Mailpile: crowdfunding a secure, private email client/cloud service

[kmoser]

@greggman

I’m not expert but it seems like there are a bunch of issues with this.

1. Once you send a email at least 2 parties are involved. You and the person at the other end. You have no guarantee the person at the other end is encrypting their email. In fact you have no guarantee they aren’t directly forwarding a copy to the NSA “to fight terrorism”

Encryption will always fail if the receiver forwards the unencrypted message to a third party, but that’s not the point here. The point is to encrypt messages so if the sender and receiver wish for their communications to remain private, a third party can’t snoop on them by reading their email while it’s in transit.

@greggman

2. Google has such great spam countermeasures because they can see all the spam sent to all the gmail addresses. This system will only see one person’s email at a time making it very difficult to counter spam to the same level as gmail.

There are other anti-spam methods, including Bayesian filtering, blocklists (Spamhaus), and more. Some of these methods work at the server level, making it irrelevant what email client you use.

@greggman

3. They claim a web-mail application which suggests using a browser to read email. But browsers download JavaScript which means a man-in-the-middle attack can always insert its own JavaScript.

Browsers can filter out Javascript. Most email-based browsers are smart enough to do this, and more, e.g. purposely fail to display images which may contain tracking beacons.