the maturity of the system from day 1. The biggest security threat is not fiber optics being tapped or encryption being broken, it is bugs.
There are a few downsides which I am aware of. It is possible harvest all of the data from the network, so if at a later point the encryption techniques get broken it will be easy to decrypt all of the e-mail sent within the network. But by sharing the encrypted data in a mesh network we ensure that the receivers IP and usage patterns are unknown.
People running bot networks may be able to harness the computing power to still send spam and calculate the proofs of work needed, to pass as normal email. The complexity can be adjusted by the sender, but it would require a real world trial to see if the complexity can be low enough for personal computers to deliver a nice user experience, while bot networks and cloud computing is an unfeasible solution for spammers.
There is no confirmation of delivery. An f-mail could get lost in the network and never reach the recipient. Also there will be a delay for f-mails to be received as it will have to be collected from the p2p network first, I do not intend the POP3 gateways to prefetch f-mail as it will then be obvious what hashed addresses it is handling if it was ever inspected.
Lets start a discussion on how to improve e-mail. Feel free to e-mail me, fork the gist and comment on it. Unfortunately this blogging system does not support comments.