Senders is focused on email infrastructure, email scaling, email deliverability, and email sendability. We are trusted by over 60 venture-backed companies with making sure their emails are being sent and delivered, and avoiding the spam folder. Our service offering covers: 1. Deliverability infrastructure. Setting up and maintaining systems that allow for safely scaling up email sending, including for cold (sales) email. 2. Account assistance. Maintaining well-organized and hygienic cold email outbound setups. 3. Strategy. Advising companies on what is working and what to expect. Please reach out for our overview deck, pricing, or partnership opportunities.

Senders

senders

Popular mailbox providers, Google and Yahoo, pioneering the safe email movement, recently put forth new email authentication mandates for email senders. The latest requirements are not only aimed at providing their users with a spam-free inbox but also significantly reducing the risks of direct domain spoofing and email phishing attacks. Email-based cyberattacks have been relentlessly plaguing inboxes, despite various controls enforced by mailbox providers due to the ever-evolving and sophisticated nature of the attacks. Cybercriminals are often successful at bypassing spam filters and creeping their way into the user’s inbox, often impersonating legitimate organizations and individuals. This not only poses an imminent threat to the recipient of these malicious emails but also causes serious damage to the reputation and credibility of the impersonated company. Your Checklist for the New Google and Yahoo Email Sender Requirements Starting early next year (2024), bulk message senders would be expected to adhere to the following requirements: Gmail and Yahoo Email Senders Need to Authenticate Their Emails Message senders often send emails that are not authenticated making it very easy for attackers to impersonate their brand or alter their messages in transit. The renowned mailbox providers recognize that validating email sources is a crucial aspect of email security that will restrict unauthorized messages from reaching their users, and subsequently scamming them. Google and Yahoo have announced the need for bulk senders to authenticate messages using standard email authentication protocols like SPF, DKIM, and . DMARC These industry-acclaimed best practices go a long way in distinguishing between genuine messages and fake ones by verifying the message’s source and content. Businesses are often impersonated in phishing campaigns, wherein their legitimate domain name is forged to send emails on their behalf. These attackers use social engineering to launch highly targeted attacks that have a high success rate. Email authentication, along with other security measures have been proven to be effective strategies in reducing and mitigating a wide range of email-based threats. Emails Should be Easy to Unsubscribe In their latest requirements, Google and Yahoo have stressed the importance of making emails easy to unsubscribe, preferably with a one-click unsubscribe option for recipients. This ensures their users only read emails that they are interested in and filters out those that may be considered spam or unnecessary. While email senders are free to send bulk messages for commercial purposes, an unsubscribe button gives recipients the ability to choose which emails they want to keep receiving and which they don’t. The primary purpose of this stance is to ensure an optimal emailing experience for Gmail and Yahoo users, encouraging them to keep their inboxes spam-free and decluttered. A clean and organized inbox with emails that add value to the users, promotes an active commitment toward customer satisfaction. Emails Should Be Interesting to Receivers Finally, with regard to the last requirement, senders should consider their recipient’s interests while curating the emails they want to send. A two-way approach towards spam reduction wherein on one hand, the recipient is able to easily unsubscribe from your emails, while you curate emails that may actually be of value to your readers - together work in unison to provide an enhanced communication experience that is also effective and beneficial to both parties. The Need for Email Authentication Enforcement: Why Now? Spam is an inbox villain that everyone wants to get rid of. While spam may cause some discomfort and inconvenience, phishing emails are not so merciful. These malicious emails often creep into mailboxes in the garb of a genuine company and spread malware, ransomware or initiate wire transfers. They inflict financial harm upon the victims, while also causing reputational damage to organizations without their knowledge. This is why email authentication is truly the need of the hour with major email service providers extending their support and encouraging adoption with immediate effect. Email Authentication is also taking precedence in other sectors, as the PCI Security Standards Council recently announced DMARC as a mandate for version 4 compliance. To comply, organizations must implement a of at least p=quarantine/reject. DMARC policy While it is a future-dated requirement, organizations are expected to adhere to these latest requirements by March 2025. Get Ready for the Upcoming Google & Yahoo Email Policy Changes - Summary of Requirements To summarize Google and Yahoo’s upcoming email sender requirements, here is a quick checklist that you can refer to: Authenticate your emails against SPF, DKIM, and DMARC Add one-click unsubscription to your emails Send emails that interest your recipients When Does Enforcement Begin? As mentioned by Google and Yahoo, enforcement is projected to begin in February 2024. The Google and Yahoo email policy changes will apply to bulk message senders sending messages to Gmail and/or Yahoo users. You will qualify to fall under the “bulk message sender” category if you send out more than 5000 emails per day. This is a common practice for organizations that frequently send out sales or marketing emails, and the new requirements are aimed at restricting these organizations from spamming the inboxes of recipients with unwanted messages while also protecting them from phishing attacks. Configuring DMARC to Meet Google & Yahoo’s Compliance Mandates From the top level, configuring DMARC and email authentication for your emails may seem like a cakewalk as it simply requires you to publish a DNS TXT record. However, that is just the tip of the iceberg. Technical protocols such as these require granular knowledge of technologies and are easy to get wrong - leading to configuration, syntactical, or other errors. This is why leading organizations fall back on PowerDMARC’s and email authentication services, for an effortless and hassle-free experience. hosted DMARC PowerDMARC Helps You: Meet faster, with automated record generation and setup Google and Yahoo’s email security requirements Monitor and optimize your configurations on a centralized dashboard. Make a smooth transition from DMARC monitoring to enforcement and protect your emails and domain name against spoofing attacks - without compromising on deliverability. Examine detailed insights on your email’s behavior and domain activity with the help of simplified reports, to troubleshoot errors. Mitigate SPF errors 10x more effectively with . SPF Macros Get round-the-clock dedicated assistance from an experienced domain and email security expert. PowerDMARC has helped thousands of customers meet compliance requirements for Google and Yahoo. Complete your checklist before 2024 - sign up for our today! DMARC analyzer

Google & Yahoo Email Senders Must Authenticate Emails by Feb 2024

Google এবং Yahoo ইমেল প্রেরকদের অবশ্যই 2024 সালের ফেব্রুয়ারির মধ্যে ইমেল প্রমাণীকরণ করতে হবে

E-Mail-Absender von Google und Yahoo müssen ihre E-Mails bis Februar 2024 authentifizieren

Los remitentes de correo electrónico de Google y Yahoo deben autenticar los correos electrónicos antes de febrero de 2024

Les expéditeurs d'e-mails Google et Yahoo doivent authentifier leurs e-mails d'ici février 2024

Google और Yahoo ईमेल भेजने वालों को फरवरी 2024 तक ईमेल प्रमाणित करना होगा

Google と Yahoo のメール送信者は 2024 年 2 月までにメールを認証する必要がある

Google 및 Yahoo 이메일 발신자는 2024년 2월까지 이메일을 인증해야 합니다.

Remetentes de e-mail do Google e Yahoo devem autenticar e-mails até fevereiro de 2024

Отправители электронной почты Google и Yahoo должны проверять электронную почту к февралю 2024 г.

Google ve Yahoo E-posta Gönderenlerin Şubat 2024'e Kadar E-postaların Kimlik Doğrulamasını Gerçekleştirmesi Gerekiyor

Người gửi email Google & Yahoo phải xác thực email trước tháng 2 năm 2024

Google 和 Yahoo 电子邮件发件人必须在 2024 年 2 月之前对电子邮件进行身份验证

Secure and Dynamic Publish/Subscribe: LCMsec: LCMSec: The Proposed Protocol

JavaScript Loops for Beginners: Learn the Basics

নতুনদের জন্য জাভাস্ক্রিপ্ট লুপ: বেসিক শিখুন

JavaScript-Schleifen für Anfänger: Lernen Sie die Grundlagen

Bucles de JavaScript para principiantes: aprenda los conceptos básicos

Boucles JavaScript pour débutants : apprenez les bases

शुरुआती लोगों के लिए जावास्क्रिप्ट लूप्स: मूल बातें सीखें

初心者のための JavaScript ループ: 基本を学ぶ

초보자를 위한 JavaScript 루프: 기본 사항 배우기

Loops JavaScript para iniciantes: aprenda o básico

Циклы JavaScript для начинающих: изучите основы

Yeni Başlayanlar İçin JavaScript Döngüleri: Temelleri Öğrenin

Vòng lặp JavaScript dành cho người mới bắt đầu: Tìm hiểu những điều cơ bản

初学者的 JavaScript 循环：学习基础知识

Traffic Filtering: BPF, XDP, and FPGA Hybrid Solutions

Many people don’t realize opting out of spam emails is an easy way to receive more junk mail or even infect a device with malware. Even opening a suspicious message could result in losing security or privacy. What are the risks of unsubscribing? Why Should You Never Unsubscribe From Spam Emails? At best, unsubscribing from spam lets the sender know the account is active, prompting them to send more emails or sell the recipient’s contact information on the dark web. At worst, what appears to be an annoying or sketchy message is actually a phishing attempt — meaning clicking anything could infect the device with malware. As of the beginning of 2024, about 46.8% of global email traffic is junk. Most people have evolved to detect and defend against it since it’s so prevalent, but they can’t catch every suspicious message. If one manages to evade filters and ends up in the inbox instead of the spam folder, it’s up to the recipient to deal with it. Does the unsubscribe button work on spam emails? Generally, no. In the best case, spammers can ignore unsubscribe requests. In the worst case, the unsubscribe button will take users somewhere — to be attacked. The malicious link directs them to a fraudulent website that looks legitimate — the scammers recreate real pages because it helps them trick people — but is really a medium to infect their device with malware. These messages are annoying and intrusive on purpose: scammers want users to open and interact with their messages. Around 71% of phishing emails use links, which is what they’d embed in a fake opt-out button. It only takes one misplaced click for an individual to unknowingly infect their computer with malware. Are Senders Legally Required to Let You Unsubscribe? In many countries, entities are legally required to let recipients unsubscribe. In the United States, the Controlling the Assault of Non-Solicited Pornography and Marketing Act gives people the right to force senders to stop emailing them. The United Kingdom has a similar law. However, there’s one major catch — phishers and spammers generally don’t care about laws. Even though regulatory agencies set severe penalties for violations — typically fines or legal action —  they are powerless in the face of the dark web. They have no recourse if they can’t figure out spammers’ identities. So, although senders technically are required to let people opt out of future messages, they won’t always follow those rules. The Risks of Unsubscribing From Spam and Scam Emails Even attempting to unsubscribe from junk mail can be detrimental to a person’s privacy and security. A spy pixel — a small image file inserted into content — tracks them as soon as they open the message. It is often as small as a 1x1 pixel, making it invisible even if they know what to look for. It can capture information like their IP address or location. Exploits are another risk. While most people scan incoming messages and block any that would automatically infect their device upon opening, no defense is 100% secure. Bad actors can exploit vulnerabilities to launch zero-click attacks — where the individual doesn’t need to click on a link, button or attachment for the malware to trigger. While uncommon, exploits can happen. One example is Outlook’s zero-click vulnerability. Researchers realized sending a reminder with a custom notification sound would cause the recipient to retrieve an audio file from any server on the internet instead of a trusted source. By sending another email containing the malicious file from their server, they could execute the code and infect the machine — without any interaction on the recipient’s part. Even if people can open the email safely, clicking unsubscribe is risky. Phishers can embed malware in the button or direct people to a malicious website. Instead of receiving fewer messages from the sender, they have to deal with ransomware, viruses or spyware — and will likely be bombarded with more spam since they’ve indicated they’re vulnerable to it. The most basic risk of opting out of receiving junk mail is loss of privacy. Interaction enables scammers to detect IP addresses and other identifying information. If they decide to sell those details to data brokers — or bad actors on the dark web — it could lead to spam calls or account takeover attempts. 3 Tips for Reducing Spam Without Unsubscribing Luckily, several ways to reduce spam without unsubscribing exist: 1. Mark the Email as Spam Marking an email as junk moves it to the spam folder, which automatically deletes it after a certain period. Additionally, it helps train the filter to block all similar incoming messages in the future. Gmail, Apple Mail and Outlook users can select the message and click the report, junk or trash icon. 2. Block the Sender Blocking a sender prevents them from sending more messages. It may not always work since phishers and spammers often spoof their addresses or use burner accounts. However, it at least temporarily reduces the frequency of junk mail in people’s inboxes by automatically sending all future messages to their spam folders. People can only block someone on Gmail if they open a message and click on the three vertical dots. Those using Apple Mail must select the message and click on the arrow next to the sender’s name for the option. Outlook users can enter their settings and add the address to the blocked senders list. 3. Create a Second Email People who have two addresses are more protected against junk mail. They can use it when signing up for promotions, filling out surveys or visiting sketchy websites while keeping the other for important notifications like shipping updates, bills and personal messages. This way, most spam goes there instead of to their original inbox. Is It Better to Block Spam Emails or Just Delete Them? Generally, it’s better to block junk mail to minimize the chances of any misclick resulting in a malware infection or privacy loss. The sender won’t receive a notification they’ve been blocked, so it doesn’t tip them off to an active account, either. While deleting them is a good idea, preventing unwanted emails is better. Many people don’t realize opting out of spam emails is an easy way to receive more junk mail or even infect a device with malware. Even opening a suspicious message could result in losing security or privacy. What are the risks of unsubscribing? Many people don’t realize opting out of spam emails is an easy way to receive more junk mail or even infect a device with malware. Even opening a suspicious message could result in losing security or privacy. What are the risks of unsubscribing? Why Should You Never Unsubscribe From Spam Emails? Why Should You Never Unsubscribe From Spam Emails? At best, unsubscribing from spam lets the sender know the account is active, prompting them to send more emails or sell the recipient’s contact information on the dark web. At worst, what appears to be an annoying or sketchy message is actually a phishing attempt — meaning clicking anything could infect the device with malware. As of the beginning of 2024, about 46.8% of global email traffic is junk. Most people have evolved to detect and defend against it since it’s so prevalent, but they can’t catch every suspicious message. If one manages to evade filters and ends up in the inbox instead of the spam folder, it’s up to the recipient to deal with it. 46.8% of global email traffic 46.8% of global email traffic Does the unsubscribe button work on spam emails? Generally, no. In the best case, spammers can ignore unsubscribe requests. In the worst case, the unsubscribe button will take users somewhere — to be attacked. The malicious link directs them to a fraudulent website that looks legitimate — the scammers recreate real pages because it helps them trick people — but is really a medium to infect their device with malware. directs them to a fraudulent website directs them to a fraudulent website These messages are annoying and intrusive on purpose: scammers want users to open and interact with their messages. Around 71% of phishing emails use links, which is what they’d embed in a fake opt-out button. It only takes one misplaced click for an individual to unknowingly infect their computer with malware. 71% of phishing emails 71% of phishing emails Are Senders Legally Required to Let You Unsubscribe? In many countries, entities are legally required to let recipients unsubscribe. In the United States, the Controlling the Assault of Non-Solicited Pornography and Marketing Act gives people the right to force senders to stop emailing them. The United Kingdom has a similar law. However, there’s one major catch — phishers and spammers generally don’t care about laws. force senders to stop emailing force senders to stop emailing phishers and spammers generally don’t care about laws. Even though regulatory agencies set severe penalties for violations — typically fines or legal action —  they are powerless in the face of the dark web. They have no recourse if they can’t figure out spammers’ identities. So, although senders technically are required to let people opt out of future messages, they won’t always follow those rules. The Risks of Unsubscribing From Spam and Scam Emails Even attempting to unsubscribe from junk mail can be detrimental to a person’s privacy and security. A spy pixel — a small image file inserted into content — tracks them as soon as they open the message. It is often as small as a 1x1 pixel , making it invisible even if they know what to look for. It can capture information like their IP address or location. often as small as a 1x1 pixel often as small as a 1x1 pixel Exploits are another risk. While most people scan incoming messages and block any that would automatically infect their device upon opening, no defense is 100% secure. Bad actors can exploit vulnerabilities to launch zero-click attacks — where the individual doesn’t need to click on a link, button or attachment for the malware to trigger. While uncommon, exploits can happen. One example is Outlook’s zero-click vulnerability. Researchers realized sending a reminder with a custom notification sound would cause the recipient to retrieve an audio file from any server on the internet instead of a trusted source. By sending another email containing the malicious file from their server, they could execute the code and infect the machine — without any interaction on the recipient’s part. from any server on the internet from any server on the internet Even if people can open the email safely, clicking unsubscribe is risky. Phishers can embed malware in the button or direct people to a malicious website. Instead of receiving fewer messages from the sender, they have to deal with ransomware, viruses or spyware — and will likely be bombarded with more spam since they’ve indicated they’re vulnerable to it. The most basic risk of opting out of receiving junk mail is loss of privacy. Interaction enables scammers to detect IP addresses and other identifying information. If they decide to sell those details to data brokers — or bad actors on the dark web — it could lead to spam calls or account takeover attempts. to detect IP addresses to detect IP addresses 3 Tips for Reducing Spam Without Unsubscribing Luckily, several ways to reduce spam without unsubscribing exist: Luckily, several ways to reduce spam without unsubscribing exist: 1. Mark the Email as Spam Marking an email as junk moves it to the spam folder, which automatically deletes it after a certain period. Additionally, it helps train the filter to block all similar incoming messages in the future. Gmail, Apple Mail and Outlook users can select the message and click the report, junk or trash icon. 2. Block the Sender Blocking a sender prevents them from sending more messages. It may not always work since phishers and spammers often spoof their addresses or use burner accounts. However, it at least temporarily reduces the frequency of junk mail in people’s inboxes by automatically sending all future messages to their spam folders. People can only block someone on Gmail if they open a message and click on the three vertical dots. Those using Apple Mail must select the message and click on the arrow next to the sender’s name for the option. Outlook users can enter their settings and add the address to the blocked senders list. 3. Create a Second Email People who have two addresses are more protected against junk mail. They can use it when signing up for promotions, filling out surveys or visiting sketchy websites while keeping the other for important notifications like shipping updates, bills and personal messages. This way, most spam goes there instead of to their original inbox. Is It Better to Block Spam Emails or Just Delete Them? Generally, it’s better to block junk mail to minimize the chances of any misclick resulting in a malware infection or privacy loss. The sender won’t receive a notification they’ve been blocked, so it doesn’t tip them off to an active account, either. While deleting them is a good idea, preventing unwanted emails is better.

