Zeigen

Spam represents more than 95% of the e-mail sent to the company where I work. On my personal Gmail account, my spam folder reflects the same experience: The daily volume there is approximately 20 times that of the legitimate mail sent directly to me.

Spam filtering, a dismal experience as recently as five years ago, is now relatively successful. Gmail’s filters are top notch, and the corporate filtering solutions we use are also excellent. However, both false negatives (spam not detected) and false positives (legitimate mail caught as spam, which I may not see for weeks if ever) are fairly common occurrences. I personally experience each of those at least once a week.

Simultaneously, not enough people seem to recognize how insecure e-mail is. I commonly see people sending passwords and credit card data via e-mail, because they apparently don’t realize that e-mail is exactly as secure as a snail-mail postcard (which is to say: not secure at all).

I first used e-mail in 1986, when I received an account for an undergraduate computer science class at U.C. Berkeley. It was my first experience with the internet. This was long before the web, of course, and the internet back then was a text-only environment that consisted mostly of news discussions (Usenet), file transfers (ftp), chat (irc), and e-mail. Back then, e-mail addresses didn’t resemble the ones we use today — there was no simple @ address. Instead you had to use a so-called bang path, telling people your account name and a list of machines that would have to be contacted one by one in order to reach the machine that had your account. So for me in that undergraduate class, it was something like mit!uunet!ucbvax!zooey!estephen. The process was error-prone and unreliable. But it was explicit about how many different machines would have to pass along your e-mail from one to another. (Sometimes a machine would not be able to deliver an e-mail until later that night; an average e-mail took 1-5 days to deliver from one end of the country to the other.) It wasn’t long before the modern @ style addresses came in, and you no longer had to tell your e-mail a long list of machines in a chain that had to be reached.

Anyone who used e-mail during that time knew first-hand that the root administrators could read every single piece of e-mail that went through their machine. Fewer people today seem to know that the same is still true now. Certain Google employees can read e-mail on your gmail account (same for Microsoft and Yahoo and their e-mail services). Your employer can certainly read your corporate e-mail. Certain AT&T employees can read all e-mail going through their backbones. Any kid with a packet sniffer can read e-mail you send from your laptop at Starbucks.

I want to say that e-mail has come a long way since my undergraduate days, but of course it hasn’t. Other than the dubious additions of text formatting (Yowza!) and attachments, the last 25 years of e-mail improvements have been minimal. Our vulnerability to spam and scams — as well as the insecurity of what we send — are proof of that. The best improvement has been the growth of free web-based mail services, especially the UI innovations of Gmail itself.

Encrypted e-mail (e.g., PGP) has been around for at least 20 years. But it’s suffered from a long-standing chicken-and-egg problem: people don’t use it because no one else is using it.

But let’s suppose that Google took the lead. Let’s suppose they changed Gmail so that the next time you logged in, you were required to create a PGP key. You were then guided through the process of storing, verifying and exchanging keys with your friends, family and frequent e-mail contacts. All of your banks and large companies would be on board as well. And starting with any e-mails sent from one Gmail account to another, 100% of the e-mails sent were encrypted and signed. There would be pressure on Hotmail, Yahoo mail and other mailing services to follow suit.

That’s step one.

Step two would be an option (completely up to you if you wanted to enable or not) to put any non-encrypted or unverified e-mail sent to you into an “Unverified Junk and Crap and Scams” folder. Over time, that folder would need to be used less and less, and the false negative spam and scams would collect there. Soon people would ignore it entirely, and only read the e-mail that was proven to be from who it was supposed to be from.

Pressure would mount for everyone to jump onto the PGP bandwagon if they actually wanted their e-mail to be received.

As a consequence: Spam would virtually disappear.

And you could send private information with a sense of security. (Not absolute security, of course, since there’s always the possibility of break-ins or the person on the other end not being able to keep your private information private.)

I want to live in that world. Let’s say goodbye to phishing e-mails purportedly from your bank, deposed Nigerian dictators looking for a little help transferring a quintillion dollars, and endless pitches for natural viagra. Let’s bring e-mail into a new era of security and reliability.

(Sorry, mom.)

(click to enlarge)