Interesting take. I have decades worth of email archived, so it does ring true for me at least. I doubt anything in there is more interesting to Big Brother but who knows?
"An email is your copy, and the sender can’t revise it later."
Sort of. They can't change plain text, but modern emails often include vast swaths of remote content. When you open the message, it retrieves the relevant assets directly from whoever sent the email. That remote content is not permanently stored. It's cached for a bit and will not be re-used if the email is opened months or years later.
If those assets disappear or are changed, there's very little any email provider can do about that.
Your own emails are immutable, if you trust nobody's modified your copy.
But proving to others that an email hasn't been modified is a more difficult task. As I understand it, you'd need to retain DKIM keys for the signing server, to check that historical DKIM signatures verify correctly and the old message was not forged or altered.
Are DKIM signing keys issued in some kind of Certificate Transparency log, where you can verify whether a particular DKIM key existed for a particular domain in the past, in order to do this in general?
>In a world where there’s enough AI capability to process the entire web and rewrite every page to remove something, the cost of “changing history” is much reduced, so we can expect more of it.
I gotta be honest, this scenario is not a concern that impacts my choice of email provider.
Is email immutable? Honestly I haven't looked into it very much, but as an email self-hoster I do know that i have the ability to decrypt any email in any user's inbox. I presume I could also edit and re-encrypt them, but I don't really know.
But as in all cases, you can only be truly sure no one is tampering if you don't give it to anyone else.
The immutability of documentation tech matters more in a world with AI.
The cameras used to document "news" will need to be watermarked, fingerprinted and authenticated, like what Canon and Nikon are already doing (and which AFP has already adopted).
It may have seemed gimmicky at first, but in a year or two, you'll probably only be able to trust visuals from companies that do this (wire agencies like AFP, AP and Reuters are heavily disincentivised to create fake news anyway but that's another topic).
At a certain level, I imagine social media apps will also encourage direct camera-to-post for documentation/videos of reality, since this will be the only end-to-end method to verify an image was created unaltered. I can imagine a world where, if you film a protest through the Instagram app, you'd get some kind of "this is real" badge on it, whereas if you upload a video, it gets treated as "could be AI" like 99% of all future content.
I mean, to be fair, Google's scam of how much GBs you have is very annoying and downright scandalous.
I had 16.5GB or so used up so it was flashing red. When paid for Gemini, my total space jumped to 2TB and my usage dropped to 12GB. Disgusting. So might as well switch to fastmail. Not sure.
Until retired as a professor, I used Thunderbird and the GPG plug-in to sign emails. That makes them immutable no matter who hosts the email server you use. I encrypted the emails holding grades, if the recipient said they were able to decrypt. Setup was non-trivial but very doable. I also used (and still use) a plug-in that clearly shows if any email fails DKIM or SPF (I think DMarc too).
Buried lede: Fastmail is using AI-generated code / words / decision-making systems, just like everyone else and following the same meaningless "principles" as everyone else.
> For our staff, we encourage understanding the tools that exist in the world, and how to use them safely. Our policy makes it clear that any use of tools, including tools with AI in them, must follow clear privacy-preserving principles:
Data Protection: All data protection, confidentiality, and privacy policies must be followed (our vendors for things like anti-abuse and support are moving towards using AI for translation, categorization, abuse detection – and we are ensuring that their policies continue to provide protection for our customers)
Accountability for work: Any AI generated writing or code must be reviewed and understood by a human being, and go through our regular second-set-of-eyes processes before being used
Bias awareness: Actively look for biases or hallucinations in AI output
Human authority: Always have a path for appeal to a human from any decision that is made by automated tools
Email is only part of my electronic memory. Over time it's become more important to me to maintain my own copies of my memory on devices I control. The forms and formats are many, and they all need a commitment to maintain control. So yes, use email over more mutable media. And avoid remotely mutable extensions to emails. And keep a local copy of your email. And maintain date-stamped archives of stuff you work on, and keep your codebases easy to run from any point in their history, and write good notes. Constant vigilance.
Where's the AI to address the number one issue I have with email?
If you count for automatically categorized Bayesian spam, it's about 99% noise.
That's one of the things that sucks about the current AI. Being employed by people that that are categorically opposed to using it to enhance privacy and filter advertising.
I have a completely unrelated question - why does their base custom domain plan starts at 60GB of storage? This has always escaped me. Not that one can use those surplus too many GBs in any other meaningful way (i.e. object storage, or something usable like Nextcloud, Seafile et cetera). This is odd. Just in case any founder or exec from Fastmail is lurking around here do have a look at it.
24 comments
[ 4.6 ms ] story [ 39.8 ms ] threadfastmail: read my lips: I pay you because you offer a traditional email service
if you add a single AI feature I will return to self hosting
Sort of. They can't change plain text, but modern emails often include vast swaths of remote content. When you open the message, it retrieves the relevant assets directly from whoever sent the email. That remote content is not permanently stored. It's cached for a bit and will not be re-used if the email is opened months or years later.
If those assets disappear or are changed, there's very little any email provider can do about that.
But proving to others that an email hasn't been modified is a more difficult task. As I understand it, you'd need to retain DKIM keys for the signing server, to check that historical DKIM signatures verify correctly and the old message was not forged or altered.
Are DKIM signing keys issued in some kind of Certificate Transparency log, where you can verify whether a particular DKIM key existed for a particular domain in the past, in order to do this in general?
I gotta be honest, this scenario is not a concern that impacts my choice of email provider.
But as in all cases, you can only be truly sure no one is tampering if you don't give it to anyone else.
The cameras used to document "news" will need to be watermarked, fingerprinted and authenticated, like what Canon and Nikon are already doing (and which AFP has already adopted).
It may have seemed gimmicky at first, but in a year or two, you'll probably only be able to trust visuals from companies that do this (wire agencies like AFP, AP and Reuters are heavily disincentivised to create fake news anyway but that's another topic).
At a certain level, I imagine social media apps will also encourage direct camera-to-post for documentation/videos of reality, since this will be the only end-to-end method to verify an image was created unaltered. I can imagine a world where, if you film a protest through the Instagram app, you'd get some kind of "this is real" badge on it, whereas if you upload a video, it gets treated as "could be AI" like 99% of all future content.
I had 16.5GB or so used up so it was flashing red. When paid for Gemini, my total space jumped to 2TB and my usage dropped to 12GB. Disgusting. So might as well switch to fastmail. Not sure.
In fact until recently email was sent and received in the clear like a postcard, the whole system wasn't designed to be secure or secret in any way.
> For our staff, we encourage understanding the tools that exist in the world, and how to use them safely. Our policy makes it clear that any use of tools, including tools with AI in them, must follow clear privacy-preserving principles:
If you count for automatically categorized Bayesian spam, it's about 99% noise.
That's one of the things that sucks about the current AI. Being employed by people that that are categorically opposed to using it to enhance privacy and filter advertising.