Why You Shouldn't Unsubscribe From Spam Emails

কেন আপনি স্প্যাম ইমেল থেকে আনসাবস্ক্রাইব করা উচিত নয়

Warum Sie sich nicht von Spam-E-Mails abmelden sollten

Por qué no debería darse de baja de los correos electrónicos no deseados

Pourquoi vous ne devriez pas vous désabonner des spams

आपको स्पैम ईमेल से सदस्यता क्यों नहीं समाप्त करनी चाहिए?

スパムメールの購読を解除すべきでない理由

스팸 이메일을 구독 취소하면 안되는 이유

Por que você não deve cancelar a assinatura de e-mails de spam

Почему не следует отписываться от спам-рассылок

Neden Spam E-posta Aboneliğinden Çıkmamalısınız?

Tại sao bạn không nên hủy đăng ký nhận email rác

为什么你不应该取消订阅垃圾邮件

BTC, ETH, NFTs: How Have They Helped Ukraine To Resist Russian Invasion?

If you ever wondered how to add your company’s logo to your emails, this article is for you. Today, Selzy covers everything about email avatars and their impact on business. What Is an Email Avatar, and Why Do You Need It? You might not know what email avatar is, but you’ve definitely seen one in your inbox. An email avatar is a small circle with an image that appears next to the sender’s name and address, helping recipients identify senders. It can also be called an email profile picture or an email profile logo. By default, mailbox providers assign generic nondescript avatars to new users. Usually, it’s the first letter of the sender’s name. Unlike on social media in emails, profile pictures don’t seem to be a must: even service emails from Google or Yahoo don’t have an avatar. That’s why emails that have an avatar tend to stand out more. Look at the screenshot below: Which messages did you look at first? The chances are that emails from Morning Brew and Mike Allen immediately grabbed your attention. And only then, you scanned the other two, with L and A letters instead of pictures. Email avatars aren’t just visually striking, they also bring tangible value. According to the 2023 Consumer Email Tracker report by DMA, 61% of people decide to open the email because they recognize the brand, and 39% do so because they recognize the brand logo. For senders, it means that an email avatar, especially a branded one, will likely increase open rates. Different Avatar Types Automatically Generated Avatar That’s the default option. Usually, a mailbox provider assigns a logo with the first letter of your or your brand’s name. Instead of a letter, it can be a human silhouette, but still just as nondescript. Company Logo Company logos as avatars are a solid option to promote brand recall and stand out among competitors in an inbox. This helps recipients quickly identify marketing messages from their favorite brands in a cluttered inbox. Custom Images Custom images — usually photos — help subscribers recognize you faster. An example: journalist Mike Allen uses a photo in his Axios newsletter. Interestingly, emails from Axios as a company don’t have a logo. How to Add Email Avatars for Different Mailbox Providers Adding an email avatar is a simple process, similar for different mailbox providers: go to account settings, click the email avatar, and upload or choose the picture to replace the auto-generated one. The tricky part is that avatars don’t get displayed across different mailbox providers. If you send from Outlook to Gmail, Gmail recipients won’t see an avatar you set in Outlook. If you want to send bulk emails with an ESP and have your profile picture displayed in any inbox, create a corporate email domain, and link it to each mailbox provider. Then, set a profile picture for this domain in each mailbox provider separately. Let’s explore how to add profile logos across different mailbox providers and what nuance you might need to take into account. Gmail Go to Google Workspace account settings, choose an image from your computer, and crop it. Gmail doesn’t have any requirements for image size or format. Google Workspace allows users with different addresses belonging to the same email domain to have unique profile pictures. It’s useful when you send multiple newsletters and want each newsletter to have its unique email avatar. On mobile devices, you can see email avatars in the Gmail app right in the inbox; they also appear in push notifications. On the desktop, they appear only inside opened emails. Outlook On the Outlook home page, click on the avatar at the top of the page, choose Edit profile, and add or change the profile picture in the settings. It will only show up in the mobile apps and inside opened emails on the desktop. Although Outlook is a big email provider, not many seem to use it to the fullest. The same brands and newsletters we covered earlier in the article don’t have a profile picture in Outlook. Then again, even Outlook’s support team doesn’t have one. Go to Yahoo’s main page and, depending on the platform (desktop, web app, or mobile), change the profile picture to your liking. Default Yahoo avatars are stylized letters of the sender’s name, but you can always replace them with a profile picture. Once you set a profile picture, you can’t remove it and revert to stylized letters — you can only replace it with a new one. Your email avatar will be displayed in all Yahoo services — for example, in Yahoo! News comment section. Some users can choose to not see senders’ profile pictures in their inboxes and have the profile pictures replaced with checkboxes for a more minimalistic look. Apple Mail Having your brand’s logo displayed in Apple Mail is not possible unless subscribers decide to assign it by themselves. They have to create a new contact from the email address, and then choose to add a photo to get to set up an avatar — which can be any picture. The senders won’t see them. Avatar vs BIMI One more way to add an email avatar is BIMI or Brand Indicators for Message Identification. The result will be the same —  your email profile picture will be in place — however, with BIMI, you get logos and better protection for your recipients from phishing attacks. BIMI is a method of email authentication, in addition to DKIM, DMARC, and SPF. “In addition” is the keyword — to get BIMI, you need to set up the DMARC authentication first. From that perspective, getting BIMI sounds like a good thing to do, but there’s a “but” — it costs at least $1,299 per year. That’s because you have to buy a digital certificate that proves you own your logo as a trademark. That’s a bummer for businesses that don’t have twelve hundred bucks to spend on a 32 KB image. Moreover, BIMI is not universally supported yet. As of May 2024, Microsoft doesn’t even plan to implement it, and some email clients like Yahoo! Japan, Seznam.cz, Comcast, and Qualitia are only considering it. So, if the majority of your audience is not in the US, getting BIMI might simply be not worth it. Email Avatar vs Gravatar Gravatar occasionally pops up in conversations about email avatars. However, you can’t set an avatar for a mailbox provider (Gmail or Yahoo) with Gravatar because it is meant for a different use. Gravatar is a service that helps you automatically set profile pictures, contact details, and even a short bio for websites on WordPress and a handful of services that are heavily used in the work setting, like Atlassian products, Slack, and GitHub. Gravatar is especially useful with WordPress websites since it saves you from the trouble of uploading a profile picture each time you want to leave a comment on a new WordPress website. Here’s what the setup process looks like: Sign up on Gravatar with your email address.


Upload an image or a photo you like.


Going forward, you’ll have your profile picture displayed on every WordPress website or supported service, provided you sign up with the same email address as on Gravatar. Key Takeaways Avatars help emails stand out and impact the open rate. Unique logos look more pronounced than generic ones, recipients also trust them more. You can add company logos or your photos for email avatars. Your company will stand out in subscribers’ inboxes while a photo helps subscribers immediately recognize who sent the email. Email avatars are only seen within the same mailbox provider. Create a corporate account in each mailbox provider and set an avatar. Otherwise, if you only have Gmail with a logo, your Outlook subscribers won’t see it. Use BIMI to add logos and improve security but be ready to pay. BIMI gives you a trademark logo and protection from phishing attacks. It costs at least $1,299 a year while avatars without BIMI are free. If you ever wondered how to add your company’s logo to your emails, this article is for you. Today, Selzy covers everything about email avatars and their impact on business. Selzy What Is an Email Avatar, and Why Do You Need It? What Is an Email Avatar, and Why Do You Need It? You might not know what email avatar is, but you’ve definitely seen one in your inbox. An email avatar is a small circle with an image that appears next to the sender’s name and address, helping recipients identify senders. It can also be called an email profile picture or an email profile logo. By default, mailbox providers assign generic nondescript avatars to new users. Usually, it’s the first letter of the sender’s name. Unlike on social media in emails, profile pictures don’t seem to be a must: even service emails from Google or Yahoo don’t have an avatar. That’s why emails that have an avatar tend to stand out more. Look at the screenshot below: Which messages did you look at first? The chances are that emails from Morning Brew and Mike Allen immediately grabbed your attention. And only then, you scanned the other two, with L and A letters instead of pictures. L A Email avatars aren’t just visually striking, they also bring tangible value. According to the 2023 Consumer Email Tracker report by DMA, 61% of people decide to open the email because they recognize the brand, and 39% do so because they recognize the brand logo. For senders, it means that an email avatar, especially a branded one, will likely increase open rates. According to the 2023 Consumer Email Tracker report by DMA, 61% of people decide to open the email because they recognize the brand, and 39% do so because they recognize the brand logo. Consumer Email Tracker Consumer Email Tracker Different Avatar Types Different Avatar Types Automatically Generated Avatar Automatically Generated Avatar That’s the default option. Usually, a mailbox provider assigns a logo with the first letter of your or your brand’s name. Instead of a letter, it can be a human silhouette, but still just as nondescript. Company Logo Company Logo Company logos as avatars are a solid option to promote brand recall and stand out among competitors in an inbox. This helps recipients quickly identify marketing messages from their favorite brands in a cluttered inbox. Custom Images Custom Images Custom images — usually photos — help subscribers recognize you faster. An example: journalist Mike Allen uses a photo in his Axios newsletter. Interestingly, emails from Axios as a company don’t have a logo. How to Add Email Avatars for Different Mailbox Providers How to Add Email Avatars for Different Mailbox Providers Adding an email avatar is a simple process, similar for different mailbox providers: go to account settings, click the email avatar, and upload or choose the picture to replace the auto-generated one. The tricky part is that avatars don’t get displayed across different mailbox providers. If you send from Outlook to Gmail, Gmail recipients won’t see an avatar you set in Outlook. If you want to send bulk emails with an ESP and have your profile picture displayed in any inbox, create a corporate email domain, and link it to each mailbox provider. Then, set a profile picture for this domain in each mailbox provider separately. bulk emails with an ESP bulk emails with an ESP Let’s explore how to add profile logos across different mailbox providers and what nuance you might need to take into account. Gmail Gmail Go to Google Workspace account settings , choose an image from your computer, and crop it. Gmail doesn’t have any requirements for image size or format. Google Workspace account settings Google Workspace account settings Google Workspace allows users with different addresses belonging to the same email domain to have unique profile pictures. It’s useful when you send multiple newsletters and want each newsletter to have its unique email avatar. On mobile devices, you can see email avatars in the Gmail app right in the inbox; they also appear in push notifications. On the desktop, they appear only inside opened emails. Outlook Outlook On the Outlook home page, click on the avatar at the top of the page, choose Edit profile, and add or change the profile picture in the settings. It will only show up in the mobile apps and inside opened emails on the desktop. change the profile picture change the profile picture Although Outlook is a big email provider, not many seem to use it to the fullest. The same brands and newsletters we covered earlier in the article don’t have a profile picture in Outlook. Then again, even Outlook’s support team doesn’t have one. Go to Yahoo’s main page and, depending on the platform (desktop, web app, or mobile), change the profile picture to your liking. Default Yahoo avatars are stylized letters of the sender’s name, but you can always replace them with a profile picture. depending on the platform depending on the platform Once you set a profile picture, you can’t remove it and revert to stylized letters — you can only replace it with a new one. Your email avatar will be displayed in all Yahoo services — for example, in Yahoo! News comment section. Some users can choose to not see senders’ profile pictures in their inboxes and have the profile pictures replaced with checkboxes for a more minimalistic look. checkboxes checkboxes Apple Mail Apple Mail Having your brand’s logo displayed in Apple Mail is not possible unless subscribers decide to assign it by themselves. They have to create a new contact from the email address, and then choose to add a photo to get to set up an avatar — which can be any picture. The senders won’t see them. Avatar vs BIMI Avatar vs BIMI One more way to add an email avatar is BIMI or Brand Indicators for Message Identification. The result will be the same —  your email profile picture will be in place — however, with BIMI, you get logos and better protection for your recipients from phishing attacks. BIMI BIMI and BIMI is a method of email authentication, in addition to DKIM, DMARC, and SPF. “In addition” is the keyword — to get BIMI, you need to set up the DMARC authentication first. From that perspective, getting BIMI sounds like a good thing to do, but there’s a “but” — it costs at least $1,299 per year . That’s because you have to buy a digital certificate that proves you own your logo as a trademark. That’s a bummer for businesses that don’t have twelve hundred bucks to spend on a 32 KB image. $1,299 per year $1,299 per year Moreover, BIMI is not universally supported yet. As of May 2024 , Microsoft doesn’t even plan to implement it, and some email clients like Yahoo! Japan, Seznam.cz, Comcast, and Qualitia are only considering it. So, if the majority of your audience is not in the US, getting BIMI might simply be not worth it. As of May 2024 As of May 2024 Email Avatar vs Gravatar Email Avatar vs Gravatar Gravatar occasionally pops up in conversations about email avatars. However, you can’t set an avatar for a mailbox provider (Gmail or Yahoo) with Gravatar because it is meant for a different use. Gravatar Gravatar Gravatar is a service that helps you automatically set profile pictures, contact details, and even a short bio for websites on WordPress and a handful of services that are heavily used in the work setting, like Atlassian products, Slack, and GitHub. Gravatar is especially useful with WordPress websites since it saves you from the trouble of uploading a profile picture each time you want to leave a comment on a new WordPress website. Here’s what the setup process looks like: Sign up on Gravatar with your email address. Upload an image or a photo you like. Going forward, you’ll have your profile picture displayed on every WordPress website or supported service, provided you sign up with the same email address as on Gravatar. Sign up on Gravatar with your email address. Sign up on Gravatar with your email address. Upload an image or a photo you like. Upload an image or a photo you like. Going forward, you’ll have your profile picture displayed on every WordPress website or supported service, provided you sign up with the same email address as on Gravatar. Going forward, you’ll have your profile picture displayed on every WordPress website or supported service, provided you sign up with the same email address as on Gravatar. Key Takeaways Key Takeaways Avatars help emails stand out and impact the open rate. Unique logos look more pronounced than generic ones, recipients also trust them more. Avatars help emails stand out and impact the open rate. Unique logos look more pronounced than generic ones, recipients also trust them more. Avatars help emails stand out and impact the open rate. You can add company logos or your photos for email avatars. Your company will stand out in subscribers’ inboxes while a photo helps subscribers immediately recognize who sent the email. You can add company logos or your photos for email avatars. Your company will stand out in subscribers’ inboxes while a photo helps subscribers immediately recognize who sent the email. You can add company logos or your photos for email avatars. Email avatars are only seen within the same mailbox provider. Create a corporate account in each mailbox provider and set an avatar. Otherwise, if you only have Gmail with a logo, your Outlook subscribers won’t see it. Email avatars are only seen within the same mailbox provider. Create a corporate account in each mailbox provider and set an avatar. Otherwise, if you only have Gmail with a logo, your Outlook subscribers won’t see it. Email avatars are only seen within the same mailbox provider. Use BIMI to add logos and improve security but be ready to pay. BIMI gives you a trademark logo and protection from phishing attacks. It costs at least $1,299 a year while avatars without BIMI are free. Use BIMI to add logos and improve security but be ready to pay. BIMI gives you a trademark logo and protection from phishing attacks. It costs at least $1,299 a year while avatars without BIMI are free. Use BIMI to add logos and improve security but be ready to pay.

