The modern global email ecosystem is not a nice place. For the most part, it is not hostile, but certainly adversarial. The distinction is that adversaries are just frustrating or annoying. Adversaries are people who send you email you don’t want, or in other ways are just plain difficult or obnoxious. Hostiles are those that attempt to do actual harm. They are bad actors who attempt to steal money/data, and extort you or compromise your assets. An easy way to distinguish is one is very illegal, one isn’t.
Enveloperty is a full email system designed to address the modern email paradigm. That is to say, address the adversarial nature of modern global email. Enveloperty primarily addresses adversaries, not hostiles. Enveloperty is meant to efficiently remove said nuisance’s to greatly improve the experience of email users. Enveloperty offers resistance, but is not designed to take on for example persistent threats.
The Modern Email Paradigm
Email was originally designed for a civil society. The original emailers were respected engineers and scientists, and the wishes of everyone involved were respected. Which is why the single account, single folder approach worked. As more people started using email, less respect was shown as the community devolved into strangers. However, the fundamental email principles were never revised to address the evolving paradigm. Instead, stop gap measures such as spam filters were installed. Measures such as those treated the symptoms of rogue emailers, but will never solve the actual problem. Today there nearly every business entity and many individuals want to send you email, which you probably don’t care to receive. There is a $20 billion market for email marketing. In short, there are 20 billion reasons for people to ignore your wishes and get email to you. Which is why the power advantage must be taken away from the sender, and established with the receiver.
Enveloperty’s Solution
The root problem with traditional email, is that bad actors can reach victims at all. In traditional email one user has one account with one email address. Once that email address is leaked, the user is forever susceptible to have unwanted and even malicious email sent to them. The user can either choose to invest a great deal of effort by creating a new email account. Or they can rely on spam filters to haphazardly intercept bad email.
We wondered what would happen if instead of having one email address, a user had infinite email addresses. This way each contact would have a address to send email, and if something went bad, that address could be trashed with a click of a button. Once the leaked address is deleted, all adversaries and hostiles alike have to start back at square one. In essence, Enveloperty is trying to stop the invasion at the beachhead. Where defense is the most simple and effective.
Enveloperty’s technique is a implementation of the classic dead drop tactic most will recognize from spy culture! The innovation is that Enveloperty engineered a way for the implementation to be efficient and simple in application with email. This is excellent because the principles of the dead drop have been battle tested and withstood the test of time. In general when it comes to infosec, simpler is better. As time goes on, more and more sophisticated implementations of a simple concept can be applied for greater effect.
Traditional email is like having a single PO box in a massive post office. Enveloperty is like having an entire post office. Approved senders essentially dead drop their email into the Enveloperty users post office using the specific email address the Enveloperty user gave them. Then when the user wants to read their important email, contents will be collected from the specific PO boxes containing important mail as defined by the user. This way, approved senders will have been told by the user where to send their email so it will get through immediately without hassle. However, senders without approval have one shot to guess a read PO box, or their email will never be read unless the user wishes otherwise.
Pictured above is an example of what unauthorized senders are faced with when attempting to send email to an Enveloperty user. Infinite unlabeled PO boxes, where they have one chance to put their email into a read PO box, or else they get kicked out by security. At the same time this does not faze approved senders, because they would have been given explicit directions like “second big box from the bottom left” to deposit their mail into a read box. Even if these instructions are leaked, there are immediate safeguards. Each box is only supposed to contain mail from one entity. So if authorized Bob put his mail in the right place, and then an attacker put their mail in the same box. The user would immediately know a breach occurred because there is only ever supposed to be email from Bob in that box. The user can give Bob instructions for another box, and told to straighten out his opsec, leaving the attacker in the dark again.
Another important feature of this system is that unless specified, no boxes are cleared out. So if there was some mistake and Bob put his email in the wrong box. The user can either look around for it, or can ask Bob where he put his mail. All mail is caught and persisted for a time, so there is plenty of margin for error for authentic email.
The only check done on email is to authenticate that it came from where it says it did. This check is called DMARC and is a standard in email. There are no lengthy or AI checks to interfere with email delivery. This means email is delivered immediately. An important quality in high volume or time sensitive exchanges making the experience more enjoyable.
Adoption & Evolution
The primary way to experience Enveloperty is through the full system solution. This includes a custom built Enveloperty back end, user interfaces, and mobile apps. However it has been challenging to get people to take such a leap from their traditional system To accommodate these more cautious adopters, Enveloperty is developing add-ons for Gmail and Outlook. The full Enveloperty system has allowed for downloading email from any IMAP or POP3 system. But with the add-on, users can retain the reliability and familiarity of legacy email systems while experiencing a portion of Enveloperty’s ingenuity. As ever however, to experience everything Enveloperty has to offer, the native solution must be used.