Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improved Authentication for Email Encryption and Security

protonmail.com

Post reply on HN
Print view View original

21–30 of 77 posts

Re: Improved Authentication for Email Encryption and Security

#21

Post by mtgx »

Wonnk13 wrote: post #3

how practical is it to drop GMail for these guys? I'm tied fairly heavily to the Google ecosystem (Chome, Play, Finance, etc etc). They already have a mountain of data on me, but I really want to start taking encryption and privacy more seriously.

What you'll want is to forward your Gmail to ProtonMail as soon as possible, because otherwise you'll always visit Gmail first. So forward Gmail and then just keep a pinned ProtonMail tab open, and get rid of whatever Gmail notification extensions you may have. Also disconnect the Gmail mobile app and set-up ProtonMail on mobile.

https://protonmail.com/support/knowledge-base/transitioning-...

What may give you a push is that Google seems to be trying to make Gmail a more proprietary and less of an interoperable standardized email service. Eventually it may not be as easy to get out of that "lock-in" as it is now (even though it seems hard, but it's mostly a matter of habit and will to change to a new service).

Re: Improved Authentication for Email Encryption and Security

#22

Post by nwuensche »

rethab wrote: post #14
mvdwoord wrote: post #5

Earlier quoted context omitted.

Currently, for me, lack of a calendar is holding me back. As well as some other features, but I could probably overcome those. Relevant uservoice: https://protonmail.uservoice.com/forums/284483-feedback/sugg...

Yeah, but it's planned. They also mentioned the calendar coming in a recent blog post. In general, I should say I am pretty happy with protonmail. I've been using it for over a year now, however, in general I'm still pretty dependent on google for calendar, android, etc. When it comes to spam, my feeling is that I do get more now. But as long as it is properly categorized -- which it is -- I don't really mind getting…

Do you also get ads by protonmail itself or does it come from other websites? And is there any unsubscribe feature like in outlook?

Re: Improved Authentication for Email Encryption and Security

#23

Post by dgoujard »

nwuensche wrote: post #20
ShinyCyril wrote: post #10

Earlier quoted context omitted.

I didn't miss anything when I left Gmail, but I imagine it depends a lot on how you use email. I switched to Fastmail on my own domain and actually prefer the webmail interface over Gmail. I mainly use IMAP via Mail.app on my laptop and phone, Pantheon Mail (formerly Geary) on my desktop. I use PGP wherever I can. I haven't received any spam at all yet, so I can't comment on how their spam filters compare to Gmail. I…

Right now, I also try to keep Google as far away from me as I can. Unfortunately, I don't own a domain myself. Have you tried out ProtonMail yourself? If so, do you think that it is a good alternative to a self-hosted server like Fastmail?

Fastmail is not self hosted it's like protonmail a mail provider. I also use fastmail, it's less expensive and more private than gmail

Re: Improved Authentication for Email Encryption and Security

#24

Post by vabmit »

vesinisa wrote: post #19
ComodoHacker wrote: post #17

>In ProtonMail’s one-password mode, the mailbox password is derived from the login password via a one-way cryptographic password hash. I wonder what the password change procedure will be when you have several gigabytes of mail in your mailbox? Would you have to download every message, re-encrypt it in your browser and send back?

Hopefully the mailbox encryption key is actually static, and they only store it encrypted with a key derived from your login password. If you use two different salts the knowledge of the login pw hash does not yield the mailbox key encryption key.

The mailbox encryption key is static. There is no need to re-encrypted all the mail when it is changed. Since the PGP Secret Key is only decrypted in the client browser or app, there is no need to transmit the decryption password to the server.

Re: Improved Authentication for Email Encryption and Security

#25

Post by vabmit »

drdaeman wrote: post #12
Wonnk13 wrote: post #3

how practical is it to drop GMail for these guys? I'm tied fairly heavily to the Google ecosystem (Chome, Play, Finance, etc etc). They already have a mountain of data on me, but I really want to start taking encryption and privacy more seriously.

One downside what totally prevents me from even giving ProtonMail a try is vendor lock-up. You'll be stuck with them with no option to migrate away while keeping historical data. No IMAP, no POP3, not even a proprietary backup format, nothing at all. One could probably automate a browser to log in, iterate mailbox and dump contents, but that certainly won't be fun. (Also, no way to use your own pre-existing key, only…

IMAP support is coming very soon. Engineers are working on the code, now. It's a more difficult task than people would imagine because the implementations of the IMAP standards by some clients (like Outlook) is a bit... "interesting".