Your Company Logo in Emails: How to Add an Email Avatar in Popular Mailbox Providers

ইমেলে আপনার কোম্পানির লোগো: জনপ্রিয় মেলবক্স প্রদানকারীদের মধ্যে কীভাবে একটি ইমেল অবতার যোগ করবেন

Ihr Firmenlogo in E-Mails: So fügen Sie einen E-Mail-Avatar bei beliebten Mailbox-Anbietern hinzu

El logotipo de su empresa en los correos electrónicos: cómo agregar un avatar de correo electrónico en proveedores de buzones de correo populares

Logo de votre entreprise dans les e-mails : comment ajouter un avatar d'e-mail dans les fournisseurs de boîtes aux lettres populaires

ईमेल में आपकी कंपनी का लोगो: लोकप्रिय मेलबॉक्स प्रदाताओं में ईमेल अवतार कैसे जोड़ें

メールに会社のロゴを表示: 人気のメールボックス プロバイダーでメール アバターを追加する方法

이메일의 회사 로고: 인기 있는 메일함 제공업체에 이메일 아바타를 추가하는 방법

O logotipo da sua empresa em e-mails: como adicionar um avatar de e-mail em provedores de caixa de correio populares

Логотип вашей компании в электронных письмах: как добавить аватар электронной почты у популярных провайдеров почтовых ящиков

E-postalarda Şirket Logonuz: Popüler Posta Kutusu Sağlayıcılarında E-posta Avatarı Nasıl Eklenir?

Logo công ty của bạn trong email: Cách thêm hình đại diện email vào các nhà cung cấp hộp thư phổ biến

电子邮件中的公司徽标：如何在热门邮箱提供商中添加电子邮件头像

Uncovering Gender Bias within Journalist-Politician Interaction in Indian Twitter: Abstract & Intro

ভারতীয় টুইটারে সাংবাদিক-রাজনীতিবিদ মিথস্ক্রিয়া মধ্যে লিঙ্গ পক্ষপাত উন্মোচন: বিমূর্ত এবং ভূমিকা

Aufdeckung geschlechtsspezifischer Voreingenommenheit in der Interaktion zwischen Journalisten und Politikern im indischen Twitter: Zusammenfassung und Einführung

Descubriendo el sesgo de género en la interacción entre periodistas y políticos en Twitter indio: resumen e introducción

Découvrir les préjugés sexistes dans les interactions journalistes-hommes politiques sur Twitter indien : résumé et introduction

भारतीय ट्विटर पर पत्रकार-राजनेता के बीच बातचीत में लैंगिक पूर्वाग्रह को उजागर करना: सार और परिचय

インドのツイッターにおけるジャーナリストと政治家の交流におけるジェンダーバイアスの解明：概要と序文

인도 트위터의 언론인-정치인 상호작용에서 성 편견 발견: 요약 및 소개

Descobrindo o preconceito de gênero na interação jornalista-político no Twitter indiano: resumo e introdução

Выявление гендерных предубеждений во взаимодействии журналистов и политиков в индийском Твиттере: Аннотация и введение

Hint Twitter'ında Gazeteci-Politikacı Etkileşimindeki Cinsiyet Önyargısını Ortaya Çıkarmak: Özet ve Giriş

Khám phá sự thiên vị giới tính trong tương tác giữa nhà báo và chính trị gia trên Twitter của Ấn Độ: Tóm tắt & Giới thiệu

揭示印度推特上记者与政客互动中的性别偏见：摘要与简介

Social Media and the Battlefield: Human Error in Modern Warfare

This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license.
Authors:
(1) Ehud Shapiro,  Department of Computer Science and Applied Math, Weizmann Institute of Science, Israel and ehud.shapiro@weizmann.ac.il. Table of Links Abstract and Introduction
Grassroots Protocols
Grassroots Implementation of Grassroots Dissemination
Applications of Grassroots Dissemination Supporting Digital Sovereignty
Future Work & Discussion
References
A. Preliminaries: Asynchronous Distributed Multiagent Transition Systems
B. All-to-All Dissemination is not Grassroots
C. Proofs Grassroots Implementation of Grassroots Dissemination Here we present an implementation of the Grassroots Dissemination protocol GD, as depicted in Figure 1: The blocklace-based Cordial Grassroots Dissemination Protocol CGD (Def. 26), and its proof of being grassroots (Prop.28). The implementation σ (Def.33) of GD by CGD, and its proof of being grassroots (Thm. 29). Algorithm 1 with pseudocode for blocklace utilities and Algorithm 2 with pseudocode realizing CGD for the model of Asynchrony. The Cordial Grassroots Dissemination protocol employs the notions of follows, needs, friend, and friendship graph similarly to GD (Def. 14). A key difference is that in Grassroots Dissemination an agent that needs a block b may receive it from a friend that has b ‘by magic’, whereas in Cordial Grassroots Dissemination such an agent p must first disclose to a friend q the blocks it knows and the agents it follows, implying that it needs b, and based on such disclosure q may cordially send b to p. We employ the blocklace [15] to realize these principles. The blocklace is a DAGlike partially ordered generalization of the totally-ordered blockchain data structure that functions as a fault resilient, conflict-free replicated data type [26]. While the mathematical construction and proofs of the blocklace realization presented next are quite involved, the final result, presented as 30 lines of pseudocode in Algs. 1, 2, is quite simple. 3.1 Blocklace Preliminaries Each block in a blocklace may contain a finite set of cryptographic hash pointers to previous blocks, in contrast to one pointer (or zero for the initial block) in a blockchain. We assume a payload function X as above, and a collision-free cryptographic hash function hash. 3.2 The Cordial Grassroots Dissemination Protocol The Cordial Grassroots Dissemination protocol CGD realizes the two principles as follows. Disclosure is realized by a new p-block serving as a multichannel ack/nack message, informing its recipient whether it follows another agent q, and if so also of the latest q-block known to p, for every q ∈ P. This is realized by the notions defined next and illustrated in Figure 3. As we shall see, a correct agent p always maintains a p-closed blocklace and produces only maximally-closed p-blocks, thus abiding by the principle of disclosure. The local state in the protocol presented includes a blocklace and block messages. Notes. Disclosure is realized by the Create&Disclose transition choosing a maximally-closed p-block, and cordiality is realized by the Cordially-Send-b-to-q, with which p sends any p’-block b it knows to any friend q that p believes needs it. Namely, for which p knows that q follows p’ and p doesn’t know that q knows b. If q knows b then p would eventually know that, when it receives the next q-block that discloses knowledge of b. The special case of Cordially-Send, where p = p’ and b is a p-block, is simply dissemination among friends. Simple (volitional) Send can be used by an agent to send any block it has to any other agent. The recipient of a volitionally sent q-block can then follow q starting from that block. Similarly, two agents can send each other blocks to become friends. The liveness condition requires an agent to disclose every so often the blocks they know, to eventually send any block that satisfies the specified conditions, and receive any block sent to it that it does not know already, but it does not require an agent to follow other agents or to voluntarily send any block. Unlike in GD, where p can construct a simple initial q-block, here the initial q-block includes a hash pointer signed by q, which cannot be created/forged by p. Asynchrony. The model of asynchrony assumes that each message sent among correct agents is eventually received and an that an adversary may control, in addition to the faulty agents, also the order of message arrival among all agents. These assumptions are satisfied by the liveness requirement of CGD. Liveness ensures that communication is reliable, as any message sent among correct miners is eventually received, yet there is no bound on the finite delay of message arrival, as postulated by the model. Correctness of an agent requires it to be correct in all computations, hence the system has to be resilient to an adversary that controls not only faulty agents but also the order of transitions by correct agents. Controlling the order of Receive transitions amounts to control of the order of message arrival, as postulated by the model. The following proposition is the analogue of Proposition 16 for GD, with an analogue proof. 3.3 A Grassroots Implementation of CGD by GD We use the theorem above to show that: Theorem 29. CGD can provide a grassroots implementation of GD. We employ the notion of monotonic-completeness wrt to a partial order to prove the correctness of the implementation: 3.4 Pseudocode Implementation of Grassroots Cordial Dissemination The Cordial Grassroots Dissemination protocol was specified as a family of asynchronous distributed multiagent transition systems CGD (Def. 26). Asynchrony. Algorithm 2 presents pseudocode implementation of the protocol for a single agent p for the model of Asynchrony. The comments indicate which transition rule is realized by what code. We assume that the agent p can interact with the protocol application that runs on their personal device. In particular, p can specify the payload for a new block or decide to send any block it knows to any other agent. As according to the model of asynchrony each message sent is eventually received, we assume the reliably_send construct to keep a record of sent messages so as not to send the same message to the same agent twice, implementing the requirement (q, b) ∈/ Out of the Cordially-Send-b-to-q transition. The construct upon eventually is also geared for the model of asynchrony: It is a ‘timeless timeout’ with no notion of time, only with a guarantee of eventuality. The implementation of grassroots dissemination for asynchrony assumes reliable communication, readily implemented by TCP. However, for grassroots dissemination to reach its full potential it must be designed for mobile agents using unreliable communication, namely UDP. With TCP, smartphones can establish a connection only with the help of an agreed-upon third party, which undermines grassroots and digital sovereignty, and the connection needs reestablishing upon roaming to a new IP address. With UDP, a connection is not needed and incorporating the sender’s current IP address in a block lets recipients (re)transmit blocks to the sender’s updated IP address, allowing roaming agents to remain connected to their friends. Furthermore, the ability of a block in a blocklace to function as a multichannel ack/nack message shines in a UDP implementation, as a received p-block b (even if received indirectly, not from p) makes redundant the (re)transmission to p of any block observed by b. A refinement of the Cordial Grassroots Dissemination protocol for mobile (address-hopping) agents communicating over an unreliable network, namely smartphones communicating via UDP, is presented as Alg. 3. Mobile Agents Communicating via UDP. Cordial dissemination over UDP exploits the ack/nak information of blocklace blocks to its fullest, by p retransmitting to every friend q every block b that p knows (not only p-blocks) and believes that q needs, until q acknowledges knowing b. The sending of unsolicited blocks (Send-b-to-q) does not guaranteed delivery, and if delivered does not guarantee acknowledgement, unless the the block is a friendship offer (with a (‘follow’, q) payload), and the recipient q accept the offer (creating a block with a (‘follow’, p) payload). Assuming that timeouts are separated by seconds and mobile address hopping is separated by hours, then the probability of two friends hopping together without one successfully informing the other of its new IP address is around 10−7 . If the two hopping friends have a stationary joint friend, then it is enough that one of the hoppers successfully informs the stationary friend of the address change, for the other hopper to soon know this new address from the stationary friend. Under the same assumptions, the probability of a clique of n friends loosing a member due to all hopping simultaneously is around 10−3.6∗n. Note that such a loss is not terminal – assuming that friends have redundant ways to communicate (physical meetings, email, SMS, global social media), new addresses can be communicated and the digital friendship restored. We note that the timer need not be of fixed duration and global – an adaptive timer for each friend might prove more efficient. This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. Authors: (1) Ehud Shapiro,  Department of Computer Science and Applied Math, Weizmann Institute of Science, Israel and ehud.shapiro@weizmann.ac.il. This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. Authors: Authors: (1) Ehud Shapiro,  Department of Computer Science and Applied Math, Weizmann Institute of Science, Israel and ehud.shapiro@weizmann.ac.il. Table of Links Abstract and Introduction Grassroots Protocols Grassroots Implementation of Grassroots Dissemination Applications of Grassroots Dissemination Supporting Digital Sovereignty Future Work & Discussion References A. Preliminaries: Asynchronous Distributed Multiagent Transition Systems B. All-to-All Dissemination is not Grassroots C. Proofs Abstract and Introduction Abstract and Introduction Grassroots Protocols Grassroots Protocols Grassroots Implementation of Grassroots Dissemination Grassroots Implementation of Grassroots Dissemination Applications of Grassroots Dissemination Supporting Digital Sovereignty Applications of Grassroots Dissemination Supporting Digital Sovereignty Future Work & Discussion Future Work & Discussion References References A. Preliminaries: Asynchronous Distributed Multiagent Transition Systems A. Preliminaries: Asynchronous Distributed Multiagent Transition Systems B. All-to-All Dissemination is not Grassroots B. All-to-All Dissemination is not Grassroots C. Proofs C. Proofs Grassroots Implementation of Grassroots Dissemination Here we present an implementation of the Grassroots Dissemination protocol GD, as depicted in Figure 1: The blocklace-based Cordial Grassroots Dissemination Protocol CGD (Def. 26), and its proof of being grassroots (Prop.28). The implementation σ (Def.33) of GD by CGD, and its proof of being grassroots (Thm. 29). Algorithm 1 with pseudocode for blocklace utilities and Algorithm 2 with pseudocode realizing CGD for the model of Asynchrony. The Cordial Grassroots Dissemination protocol employs the notions of follows, needs, friend, and friendship graph similarly to GD (Def. 14). A key difference is that in Grassroots Dissemination an agent that needs a block b may receive it from a friend that has b ‘by magic’, whereas in Cordial Grassroots Dissemination such an agent p must first disclose to a friend q the blocks it knows and the agents it follows, implying that it needs b, and based on such disclosure q may cordially send b to p. We employ the blocklace [15] to realize these principles. The blocklace is a DAGlike partially ordered generalization of the totally-ordered blockchain data structure that functions as a fault resilient, conflict-free replicated data type [26]. While the mathematical construction and proofs of the blocklace realization presented next are quite involved, the final result, presented as 30 lines of pseudocode in Algs. 1, 2, is quite simple. 3.1 Blocklace Preliminaries 3.1 Blocklace Preliminaries Each block in a blocklace may contain a finite set of cryptographic hash pointers to previous blocks, in contrast to one pointer (or zero for the initial block) in a blockchain. We assume a payload function X as above, and a collision-free cryptographic hash function hash. 3.2 The Cordial Grassroots Dissemination Protocol 3.2 The Cordial Grassroots Dissemination Protocol The Cordial Grassroots Dissemination protocol CGD realizes the two principles as follows. Disclosure is realized by a new p-block serving as a multichannel ack/nack message, informing its recipient whether it follows another agent q, and if so also of the latest q-block known to p, for every q ∈ P. This is realized by the notions defined next and illustrated in Figure 3. As we shall see, a correct agent p always maintains a p-closed blocklace and produces only maximally-closed p-blocks, thus abiding by the principle of disclosure. The local state in the protocol presented includes a blocklace and block messages. Notes. Disclosure is realized by the Create&Disclose transition choosing a maximally-closed p-block, and cordiality is realized by the Cordially-Send-b-to-q, with which p sends any p’-block b it knows to any friend q that p believes needs it. Namely, for which p knows that q follows p’ and p doesn’t know that q knows b. If q knows b then p would eventually know that, when it receives the next q-block that discloses knowledge of b. The special case of Cordially-Send, where p = p’ and b is a p-block, is simply dissemination among friends. Simple (volitional) Send can be used by an agent to send any block it has to any other agent. The recipient of a volitionally sent q-block can then follow q starting from that block. Similarly, two agents can send each other blocks to become friends. The liveness condition requires an agent to disclose every so often the blocks they know, to eventually send any block that satisfies the specified conditions, and receive any block sent to it that it does not know already, but it does not require an agent to follow other agents or to voluntarily send any block. Notes. Unlike in GD, where p can construct a simple initial q-block, here the initial q-block includes a hash pointer signed by q, which cannot be created/forged by p. Asynchrony. The model of asynchrony assumes that each message sent among correct agents is eventually received and an that an adversary may control, in addition to the faulty agents, also the order of message arrival among all agents. These assumptions are satisfied by the liveness requirement of CGD. Liveness ensures that communication is reliable, as any message sent among correct miners is eventually received, yet there is no bound on the finite delay of message arrival, as postulated by the model. Correctness of an agent requires it to be correct in all computations, hence the system has to be resilient to an adversary that controls not only faulty agents but also the order of transitions by correct agents. Controlling the order of Receive transitions amounts to control of the order of message arrival, as postulated by the model. The following proposition is the analogue of Proposition 16 for GD, with an analogue proof. 3.3 A Grassroots Implementation of CGD by GD 3.3 A Grassroots Implementation of CGD by GD We use the theorem above to show that: Theorem 29. CGD can provide a grassroots implementation of GD. Theorem 29. We employ the notion of monotonic-completeness wrt to a partial order to prove the correctness of the implementation: 3.4 Pseudocode Implementation of Grassroots Cordial Dissemination 3.4 Pseudocode Implementation of Grassroots Cordial Dissemination The Cordial Grassroots Dissemination protocol was specified as a family of asynchronous distributed multiagent transition systems CGD (Def. 26). Asynchrony. Algorithm 2 presents pseudocode implementation of the protocol for a single agent p for the model of Asynchrony. The comments indicate which transition rule is realized by what code. We assume that the agent p can interact with the protocol application that runs on their personal device. In particular, p can specify the payload for a new block or decide to send any block it knows to any other agent. As according to the model of asynchrony each message sent is eventually received, we assume the reliably_send construct to keep a record of sent messages so as not to send the same message to the same agent twice, implementing the requirement (q, b) ∈/ Out of the Cordially-Send-b-to-q transition. The construct upon eventually is also geared for the model of asynchrony: It is a ‘timeless timeout’ with no notion of time, only with a guarantee of eventuality. Asynchrony. The implementation of grassroots dissemination for asynchrony assumes reliable communication, readily implemented by TCP. However, for grassroots dissemination to reach its full potential it must be designed for mobile agents using unreliable communication, namely UDP. With TCP, smartphones can establish a connection only with the help of an agreed-upon third party, which undermines grassroots and digital sovereignty, and the connection needs reestablishing upon roaming to a new IP address. With UDP, a connection is not needed and incorporating the sender’s current IP address in a block lets recipients (re)transmit blocks to the sender’s updated IP address, allowing roaming agents to remain connected to their friends. Furthermore, the ability of a block in a blocklace to function as a multichannel ack/nack message shines in a UDP implementation, as a received p-block b (even if received indirectly, not from p) makes redundant the (re)transmission to p of any block observed by b. A refinement of the Cordial Grassroots Dissemination protocol for mobile (address-hopping) agents communicating over an unreliable network, namely smartphones communicating via UDP, is presented as Alg. 3. Mobile Agents Communicating via UDP. Cordial dissemination over UDP exploits the ack/nak information of blocklace blocks to its fullest, by p retransmitting to every friend q every block b that p knows (not only p-blocks) and believes that q needs, until q acknowledges knowing b. The sending of unsolicited blocks (Send-b-to-q) does not guaranteed delivery, and if delivered does not guarantee acknowledgement, unless the the block is a friendship offer (with a (‘follow’, q) payload), and the recipient q accept the offer (creating a block with a (‘follow’, p) payload). Assuming that timeouts are separated by seconds and mobile address hopping is separated by hours, then the probability of two friends hopping together without one successfully informing the other of its new IP address is around 10−7 . If the two hopping friends have a stationary joint friend, then it is enough that one of the hoppers successfully informs the stationary friend of the address change, for the other hopper to soon know this new address from the stationary friend. Under the same assumptions, the probability of a clique of n friends loosing a member due to all hopping simultaneously is around 10−3.6∗n. Note that such a loss is not terminal – assuming that friends have redundant ways to communicate (physical meetings, email, SMS, global social media), new addresses can be communicated and the digital friendship restored. We note that the timer need not be of fixed duration and global – an adaptive timer for each friend might prove more efficient. Mobile Agents Communicating via UDP.

