Re: [lamps] Proposed addition of header protection to the LAMPS charter

["John R Levine" <[e-mail]>]

On Mon, 12 Nov 2018, Daniel Kahn Gillmor wrote:
>> they looked in their mail programs.  The only thing that was
>> consistent from one MUA to another was that they looked awful.
>
> John, if you have the infrastructure set up to generate screenshots of
> e-mail messages on multiple MUAs (particularly those that handle message
> encryption and/or signatures), i'd love to take advantage of it!  If
> it's something you can share, please let me know (off-list is fine if
> it's not something you can make broadly public).

I have the code that wraps and responds lying around somewhere.  I'll see 
if I can find what addresses it's attached to.  I don't have any 
screenshot tools beyond what anyone has on a Mac or a phone.

> There are multiple clients already doing header protection today,
> interoperably (e.g. enigmail and K-9 mail).  This is not a code-free
> exercise :)

The question isn't whether it's possible to write applications that can 
wrap and unrwap mail.  Of course it is.  The question is whether it's 
usable at scale.  Two niche applications do not scale make.  Get Oath and 
Gmail to implement it in webmail and MS to put it in Outlook, and then 
it'll be interesting.

If e2e encrypted mail becomes at all popular outside of small closed 
communities it will be useless because 95%* of it will be spam and 
malware.  Spam filtering depends both on metadata which the MTA can use 
with encrypted mail and with body filtering which it can't.  Filters need 
to look at the contents and correlate them with the contents of other 
messages both to look for bulk mail, and to recognize and deflect links to 
phishes and malware.

The mail community has known about this issue for a long time and so far 
we have no idea what to do about it other than giving your keys to your 
MTA so it can unwap and filter.

Regards,
John Levine, [e-mail], Taughannock Networks, Trumansburg NY
Please consider the environment before reading this e-mail. https://jl.ly

* - that's how much of mail is spam and malware these days