Indelible email

Here's another idea for a form of secure messaging. This time, it's middleware for a secure email ecosystem.

The idea is to have businesses set up bitcoin wallets, manage the private keys, and to use bitcoin for email.

This would just be middleware to abstract bitcoin from users. On top of this would be a normal email server layer, where users can request their inboxes from the corporate server, with or without encryption and other features.

Using bitcoin for email would allow records to be created that could not be destroyed or altered, and would make compliance easier for businesses, and discovery (with subpoenas) easier for the courts.

With message sizes growing massively if this system were used, the blockchain messages could instead contain hashes of payloads located in parallel systems. Each business with a node, for example, could expose the payloads through web services, which would be encrypted so that only the recipient's public key could decrypt it.

I once wrote an idea for a client-encrypted email system, and the biggest criticism I could find of similar systems is that a user wouldn't, in practice, know it wasn't secretly compromised, no matter what protections were in place in the client. Using this corporate middleware that relies on the blockchain would solve those problems, at least for businesses.

Now, I've specifically said to use bitcoin, rather than a non-currency blockchain, because one benefit of this system could be requiring messages to have some payment made for processing of the messages. The amount would be set so that spamming would be costly, but normal email would cost little.

Emails could still be read and relied on pretty well without even being verified, subject to being revokable on discovery of a fraud within an hour. And any messages that are sent without payment could be ignored by the middleware as spam.

One challenge of this system would be how to communicate addresses. They could be actual bitcoin addresses communicated by text or QR code, but it seems like a more user-friendly approach would be to have a directory on each node, or to use TXT DNS records or something, so that normal email addresses could be looked up and converted into bitcoin addresses.

Anyway, thoughts on this system? Ideas for refinement of the idea, or criticisms of why it wouldn't work or is stupid?

Internode Id Increment Security Vulnerability

I was looking at the tracking information for a new phone I've ordered and I noticed that the id in the URL was relatively short, and that the site requires no authentication. That combination is always a red flag.

Telstra's Terrible Security

I pre-ordered an iPhone 4S with Telstra in the middle of last night, and got a call from 0883081023 this afternoon to confirm the order. This is when I had such a bad experience that I decided to coin some terms:

telstrible [telstr-uh-buh'l] adjective

shockingly insecure

The person who called me asked for all my details, which is telstrible security.

Origin:
2011; post-Modern English < Telstra + Terrible

telstribly [telstr-uh-blee] adverb

performed terribly by Telstra

Telstra telstribly connected my phone line, because it took ages and they messed up the account..

Origin:
2011; post-Modern English < Telstra + Terribly

LulzSec was right

I'm posting a story that someone communicated to me, which highlights how bad the state of IT security is. Take it with a grain of salt or a bar of chocolate (which is better than a grain of salt). I for one believe it. I've paraphrased some parts where I thought that idioms might hint at the identity of the person:

I decided, not for shits and giggles, but because I was bored, to see how easy it really is to find credentials on google.

It's *really* easy.