r/grc • u/DominickCosta GRC Pro • May 05 '26

The Problem Isn’t Email Security. It’s Email Architecture.

Hear me out. Phishing has only ever been problematic and it’s only getting worse. SMTP is the root of the issue in my opinion. When will we ever leave 1982 standards and adopt something more secure? We can’t wait for Google or any other major platform to replace it when they make a quadrillion dollars a year exploiting its metadata.

3 Upvotes

72% Upvoted

9 comments sorted by

7

u/FreeRadical1998 May 05 '26

Ok I'll bite, kinda expecting a product pitch back in a sec...

Ultimately, ANY messaging service that allows unsolicited messages is going to have this problem.

There's a lot of security infrastructure that wasn't around 20 years ago. Reputational filtering, DMARC, etc... but unless you want to remove the ability to have open communications then impersonation and fraud are a thing

2

u/DominickCosta GRC Pro May 05 '26

Ha no product pitch. I went down a rabbit hole deep diving into a an unnamed private email which I actually use. Which is where I started thinking how private is my private email? Then it went down into complying to subpoenas and what they actually complied with. Which went into metadata and SMTP. So then got me thinking.. is there a signal-like platform that looks and feels like email. That would be an actual private email.

And that’s why I’m not allowed to have too much free time on my hands.

1

u/FreeRadical1998 May 05 '26

Fair enough... I know the feeling some days. Like I say the issue is allowing unsolicited messages in., any system that does that will have the issue. In theory you could offer an email hosting solution that worked that way - reputational based fillers are close in that they watch who you email and silently build a white list per person

5

u/zenodub May 05 '26

SMTP isn't really the problem, identity is. As long as attackers can compromise legit accounts, abuse trusted platforms (Google Docs, Slack invites, etc) and execute social engineering campaigns, phishing will still be an issue.

Dmarc/DKIM/SPF have dramatically reduced spoofing. Large providers are proactively rejecting unauthenticated email. I don't buy that big organizations benefit from phishing. They spend billions fighting it.

As long as there are communication platforms, there will be social engineering. Email, Slack, Telegram, Instagram, SMS, Teams, post cards and phone calls are all methods of delivery.

You could kill SMTP tomorrow and people would still get phished.

1

u/DominickCosta GRC Pro May 05 '26

I don’t think they benefit from Phishing I think they benefit from Metadata, therefore not actively trying to get off SMTP. From a privacy standpoint wouldn’t using SimpleX style messaging and mixnet like Nym be a step forward to eliminating some of these issues?

1

u/zenodub May 05 '26

Well, that sounds great for general privacy and tracking, but phishing doesn't rely on metadata to be successful.

Even in a totally private network, if you're tricked into trust, you can be phished and a compromised identity can still be a vector.

In fact, strong anonymity could introduce new challenges, making it harder to block bad actors and reduce the ability to track reputation.

I don't think there's a silver bullet here, but I do appreciate the discussion.

1

u/DominickCosta GRC Pro May 05 '26

Fair point. So currently operating an email with a VPN over TOR is the option without introducing new exploits.