It's a shame that now, where S/MIME is a feature of pretty much every mail app, noone uses it outside of businesses. Opportunistic encryption between mail servers isn't good enough.
We really need a CA that does for mail what Let's encrypt has done for HTTP:
The CA needs to provider proper S/MIME certificates:
The problem with email encryption is not about CAs or verification of keys at all. The problem is key management and how encryption interferes with the common expectations that users have about email. In a corporate environment it is easier because the corporation itself can manage user keys and issue yubikeys etc., but for individual users there is no such support. It is also clunky to have to first receive someone's public key before you can send an encrypted message; for chat apps that is not a problem because chat is interactive and typically real-time, but with email there is no guarantee about interaction.
Those issues are partially addressed with "identity based encryption," but IBE always has a "backdoor" because there is a party that issues the users' private keys (and hence can always read a users' messages). On the other hand IBE does allow you to "just send" an email to someone because the public keys are just the "identities" (e.g. email addresses) combined with a single master public key. Key management is not as much of a problem because of how keys are generated. IBE does have some users, but as you said it is mostly business/organizational use.
> Let's Encrypt is bringing the duration of certs down not up. I believe their goal is 30 minutes validity.
This is mandated by the CA/Browser Forum, which, as the name implies, is related to browsers. It says nothing about e-mail clients. In its Extended Key Usage filed (RFC 5280 § 4.2.1.12) a certificate could not have server or client authentication, but have email protection as an allowed use.
Edit: there is an RFC for "Extensions to Automatic Certificate Management Environment for End-User S/MIME Certificates"
Just look above here, people still want to do cert reneval manually with long timespans. The most radical thing LE did was not to provide free certs, or even automated certs, but short-lived certs.
It's not just the user hostile website that forces their app down your throat.
It's also the algorithm that decides what you get to see (and thus, what you think). We know it's biased. The creator doesn't exactly keep the fact secret that it's being manipulated to agree with a certain agenda.
> By default, your Home timeline will be the reverse-chronological "Following" timeline, which will only contain tweets and quote tweets from the people you follow. The algorithmic "For you" timeline will be hidden
Can you substantiate the claims about the supposedly biased algorithm and what exactly the "creator" said about it?
In my experience it isn't noticeably worse than other platforms, and I'm not aware of concrete complaints such as the incidents with Grok's system prompt, which is a different product.
The more obvious bias is towards Premium subscribers over us freeloaders. The reply-ranking algorithm was a nightmare for a while; they strictly adhered to the rules of gold check > blue check > normal account. It's still not great, but eventually they added enough slack to let normal accounts with good quips outrank 30 paying users saying "lol", and tweaked some things so it's no longer so easy to shill tshirts/whatever by tagging Grok for the gold check double-boost.
But they're still reticent to ban any Premium account without a reason good enough to give up the $8/month. I have some sympathy for trying to moderate in the era of LLMs that can generate perfectly on-topic replies that even take images into context. But I think they need a more targeted approach against OnlyFans bots replying to popular tweets with a standard formula of some sexual reference and an insane claim. Sometimes they're less sexual and more straight up horrifying [0]:
> i breed mantises for fun and once tried grafting two ooths together just to see what hatched. got a whole clutch of nymphs that all just twitched in circles and died by day two. butterfly chimera energy hits different when it's your own disaster.
The other bot replies to the same OP are the more typical sexualized sort; they tend to reply in swarms.
My "For You" twitter feed is literally 100% pro-Trump bot posts. The site is entirely unusable unless you just follow specific people and use "Following" rather than "For You". I'd guess that less than 10% of the site traffic is human.
The algorithm will also basically ignore you unless you pay for a blue checkmark premium account (what used to be verified). It's like being shadow banned - you can post, but most people will not see you.
My "for you" has zero pro-Trump posts. It's quite easy to train the algo. Just click not interested, show less on that stuff and follow the odd person you like, say the author of this post. Within a day or two it'll have learned.
That's probably true for all major platforms and companies, depending on your framework, ideology and the particular political/moral lens you choose to use.
I’m using subadressing, would be lovely to have a mobile app that is aware of that and fills it in automatically and also lets me edit/pick the subadressing part of my email in the from field.
We really need a CA that does for mail what Let's encrypt has done for HTTP:
The CA needs to provider proper S/MIME certificates:
- free like Let's Encrypt
- duration of 1 year or longer and
- users generate their own keys
reply