Viewing profile — amilich

Hey - really sorry to hear this - could you email me andrew@cursor.com? Here are 3 suggestions to try- 1. Reset your settings.json - if shared with vscode, sometimes settings can c…

Thanks for sharing! PGP support has been a huge request and enables end-to-end encryption automatically between large email providers for one of the first times we know of.

It's enough of other companies making money on our data. That's why I started Skiff (end-to-end encrypted email/docs/drive/calendar)! It's harder to build products E2EE but you get…

Hello :) Skiff cannot access email content, subject, and header info. To/from/cc/bcc fields are not stored end-to-end encrypted, though.

Few notes - iOS issue stems from a recent upgrade from an iframe to a webview. It's fixed on all mobile apps and versions. - All DMARC-failing mail does go to spam. - Caching image…

Thanks for the report. I am investigating this now.

I just compared Skiff and Tutanota on your tool. The results were the same. Thank you for confirming this.

It's very simple. One of them had access to user's private keys (Lavabit). One never has access to user private keys (Skiff).

That's why Skiff has had 4 security audits, not just 1 3 years ago. And, with multiple of the best auditors.

No, I'm not joking. We do have this option, and it's consistent with the defaults across private mail providers. Still waiting for your list of the ones that don't load images by d…

Any security engineer would have a heart attack if any employee, friend, or colleague said "security audit stuff [doesn't] matter." I wouldn't use software that doesn't undergo sec…

Actually, that's completely false. Security audits are a standard, reputable process for software. Trail of Bits is probably the best (or one of very few top) firms in this categor…

That's just false. Downloading crypto libraries over the web plagued Javascript crypto for years. We use tweetnacl, stablelib, and webcrypto - and tweetnacl also uses webcrypto!

Yes - privacy focused mail providers offer this as an option but do not enable it by default. Mainstream mail providers do not even have it as an option.

We use an open-source mailserver (Haraka), but security audits are the most trustworthy way to do this. We've had 4: skiff.com/transparency. Audits cover infrastructure.

What mail providers block all remote content by default?

Skiff encrypts all received emails with user public keys immediately on receipt. This is quite clear in our security model page and whitepaper. Skiff does not have access to any us…

No: Skiff does not have access to a single email stored on our platform, including ones received externally. All are public-key encrypted, including subjects and content.

We also don't do this. In a near future implementation you can just synchronize the end-to-end encrypted search index.

This sounds like a possible captcha error. Can you email me at andrew (at) skiff.com ? Sorry about this.

We offer a block remote content feature. There is no foolproof way to load any remote content without possibly exposing email open information.

See https://skiff.com/transparency , Trail of Bits has performed 2 audits, Cure53 1 audit, and we had an additional audit 2.5 years ago.

No, this is done with public-key encryption which does not require the client.

Those ads are still targeted to you, maybe not off of your email content (now vs 2017)

Before this basic cryptography was downloaded via JS files which yields no security and gave web cryptography a bad reputation. That is not true now.