HerraBRE

This is neat!

DoH/DoT over Tor will provide stronger security and privacy guarantees across the board, but a well run .odns (anycast, good caches) could probably provide better performance.

The .odns anonymity is strictly weaker than DoH-over-Tor because the .odns operator can see which recursive resolver is in use, and not all such resolvers serve large enough audiences to provide strong anonymity.

The .odns requests are also very easy to identify, monitor and block, and it's likely that metadata (query size, timings) will still leak a fair bit of information, especially if correlated with other network activity.

To expand on this slightly, and illustrate:

I'm going to go out on a limb, and assert that THE most common attack performed against peoples' e-mail, is a jealous person who knows their partner's password logging on to their e-mail and reading their mail.

I know people who have done this. You probably do too.

People trust each other, people routinely tell their loved ones their passwords. And relationships routinely fall apart and trust is routinely violated.

Deleting from the server mitigates this problem and greatly reduces the window of opportunity for the attacker.

The privacy cost/benefit ratio for routinely deleting from the server probably beats every other privacy enhancing technique out there. Super simple, super effective.

Techies too often forget that privacy isn't just about the NSA, APTs and TLAs. The fact is, the people most interested in violating your privacy are the people who know you personally...

I wrote [most of] Mailpile. I'll check back here now and then and try to answer any questions folks have.

Unless your adversary has a time machine, deleting from the server protects your past e-mails from any server-side compromise.

That's not nothing. :-)

But you're right there are trade-offs. If you don't have good backups, you are indeed increasing the odds of data loss by managing the data yourself. That is also true of encryption of data at rest, you are increasing the odds of data loss to buy some protection against unauthorized access. There are always trade-offs.

I had grand visions for how Mailpile could help mitigate such issues by encrypting the mail and re-uploading back to an IMAP server. But I haven't gotten that written, so for now it's just an idea. Someday, I hope.

Disclaimer: I wrote Mailpile. :-D

This is still a muddled view of things.

In pay-for-click, advertisers are paying for advertising which is effective. The click is how that is measured.

There are other ways to measure effectiveness, but measuring clicks is simple and reliable. No matter how you do it, advertisers ultimately want to pay for ads that work and lead to sales.

Everything else is a means to an end, targeting in particular. Ineffective advertising is a worthless waste of money, no matter how well targeted it is. Untargeted advertising which leads to sales on the other hand, is very valuable.

So sure, advertisers will prefer targeted advertising. But that's because they expect it will work better than the alternative. What matters to them is whether it works, not how.

To the general public the how is critical though. If there was less tracking and spying and data harvesting we'd all be better off. So it's very important to squash the misunderstanding that tracking and targeting itself has intrinsic value for anyone. For society (and for the ad networks), tracking has a significant cost and is in many ways a significant liability. For advertisers it's a tool in their toolbox, and if we could replace it with a more benign one, that'd be good for everyone.

Why do you say it was censored and removed? It's dropped down to page two, but that's perfectly normal once something has been on the front page for a while.

That is not how Google's business works.

Advertisers quite literally pay for clicks. That was part of how Google disrupted the market back in the day; most other advertising networks were selling "impressions", but Google was so confident in the relevance of their ads that you got impressions for free and only paid when a customer actually clicked on it.

The click is worth paying for, because it is a signal that the user has seen the ad, thought about the ad, and is interested in the ad. Advertising gold.

Obviously Google have many products (they bought Doubleclick an "impressions" company), and there are analytics value-ads and all sorts of things. But the core of their business is still pay-per-click advertising.

Your idea that advertisers are buying raw data is a misunderstanding.

It's still a means to an end. You don't pay with your data, you "pay" by interacting with ads.

Consider that Google actually became super profitable well before all the detailed tracking started. You grossly underestimate the synergy of "people searching for products" and "displaying ads". Everything else is an optimization.

You're describing Facebook... which is no where near as profitable as Google, in spite of much more invasive tracking.

If you never click an ad and use an adblocker so you never even see them, your traffic and your data just cost Google money. They may be able to extract some small amount of value by observing your behaviour and using those insights to improve their products, but they don't make any money until someone pays for an ad.

I agree the café analogy isn't perfect. I was just pointing out that outsiders who don't understand what's going on may fundamentally misunderstand the transaction. You can still provide value to the café by sitting in their chairs if you liven up the place and give them feedback on how to make the place nicer.

But if customers never buy anything, the café goes broke. And people stop interacting with ads on Google, Google does too.

I actually feel it's misleading and wrong at a very fundamental level; this was the only thing I disagreed with in the whole press release!

Consumers "pay" for Google's services by giving ads attention so the ads have value and Google can sell them.

All the data harvesting is a means to a end: to make the ads more appealing so you'll click. Google don't profit from the data directly; in fact all the data harvesting and processing is a significant cost factor. There are certainly other businesses that resell data and profit directly from data harvesting, but AFAIK, Google is not really one of them.

It's a bit like saying that you pay a café by letting them observe you while you sit in their chairs. A basic misunderstanding of what's actually going on.

This is a legitimate concern.

I would not put it past Facebook (or other businesses which are addicted to harvesting user data) to behave badly against networks like this. However, for the sake of their reputations they'd still probably do it quietly, which means many of the person-to-person attacks that deletion protects against would still be thwarted.

This is a problem the same way Facebook's privacy controls are a problem. Facebook themselves are not bound by them, but they're still useful if you want to protect your data from other users of the platform.

And FWIW, I think most of the big crawlers respect robots.txt - this is the same sort of thing.

If the social contract says "delete things when you see a delete message", then that's useful in a federated environment.

Only bad actors will disobey and they will have to modify their software in order to do so. This doesn't provide absolute protection against bad actors, but since most bad actors don't own a time machine, it reduces the scope of the harm they can enact.

Consider the adversary "angry ex-boyfriend." Let's assume he wasn't always angry and isn't a sociopath. By the time he has become angry, the sensitive posts have already been deleted. This makes a difference in real life to real people.

There is indeed a user-interface concern, to not over-promise to the end-user. But that doesn't justify leaving such a useful thing out at the protocol level.