Grassroots Implementation of Grassroots Dissemination

Satoshi Nakamoto and Bitcoin weren’t exactly popular in the early days, not even among their peers. Privacy-inclined people, who were also experts in programming, and were looking for an alternative to banks and traditional money, were the first ones to read the Bitcoin whitepaper —and most of them didn’t think highly of it. Gregory Maxwell, a self-declared cypherpunk, was one of them. Maxwell is an American programmer well-known for his deep involvement in Bitcoin, to the point of being one of the most important developers of Bitcoin Core (its main implementation) for years. It wasn’t like that since the beginning, though. He first got involved in other open-source and collaborative systems, being an early contributor to Wikipedia and later an employee at the Mozilla Foundation. However, he believed that decentralized consensus wasn’t possible. “When Bitcoin first came out, I was on the cryptography mailing list. When it happened, I sort of laughed. Because I had already proven that decentralized consensus was impossible.” Before really paying enough attention to the Bitcoin code, he was helping to develop the now widely-used Opus Audio Codec. This is an audio format specially designed to compress and transmit audio over the Internet. It offers high-quality sound while using less data, making it ideal for applications like voice calls, video conferencing, and streaming music. Household names like YouTube, Spotify, Netflix, Discord, and Skype use this technology today. Maxwell on Bitcoin Even before Bitcoin, Maxwell was involved in the Reusable Proof-of-Work (RPOW) project created by Hal Finney —who would also turn to Bitcoin later. This system created RPOW tokens that could be transferred between users and exchanged for new units, but it wasn’t exactly like decentralized money. Maxwell was aiming to create conditional transfers (similar to smart contracts) in the platform, but the adoption of it wasn’t high. He came back to Bitcoin in late 2010, as a miner first, just trying to use his GPUs in something useful. Soon after, he paid closer attention to the whitepaper and the source code and changed his mind about the project. He then started to collaborate at a technical level, and he’s been doing it since 2011. In those early days, he focused on protocol design, incentives, and cryptographic review. ** ** In 2014, he also co-founded Blockstream, a company mainly created to boost and fund Bitcoin development. While there, Maxwell helped to create the two-way peg, which makes sidechains possible. These are separate chains connected to a parent distributed ledger, like Bitcoin, enabling experimentation with new features and functionalities without risking the main chain's security. The two-way peg would allow assets to move between chains without losing their value. As a Bitcoin Core developer, Maxwell also helped to build the homomorphic key derivation in Bitcoin Improvement Proposal (BIP) #32, which allows for the generation of multiple public and private key pairs from a single master key. Additionally, he co-authored the BIP-9 to establish a standard for light updates (softforks), and the BIP-173 to define a new type of address for SegWit —another improvement update to increase efficiency. He left Blockstream in 2018 and focused on the creation of smart contract features for Bitcoin. That way, he became the author of a new important improvement for Bitcoin, the Taproot update. This technique combines multiple spending conditions into a single signature, enhancing privacy and reducing transaction costs —which encourages the creation of complex smart contracts. Some Concerns, and Time As much as other fellow cypherpunks, Maxwell has also expressed some concerns about Bitcoin's internal functionality. This is the system that really spread the idea of decentralized money, but it’s not perfect. For starters, Maxwell told the story about his early days as a miner, and how the overheating caused by the machines even drew the police to his home. Mining is, indeed, worrisome, given the great amount of electric energy that it needs. Privacy is another issue in the Bitcoin ledger. People tend to believe that Bitcoin is anonymous, but that’s quite far from the truth. Bitcoin is actually pseudonymous, which means instead of names and ID documents it uses cryptographic addresses. However, that doesn’t mean you can’t be tracked, especially because every transaction is publicly available in a blockchain explorer. And they include data like amount, date, and connected addresses (senders and recipients). Maxwell is also trying to fix this issue in the first cryptocurrency, as he commented in an interview. “Obviously privacy is a big area where Bitcoin needs improvement and I've tried to come up with fancy technology to improve the situation, but it's always a balancing act. Privacy is the one area where if Bitcoin doesn't get better at it... it might leave the world a worse off place than if Bitcoin hadn't existed. The worst case for Bitcoin privacy is pretty bad.  There has been a lot of progress but more is needed.” Despite current flaws, Maxwell also thinks that mass adoption of cryptocurrencies is just a matter of time. Impediments like insecure hardware, buggy software, tax barriers, or self-custody risks will find a solution over the years, and we’re on our way to it. Obyte as a Step into the Future Obyte has emerged as a compelling alternative to Bitcoin, addressing concerns regarding privacy, and decentralization. Unlike Bitcoin, which requires miners as inevitable intermediaries to approve transactions, Obyte employs a Directed Acyclic Graph (DAG) structure where transactions don’t need any approval. This approach eliminates the need for blocks and their creators, making Obyte fully decentralized. Moreover, Obyte offers enhanced privacy features, such as the integration of the privacy coin Blackbytes and in-wallet encrypted chat functionality. These options provide users with greater confidentiality in their transactions and communications, addressing the privacy concerns prevalent in Bitcoin's ledger. By prioritizing decentralization and privacy, Obyte ensures that users can freely conduct transactions on their own and have the option to do so without compromising their sensitive information to public scrutiny, distinguishing it as a more privacy-focused and decentralized option in the cryptocurrency landscape. This ecosystem is really the next step into the future, as many cypherpunks have dreamed of. Read more from Cypherpunks Write Code series: Tim May & Crypto-anarchism Wei Dai & B-money Nick Szabo & Smart Contracts Adam Back & Hashcash Eric Hughes & Remailer St Jude & Community Memory Hal Finney & RPOW John Gilmore & EFF Satoshi Nakamoto & Bitcoin Featured Vector Image by Garry Killian / Freepik Photograph of Gregory Maxwell by Blockstream Satoshi Nakamoto and Bitcoin weren’t exactly popular in the early days, not even among their peers. Privacy-inclined people, who were also experts in programming, and were looking for an alternative to banks and traditional money, were the first ones to read the Bitcoin whitepaper —and most of them didn’t think highly of it. Gregory Maxwell, a self-declared cypherpunk, was one of them. Maxwell is an American programmer well-known for his deep involvement in Bitcoin, to the point of being one of the most important developers of Bitcoin Core (its main implementation) for years. It wasn’t like that since the beginning, though. He first got involved in other open-source and collaborative systems, being an early contributor to Wikipedia and later an employee at the Mozilla Foundation. However, he believed that decentralized consensus wasn’t possible. Maxwell is an American programmer well-known for his deep involvement in Bitcoin, to the point of being one of the most important developers of Bitcoin Core (its main implementation) for years. Maxwell Maxwell he believed he believed “When Bitcoin first came out, I was on the cryptography mailing list. When it happened, I sort of laughed. Because I had already proven that decentralized consensus was impossible.” “When Bitcoin first came out, I was on the cryptography mailing list. When it happened, I sort of laughed. Because I had already proven that decentralized consensus was impossible.” Before really paying enough attention to the Bitcoin code, he was helping to develop the now widely-used Opus Audio Codec. This is an audio format specially designed to compress and transmit audio over the Internet. It offers high-quality sound while using less data, making it ideal for applications like voice calls, video conferencing, and streaming music. Household names like YouTube, Spotify, Netflix, Discord, and Skype use this technology today. Maxwell on Bitcoin Even before Bitcoin, Maxwell was involved in the Reusable Proof-of-Work (RPOW) project created by Hal Finney —who would also turn to Bitcoin later. This system created RPOW tokens that could be transferred between users and exchanged for new units, but it wasn’t exactly like decentralized money. Maxwell was aiming to create conditional transfers (similar to smart contracts) in the platform, but the adoption of it wasn’t high. He came back to Bitcoin in late 2010, as a miner first, just trying to use his GPUs in something useful. Soon after, he paid closer attention to the whitepaper and the source code and changed his mind about the project. He then started to collaborate at a technical level, and he’s been doing it since 2011. In those early days, he focused on protocol design, incentives, and cryptographic review. He then started to collaborate at a technical level, and he’s been doing it since 2011. he focused he focused ** ** In 2014, he also co-founded Blockstream, a company mainly created to boost and fund Bitcoin development. While there, Maxwell helped to create the two-way peg, which makes sidechains possible. These are separate chains connected to a parent distributed ledger, like Bitcoin, enabling experimentation with new features and functionalities without risking the main chain's security. The two-way peg would allow assets to move between chains without losing their value. As a Bitcoin Core developer, Maxwell also helped to build the homomorphic key derivation in Bitcoin Improvement Proposal (BIP) #32 , which allows for the generation of multiple public and private key pairs from a single master key. Additionally, he co-authored the BIP-9 to establish a standard for light updates (softforks), and the BIP-173 to define a new type of address for SegWit —another improvement update to increase efficiency. Maxwell also helped to build the homomorphic key derivation in Bitcoin Improvement Proposal ( BIP ) #32 BIP BIP He left Blockstream in 2018 and focused on the creation of smart contract features for Bitcoin. That way, he became the author of a new important improvement for Bitcoin, the Taproot update . This technique combines multiple spending conditions into a single signature, enhancing privacy and reducing transaction costs —which encourages the creation of complex smart contracts. Taproot update Taproot update Some Concerns, and Time As much as other fellow cypherpunks , Maxwell has also expressed some concerns about Bitcoin's internal functionality. This is the system that really spread the idea of decentralized money, but it’s not perfect. For starters, Maxwell told the story about his early days as a miner, and how the overheating caused by the machines even drew the police to his home. Mining is, indeed, worrisome, given the great amount of electric energy that it needs. cypherpunks cypherpunks Privacy is another issue in the Bitcoin ledger. People tend to believe that Bitcoin is anonymous, but that’s quite far from the truth. Bitcoin is actually pseudonymous, which means instead of names and ID documents it uses cryptographic addresses. However, that doesn’t mean you can’t be tracked, especially because every transaction is publicly available in a blockchain explorer. And they include data like amount, date, and connected addresses (senders and recipients). Privacy is another issue in the Bitcoin ledger. Maxwell is also trying to fix this issue in the first cryptocurrency, as he commented in an interview. an interview. an interview. “Obviously privacy is a big area where Bitcoin needs improvement and I've tried to come up with fancy technology to improve the situation, but it's always a balancing act. Privacy is the one area where if Bitcoin doesn't get better at it... it might leave the world a worse off place than if Bitcoin hadn't existed. The worst case for Bitcoin privacy is pretty bad.  There has been a lot of progress but more is needed.” “Obviously privacy is a big area where Bitcoin needs improvement and I've tried to come up with fancy technology to improve the situation, but it's always a balancing act. Privacy is the one area where if Bitcoin doesn't get better at it... it might leave the world a worse off place than if Bitcoin hadn't existed. The worst case for Bitcoin privacy is pretty bad.  There has been a lot of progress but more is needed.” Despite current flaws, Maxwell also thinks that mass adoption of cryptocurrencies is just a matter of time. Impediments like insecure hardware, buggy software, tax barriers, or self-custody risks will find a solution over the years, and we’re on our way to it. Obyte as a Step into the Future Obyte has emerged as a compelling alternative to Bitcoin, addressing concerns regarding privacy, and decentralization. Unlike Bitcoin, which requires miners as inevitable intermediaries to approve transactions, Obyte employs a Directed Acyclic Graph (DAG) structure where transactions don’t need any approval. This approach eliminates the need for blocks and their creators, making Obyte fully decentralized. Obyte Obyte Obyte employs a Directed Acyclic Graph (DAG) structure where transactions don’t need any approval. Moreover, Obyte offers enhanced privacy features, such as the integration of the privacy coin Blackbytes and in-wallet encrypted chat functionality . These options provide users with greater confidentiality in their transactions and communications, addressing the privacy concerns prevalent in Bitcoin's ledger. Blackbytes Blackbytes chat functionality chat functionality By prioritizing decentralization and privacy, Obyte ensures that users can freely conduct transactions on their own and have the option to do so without compromising their sensitive information to public scrutiny, distinguishing it as a more privacy-focused and decentralized option in the cryptocurrency landscape. This ecosystem is really the next step into the future, as many cypherpunks have dreamed of. Read more from Cypherpunks Write Code series: Read more from Cypherpunks Write Code series: Tim May & Crypto-anarchism Tim May & Crypto-anarchism Tim May & Crypto-anarchism Tim May & Crypto-anarchism Wei Dai & B-money Wei Dai & B-money Wei Dai & B-money Wei Dai & B-money Nick Szabo & Smart Contracts Nick Szabo & Smart Contracts Nick Szabo & Smart Contracts Nick Szabo & Smart Contracts Adam Back & Hashcash Adam Back & Hashcash Adam Back & Hashcash Adam Back & Hashcash Eric Hughes & Remailer Eric Hughes & Remailer Eric Hughes & Remailer Eric Hughes & Remailer St Jude & Community Memory St Jude & Community Memory St Jude & Community Memory St Jude & Community Memory Hal Finney & RPOW Hal Finney & RPOW Hal Finney & RPOW Hal Finney & RPOW John Gilmore & EFF John Gilmore & EFF John Gilmore & EFF John Gilmore & EFF Satoshi Nakamoto & Bitcoin Satoshi Nakamoto & Bitcoin Satoshi Nakamoto & Bitcoin Satoshi Nakamoto & Bitcoin Featured Vector Image by Garry Killian / Freepik Featured Vector Image by Garry Killian / Freepik Freepik Freepik Photograph of Gregory Maxwell by Blockstream Photograph of Gregory Maxwell by Blockstream Blockstream Blockstream

