It is getting increasingly clear to the world that e-mail as a technology is utterly broken. We need something better and we need it soon. But why is e-mail so urgent compared to all the other things we could focus on? E-mail is by far the most successful application of the Internet. Over 2.5 billion people use e-mail. However over 1 billion of those use one of Google, Microsoft and Yahoo as their provider. Thus, there is a strong centralization in the current market that wasn't there before. In this entry I wanted to quickly talk through the different reasons why e-mail need to be replaced urgently.

Protocols

The core protocols for e-mail where developed several decennia ago and were never designed with any thought to real security. The current support for TLS has mostly been tacked on long after the fact and is in many cases quite ill-suited to the problem. Many servers are also not very compliant, which leads to situations where you have to accept bad certificates in order to deliver e-mail to most of the world - and accept really bad ciphers. The protocols for e-mail should be recreated from scratch, taking in all the lessons we have learned of many years using SMTP, IMAP and POP in various settings.

Legal attacks

In the US there are several pieces of legislation that makes it an extrmely hostile environment for hosting e-mail providers. As an example, law enforcement does not need a warrant to access e-mail that has been stored on a server for longer than 180 days. This applies for all e-mail stored by American service providers, no matter where you are from or where the e-mail is physically stored. American service providers are also subject to National Security Letters and other nice legal gambits. This makes it very unfortunate that most e-mail providers are centralized in the United States. Of course other countries have similar problems. But we need to go back to distributing service providers into as many legislations as possible to combat these kinds of legal attacks.

Metadata

The current way of doing e-mail reveals a large amount of metadata that is completely unnecessary to reveal. Even encryption solutions usually only encrypt the body of the e-mail. It is completely possible to create a system for e-mail that doesn't reveal any information about who you are talking to. (It would be harder to hide when you are talking to someone, though). How can delivery happen with encrypted metadata? Well, you can do mix-networks, or onion-routing, or direct-delivery over private transport. There are many options for solving this problem once and for all.

Encryption

While encryption of e-mail is possible to do using S/MIME or PGP, it's a nightmare from a usability standpoint. We need better usability of encryption and also better standards that are simple to implement while retaining the core security of the concept. We also need to make sure that the encryption defaults are sane and doesn't encourage dangerous behavior. And finally, everything should be encrypted - not just the body of an e-mail.

A particular problem here is also the process of verifying keys. If we want encryption to be used by the masses we need to make this part of the protocols as easy as possible to use, while still retaining safety.

Centralization

As mentioned in other points, e-mail is currently very centralized. This means that we are relying on a small number of service providers to have good uptime, good security and be resistant to legal attacks. None of these seem to be true for our current providers. The irony is that e-mail has been a federated protocol almost from the start. So going back to more decentralization is not something we need to change e-mail to achieve. We probably will have to change the ecosystem and the tools to make it easy and safe to do it though.

User experience

There are three types of e-mail clients being used at the moment. Thick clients on user computers, web clients and mobile clients. Most of the web clients have a terrible user experience combined with a lack of features. The thick clients have an even worse user experience but do support a larger range of features. Google is one of the few web clients that people seem to actually enjoy using. But Google means centralization and lock-in to a proprietary solution. So we need better clients - both better native clients and better free software web clients.

Fast search

We are storing more and more information in our e-mail accounts. I personally have on the order of a million e-mails over my different accounts. In order to manage this huge mass we need tools that enable extremely accurate and FAST search over this amount of e-mail. Google does a pretty good job with the speed, but lacks many of the features that you might want in a search. We also need search solutions that are not tied to a specific service provider. If Google's search engine was open source and I could deploy it on my own servers that would make me really happy, though.

Summary

So these are the main reasons why I think e-mail is broken. There are alternatives out there being developed and some of them are quite interesting. Others are going down the wrong path (in my opinion). I might spend some time talking about the alternatives in another post.