I don't see an architectural alternative for such services yet. You'd need a client side app sandbox which allows servers to schedule routines to run locally on secret data, without leaking back data which the server can decrypt. It would also need to be cross-platform and have the same user accessibility as the web browser.
Or you could use, you know, a native client. It may increasingly become a foreign concept to the "facebook generation" but your computer is still fully capable of running a mail client on its own.
Of course you don't get to sell SaaS-subscriptions when you implement tray.io as a procmail GUI...
A native client without a user data sandbox doesn't solve the problem of networked applications leaking private data and spying on the user at all. The code needs to be open source, versioned, vetted, and only obtained via a trusted repository for every application the user wants to run each time it is updated. The user is no longer instantly able to access the latest version of the application by simply typing in a URI.
Would you be comfortable explaining to relatives, aquantainces, and the elderly in a casual conversation:
How to install, use, and maintain linux. How to install, use, and maintain their own mail server and spam filters. How PGP works. How to setup and use thunderbird+enigimail or mutt.
Compared to visiting a URI, would doing so be more technically demanding or less technically demanding for users who have not specialized in computing? Is the proportion of society which inevitably chooses not to specialize in a computing inherently more deserving or inherently less deserving of the benefits of encryption and privacy?
I think the gap in our perspective is most likely attributable to A) how widespread we wish to see encryption used by the general public in the future, or B) our expectations of the of the technical stamina of the general public when confronted with unfamiliar tasks, rather than generational effects.
I can't say you're wrong about privacy eroding but at the same time we always have a choice. If this service offers enough value then I'll choose to deal with the privacy intrusion because that's what I'm comfortable with. I'm trading a bit of privacy for the value the service offers. I can live without the service if I value my privacy more. If one really wants a service like this and there isn't another way to get what they offer without sacrificing privacy then the only options are to go without it or trade in privacy.
When you sign up for an account on most sites it's implied that you're giving up some bit of privacy for the convenience of having someone else handle your data. The alternative is building and maintaining your own system which isn't always realistic and the vast majority of people on earth cant do it.
I get that privacy is important to a lot of people and that the fact that sometimes protecting your privacy means making things difficult for yourself but I don't know if there's any way around it (actually, I don't believe there is). For example, some people Who are very concerned with privacy refuse to use Facebook and because of this they are missing out on connecting with friends, colleagues, and even potential customers because those people rely on Facebook so heavily to communicate. I've seen the people who are left out in the cold because of this then become even more vocal about privacy issues (not saying you're one of them, just in general) but in the end we all still have a choice.
Choosing to protect your privacy these days means potentially sacrificing a lot more in its place. Some people argue that this fact proves that we don't have a choice but I disagree. We may not like the consequences but the choice still exists.
Personally I'm all about privacy but not to the point of blocking cookies or other tracking on websites or avoiding services because they can potentially see my data. I think at a certain point you either have to trust that nothing is likely to go wrong by simply using a service or just not use it. I mean, there's always the risk that your personal information may fall into the wrong hands but that's life - its risk. You just have to be smart and/or realistic about it. I'll accept the risk I take storing my payment information with Amazon and I'll accept the risk of having some information willingly stored in Google's services and even be tracked by Analytics. I'll be more cautious with the risk of letting a new service like tray.io potentially reading my emails.
I don't think there's a way to offer a service like this without giving up some privacy. Do you know of a way to alleviate privacy concerns while still offering the kinds of services that, as you rightly point out, erode our privacy? The person who comes up with that could definitely profit!
Please believe me when I say I get your concern. I'm just kind of a weirdo around here. I don't hold many strong positions one way or the other on most issues. I tend to be in the center on most things. I'm a very moderate HNer which I feel is unusual but I'm definitely glad there are people like you who lean more toward either end of the spectrum instead of being in the middle on a given issue. It may turn out that my nonchalant attitude towards privacy will bite people like me one day and people like you will be there to change things (and say "I told you so" :)).
