Email is Broken

Let’s face it – Email is Broken.

The tool that has taken up more bandwidth and hard drive space than ALL THE OTHER WEB SERVICES COMBINED in the short history of the Internet, is broken.noo

To back up a little, I’m a software architect and IT consultant, and most of my clients at some point need help with IT security. And obviously,  IT Security-with-a-Capital-S is a big deal.

So we talk to our clients about the threats from China, Russia, the former Soviet Republics, North Korea, Turkey, Brazil etc. and of course the threats from domestic sources – whether directly or through compromised bots and zombies. We talk about firewalls, antivirus/malware, phishing, spear-phishing, whale-phishing, white-whale-phishing, spamming, hacks, hardening, software updates, encryption, VPNs, training, spoofing, middle man attacks, wifi security, drive by infections, more training, Internet-of-Things, The Dark Web, passwords, biometrics, three letter government agencies, public key encryption, and even more training.

I’ve personally worked in Austin & Silicon Valley, and with people on 6 continents. I’ve built a dozen email servers from scratch. I’ve written spam filters and worked on email clients and implemented dozens of fixes. I’ve integrated with email in a dozen programming languages. We manage thousands of email accounts, and we’ve watched even the most robust and well protected email systems fall to attacks. So really, I almost always come back to the fact that it all starts with Email. When I think of all the Security hoops we have to jump though, and how much time, effort and money we spend (or feel like we should be spending), as a culture, on digital Security, I think how much better our entire Security infrastructure would be if we … JUST. FIXED. EMAIL.

To be fair, Email wasn’t always so bad. The underlying architecture of Email as we know it was developed by Ray Tomlinson in 1971 on ARPANET – the DOD precursor to our modern Internet. By 1976, 75% of all ARPANET traffic was Email. Early email was a command line tool used to send quick messages to other computer users – it was literally [email protected]. From a practical standpoint, it worked a lot like the text messaging we use on our phones – i.e. all text, quick messages, limited user interface. In fact , RFC 733 (https://tools.ietf.org/html/rfc733) in 1977 was titled “STANDARD FOR THE FORMAT OF ARPA NETWORK TEXT MESSAGES(1)”. The operative phrase there being “text messages.” i.e. – not “rich text messages” or “multipart internet mail extension messages”.

Also, email was designed from the ground up to be open – meaning anyone could read and edit the source code, and it was open in that email could take any route to get from one user to another. And while it wasn’t feature rich, nor locked down tight, the simplicity of email made it a safe and efficient, time-agnostic, way to communicate. The understanding though, amongst those early users, was that you should always “treat Email like a postcard”. All those early users, mostly scientists, understood the open nature of Email, and knew the limitations that accompanied its open nature.

That lasted the better part of 2 decades – through the early stages of the Internet (aka ARPANET). Eventually, (like mid-80’s), because we’re clever monkeys, some dude said, ‘Hey, I want a user interface.’ So he wrote some code to add a user interface to make life easier. Then some other dude said, “Hey, I’d like attach a file.” So he wrote some code, added it to the protocol, and before long we had attachments with the fancy new UI, which became a GUI, then hyperlinks, HTML, address books, filtering rules, sorting, archiving, and … spoofed email headers?

Woops – we went too far.

All those layers of code made Email easier to use and more powerful. Every layer provided an enhancement to Email – usually to make it more convenient. Companies like AOL, Earthlink, Microsoft, Google, Apple, Netscape and others made a LOT of money from email. Plus the rest of us loved it – we became more productive, made more money ourselves, and discovered the power of Email. So much so that Email became the largest single source of Internet traffic by 2007. And at the time of this writing (early 2018), most modern businesses couldn’t imaging running their businesses without email. When email goes down, we freak out!

But there weren’t any adults in the room. No one told us where to stop, and no one should have. We needed to make a big, wild, powerful tool to break our paper addiction and move us into a digital paradigm. We needed a freeform communications tool that lets anyone contact anyone, both in real time and with a time lag. As a result, Email has become key to almost everything we do on the Internet. Every other account we have on the Internet – Facebook, Dropbox, Zillow, IFTTT, Banking, Insurance, FedBizOpps etc. etc.  – requires an email address just to sign up for the account. You can’t even get broadband or a mobile phone without an email address, and why would you want to?

