AI & Email Immutability: Examining the Challenges

To ensure responsible AI usage, our staff is encouraged to understand available tools and their safe application. Our policy mandates that any tool use, including AI, adheres to privacy-preserving principles.

Data Protection

All data protection, confidentiality, and privacy policies must be followed. Vendors for anti-abuse and support are integrating AI for translation, categorization, and abuse detection, and we ensure their policies protect our customers.

Accountability

A person must review and understand any AI-generated writing or code, which must undergo standard review processes before use.

Bias Awareness

Actively seek biases or hallucinations in AI outputs.

Human Authority

There should always be a way to appeal an automated tool's decision to a human.

Plain text is unchangeable, but modern emails frequently incorporate remote content. Opening an email retrieves assets directly from the sender. This content isn't permanently stored; it's cached temporarily and not reused if the email is opened later.

Email providers have limited control if these assets disappear or change.

AMP messages can dynamically change displayed content in Gmail over time. The sender can't use it as a read receipt because the provider can state, "Our infrastructure performs this operation for the user for immutability purposes," like other email operations that proxy requests for privacy.

While seeing your email update with tracking progress can be neat, a new email would suffice.

While perhaps no one outside the company ever saw the plaintext version of emails, it proved useful for content verification by outputting the full message content to the console.

Customers may not appreciate receiving only plain text emails. The mechanics of email formatting are quite simple, though complexity arises when trying to be fancy.

HTML email's vulnerability is its content's potential location.
Text-only email remains prominent and widely used for this reason.

Apple’s private loading feature offers a fix: the mail server retrieves and saves referenced content, preserving what was served when the message was sent.

My choice of email provider isn't swayed by this.

Cameras used for documenting "news" will require watermarks, fingerprinting, and authentication, as Canon and Nikon are implementing. Social media apps may promote direct camera-to-post for unaltered reality documentation, potentially marking content filmed through the app as "real" while treating uploaded videos as potentially AI-generated.

AI could likely detect if a screen is being recorded.

Manipulating media has become easier, but courts have always dealt with manipulated evidence. Lawyers need to carefully select jurors who aren't easily swayed by AI manipulation.

Watermarking at the source and social media platforms using it to make a clickable/hard watermark are important.

The real danger lies in the fact that most users disregard mainstream media, and a system requiring signed photos from camera hardware wouldn't significantly curb the spread of misinformation, as people readily believe images with text.

This limits bad actors to the platform itself. The audience must learn new ways to "trust", and technology alone will not suffice. I put more faith in new social norms.

LIDAR sensors could verify depth information in images.

It seems unlikely Instagram, owned by someone keen on AI, would do this.

Cameras can record screens playing AI-generated videos and authenticate them. While detectable now, screens will adapt as elections hinge on it.

Using a mirror over the LIDAR sensor defeats the "record the screen" hack.

People will have to take responsibility. Test extraordinary claims, even from leaders, before relying on them.

It is already possible to create realistic sets using Stagecraft studios, where actors are filmed surrounded by massive LED walls displaying dynamic digital sets.

Proving an email's authenticity to others is challenging. It involves retaining DKIM keys to verify historical signatures and ensure the message's integrity.

Check if DKIM signing keys are in a Certificate Transparency log to verify their past existence for a domain.

Email was originally insecure. From the article: "An email is your copy, and the sender can’t revise it later." One can only ensure no tampering has occurred if the email remains private.

If Fastmail adds AI features, I will revert to self-hosting.

Domain age, IP, and DKIM/DMARC compliance are important. Switching to hosted email resolved delivery issues.

Replying to emails from a domain can prevent being blocked. This may not work for cold emails.

Gmail ignored my email server despite having a Class C IP range and a 30-year-old domain.

Before sending emails, use mail-tester.com to verify DKIM setup and IP blacklist status.

I aim to dogfood an AI assistant that helps developers understand unfamiliar bug reports instead of using Google or Slack.

Google's AI overview often surpasses our proprietary AI assistant.

Adding users to a Fastmail billing plan requires each user to have their own paid plan, which may not be ideal for family members. I had hoped for a discount for multiple accounts.

Paying for Gemini increased my storage space, but my usage dropped. I might switch to Fastmail.

Automatically categorized Bayesian spam is largely noise. The problem with current AI is that employers are against using it to improve privacy and ad filtering.