Cypherpunks Write Code: Gregory Maxwell and Bitcoin Core

সাইফারপাঙ্কস কোড লিখুন: গ্রেগরি ম্যাক্সওয়েল এবং বিটকয়েন কোর

Cypherpunks schreiben Code: Gregory Maxwell und Bitcoin Core

Código de escritura de Cypherpunks: Gregory Maxwell y Bitcoin Core

Cypherpunks écrit du code : Gregory Maxwell et Bitcoin Core

साइफरपंक्स ने कोड लिखा: ग्रेगरी मैक्सवेल और बिटकॉइन कोर

サイファーパンクがコードを書く: グレゴリー・マクスウェルとビットコイン・コア

Cypherpunks의 코드 작성: Gregory Maxwell 및 Bitcoin Core

Código de gravação Cypherpunks: Gregory Maxwell e Bitcoin Core

Шифропанки пишут код: Грегори Максвелл и Bitcoin Core

Şifrepunklar Kod Yazıyor: Gregory Maxwell ve Bitcoin Core

Cypherpunks viết mã: Gregory Maxwell và Bitcoin Core

密码朋克编写代码：Gregory Maxwell 和比特币核心

Invisible Online: A Family Guide to Private and Secure Online Living

Cryptography can be used to have not only decentralized and private money but also private communications. The activists known as cypherpunks knew this too well, and that’s why not only Bitcoin came out from that mailing list started in the ’90s. A bunch of free and useful cryptographic tools are the legacy of cypherpunks, including the one created by Phil Zimmerman —a remarkable cypherpunk even to this day. Born on February 12, 1954, in Camden, New Jersey, Zimmermann studied computer science at Florida Atlantic University, where he earned his degree in 1978. His career trajectory began with software engineering roles in various companies, including a stint at the nuclear power company, System Simulation Corporation, where he worked on cryptographic security systems. However, the interesting part is that he was also an anti-nuclear activist. It’s known that he was arrested for partaking in an anti-nuclear protest in Nevada, alongside prominent figures like Carl Sagan and Martin Sheen. This commitment to activism underscored Zimmermann's convictions, solidifying his standing within the anti-nuclear movement. Amidst the shifting geopolitical landscape of the early 1990s, Zimmermann's focus pivoted towards cryptography, recognizing its potential to safeguard private communications in an increasingly interconnected world. It was during this period that he would join the cypherpunks and create his ‘magnum opus’. Pretty Good Privacy (PGP) This is a thing even Satoshi Nakamoto used to protect his emails, and it’s still widely used as a standard to achieve private communications. Developed in 1991, PGP is an encryption software designed to secure email messages. Zimmermann's motivation behind PGP was rooted in his concerns about government surveillance and the need for accessible cryptographic tools to protect individual privacy. In his own words: “It's personal. It's private. And it's no one's business but yours. You may be planning a political campaign, discussing your taxes, or having a secret romance. Or you may be communicating with a political dissident in a repressive country. Whatever it is, you don't want your private electronic mail (email) or confidential documents read by anyone else (...) PGP empowers people to take their privacy into their own hands. There has been a growing social need for it. That's why I wrote it.” As for its internal features, PGP uses a pair of cryptographic keys for each user—a public key and a private key. The public key, which is freely distributed, is used by others to encrypt messages intended for the user. Meanwhile, the private key, kept confidential by the user, is used for decrypting these messages. When someone wants to send an encrypted message to a PGP user, they obtain the recipient's public key. Using this key, they encrypt the message, ensuring that only the intended recipient, who possesses the corresponding private key, can decrypt and read it. This process provides confidentiality for the message. Additionally, PGP supports digital signatures, enabling users to verify the authenticity and integrity of emails. By hashing the message and encrypting the hash with their private key, senders create digital signatures that recipients can verify using the sender's public key. After PGP Back then, the US government considered cryptographic tools as weapons, and that’s why Zimmerman was investigated by authorities for the free distribution of PGP. Luckily, they dropped the case in 1996 without charges, and the cypherpunk founded PGP Inc., along with a new release of PGP. The company in charge of maintaining the software was eventually sold to Symantec in 2010. Following the success of PGP, Zimmermann has also been involved in various ventures aimed at bolstering digital security and privacy. In 2012, he co-founded Silent Circle alongside Mike Janke and Jon Callas, focusing on developing secure hardware and subscription-based software solutions. Additionally, Zimmermann collaborated with other key figures from Silent Circle and Lavabit (an encrypted webmail service) to establish the Dark Mail Alliance in 2013, with the objective of creating a new protocol to enhance email encryption, addressing limitations in PGP. Beyond his cryptographic endeavors, Zimmermann extended his influence to social networking platforms, advocating for ethical and privacy-centric alternatives to mainstream platforms like Facebook. His involvement in the social network Okuna, previously known as Openbook, aimed to provide users with a platform that prioritized privacy and democratic values over profit-driven models. Zimmermann's contributions have been widely recognized, with numerous awards acknowledging his pioneering work in cryptography and advocacy for digital rights. From inductions into halls of fame to prestigious accolades such as the Louis Brandeis Award from Privacy International and the Norbert Wiener Award for Social and Professional Responsibility, Zimmermann's legacy continues to resonate within the realms of technology and human rights advocacy. In a world of surveillance There’s a thing called “the Zimmerman law” that refers to his words about technology and surveillance: “The natural flow of technology tends to move in the direction of making surveillance easier (…) the ability of computers to track us doubles every eighteen months.” If the period is exact or not in reality, it doesn’t matter, because today mass surveillance and censorship have become common feats by governments worldwide. PGP can help us to protect our privacy and digital rights, but it’s not the only tool available for that. Obyte, for instance, can also help with private communications and decentralized, fast, and secure financial transactions worldwide. Built on a Directed Acyclic Graph (DAG) structure, Obyte ensures global transactions without the need for miners or any other middlemen. This structure enables Obyte to increase its decentralization and offers a high level of control to its users. In addition to its financial features, where tokenization of any asset is also possible, Obyte integrates private communications functionality directly into its platform. Users can leverage Obyte's built-in messaging system in the wallet to communicate securely and privately, thanks to end-to-end encryption, similar to PGP. This feature enhances user privacy by enabling them to freely communicate without a company or government behind them, thus providing a comprehensive solution for both financial transactions and private messaging. As a result, we can say that Obyte is empowering users with a versatile platform for conducting secure and private interactions worldwide. Read more from Cypherpunks Write Code series: Tim May & Crypto-anarchism Wei Dai & B-money Nick Szabo & Smart Contracts Adam Back & Hashcash Eric Hughes & Remailer St Jude & Community Memory Hal Finney & RPOW Featured Vector Image by Garry Killian / Freepik Photo by Phil Zimmerman Cryptography can be used to have not only decentralized and private money but also private communications. The activists known as cypherpunks knew this too well, and that’s why not only Bitcoin came out from that mailing list started in the ’90s. A bunch of free and useful cryptographic tools are the legacy of cypherpunks, including the one created by Phil Zimmerman —a remarkable cypherpunk even to this day. that mailing list that mailing list Born on February 12, 1954, in Camden, New Jersey, Zimmermann studied computer science at Florida Atlantic University, where he earned his degree in 1978. His career trajectory began with software engineering roles in various companies, including a stint at the nuclear power company, System Simulation Corporation, where he worked on cryptographic security systems. Zimmermann studied computer science at Florida Atlantic University, where he earned his degree in 1978. Zimmermann Zimmermann However, the interesting part is that he was also an anti-nuclear activist. It’s known that he was arrested for partaking in an anti-nuclear protest in Nevada, alongside prominent figures like Carl Sagan and Martin Sheen. This commitment to activism underscored Zimmermann's convictions, solidifying his standing within the anti-nuclear movement. It’s known It’s known Amidst the shifting geopolitical landscape of the early 1990s, Zimmermann's focus pivoted towards cryptography, recognizing its potential to safeguard private communications in an increasingly interconnected world. It was during this period that he would join the cypherpunks and create his ‘magnum opus’. Pretty Good Privacy (PGP) This is a thing even Satoshi Nakamoto used to protect his emails, and it’s still widely used as a standard to achieve private communications. Developed in 1991, PGP is an encryption software designed to secure email messages . Zimmermann's motivation behind PGP was rooted in his concerns about government surveillance and the need for accessible cryptographic tools to protect individual privacy. In his own words : Developed in 1991, PGP is an encryption software designed to secure email messages In his own words In his own words “It's personal. It's private. And it's no one's business but yours. You may be planning a political campaign, discussing your taxes, or having a secret romance. Or you may be communicating with a political dissident in a repressive country. Whatever it is, you don't want your private electronic mail (email) or confidential documents read by anyone else (...) PGP empowers people to take their privacy into their own hands. There has been a growing social need for it. That's why I wrote it.” “It's personal. It's private. And it's no one's business but yours. You may be planning a political campaign, discussing your taxes, or having a secret romance. Or you may be communicating with a political dissident in a repressive country. Whatever it is, you don't want your private electronic mail (email) or confidential documents read by anyone else (...) PGP empowers people to take their privacy into their own hands. There has been a growing social need for it. That's why I wrote it.” As for its internal features, PGP uses a pair of cryptographic keys for each user—a public key and a private key. The public key, which is freely distributed, is used by others to encrypt messages intended for the user. Meanwhile, the private key, kept confidential by the user, is used for decrypting these messages. When someone wants to send an encrypted message to a PGP user, they obtain the recipient's public key. Using this key, they encrypt the message, ensuring that only the intended recipient, who possesses the corresponding private key, can decrypt and read it. This process provides confidentiality for the message. Additionally, PGP supports digital signatures, enabling users to verify the authenticity and integrity of emails. By hashing the message and encrypting the hash with their private key, senders create digital signatures that recipients can verify using the sender's public key. After PGP After PGP Back then, the US government considered cryptographic tools as weapons, and that’s why Zimmerman was investigated by authorities for the free distribution of PGP. Luckily, they dropped the case in 1996 without charges, and the cypherpunk founded PGP Inc., along with a new release of PGP. The company in charge of maintaining the software was eventually sold to Symantec in 2010. Following the success of PGP, Zimmermann has also been involved in various ventures aimed at bolstering digital security and privacy. In 2012, he co-founded Silent Circle alongside Mike Janke and Jon Callas, focusing on developing secure hardware and subscription-based software solutions. Additionally, Zimmermann collaborated with other key figures from Silent Circle and Lavabit (an encrypted webmail service) to establish the Dark Mail Alliance in 2013, with the objective of creating a new protocol to enhance email encryption, addressing limitations in PGP. Following the success of PGP, Zimmermann has also been involved in various ventures aimed at bolstering digital security and privacy. Beyond his cryptographic endeavors, Zimmermann extended his influence to social networking platforms, advocating for ethical and privacy-centric alternatives to mainstream platforms like Facebook. His involvement in the social network Okuna , previously known as Openbook, aimed to provide users with a platform that prioritized privacy and democratic values over profit-driven models. Okuna Okuna Zimmermann's contributions have been widely recognized, with numerous awards acknowledging his pioneering work in cryptography and advocacy for digital rights. From inductions into halls of fame to prestigious accolades such as the Louis Brandeis Award from Privacy International and the Norbert Wiener Award for Social and Professional Responsibility, Zimmermann's legacy continues to resonate within the realms of technology and human rights advocacy. In a world of surveillance In a world of surveillance There’s a thing called “the Zimmerman law” that refers to his words about technology and surveillance: “The natural flow of technology tends to move in the direction of making surveillance easier (…) the ability of computers to track us doubles every eighteen months.” If the period is exact or not in reality, it doesn’t matter, because today mass surveillance and censorship have become common feats by governments worldwide. his words his words “The natural flow of technology tends to move in the direction of making surveillance easier (…) the ability of computers to track us doubles every eighteen months.” mass surveillance mass surveillance PGP can help us to protect our privacy and digital rights, but it’s not the only tool available for that. Obyte , for instance, can also help with private communications and decentralized, fast, and secure financial transactions worldwide. Built on a Directed Acyclic Graph (DAG) structure, Obyte ensures global transactions without the need for miners or any other middlemen. This structure enables Obyte to increase its decentralization and offers a high level of control to its users. Obyte Obyte In addition to its financial features, where tokenization of any asset is also possible, Obyte integrates private communications functionality directly into its platform. Users can leverage Obyte's built-in messaging system in the wallet to communicate securely and privately, thanks to end-to-end encryption, similar to PGP. tokenization of any asset tokenization of any asset in the wallet in the wallet This feature enhances user privacy by enabling them to freely communicate without a company or government behind them, thus providing a comprehensive solution for both financial transactions and private messaging. As a result, we can say that Obyte is empowering users with a versatile platform for conducting secure and private interactions worldwide. Read more from Cypherpunks Write Code series: Read more from Cypherpunks Write Code series: Read more from Cypherpunks Write Code series: Tim May & Crypto-anarchism Tim May & Crypto-anarchism Tim May & Crypto-anarchism Wei Dai & B-money Wei Dai & B-money Wei Dai & B-money Nick Szabo & Smart Contracts Nick Szabo & Smart Contracts Nick Szabo & Smart Contracts Adam Back & Hashcash Adam Back & Hashcash Adam Back & Hashcash Eric Hughes & Remailer Eric Hughes & Remailer Eric Hughes & Remailer St Jude & Community Memory St Jude & Community Memory St Jude & Community Memory Hal Finney & RPOW Hal Finney & RPOW Hal Finney & RPOW Featured Vector Image by Garry Killian / Freepik Featured Vector Image by Garry Killian / Freepik Freepik Freepik Photo by Phil Zimmerman Photo by Phil Zimmerman Phil Zimmerman Phil Zimmerman

