We’ve lost the most widespread service on the Internet to an entire generation. Most people under about 25 don’t use electronic mail by choice, largely because it’s so infested with spam.She notes that:
They seem to be supplanting it not only with IM, but with private messages sent through social sites (MySpace, or any other blogging site that is allowing user registration and private messaging). The latter has the advantage over regular email in that it’s easier to secure from spamming. Comment spam is still a problem, but PM spams aren’t because the ONLY way you can send a PM is to register by hand. Spammers still try to abuse one site or another, but they’re detected quickly and kicked off; they can’t automate the process enough to make it worth their while. Social sites’ software by and large doesn’t support bulk private messaging.Plus mobile phone text messages. That seems to be what I see, too. And this isn’t a lot different from what I do; I use mail all the time, still, weeding through the spam, but I do most of my correspondence in smallish mailing lists that I can easily file and read in a bunch, and I use forums such as this blog, plus the occasional mobile text message. Younger folk text a lot more than I do and don’t have near the same tolerance for spam; after all, they’ve never known mail without spam.
I don’t know if I agree with her diagnosis of the problem with mail.
She says:
When you get right down to it, the problem with email is that the relaying itself doesn’t require any central registration or verification of the sender, and you can hit the same target from ANY given point, so you just go where the security’s weakest.
Sender verification can be good, but why does it have to be central? As noted in a previous post, an outfit called MessageLevel offers effective authentication without a central Internet authority. (Full disclosure: I’m on their technical advisory board.) And of course social sites offer registration and verification that does not centralize those functions for the entire Internet.
We’ve seen all this before, on USENET, and back in the fragmented days of BBSes (bulletin board systems, the non-networked single machine conference systems that were popular back in the 1980s). And that’s the problem with distributed registration and verification: fragmentation. The big advantage of the Internet and of electronic mail is its global reach including most everyone.
This is of course also exactly what spammers abuse.
Wendy continues:
Of course, regular postal mail doesn’t have the huge abuse problems either, because it’s more centrally controlled AND it costs the senders to use it. If we took either one of these steps in the email realm, we could reduce the number of problems. But as long as nobody wants either option, we’ll still have a wild wild west for email.
I think paper mail has abuse problems; I throw out about half the mass of the mail I get. I would be some significant fraction of the volume of landfills is made up of unwanted catalogs. Sure, it’s less of a problem than for real (electronic) mail.
But I see no reason to assume that centralization and sender-pays are the only possible solutions simply because they’re what paper mail uses. Centralized means single point of failure, whether via lack of innovation (which has often been the U.S. Postal Service’s problem), via attack by miscreants, or political gaming. Distribution and decentralization are the major strengths that let the Internet grow; let’s use them.
However, Wendy saved the most important question for last:
The question is whether the preference for social sites will end up altering the organization of the Internet. In other words, will people group themselves willingly in the absence of centralization, to gain the security benefits? It was a good argument for tribes at the beginning …
I’ve seen newspaper articles about the phenomenon of younger folk using IM, social sites, and texting in place of electronic mail, and they all seem to miss the bigger point. If everyone younger than some age, maybe 25, does this, then the organization of the Internet is already altered. And not just now, for the indefinite future.
We old farts can continue using our email just like many over-60s continue watching the evening news on broadcast TV. A dying medium can continue to have some life as long as its original audience stays alive, but that doesn’t mean that a generational shift isn’t already happening.
In the case of social sites, the question I’m surprised isn’t more prevalent is: when will they interconnect? Maybe I shouldn’t be surprised, because we’ve seen this before, with BBSes, and with walled gardens such as CompuServ, Prodigy, and AOL. I still remember when I asked a CompuServ rep for his electronic mail address in the late 80s, and he gave me only his CompuServ address, because that was all that was important; just ask him. CompuServ and Prodigy are no more, and they and AOL long ago got connected, kicking and screaming.
Will this happen to the social sites, too? And how does it happen without spam piggybacking? Surely in a distributed P2P Internet there must be a distributed solution. Surely in an era when social sites are selling for megabucks, it’s going to happen, and whoever does it right will make big money on it.
-jsq
PS: Sometimes I feel like a superannuated replicant:
I’ve seen things you people wouldn’t believe. Attack ships on fire off the shou lder of Orion. I watched C-beams glitter in the dark near the Tannhauser gate. All those moments will be lost in time, like tears in rain. Time to die.
Roy Batty, Blade Runner
When will they interconnect? No knowing, but I’m sure the minute they do, the benefits of centralization by group will erode and we WILL see the spam piggybacking on it. Anything P2P that refuses to centralize at least to some extent will (by its very nature) end up trusting more and verifying less in the interests of greater connectivity. The spammers will slip into those gaps.
I hadn’t heard of MessageLevel before, but yes, a three-way handshake would work — assuming you’re not talking to a phisher:
Phisher: Hi, we’re closing your account!
Victim: Say, did you send this message?
Phisher: Why, yes, I did!
Victim: All righty, then!
Sure, it’ll protect against spoofing of well-known addresses like “customerservice@citi.com,” but it’ll still fool people who don’t know that “customerservice@citibnk.com” isn’t legit. And it won’t do a thing to stop “E4FEWOI@jasureyoubetcha.org” from telling us all about v!agra.
How are you going to validate an email address without looking it up in an authoritative directory? And how is the directory going to be authoritative without being at least to some extent centralized?
Riddle me THAT, Boy Wonder — er, Superannuated Replicant!
Home again, home again, jiggity-jig.
PS – I always forget about mobile phone text messaging because I SO got over that in the mid-’90s.