Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail now the maintainer of OpenPGPjs email encryption library

protonmail.com

Post reply on HN
Print view View original

21–30 of 30 posts

Re: ProtonMail now the maintainer of OpenPGPjs email encryption library

#21

Post by uncletaco »

bigiain wrote: post #19
ryanlol wrote: post #18

Earlier quoted context omitted.

This is why we have HSMs. It can in fact be "impossible" to steal ones crypto keys.

Yeah, but "stealing" them isn;t the NSA's only avenue to acquire them. With Lavabit they just said "give us the keys so we can snoop all we want" - I suspect very few of us would be able to resist like Levinson did (as in, shut your company and livelihood down, and hope they don't throw you in jail for doing so). (Fortunately, most of us won't have users with as much heat coming down on them as Snowden, but if you're…

"stealing" is the only path the NSA can take in the case of ProtonMail, due to their servers being hosted in Switzerland and not within the borders of a nation that has a strong relationship with the US intelligence community.

Re: ProtonMail now the maintainer of OpenPGPjs email encryption library

#22

Post by WoMaameTwe »

bigiain wrote: post #2

So my first reaction there was "there goes another non-five eyes (or nine or fourteen eyes) hosted mail service who've just painted a (or another) great big target on themselves to attract even more NSA scrutiny". (Second reaction was "Crypto in the browser in Javascript _again?_ Didn't was already point out this is 'doing it wrong'?")

Can I use my own domain name with Protonmail?

Re: ProtonMail now the maintainer of OpenPGPjs email encryption library

#23

Post by jpalomaki »

Reminder for the obvious: Javascript is now longer just for web browsers and GPG is not just for email. GPG is also used in B2B scenarios where files are being passed between between servers.

Also Javascript based client applications installed locally are becoming more common (think about Atom etc). Maybe we will soon also see Javascript based desktop IMAP client.

Re: ProtonMail now the maintainer of OpenPGPjs email encryption library

#24

Post by bigiain »

uncletaco wrote: post #21
bigiain wrote: post #19

Earlier quoted context omitted.

Yeah, but "stealing" them isn;t the NSA's only avenue to acquire them. With Lavabit they just said "give us the keys so we can snoop all we want" - I suspect very few of us would be able to resist like Levinson did (as in, shut your company and livelihood down, and hope they don't throw you in jail for doing so). (Fortunately, most of us won't have users with as much heat coming down on them as Snowden, but if you're…

"stealing" is the only path the NSA can take in the case of ProtonMail, due to their servers being hosted in Switzerland and not within the borders of a nation that has a strong relationship with the US intelligence community.

I'd bet good money that the NSA can outsource this to their friends/counterparts/lackeys in any of five eyes, nine eyes, and fourteen eyes countries - and through less official channels involving local or flown-in thugs, pretty much everywhere else. They probably can't easily get Huawei's or Baidu's private keys, but I bet there's tens or hundreds of thousands of Protonmail sized companies in China/Russia/everywhere else that they _can_ strongarm the owners or sysadmin staff into handing keys over.

Or maybe I'm just in a way too "the whole world is fucked" mood today...

Re: ProtonMail now the maintainer of OpenPGPjs email encryption library

#25

Post by girvo »

jpalomaki wrote: post #23

Reminder for the obvious: Javascript is now longer just for web browsers and GPG is not just for email. GPG is also used in B2B scenarios where files are being passed between between servers. Also Javascript based client applications installed locally are becoming more common (think about Atom etc). Maybe we will soon also see Javascript based desktop IMAP client.

> Javascript based desktop IMAP client

Nylas N1 is an example of this (and excellent, might I add)!

https://nylas.com/

Re: ProtonMail now the maintainer of OpenPGPjs email encryption library

#26

Post by phunehehe0 »

In case anyone looks for the same thing, I saw "ProtonMail is community software, funded by the community, and open source." and jumped to GitHub to search. As stated in https://github.com/ProtonMail/WebClient/issues/5, the only open source part is the JavaScript based client, so you can't self-host ProtonMail.

Re: ProtonMail now the maintainer of OpenPGPjs email encryption library

#27

Post by chinathrow »

ryanlol wrote: post #18
bigiain wrote: post #14

Earlier quoted context omitted.

If I'm the NSA, I'd already have stolen Protonmail's HSTS pinned cert's private key (possibly by burning a zero day getting into one of their web servers, possibly by "asking nicely" to some tech employee there for whom I had appropriate leverage). But yeah - short of nation-state or very high level LEO (who're just piggybacking on their local NSA equivalent), HSTS with pinned certs is as close to "secure" as we have…

This is why we have HSMs. It can in fact be "impossible" to steal ones crypto keys.

Only if you are sure the HSM isn't rigged from the start.

Re: ProtonMail now the maintainer of OpenPGPjs email encryption library

#28

Post by mike-cardwell »

jpalomaki wrote: post #23

Reminder for the obvious: Javascript is now longer just for web browsers and GPG is not just for email. GPG is also used in B2B scenarios where files are being passed between between servers. Also Javascript based client applications installed locally are becoming more common (think about Atom etc). Maybe we will soon also see Javascript based desktop IMAP client.

I'd rather desktop clients written in JavaScript talked to gpg-agent. OpenPGP.js wont let me use my smart card or my yubikey and I don't want to have to maintain multiple keyrings on the same system because some apps want to use GnuPG and others OpenPGP.js

Re: ProtonMail now the maintainer of OpenPGPjs email encryption library

#29

Post by cm3 »

It seems that WebCrypto is already implemented in browsers. Does this library make use of it, or is it pure JavaScript? If so, why is that? Most crypto algos are susceptible to side channel attacks, and trying to get that right in JavaScript across browsers doesn't look generally possible.

Re: ProtonMail now the maintainer of OpenPGPjs email encryption library

#30

Post by grinich »

girvo wrote: post #25
jpalomaki wrote: post #23

Reminder for the obvious: Javascript is now longer just for web browsers and GPG is not just for email. GPG is also used in B2B scenarios where files are being passed between between servers. Also Javascript based client applications installed locally are becoming more common (think about Atom etc). Maybe we will soon also see Javascript based desktop IMAP client.

> Javascript based desktop IMAP client Nylas N1 is an example of this (and excellent, might I add)! https://nylas.com/

Thanks for the kind words! (I work at Nylas.)

Here's a blog post with more details about Nylas N1 and PGP: https://nylas.com/blog/pgp

Post reply on HN