Great, this solution obviously addressing a burning need. May I ask, were previous solutions free and work on nearly all email clients?
I don't really see any major race happening. The best information grabbing tool already works great - people's eyes. The purpose of this tool is just to make forwarding a little harder, and add auditing and watermarking for environments where this added information can be acted on.
Thanks, I'll try to address as many of these as I can. I've broken a few of these into groups below, as I think they have similar solutions.
====
I) Where's the utility of this tool?
> Right-click -> Save Image as -> forward to anybody you want
1) The purpose of this demo is just to establish if anyone finds this type of service useful. There are many ways to expand this technology so that it becomes far more complex to defeat.
2) Perhaps I've sent this information to many people, but I've automatically watermarked each image. Now I can track the information leak back to you and carry out some more traditional corrective procedures...
3) Maybe this product just isn't for you? Perhaps this product is best suited for companies and government organizations, where clear policies and penalties already provide effective deterrents. This service would just supplement these policy-instruments with additional automated protection, auditing and watermarking.
===
II) Minor technical challenges:
> Most email readers block images by default
It's easy enough to turn images on, in the most widely-used clients. Just looking at my inbox, embedded images are far from uncommon in emails.
> Answering by quoting your email just got really hard.
Answering by quoting email works great, if you're alright with quoting everything. The SMTP integration supports full HTML emails and shows the quoted email very similarly to the way that Gmail does.
====
III) Accessibility vs data protection tradeoffs. These are fine:
> Disabled persons who rely on screen readers and other assistance technologies just got screwed, thanks.
> Your email picture service is down or has server trouble, no recipient can read such mails anymore.
====
IV) Solvable problems:
> I've read your email at the office, now I can't read it at home, or on my iPhone, or vice versa.
This is solveable. See my other comment.
> Searching trough email by text will never find those emails because they contain no text.
Devices with small screen sizes (iPhone and the like) can't re-layout the text (as in word wrap), making such image emails really painful to read.
NOFWD keeps an archive of the messages you send through it (which you can choose to delete or disable if you wish.) You can search this.
====
V) Are these really a problem?:
> Some email services download images for you and don't link to your server.
Really? I'd like to know which. Haven't seen this happen yet.
> Cryptographic email signing becomes meaningless as the recipient can't parse the signature and message body to verify the hash.
> A lot of spam filters might screen out emails that are nothing but an image.
Temporary solution: If you have multiple devices, you can create an account on NOFWD, and log into nofwd.com from each device. Now, NOFWD will see all of your devices as a single entity, and not self-destruct your messages that you view. This behavior can be ended by logging out again.
Long term: More generally, I want to expand the fingerprinting and management technology, so that the system can automatically learn users and not flag false-positives. Imagine how Paypal or Facebook detects that you're not logging in from one of your usual locations.
NDAs and other legal contracts are one existing solution to this problem, but those are very slow and heavy-weight. This is meant to be very fast and light-weight. Neither solution is bulletproof. Instead of choosing though, you could use both!
I created this project because I was tired of seeing my friends violate the confidentiality of our private conversations, by constantly forwarding our emails to third parties. As you at HN will understand, 100% unbreakable rights management of digital content is physically impossible. That said, I think that this tool has great value, at least for people who face the same problem that I had.
Currently, you can use this tool manually, via the demo page, or you can integrate with your email client via the SMTP integration method. I'd like to find some way to streamline the setup process for the SMTP integration. Any ideas?
Other applications for this service:
- Use in addition to email disclaimers and confidentiality agreement footers at the bottom of emails.
- Watermark emails for tracking purposes.
- Supplement existing internal corporate policies for information disclosure.
- Provide additional auditing support for email access-control.
- Delete email messages after they have been sent.
Caveats:
- Currently detects all access attempts from the same computer as one single recipient. Likewise, accessing an email account from multiple devices will be detected as multiple recipients. I.e. each computer == one recipient.
In the cases where there are no physical-world measurements, as with inputs and outputs to many machine learning problems, it is math. "Experiments" using randomized algorithms and measuring the results, themselves, certainly don't qualify as science.