Cypherpunks Write Code: Phil Zimmerman and PGP

সাইফারপাঙ্কস কোড লিখুন: ফিল জিমারম্যান এবং পিজিপি

Cypherpunks schreiben Code: Phil Zimmerman und PGP

Código de escritura de Cypherpunks: Phil Zimmerman y PGP

Cypherpunks écrivent du code : Phil Zimmerman et PGP

साइफरपंक्स कोड लिखें: फिल ज़िमरमैन और पीजीपी

サイファーパンクがコードを書く: フィル・ジマーマンと PGP

사이퍼펑크의 코드 작성: Phil Zimmerman 및 PGP

Cypherpunks escrevem código: Phil Zimmerman e PGP

Шифропанки пишут код: Фил Циммерман и PGP

Şifrepunklar Kod Yazıyor: Phil Zimmerman ve PGP

Cypherpunks viết mã: Phil Zimmerman và PGP

密码朋克编写代码：Phil Zimmerman 和 PGP

B2B Tools You Need To Have in Your Arsenal in 2024

It's true that most software developers are familiar with code-signing certificates, but some newcomers may not fully understand them or how they differ from email-signing documents. While both certificates and documents involve digital signatures, they serve different purposes, and it's crucial to understand the distinction between them. Digital signatures are commonly used in various contexts, with document and code signing being the most prevalent. If you've explored ways to secure your data, you've likely encountered different software and certificates, such as email signing and document signing. If you find yourself unsure about which certificate is suitable for your needs, rest assured that you're not alone. In this article, we'll delve into the differences between these two types of certificates. But before we do that, let's start by covering the basics of document signing and code signing certificates. What is a Code Signing Certificate? Software, scripts, and executables are signed by code-signing certificates to ensure their identity and integrity. The software publisher can digitally sign code with a code signing certificate (for example, you can digitally sign software you download and install). As a result, it provides two important benefits: . Software publisher information is confirmed and displayed Which software would you download if two similar programs appeared on the market, one issued by Apple, and the other by AppleHackingzone? By signing the final version of the code, a developer ensures that the software users download has not been tampered with. Two very significant things are accomplished by code signing. It guarantees the authorship and the developer's identity, preventing a random attacker from passing off malware as a or software patch. It verifies the software again to ensure it wasn't damaged, corrupted, or tampered with during installation. The code must seem exactly as it did when the developer signed it, and this is ensured by comparing the user-generated hash to the developer-generated value. Microsoft Apple The public can still trust a relatively unknown software company if the developers utilize a code signing certificate they obtained from a certificate authority (CA). This is because code signing extends the CA's trust in the developer. Malware assaults have grown in frequency as a result of people spending more time online as a result of the pandemic. Code signing certificates are one of the strategies used by hackers to mask malware as legitimate software, increasing the number of victims. By compromising the victim's private key and certificate, this is accomplished. To avoid this important step, users must sign their code using a highly secure certificate. Benefits of the Code Signing Certificate Digital signatures are applied to programs, files, updates, or executables to verify their authenticity and integrity after installation and execution. Using code signing, Microsoft developers, programmers, and software engineers can prove, for example, that your Windows 10 update came from Microsoft, not a hacker. By downloading a code-signed file, you can ensure you are downloading it from the intended author/publisher instead of some hacker trying to steal your data and information. In essence, it informs you that the code hasn't been altered by a bad actor, allowing you to install and execute it confidently on your computer. What is an Email Signing and Document? Email signing and document certificates are used for digitally signing emails and documents. You may have seen these documents enabled in organizations and different document types like Microsoft Office and Adobe. The certificate shows the identity of the sender while defining the document. The validity and identity of the certificate holder are guaranteed by digital certificates. You include a signature when you send or receive an email or fill out an online form, which can only be unlocked by the recipient's server using their public key. This guarantees that the data is transmitted securely and without being tampered with or changed by anyone. This encryption key creates an unbreakable connection between your web browser and the receiving server that is strictly necessary for safe data submission and to verify the sender's identity. Why consider Email Signing and Documentation? Sign and encrypt emails. Sign Microsoft Office documents electronically Verify your identity with online services How are Code-and Email-Signed Documents Used? In a nutshell, we can say that both are somewhat similar. If we look closely, they are both used to secure data for software packages, emails, or documents. Code-signing certificates and email-signing documents are digital Both have rigorous vetting processes to ensure the authority Both are used to secure users from being attacked Both provide certain periods of validity like one, two, and three years Code Signing Certificate vs. Email Signing & Document - Core Differences Core Differences Code Signing Certificate Email Signing and Documentation Security Secure software, application and device drivers Secure emails, Adobe and Microsoft Office Users Developers and software publishers Organizations, banks, and universities Number of Signings Unlimited Limited or varied depending on the organization Conclusion Code signing certificates and email and document signing are a complex world, and it is important to have the right solution in place to protect your organization from every type of digital fraud. As a result, you must choose the right signature provider to safeguard online communication and experiences.

Code Signing Certificate vs. Email and Document Signing Certificate

Having explored how to implement an authentication system in Next.js 14 with NextAuth.js(Auth.js) in the first part of this blog, it is crucial to take the next step to ensure the validity of user information: email validation. This process is not only an additional step in the security of our application, but an essential component to ensure that interactions between the user and the platform are legitimate and secure. In this second part, we will focus on integrating email validation by sending emails, using Resend for sending emails, and React Email to create attractive and functional email templates. Initial Configuration Make sure your project already has the authentication system described in the first part of the blog implemented. This includes having Next.js 14 and NextAuth configured correctly. https://hackernoon.com/how-to-implement-authentication-in-nextjs-14-with-nextauthjs-shadcnui-react-hook-form-and-zod?embedable=true Resend and Ract Email Integration in Next.js Setting Up Install the dependencies needed in the project. This time we’ll use you can use the package manager of your choice. pnpm pnpm add resend react-email @react-email/components : to send emails. Resend : to create beautiful emails using React and TypeScript. React Email 2. Create the following structure for the project: ...
├── emails/
│   └── verification-template.tsx
...
├── src/
│   ├── actions/
│   │   ├── email-actions.tsx
│   │   └── auth-actions.tsx
│   ├── app/
│   │   ...
│   │   ├── (primary)/
│   │   │   ├── auth/
│   │   │   │   └── verify-email/
│   │   │   │       └── page.tsx
│   │   │   ├── layout.tsx
│   │   │   └── page.tsx
│   │   │   ...   
│   ├── components/
│   │   └── auth/
│   │       ├── signin-form.tsx
│   │       ├── signup-form.tsx
│   │       ...
│   ...
│   ├── utils.ts
│   ...
...
├── .env
... Creating Email Templates With React Email React Email allows you to create email templates using JSX, which facilitates the creation of attractive and consistent emails with your brand. Let’s create a basic email template as a React component. In this case, we will create the template that will be sent for the user to confirm their email. : emails/verification-template.tsx // Import React and necessary components from @react-email/components
import * as React from 'react';
import { Body, Button, Container, Head, Hr, Html, Img, Preview, Section, Text } from '@react-email/components';

import { getBaseUrl } from '@/utils';

// Obtain the base URL using the imported function
const baseUrl = getBaseUrl();

// Define the properties expected by the VerificationTemplate component
interface VerificationTemplateProps {
    username: string;
    emailVerificationToken: string;
}

// Define the VerificationTemplate component that takes the defined properties
export const VerificationTemplate = ({ username, emailVerificationToken }: VerificationTemplateProps) => (
    <Html>
        <Head />
        <Preview>Preview text that appears in the email client before opening the email.</Preview>
        <Body style={main}>
            <Container style={container}>
                <Img
                    src='my-logo.png'
                    alt='My SaaS'
                    style={logo}
                />
                <Text style={title}>Hi {username}!</Text>
                <Text style={title}>Welcome to Starter Kit for building a SaaS</Text>
                <Text style={paragraph}>Please verify your email, with the link below:</Text>
                <Section style={btnContainer}>
                    {/* Button that takes the user to the verification link */}
                    <Button
                        style={button}
                        href={`${baseUrl}/auth/verify-email?token=${emailVerificationToken}`}
                    >
                        Click here to verify
                    </Button>
                </Section>
                <Hr style={hr} />
                <Text style={footer}>Something in the footer.</Text>
            </Container>
        </Body>
    </Html>
);

// Styles applied to different parts of the email for customization
const main = {
    backgroundColor: '#020817',
    color: '#ffffff',
    fontFamily: '-apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Oxygen-Sans, Ubuntu, Cantarell, "Helvetica Neue", sans-serif',
};

const container = {
    margin: '0 auto',
    padding: '20px 0 48px',
};

... This component creates an HTML email template that includes styles and dynamic content. Properties are defined to receive y . These properties are used to customize the email for the user and generate the verification link. username emailVerificationToken To validate and test the template React Email provides a command to locally run a server that will expose the templates we have created inside the emails folder. We create the script in the to run the server. package.json {
  "scripts": {
    "dev": "email dev"
  }
} 2. We execute the script and this will run the server on ; we will see a screen like the following with all the templates created. localhost In our case, we have only one template. As you can see below, we have a preview of the email that will be sent to the user. Sending Emails With Resend Create a . Resend account Create a new . API KEY Add the to file. API KEY .env ...
# resend
RESEND_API_KEY="re_jYiFaXXXXXXXXXXXXXXXXXXX" 4. To create the functionality of sending emails, we could create endpoints inside the folder and make requests, however, on this occasion we will do it by taking advantage of the server actions potential. api/ http : actions/email-actions.ts 'use server'

import React from 'react'
import { Resend } from 'resend'

// Creates an instance of Resend using the API KEY
const resend = new Resend(process.env.RESEND_API_KEY)

// Defines the data structure for an email.
interface Email {
    to: string[] // An array of email addresses to which to send the email.
    subject: string // The subject of the email.
    react: React.ReactElement // The body of the email as a React element.
}

export const sendEmail = async (payload: Email) => {
    const { error } = await resend.emails.send({
        from: 'My SaaS <onboarding@resend.dev>', // Defines the sender's address.
        ...payload, // Expands the contents of 'payload' to include 'to', 'subject', and 'react'.
    })

    if (error) {
        console.error('Error sending email', error)
        return null
    }

    console.log('Email sent successfully')
    return true
} Note: To test in free development, you have to use as the sender the email “onboarding@resend.dev”, otherwise, you would have to add a custom domain. 5. Send the email when registering a new user. : actions/auth-actions.ts ...

import { sendEmail } from './email-actions'

import VerificationTemplate from '../../emails/verification-template'

// Import a utility function to generate a secure token.
import { generateSecureToken } from '@/utils'

export async function registerUser(user: Partial<User>) {
 try {
  // Creates a new user in the database with the provided data.
  // Passwords are hashed using bcrypt for security.
  const createdUser = await prisma.user.create({
   data: {
    ...user,
    password: await bcrypt.hash(user.password as string, 10),
   } as User,
  })

  // Generates a secure token to be used for email verification.
  const emailVerificationToken = generateSecureToken()

  // Updates the newly created user with the email verification token.
  await prisma.user.update({
   where: {
    id: createdUser.id,
   },
   data: {
    emailVerificationToken,
   },
  })

  // Sends a verification email to the new user using the sendEmail function.
  await sendEmail({
   to: ['your Resend registered email', createdUser.email],
   subject: 'Verify your email address',
   react: React.createElement(VerificationTemplate, { username: createdUser.username, emailVerificationToken }),
  })

  return createdUser
 } catch (error) {
  console.log(error)
  if (error instanceof Prisma.PrismaClientKnownRequestError) {
   if (error.code === 'P2002') {
    // Returns a custom error message if the email already exists in the database.
    return { error: 'Email already exists.' }
   }
  }

  return { error: 'An unexpected error occurred.' }
 }
} Once the user is created and the verification token is generated, the function sends an email to the new user. This email is constructed using the React component, personalized with the user's name and verification token. This step is crucial for verifying the user's email address as valid and controlled by the user. VerificationTemplate Page to Validate the Token Once the email is sent to the user, this will have a link that will take him back to the site. To validate the email, for this, we need to create the page. : (primary)/auth/verify-email/page.tsx /* 
  All imports
*/

// Defines the prop types for the VerifyEmailPage component.
interface VerifyEmailPageProps {
 searchParams: { [key: string]: string | string[] | undefined }
}

export default async function VerifyEmailPage({ searchParams }: VerifyEmailPageProps) {
 let message = 'Verifying email...'
 let verified = false 
 if (searchParams.token) { // Checks if a verification token is provided in the URL.
  // Attempts to find a user in the database with the provided email verification token.
  const user = await prisma.user.findUnique({
   where: {
    emailVerificationToken: searchParams.token as string,
   },
  })

