Re:Brave Search removes last remnant of Bing from search res...
by derefr on Thursday April 27, 2023 @08:23PM
(#35736150)
> I can think of no valid reason why a (supposedly privacy-respecting) email relay service should require a browser extension to be installed.
I can answer this one: they're fine with not knowing who anyone is, but they're trying to make sure that each account maps to one real person — they're trying to prevent spammers from registering thousands of accounts, and from continuously registering more accounts whenever they get banned.
A browser extension that feeds their service a heartbeat packet every once in a while from a particular IP address, is a Proof of Identity. It ties the email account accessed through that browser, to a browser installation of the extension, such that you can only actively use as many email accounts as you have devices x installed browsers (which might be a surprisingly large number to you, a human; but is still a problematically low number compared to the number of accounts the average spammer wants to register — especially when most of those accounts get banned in short order.)
This is a workaround for the fact that there's as-of-yet no such thing as an "anonymous identity verification service" — something like an OAuth IdP that deduplicates users on the client-to-agent side through strong identity verification on registration (photo of your passport, webcam picture with this hand gesture, you know the drill); but then protects client anonymity on the agent-to-service side. If you had to SSO to your DDG email through such a service, then they very likely wouldn't be asking you to install the extension.
I can answer this one: they're fine with not knowing who anyone is, but they're trying to make sure that each account maps to one real person — they're trying to prevent spammers from registering thousands of accounts, and from continuously registering more accounts whenever they get banned.
A browser extension that feeds their service a heartbeat packet every once in a while from a particular IP address, is a Proof of Identity. It ties the email account accessed through that browser, to a browser installation of the extension, such that you can only actively use as many email accounts as you have devices x installed browsers (which might be a surprisingly large number to you, a human; but is still a problematically low number compared to the number of accounts the average spammer wants to register — especially when most of those accounts get banned in short order.)
This is a workaround for the fact that there's as-of-yet no such thing as an "anonymous identity verification service" — something like an OAuth IdP that deduplicates users on the client-to-agent side through strong identity verification on registration (photo of your passport, webcam picture with this hand gesture, you know the drill); but then protects client anonymity on the agent-to-service side. If you had to SSO to your DDG email through such a service, then they very likely wouldn't be asking you to install the extension.