Re: Improved Authentication for Email Encryption and Security

#26

Post by terraforming »

ShinyCyril wrote: post #10
Wonnk13 wrote: post #3

how practical is it to drop GMail for these guys? I'm tied fairly heavily to the Google ecosystem (Chome, Play, Finance, etc etc). They already have a mountain of data on me, but I really want to start taking encryption and privacy more seriously.

I didn't miss anything when I left Gmail, but I imagine it depends a lot on how you use email. I switched to Fastmail on my own domain and actually prefer the webmail interface over Gmail. I mainly use IMAP via Mail.app on my laptop and phone, Pantheon Mail (formerly Geary) on my desktop. I use PGP wherever I can. I haven't received any spam at all yet, so I can't comment on how their spam filters compare to Gmail. I…

Does Pantheon-Mail support PGP?

Re: Improved Authentication for Email Encryption and Security

#27

Post by icebraining »

ComodoHacker wrote: post #13
jimktrains2 wrote: post #11

This all seems to be a web-based application ( https://github.com/ProtonMail/WebClient ). How are the security issues regarding knowing that you're always running that code and that the server isn't compromised and sending altered code? The arguments against server-supplied, js-in-the-browser crypto have been done to death. Why is this any different, and why am I wrong to dismiss it out-of-hand as (in)secure as simpl…

>Why is this any different Nobody says it's different >Why isn't this only an open-source, native app (where I can load a specific, known version instead of whatever is on the server). OK, let's suppose you're using a native app. One day vendor issues an update with some critical vulnerability patched. Unfortunately, another vulnerability (or even backdoor) sneaks into this update for whatever reasons. How is this an…

An update to the native app must be the same for everyone, and being open source, the chances that someone will find out about it are much greater.

In a web app, they can send a backdoored copy of the code just to you and just a single time, which is much harder to detect.

Re: Improved Authentication for Email Encryption and Security

#28

Post by mark_l_watson »

"In ProtonMail’s one-password mode, the mailbox password is derived from the login password via a one-way cryptographic password hash."

I wondered why they didn't do this. As a customer, this is a welcome change.

One thing that is of general concern to me: I tend to use a lot of encrypted traffic because much of my work is done on SSH shells to servers, and some of my customers request encrypting work files and use VPNs. With also using ProtonMail, I would expect to be on a government list of some sort. Given the general anti-privacy and anti-encryption rhetoric from public government officials this is a concern.

What our government should do is a moon-shot level of effort to promote strong encryption and very robust digital infrastructure. While this might unfortunately make law enforcement's job a little more difficult, the advantages in fighting computer crime and generally saving businesses, citizens and the government money would be worth it. I think it would also increase our level of national security, with all of our systems less hackable.

Re: Improved Authentication for Email Encryption and Security

#29

Post by nickik »

mtgx wrote: post #18
polack wrote: post #4

So how does one migrate from the two password to the one? I like the idea of protonmail, but since they made it incompatible with normal public key encrypted mail it's pretty useless for many of us, unfortunately...

PGP is quite difficult to use by most people, and it doesn't even support forward secrecy, which is a huge weakness. It will never be used by more than a core group of highly technical, which is maybe less than 0.01% of the population. If we're to push end-to-end encryption to the masses, then we ought to try to get forward secrecy in it, and it should be quite invisible to the user. That's not to say that ProtonMail…

I would like something better then GPG as well, but at the moment I have a group of contacts that I would like to write GPG with.

If you have a replacement for GPG and E-Mail please tell me what it is.

Re: Improved Authentication for Email Encryption and Security

#30

Post by mark_l_watson »

ShinyCyril wrote: post #10
Wonnk13 wrote: post #3

how practical is it to drop GMail for these guys? I'm tied fairly heavily to the Google ecosystem (Chome, Play, Finance, etc etc). They already have a mountain of data on me, but I really want to start taking encryption and privacy more seriously.

I didn't miss anything when I left Gmail, but I imagine it depends a lot on how you use email. I switched to Fastmail on my own domain and actually prefer the webmail interface over Gmail. I mainly use IMAP via Mail.app on my laptop and phone, Pantheon Mail (formerly Geary) on my desktop. I use PGP wherever I can. I haven't received any spam at all yet, so I can't comment on how their spam filters compare to Gmail. I…

I have done the same, but with exception of being a paying customer for Play Movies and Play Music. I also buy extra GDrive storage, and use it for encrypted backups of my laptop (I have backup scripts that ZIP up my writing and work projects, GPG encrypt them, and I manually transfer the files to GDrive.

Google does derive real revenue from me, but not so much via their advertising business.

Edit: FastMail is a very good email service, BTW.

Post reply on HN