  // Conditionally updates the message and verified status based on the user lookup.
  if (!user) {
   message = 'User not found. Check your email for the verification link.'
  } else {
   // If the user is found, updates the user record to mark the email as verified.
   await prisma.user.update({
    where: {
     emailVerificationToken: searchParams.token as string,
    },
    data: {
     emailVerified: true,
     emailVerificationToken: null, // Clears the verification token.
    },
   })

   message = `Email verified! ${user.email}`
   verified = true // Sets the verified status to true.
  }
 } else {
  // Updates the message if no verification token is found.
  message = 'No email verification token found. Check your email.'
 }

 return (
  <div className='grid place-content-center py-40'>
   <Card className='max-w-sm text-center'>
    <CardHeader>
     <CardTitle>Email Verification</CardTitle>
    </CardHeader>
    <CardContent>
     <div className='w-full grid place-content-center py-4'>
      {verified ? <EmailCheckIcon size={56} /> : <EmailWarningIcon size={56} />}
     </div>
     <p className='text-lg text-muted-foreground' style={{ textWrap: 'balance' }}>
      {message}
     </p>
    </CardContent>
    <CardFooter>
     {verified && (
      // Displays a sign-in link if the email is successfully verified.
      <Link href={'/auth/signin'} className='bg-primary text-white text-sm font-medium hover:bg-primary/90 h-10 px-4 py-2 rounded-lg w-full text-center'>
       Sign in
      </Link>
     )}
    </CardFooter>
   </Card>
  </div>
 )
} After successfully validating the user’s email, we will see the following message. Now, we will implement a last validation for when the user wants to log in and has not yet verified his email. : components/auth/sigin-form.tsx ...

 async function onSubmit(values: InputType) {
  try {
   setIsLoading(true)

   const response = await signIn('credentials', {
    redirect: false,
    email: values.email,
    password: values.password,
   })
   if (!response?.ok) {
// if the email is not verified we will show a message to the user.
    if (response?.error === 'EmailNotVerified') {
     toast({
      title: 'Please, verify your email first.',
      variant: 'warning',
     })

     return
    }

    toast({
     title: 'Something went wrong!',
     description: response?.error,
     variant: 'destructive',
    })
    return
   }

   toast({
    title: 'Welcome back! ',
    description: 'Redirecting you to your dashboard!',
   })

   router.push(callbackUrl ? callbackUrl : '/')
  } catch (error) {
   console.log({ error })
   toast({
    title: 'Something went wrong!',
    description: "We couldn't create your account. Please try again later!",
    variant: 'destructive',
   })
  } finally {
   setIsLoading(false)
  }
 }

... That’s it! 🎉 The user will be able to validate his email and finish his registration in our application. 🧑‍💻 Repo here Conclusion We already know how to create and send emails using React Email and Resend. This process allows you to leverage your knowledge of React to design emails efficiently while maintaining a familiar and productive workflow. You can experiment with different components and properties to create emails that perfectly fit the needs of your projects. Want to connect with the Author? Love connecting with friends all around the world on . 𝕏 Also published here

How to Send Email Verification in Next.js 14 With NextAuth.js, Resend, and React Email

NextAuth.js এর সাথে Next.js 14-এ ইমেল যাচাইকরণ কীভাবে পাঠাবেন, ইমেল পুনরায় পাঠাবেন এবং প্রতিক্রিয়া জানাবেন

So senden Sie eine E-Mail-Verifizierung in Next.js 14 mit NextAuth.js, Resend und React Email

Cómo enviar verificación por correo electrónico en Next.js 14 con NextAuth.js, reenviar y reaccionar correo electrónico

Comment envoyer une vérification par e-mail dans Next.js 14 avec NextAuth.js, renvoyer et réagir par e-mail

NextAuth.js के साथ Next.js 14 में ईमेल सत्यापन कैसे भेजें, पुनः भेजें और ईमेल पर प्रतिक्रिया कैसे करें

NextAuth.js を使用して Next.js 14 で電子メール検証を送信し、電子メールを再送信し、反応する方法

NextAuth.js, 재전송 및 반응 이메일을 사용하여 Next.js 14에서 이메일 확인을 보내는 방법

Como enviar verificação de e-mail em Next.js 14 com NextAuth.js, reenviar e reagir e-mail

Как отправить подтверждение по электронной почте в Next.js 14 с помощью NextAuth.js, повторной отправки и ответа на электронную почту

Next.js 14'te NextAuth.js, Yeniden Gönderme ve E-postayla Tepki Verme ile E-posta Doğrulaması Nasıl Gönderilir

Cách gửi xác minh email trong Next.js 14 với NextAuth.js, gửi lại và phản hồi email

如何使用 NextAuth.js、重新发送和响应电子邮件在 Next.js 14 中发送电子邮件验证

This paper is available on arxiv under CC 4.0 license. Authors: (1) Qin Wang, CSIRO Data61, Australia; (2) Shiping Chen, CSIRO Data61, Australia. Table of Links Abstract & Introduction Ethereum Accounts Account Abstraction Security Analysis Further Discussions Conclusion & References IV. SECURITY ANALYSIS We explore the potential security issues that may exist in new account formats after its update. We recall a series of account threats and related smart contract risks and develop a framework to evaluate potential risks in account abstraction. Conventional analyses of Ethereum often partition it into four distinct layers (e.g., [20]): the application layer (including accounts, smart contracts, and EVM), the data layer (including transactions, blocks, and events), the consensus layer (involving PoX mechanisms and incentives), and the network layer (comprising node discovery, message propagation, and verification). Given the central theme of this endeavor around accounts, we deliberately narrow our purview to the application layer, exploring the potential vulnerabilities targeting accounts, smart contracts, and related solidity language. Additionally, our coverage extends to certain elements within the transaction and block layers. Focused scope. (Tab.III). Inspired by a series of elegant investigations [20]–[27], we distill a succinct overview of vulnerabilities present within the current Ethereum application layer. These vulnerabilities can be broadly attributed to three factors: design pitfalls, vulnerabilities intrinsic to the Solidity programming language, and errors stemming from contract programming. Within each of these categories, we identify and elaborate upon sub-vulnerabilities ( ) that manifest across diverse functions and processes ( ). Our discussion then delves into the potential of account abstraction to alleviate these vulnerabilities. We examine the feasibility of employing account abstraction to mitigate these issues and explore strategies for implementation that could effectively address these concerns ( ). Framework design Vulnerability CauseFmWhere byWhichFunc . Our discussions are categorized into two facets, contingent upon the effectiveness of AA updates. Analyses This vulnerability centers around a concurrency issue where the blockchain’s future state is contingent upon the sequence of transaction execution, a process influenced by miners who group transactions into blocks based on incentives. The design of AA effectively mitigates this problem by employing bundlers to manage and submit transactions. Unlike miners or validators, bundlers have a limited scope of impacting transaction orders, as they handle a relatively small number of transactions. ✓ Transaction disorder. This vulnerability happens when a contract utilizes block.timestamp in crucial operations or as a means of generating randomness. It can be exploited by a malicious miner who has the capability to manipulate the value of block.timestamp (evidenced by [28]). The introduction of account abstraction helps address this concern, as AA reduces reliance on block.timestamp and shifts focus to bundlers, which are better suited for managing transactions and ensuring more controlled and secure interactions. ✓ Timestamp manipulation. The vulnerability stems from the EVM’s absence of address validity checking. In the process of encoding during contract invocation, if the encoded arguments’ length is insufficient, the EVM compensates by adding extra zeros to ensure 32 bytes. The AA design, through the involvement of the bundler and EntryPoint contract, can mitigate this issue. The design can effectively check the length of Ethereum addresses via msg.data. ✓ Short address. This vulnerability revolves around the manipulation of seed (a form of randomness) by malicious miners in gambling and lottery contracts that use pseudorandom number generation. AA might not directly enhance the security of random seed creation. This is because the process of generating random seeds typically involves functions within the contract logic rather than being directly embedded in accounts, which is the primary focus of AA. ✗ Randomness reliance. Malicious actors leverage empty accounts (devoid of nonce, balance, code, and storage) to initiate a DoS attack. These empty accounts still necessitate tracking within the Ethereum state trie and result in extended transaction processing times. AA is not equipped to mitigate this vulnerability, as it currently lacks verification mechanisms for empty accounts. However, the issue has been addressed through the implementation of EIP-161. ✗ Empty account. Ethereum uses the gas mechanism to deter abuse of computing resources, but this vulnerability emerges when the gas cost for resource consumption is improperly set. The exploitation of under-priced opcodes will consume a disproportionate amount of computing resources. This issue is not specifically addressed by the design of account abstraction, as it pertains to the gas pricing and resource allocation mechanisms within Ethereum. ✗ Under-price opcodes. Solidity would trigger an exception and terminate the call due to its rigid limit of 1,024 frames in the EVM call stack. Malicious actors could recursively call a contract, causing it to reach the maximum stack depth and fail subsequent external calls. While account abstraction cannot inherently address this specific vulnerability, changes in the Ethereum protocol (e.g., EIP-150) can indirectly impact AA as well as other aspects of the Ethereum ecosystem. ✗ Stack limit. The vulnerability arises when a contract’s execution demands a greater amount of gas than the permitted block gas limit. This occurs due to the inclusion of unbounded operations, such as loops, within the contract. AA design offers effective solutions to counter such issues in two primary ways: Firstly, the paymaster contract defines a fee policy that establishes clear limitations on gas limits. This mechanism ensures that transactions adhere to predefined gas constraints, preventing situations where execution demands exceed the allowable limit. Secondly, after AA’s update, every loop in smart contracts is invoked by an internal account rather than an external account. This setup grants the contract owner the ability to terminate loops if necessary ✓ Unbounded operations. This vulnerability stems from the inconsistency between the two return values from different calling routes: (i) directly referencing the callee contract instance and (ii) using low-level methods like send and call. Route-(i) will return the call back to the caller while Route- (ii) returns false to the caller. The inconsistency in behavior persists in the current state of the Solidity compiler, lacking rectification. AA design does not inherently address this issue, but updates or changes in the Solidity compiler or EVM could potentially influence AA as well. ✗ Inconsistent call returns. The vulnerability arises from Solidity’s behavior regarding uninitialized compound local variables, which, when not explicitly initialized, leads to the reference defaulting to slot 0 and overwriting content from that point onwards. AA design does not address this particular languagelevel issue, but it’s fortunate that the vulnerability was rectified by updating the version of Solidity. ✗ Pointer unreset. ✗ Outdated compiler. This vulnerability surfaces when a contract is compiled using an outdated compiler that harbors bugs. While AA design may not directly address this concern, it aligns with the solution: opting for an up-to-date compiler can substantially reduce the associated risks. Keeping the compiler current is a key practice to ensure the solidity and security of the compiled contracts. The vulnerability stems from the misnaming of the constructor function, inadvertently allowing unauthorized parties to take ownership of the contract. While AA design cannot directly solve this issue, it is fortunate that the problem was mitigated through the introduction of the constructor keyword ✓ Unclear constructor name. A contract can invoke another contract’s function by directly referencing the callee contract’s instance. However, the verification process carried out by the Solidity compiler only assesses whether the invoked function has been declared, and it doesn’t extend to verifying child functions that the invoked function inherits or parent functions that trigger it. This loophole can lead to unintended function execution. AA design does not offer a solution for this vulnerability, as it stems from Solidity’s insufficient type system. In this context, AA’s mechanisms don’t directly address this issue. ✗ Type casts. The vulnerability arises when an external contract initiates a function within the caller contract before the latter’s ongoing execution concludes—essentially manifesting as a cyclic call. This exploitable invocation persists until the caller contract depletes its gas resources. The foundation of this vulnerability can be attributed to two pivotal factors: (i) a contract’s decision-making hinges on specific state variables, which necessitate updating prior to invoking another contract; and (ii) the absence of a predefined gas limit for the transition. The introduction of AA can offer a partial solution to this issue. AA’s advantages, including reduced gas consumption and the ability to control transactions precisely through the paymaster contract, contribute to its potential mitigation. Additionally, user operations are treated as distinct inputs through independent transactions, fostering an environment free from dependencies on other contracts. This segregation of operations enhances security by reducing the risk of vulnerability to such cyclic call-related attacks. ✓ Reentrancy. The vulnerability arises from a scenario in which users can deposit funds into their contract accounts but are unable to later access or spend those deposited funds. Two primary factors contribute to this vulnerability: (i) contracts not furnishing a function for the expenditure of funds, and (ii) the inadvertent or deliberate termination of the callee contract. Account abstraction can offer partial mitigation of this vulnerability due to its transaction batching made by bundlers. With each user-requested operation, such as depositing funds into a smart contract, the transaction bundler gains an enhanced capability to inspect the contract before sending tokens. This heightened level of examination surpasses that of a standard user. The transaction bundler possesses the potential to ensure that operations transpire within the confines of the originating contract’s security. ✓ Frozen ether. Contract upgrading can be approached through two methods: (i) Dividing a contract into a proxy contract (non-updatable) and a logic contract (updatable). (ii) Employing a registry contract to maintain a record of the updated contracts. While the design of account abstraction is separate from these complexities, its contract functionalities align with its principles of upgradability. ✗ Upgraded contract. EVM offers an opcode called delegatecall, allowing the bytecode of a callee contract to be inserted into the bytecode of the caller contract. The vulnerability arises due to the possibility that a callee contract can modify state variables within the caller contract. Account abstraction does not inherently provide a distinct method to mitigate this particular vulnerability. The effectiveness of AA’s security in mitigating the issue hinges on its inherent design and solution. Fortunately, addressing this can be achieved via a straightforward means by enhancing its declaration. ✗ Delegatecall injection. This vulnerability stems from the situation where a callee contract causes the execution of a caller contract to be reverted. The design of account abstraction does not offer a significantly improved mitigation for this issue, as it fundamentally stems from contract programming practices. Consequently, this vulnerability might still be pertinent even within AA’s contract functionalities. ✗ Unexpected revert. This vulnerability surfaces when a contract’s decision-making relies on the values of this.balance or address(this).balance. These values can be manipulated by an attacker to gain unauthorized access to funds. The design update introduced by AA can potentially influence this vulnerability. In AA, all account addresses are explicitly bound with balances, unlike the implicit nature of the former design. This alteration could impact the dynamics of this vulnerability. ✓ Manipulated balance. This vulnerability arises when the result of an arithmetic operation surpasses the range of a Solidity data type. Regrettably, neither the Solidity compiler nor the EVM incorporates mechanisms to identify integer overflow or underflow. Account abstraction design limitations prevent it from overcoming these challenges. However, a solution to mitigate this vulnerability is within reach through the utilization of the SafeMath library, which has already proven effective in handling such arithmetic issues. ✗ Integer overflow. The vulnerability surfaces when a sender channels funds to multiple recipients via a proxy contract, bypassing individual transactions. In this mechanism, the proxy contract evaluates the authenticity of digital signatures from senders. If these signatures lack essential data (such as nonce or proxy contract address), a malicious recipient can exploit the situation to replay the message repeatedly, facilitating the withdrawal of surplus payments. In AA’s design, the role of the bundler mirrors that of a proxy agent. The bundler manages the accumulation of multiple transactions, functioning as a trusted entity. This approach not only aligns with the principles of a proxy contract but also serves as a safeguard against replay attacks. Further, the adoption of multi-sig techniques in AA can also contribute to the mitigation of issues. ✓ Insufficient signature. When the owner of a contract or a third party utilizes the self-destruct method to terminate a contract, the contract’s bytecode and storage will be erased. The vulnerability emerges from inadequate authentication mechanisms embedded within the contract. AA can indeed mitigate this issue by introducing multi-factor authentication, a more robust approach. This mandates the approval of multiple parties before a suicide operation is executed. By implementing this safeguard, AA enhances security by fortifying the authentication process and reducing the likelihood of unauthorized termination. ✓ Self-destruct contract. The problem originates from the utilization of tx.origin, a global variable within Solidity that identifies the original EOA responsible for triggering the transaction. The vulnerability arises when a contract employs tx.origin for authorization, thereby exposing it to phishing attacks. AA addresses this concern through its integration of EOA with contract invocation. The integration is pivotal as AA replaces tx.origin with msg.sender in default authentication. This shift is now a necessary step to bolster security against vulnerabilities stemming from tx.origin usage. ✓ tx.origin. This security issue arises due to the absence of identity verification when a caller invokes a function to transfer Ether to a random address. As seen in the mitigation strategies employed for previous balance-related vulnerabilities, the authentication mechanisms and the role of the bundler within account abstraction can aid in alleviating this problem. This ensures that only authorized entities are permitted to initiate such actions, thwarting unauthorized withdrawals. ✓ Wrong payment. Transaction details within a blockchain are inherently public due to the nature of the technology. While designating a state variable as private can limit other contracts’ access, the value of such a variable can still be inferred from transaction data. It’s worth noting that AA design does not specifically address the intricacies of transaction confidentiality; however, it aligns with the overall progression of smart contract evolution. Mitigation strategies encompass the implementation of cryptographic techniques like commitment schemes [29] and zero-knowledge proofs [30]. Additionally, hardware-based solutions [31] could also be explored to enhance the security of sensitive data within an untrusted environment. ✗ Lack of confidentiality. This vulnerability stems from inaccurately defining the visibility of a function, where the default public visibility can be exploited by attackers to improperly access functions. AA design doesn’t directly address this issue but aligns with its solution. This vulnerability is mitigated by requiring explicit specification of function visibility, a measure AA’s design also adheres to. ✗ Erroneous visibility.

