I loved email. It's dead.
2019-02-24
I loved email. It's dead.
We should start thinking of email addresses only as attack vectors.
An email address a piece of information which, once disclosed, allows someone or something to communicate with you forever. The consequence of this communication is that you may get interrupted by a notification, and bear the cost of storing, reading, and/or deleting the message; the message also increases the cost of searching through all your other messages.
These costs are small. The number of emails you receive, however, is very large. I have received well over a hundred thousand emails so far. Over time it adds up.
There are many-to-many communication systems which are indexed on other kinds of addresses (such as your phone number, postal address, your Facebook identity, your cryptographic public key, and so on). Email is like a phone number or a postal address: it has the property that "knowledge-is-permission", i.e., if you know the address, you can send data to it. Unlike other knowledge-is-permission addressing systems, or "capabilities" to abuse the computer science lingo, sending an email is almost costless, much less than the smallest unit of any normal currency.
The problem is that sharing your email address is a transitive operation: you are granting the recipient the capability to share the address with whomever he/she/it chooses. It is of course much worse than that: the address might be obtained accidentally or maliciously by a third party with whom you have no relationship, due to error, or the recipient going bankrupt, or a data breach, or being sold. There are some laws against sharing "personal data" without permission, but they're not remotely sufficient and probably not the right tool for the job anyway.
There is a commercial incentive to obtain email addresses from customers. They improve price discrimination, which means that customers collectively have to pay more (though some may pay less). Therefore companies try to force customers to hand over email addresses. You are required to divulge an email address to obtain the product; this is useful because it helps keep you informed as the product is delivered. But then a few weeks or months later, you start getting adverts from the company.
In the time it took me to write the previous paragraph, an advert arrived by email from a company from which I bought some blinds for my flat in December.
But in the time it took me to write that paragraph, I blocked all future emails from them.
What I have done is established a system of individual addresses for each company I and organisation I deal with. When I signed up with Blinds2Go, they got given my email address as mk270-blinds@no.ucant.org. But all I had to type was:
address-tool --retire mk270-blinds
and all future email from them is prevented with a curt "bounce" message, and I never receive a notification or store the message.
Effectively, this amounts to having one email address per interlocutor, with revocation indexed on sender email address.
What we actually need is a distributed store-and-forward messaging system where addresses are not transitive: instead, one would receive an invitation to communicate which could only be used by the recipient and not by third parties. This is vaguely similar to the PGP web of trust, Facebook messages between friends, and so on, but is probably most closely represented by the Scuttlebutt system.
To be continued ...