However, we’ve reached the point where we need to roll it back. We’ve pushed Email way beyond the limits of what it can safely do. Email was never meant to be a secure form of communication – it’s insecurity is inherent in the underlying protocols. And we can’t keep adding more security layers to Email without destroying the very thing that makes Email work – which is its ‘open-ness’. Almost every other private messaging system in our modern society is more secure, primarily because those other messaging tools – Facebook Messenger, Skype, Google Chat, Snapchat, Twitter etc. are all closed systems.  No one can force a Tweet onto my Twitter feed or spoof another user’s Twitter address. Compare that to Email, where anyone in the world can force their email (and a name associated with it!) into my Inbox. And, of course, I can do the same to them. I could send a message to [email protected] or [email protected], and claim I’m Theresa May, and probably get the message into someone’s inbox at the White House or the Kremlin. However, I don’t stand a chance of being able to send either of those people a text message on their phones and actually have it look like it’s coming from Theresa May.

Moreover, I want to address the scope of this issue. I realize full well that it’s not as shiny as Tax Reform, and doesn’t spark the righteous indignation of Gun Control, but in terms of the number of world citizens that this issue affects all day every day, this problem is MASSIVE!

So what are the real solutions?

Well, I’m a fan of a) finding simple solutions  and b) pulling on the biggest levers. And when you’re talking big tech, it’s the big companies. So I’m making an open call to Microsoft, Apple, Google, Yahoo, Mozilla & AOL. Those 6 companies have control over the servers or clients of more than 80% of the world’s email. If we think of this in true epidemiological fashion, and essentially immunize the worst vectors, we get an exponential decrease in overall infections.

So here’s my open letter to the C-suites and Email Architects of those 6 companies:

————–

Dear Microsoft, Apple, Google, Yahoo, Mozilla Foundation and AOL,

We, the Citizens of the Digital World, need your help.

Please make the following changes to your email software, both client and server:

1) Create a “Secure” mode for both your email clients and your email servers that does the following:

2) Enable this “Secure” mode by default for Business & Enterprise Users

3) Create a “Super Safe” mode that also disallows attachments.

You can each do this individually, or in cooperation with each other. We don’t care. 

Thanks in advance for your cooperation,

The Citizens of the Digital World

——————————————-

Each of these above corporations can make these changes unilaterally to their own toolsets – no cooperation is required. No legislation. No IETF working groups. No nothing. Just do it. Moreover, the new Secure mode will actually be a money-making feature they can sell to their clients.

Additionally, (and this is my favorite part), we’re not adding new layers to try to fix a problem that shouldn’t exist in the first place. Instead, we’re removing layers that, really, never should have existed. The only GUI enhancement is item 1-g, adding the sender’s original email address to the top of the message in big, fat, bold type. Make it unmistakable, just like a sender’s phone number is on our text messages. That’ll require a little work, but even most amateurs could code it up in a few hours.

Of course, if we want to take it even further and immunize the next group of easily identifiable transmission vectors, we need to get the List Managers involved. Here’s an additional open letter to the email newsletter providers of the world like MailChimp, Constant Contact, Mandrill, List-Manage, Sendy, Amazon SES etc.

————————————

Dear List Managers,

We, the Citizens of the Digital World, need your help.

Please help us make email more secure by taking the following steps:

1) No spoofing – make all users authenticate through THEIR email servers when sending messages to email lists. Alternately, send the message from your own server. I don’t care if a message comes from an @mailchimp.com etc. email address. As long as the message itself says it’s coming from person X or Y or Z, and I’ve signed up for the list, then I’m fine with it.

2) Implement an option for senders to be compatible with the above recommendations for email client and server providers. Give your users an option to use ascii text and no colors or HTML in their messages. Yes, some users can’t imagine sending newsletters and promo codes out without 12 images and 9 colors. But 99% of that JUNK goes into the Trash folder anyway. What users (not recipients) REALLY love about your service is the list management. So let your users have a choice to focus on that. Let their message be about the content rather than the design.

You can each do this individually, or in cooperation with each other. 

Thanks in advance for your cooperation,

The Citizens of the Digital World

————————————

This slideshow requires JavaScript.

 

All views expressed herein are the opinion of the Author, and do not necessarily represent the views or opinions of DurangoDowntown.com.

Sources

https://phrasee.co/a-brief-history-of-email/

https://en.wikipedia.org/wiki/History_of_email

 

About the Author: Nathan Morris is a software architect, inventor and IT Consultant in Durango, CO. Nathan has worked in the Austin, Silicon Valley and Global tech industries, and has degrees in Philosophy, Geography and Mathematics. Nathan is currently a partner in a Durango based software developement house – Web Services Management, which is the parent company of DurangoDowntown.com. Additionally, Mr. Morris is the principal founder of the CircuitMouse IoT app & framework.