Account Abstraction, Analysed: Security Analysis

SOLID design principles are the most important design principles you need to know to write clean code. Having a solid command over SOLID principles is an indispensable skill for any programmer. They are the foundation on which other design patterns are developed. In this article, we will tackle the SOLID design principles using some real-life examples and understand their importance. Together with Polymorphism, Abstraction, and Inheritance, SOLID Principles are really important to be good at objective-oriented programming. Why Are SOLID Principles Important? SOLID principles are important for multiple reasons: SOLID principles allow us to write clean & maintainable code: When we start a new project, initially the code quality is good because we have a limited set of features that we implement. However, as we incorporate more features the code starts becoming cluttered. SOLID Principles build upon the foundations of Abstraction, Polymorphism, and Inheritance and lead to design patterns for common use cases. Understanding these design patterns helps to implement common use cases in programming. SOLID Principles help us write clean code which improves the testability of the code. This is because the code is modular and loosely coupled. Each module can be developed independently and tested independently. Let’s now explore each of the SOLID principles in detail with real-world examples. 1. Single Responsibility Principle S in SOLID principles stands for Single Responsibility Principle. The Single Responsibility Principle states that a class should have only a single reason to change. This limits the number of places we need to make changes when incorporating additional requirements in our project. Each class should have exactly one reason to change. For example, let’s say we are designing a banking application in Java where we have a class that allows basic operations like debit, credit, and . The method takes an enum called (like Email, SMS, etc.) and sends the update with the appropriate medium. We will write the code for that as shown below. SavingsAccount sendUpdates sendUpdate NotificationMedium public class SavingsAccount {
    public int balance;
    public String name;

    public SavingsAccount(int initialBalance, String name) {
        this.balance = initialBalance;
        this.name = name;
        System.out.println("Created a savings account with balance = " + initialBalance);
    }

    public void debit(int amountToDebit) {
        // debit business logic
    }

    public void credit(int amountToCredit) {
        // credit business logic
    }  

    public void sendNotification(NotificationMedium medium) {
        if (medium == NotificationMedium.SMS) {
            // Send SMS here
        }
        else if (medium == NotificationMedium.EMAIL) {
           // Send Email here
        }
    }
} public enum NotificationMedium {
    SMS,
    EMAIL
} Now, if you look at the class above, it can change due to multiple reasons: SavingsAccount If there is any change in the core logic of class (like , , etc.). SavingsAccount debit credit If the bank decides to introduce a new Notification medium (let’s say WhatsApp). This is a violation of the Single Responsibility Principle in SOLID Principles. To fix, it we will make a separate class that sends the notification. Let’s refactor the code above according to the SOLID Principles public class SavingsAccount {
    public int balance;
    public String name;

    public SavingsAccount(int initialBalance, String name) {
        this.balance = initialBalance;
        this.name = name;
        System.out.println("Created a savings account with balance = " + initialBalance);
    }

    public void debit(int amountToDebit) {
        // debit business logic
    }

    public void credit(int amountToCredit) {
        // credit business logic
    }

    public void printBalance() {
        System.out.println("Name: " + name+ " Account Balance: " + balance);
    }

    public void sendNotification(Medium medium) { 
        Sender.sendNotification(medium, this);
    }
} public enum NotificationMedium {
    SMS,
    EMAIL
} public class Sender {
    public static void sendNotification(NotificationMedium medium, SavingsAccount account) {
        // extract account data from the account object
        if (medium == NotificationMedium.SMS) {
            //logic to send SMS here
        }
        else if (medium == NotificationMedium.EMAIL) {
            // logic to send Email here
        }
    }
} Now, since we have refactored the code, if there is any change in the or the format, we will change the class. However, if there is a change in the core logic of , there will be changes in the class. NotificationMedium Sender SavingsAccount SavingsAccount This fixes the violation that we observed in the first example. 2. Open/Close Principle The Open Close principle states that we should design the classes in such a way so that they are open for extension (in case of adding additional features) but closed for modification. Being closed for modification helps us in two ways: Many times, the original class source may not be even available. It could be a dependency consumed by your project. Keeping the original class unchanged reduces the chances of bugs. Since there might be other classes that are dependent on the class that we want to modify. To see an example of the Open Close Principle, let’s take a look at the example of a shopping cart (such as the one implemented on e-commerce websites). I am going to create a class called as which will contain a list of (s) that you can add to it. Depending on the type of item, and the taxation on it we want to create a method that calculates the total cart value inside the class. Cart Item Cart Classes should be open for extension and closed for modification import java.util.ArrayList;
import java.util.List;

public class Cart {
    private List<Item> items;
 

    public Cart() {
        this.items = new ArrayList<>();
    }

    public void addToCart(Item item) {
        items.add(item);
    }

    public double calculateCartValue() {
        double value = 0.0;
        for(Item item: items) {
            if (item.getItemType() == GIFT) {
                // 8% tax on gift + 2% gift wrap cost
                value += (item.getValue()*1.08) + item.getValue()*0.02
            }
            else if (item.getItemType() == ItemType.ELECTRONIC_ITEM) {
                value += (item.getValue()*1.11);
            }
            else {
                value += item.getValue()*1.10;  
            }
        }
        return value;
    }
} @Getter
@Setter
public abstract class Item {
    protected double price;
    private ItemType itemType;    
    
    public double getValue() {
        return price;
    }
} public enum ItemType {
    ELECTRONIC,
    GIFT
} In the above example, method calculates the cart value by iterating over all the items inside the cart and invoking logic based on the type of item. calculateCartValue Although this code looks correct, it violates the SOLID Principles. Let’s say we need to add a new rule for a different type of item (say Grocery) while calculating cart value. In that case, we would have to modify the original class and write another condition inside it which checks for items of type . Cart else if Grocery However, with little refactoring, we can make the code adhere to the open/close principle. Let’s see how. First, we will make the class abstract and make concrete classes for different types of (s) as shown below. Item Item public abstract class Item {
    protected double price;
    
    
    public double getValue() {
        return price;
    }
} public class ElectronicItem extends Item {

    public ElectronicItem(double price) {
        super.price = price;
    }
    @Override
    public double getValue() {
        return super.getValue()*1.11;
    }
} public class GiftItem extends Item {
    public GiftItem(double price) {
        super.price = price;
    }

    @Override
    public double getValue() {
        return super.getValue()*1.08 + super.getValue()*0.02;
    }
} public class GroceryItem extends Item {

    public GroceryItem(double price) {
        super.price = price;
    }

    @Override
    public double getValue() {
        return super.getValue()*1.03;
    }
} Inside each concrete Item classes like , ,  and implement the method which contains the business logic for the taxation and value calculation. GroceryItem GiftItem ElectronicItem getValue() Now, we will make the class depend on the abstract class and invoke the method for each item as shown below. Cart Item getValue() import java.util.ArrayList;
import java.util.List;

public class Cart {
    private List<Item> items;

    public Cart(Payment paymentOption) {
        this.items = new ArrayList<>();
    }

    public void addToCart(Item item) {
        items.add(item);
    }

    public double calculateCartValue() {
        double value = 0.0;
        for(Item item: items) {
            value += item.getValue();
        }
        return value;
    }
} Now, in this refactored code, even if new types of (s) are introduced, the class remains unchanged. Due to polymorphism, whatever is the actual type of the inside the , that class’s method would be invoked. Item Cart Item items ArrayList getValue() 3. Liskov’s Substitution Principle Liskov’s substitution principle states that in a given code, even if we replace the object of a superclass with an object of the child class, the code shouldn’t break. In other words, when a subclass inherits a superclass and overrides its methods, it should maintain consistency with the behavior of the method in the super class. For example, if we make the following classes and two classes and class. Now, let’s say we create a method called as within the Vehicle class, it can be overridden in class, but it will be unsupported in the class as doesn’t have an engine (see code sample below) Vehicle Car Bicycle startEngine() Car Bicycle Bicycle The subclass should maintain consistency with the behavior of the superclass when overriding methods. class Vehicle {
   public void startEngine() {
      // start engine of the vehicle
   }
}

class Car extends Vehicle {
  @Override
  public void startEngine() {
    // Start Engine
  }
}

class Bicycle extends Vehicle {
  @Override
  public void startEngine(){ 
    throw new UnsupportedOperationException("Bicycle doesn't have engine");
  }
} Now, let’s say there is some code that expects an object of type vehicle and relies on the method. If, while calling that piece of code instead of passing an object of type we pass a object, it would lead to issues in the code. Since the (s) class’s method will throw an exception when the method is called. This would be a violation of the SOLID Principles (Liskov’s substitution principle) startEngine() Vehicle Bicycle Bicycle startEngine() To resolve this issue, we can create two classes and and have inherit from the class and have inherit from MotorizedVehicle NonMotorizedVehicle Car MotorizedVehicle Bicycle NonMotorizedVehicle class Vehicle {
}

class MotorizedVehicle extends Vehicle {
   public void startEngine() {
      // start engine here
   }
}

class Car extends MotorizedVehicle {
  @Override
  public void startEngine() {
    // Start Engine
  }
}

class NonMotorizedVehicle extends Vehicle {
   public void startRiding() {
     // Start without engine
   }
}

class Bicycle extends NonMotorizedVehicle {
  @Override
  public void startRiding(){ 
    // Start riding without the engine.
  }
} 4. Interface Segregation Principle The “I” in SOLID Principles stands for the Interface Segregation Principle. The Interface segregation principle states that rather than having bigger interfaces that force implementing classes to implement unused methods, we should have smaller interfaces and have classes implemented. This way, classes only implement the relevant methods and remain clean. Divide your interfaces into multiple smaller interfaces rather than one big interface. For example, let’s look at the built-in Collections framework in Java. Among other data structures, Java also provides and data structure, LinkedList ArrayList class implements the following interface(s): , , , , , and . ArrayList Serializable Cloneable Iterable Collection List RandomAccess class implements , , , , , , and . LinkedList Serializable Cloneable Iterable Collection Deque List Queue That’s quite a lot of interfaces! Rather than having so many interfaces, Java developers could have combined , , , , , and into one interface, let’s say interface. Now, both and classes could have implemented this new interface. Serializable Cloneable Iterable Collecton List RandomAccess IList ArrayList LinkedList IList However, since does not support random access, it could have implemented the methods in the interface and could have thrown when somebody tries to call it. LinkedList RandomAccess UnsupportedOperationException However, that would be a violation of the Interface Segregation principle in SOLID Principles as it would “force” the LinkedList class to implement the methods inside the interface even though not required. RandomAccess Therefore, it is better to split the interface based on the common behavior and let each class implement many interfaces rather than one big interface. Dependency Inversion Principle The Dependency Inversion Principle states that classes at the upper level shouldn’t directly depend on the classes at the lower level.  This causes a tight coupling b/w the two levels. Instead of that, lower classes should provide an interface on which the upper-level classes should depend. Depend on interfaces rather than classes For example, let’s continue with the example we saw above and enhance it to add some payment options. Let’s assume we have two types of payment options with us and . Now, in the class, we want to add a method to which would calculate the cart value and initiate the payment based on the supplied payment. method. Cart DebitCard Paypal Cart placeOrder To do this, we could have added dependency in the example above by adding the two payment options as fields inside the class. However, that would tightly couple the class with and class. Cart Cart Cart DebitCard Paypal Instead of that, we would create a interface and have both the and classes implement the interfaces. Now, the class will depend on the interface, and not the individual payment types. This keeps the classes loosely coupled. Payment DebitCard Paypal Payment Cart Payment See the code below. public interface Payment {
    void doPayment(double amount);
}



public class PaypalPayment implements Payment {
    @Override
    public void doPayment(double amount) {
        // logic to initiate paypal payment
    }
}


public class DebitCardPayment implements Payment {
    @Override
    public void doPayment(double amount) {
        // logic to initiate payment via debit card
    }
}



import java.util.ArrayList;
import java.util.List;

public class Cart {
    private List<Item> items;

    private Payment paymentOption;


    public Cart(Payment paymentOption) {
        this.items = new ArrayList<>();
        this.paymentOption = paymentOption;
    }

    public void addToCart(Item item) {
        items.add(item);
    }

    public double calculateCartValue() {
        double value = 0.0;
        for(Item item: items) {
            value += item.getValue();
        }
        return value;
    }

    public void placeOrder() {
        this.paymentOption.doPayment(calculateCartValue());
    }
} If you are interested in learning more about object-oriented programming, GoF design patterns, and low-level design interviews, then do check my highly rated course Object Oriented Programming + Java Design Patterns

SOLID Principles In Java: A Beginner's Guide

জাভাতে সলিড প্রিন্সিপলস: একটি বিগিনারস গাইড

SOLID-Prinzipien in Java: Ein Leitfaden für Anfänger

Principios SOLID en Java: una guía para principiantes

Principes SOLID en Java : guide du débutant

जावा में ठोस सिद्धांत: एक शुरुआती मार्गदर्शिका

Java の SOLID 原則: 初心者ガイド

Java의 SOLID 원칙: 초보자 가이드

Princípios SOLID em Java: um guia para iniciantes

Принципы SOLID в Java: руководство для начинающих

Java'da SOLID İlkeleri: Yeni Başlayanlar İçin Kılavuz

Nguyên tắc RẮN trong Java: Hướng dẫn cho người mới bắt đầu

Java 中的 SOLID 原则：初学者指南

Stories, News & Mentions about SENDERS

Senders’s Stories on HackerNoon