• PC World
• »Software
• »Browsers & Add-Ons

SAN FRANCISCO -- Between spam and viruses, e-mail is taking a battering as users' favorite online application. Add to that privacy concerns and a few emerging alternatives such as messaging and voice telephony, and the killer app may be losing favor, say some experts at the recent E-mail Technology Conference here.

No single product or technology will keep our inboxes clean or our computers safe, speakers and attendees agreed. But some say it won't be possible to sufficiently stem the tide.

Trust No One

The first step to secure e-mail is to force accountability by identifying who is sending the message, say many analysts.

Two promising e-mail authentication systems are under development. One is Sender ID, which combines Pobox.com's Sender Policy Framework (also known as Sender Permitted From) and Microsoft's Caller ID for E-mail. The other is Yahoo's DomainKeys.

Sender ID maintains lists of IP addresses from which sent e-mail can be traced. DomainKeys uses a set of private and public encryption keys to validate the IP address (or domain) of the sender, and to verify that the message's contents haven't been altered.

Even the developers admit spammers and phishers will find ways to fool these security techniques by making their messages appear to originate from trusted domains. Authentication alone is insufficient, said John Levine, who chairs the Anti-Spam Research Group, at the conference's "E-mail and Free Speech" wrap-up session. "All SPF can say is...this message is domain-verified," he said.

Similarly, the speakers agreed nearly unanimously that the Federal Trade Commission's recent rejection of a Do Not E-mail registry was correct. Sponsor Senator Charles Schumer (D-New York) and other members of Congress had hoped to model a list after the successful Do Not Call list for telemarketers. But unlike phone calls, which can nearly always be traced to the originator, spam is rarely sent from the address in the "From" field, and spammers' use of open relays makes messages untraceable. Also, securing such a list is essential, the speakers noted. If a list of valid e-mail addresses fell into the hands of spammers, they'd use it for nefarious purposes.

Early-Warning Systems

Another point of contention is the role of users in e-mail security, particularly as viruses are primarily spread through e-mail. Internet pioneer Dr. Vinton Cerf described his concept of "cyberhygiene" in his Thursday morning keynote address.

"We really need to educate ourselves and our colleagues to update [our] virus protection," he said.

Even the most conscientious e-mail user finds it difficult to keep up with the virus writers, however. Current antivirus defenses are outdated, said Mark Sunner, chief technical officer with e-mail security service provider MessageLabs, in a session on "E-mail's Future: Trends, Trials, and Tribulations."

"The model of virus protection has not changed in a decade, but the model of viruses has changed dramatically," Sunner said.

Viruses do the most damage in the first few hours of their attack, before antivirus vendors can isolate them and develop defenses for customers to download during regular updates. Speakers cited new early-alert services by several e-mail vendors. The services monitor a large swath of worldwide e-mail traffic, watching for patterns similar to those preceding a virus attack. When that occurs, the service warns customers to raise their e-mail defenses until patches for the new virus become available.

E-mail appliance vendor IronPort Systems offers such a service with its Virus Outbreak Filters. The company uses its SenderBase e-mail reputation service to give customers an early warning of a virus release. SenderBase analyzes approximately 3 billion e-mail messages a day from about 28,000 ISPs, large organizations, and universities. IronPort estimates that this represents one-quarter of global e-mail traffic.

New Options Emerge

E-mail could also slip in popularity, several conference speakers suggested.

Already threatened by spam and viruses, e-mail technology is becoming less user-friendly, they said. As new messaging alternatives emerge, some users may prefer instant messaging or other methods.

Our reliance on e-mail could quickly become slavery, Cerf said. He gave the example of an exchange that might entail a three-day e-mail chain, but which could be handled in a five-minute phone call.

Adopting a new messaging medium may bring short-term relief, however. Several attendees predicted that as people migrate to IM, voice over IP, and other new means of communication, spammers and virus writers will be close behind.

Privacy was also cited as a threat to e-mail's effectiveness, possibly greater than viruses. But people are also more accepting of an erosion of privacy in the current political environment, said Philip Zimmermann, creator of the Pretty Good Privacy (PGP) encryption system, in a keynote address.

"The erosion of privacy [is] a by-product of Moore's Law," Zimmerman said, citing the Intel founder's declaration that computing power doubles every 18 months. Applied to privacy, Zimmerman said, the capability of computers to track us is doubling every 18 months.

Next: Privacy Erodes?

Zimmermann expressed disappointment that so few people encrypt their e-mail.

"The power users, the cognoscenti, will use PGP, but your mom won't," he said. Encryption technology is not likely to be widely adopted until there's a way to keep users from having to deal with "distractions," he said. "Users need to deal with an invisible encryption proxy that links to the mail server without them being aware of it," he said, citing the Hushmail Web-based encryption service as an example.

ISPs regularly filter the contents of e-mail to identify viruses and suspected spam, but Google's Gmail service has raised concern from some privacy advocates by going a step further, presenting ads based on the message's content.

Filtering presents a slippery slope, said Lee Tien, senior staff attorney with the Electronic Frontier Foundation, in a session on e-mail and free speech.

"Spam has made people comfortable with the idea that someone is filtering their e-mail," he said. From a legal perspective, this "erodes any argument that you have an expectation of privacy" in your e-mail, Tien said. He pointed out that the profile Gmail creates, and the subsequent ads it serves based on that profile, could be subpoenaed. While people trust Google with their personal information, the service could someday be sold to another company that may not be as trustworthy.