Re: [saag] Ubiquitous Encryption: spam filtering

[Phillip Hallam-Baker <[e-mail]>]

On Tue, Jun 23, 2015 at 11:19 AM, John Levine <[e-mail]> wrote:

> I can't find in the archives whether the ubiquitous encryption
> discussion has looked at the knotty issues of spam filtering.
>
> It's a really hard problem -- filtering is essential to keep mail
> usable, both due to the sheer volume of the spam and the need to keep
> phishing and malware away from recipients.  You can do some filtering
> on the envelope, but there's no substitute for looking at the contents
> of the message.
>
> All of the middlebox issues apply, it's much easier to do the
> filtering on a large shared server than at endpoints.  Partly that's
> because the endpoints often have limited bandwidth and compute power
> (think phones) and partly it's because effective filtering needs to
> consult shared frequently updated lists of malware signatures and
> malicious urls.
>

I don't think it is actually much of a problem in practice. People just
have to be prepared to accept that they probably don't want end-to-end
encrypted mail from people they don't know. Once that is accepted, the
solutions are fairly straightforward, the publicly visible email encryption
key is to the spam filter, after a reply send an end to end key...

Main constraint is that you don't want to accept end-to-end encrypted email
unless it is signed by someone you know. So the endy mail problem becomes
an introduction problem.