Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Improved Authentication for Email Encryption and Security

protonmail.com

Post reply on HN
Print view View original

31–40 of 77 posts

Re: Improved Authentication for Email Encryption and Security

#31

Post by mapgrep »

mtgx wrote: post #18
polack wrote: post #4

So how does one migrate from the two password to the one? I like the idea of protonmail, but since they made it incompatible with normal public key encrypted mail it's pretty useless for many of us, unfortunately...

PGP is quite difficult to use by most people, and it doesn't even support forward secrecy, which is a huge weakness. It will never be used by more than a core group of highly technical, which is maybe less than 0.01% of the population. If we're to push end-to-end encryption to the masses, then we ought to try to get forward secrecy in it, and it should be quite invisible to the user. That's not to say that ProtonMail…

Perfect is the enemy of good. Mass adoption of PGP would made the work of hackers and spy agencies orders of magnitude harder.

Moxie writes from a personal perspective and you'll notice he never claims to have something better in hand. His Signal still lacks utterly basic functionality provided by PGP, most important among them the ability to transmit arbitrary attachments (Signal only supports an undisclosed list of media attachments) but also including the ability to retain your messages long term in a particular location. Meanwhile, many of the tradeoffs made to make Signal easy could be made using PGP: Automatic generation of keys; centralized key repo; centralized mapping of keys to contact points (email/phone); trust by default.

Re: Improved Authentication for Email Encryption and Security

#33

Post by smnscu »

We had this at Lavaboom (German encrypted email, bankrupt) 2 years ago. Our designer came up with this idea, I initially wanted to implement the classic 2 password design. The tricky bits are (1) explaining to the users that they can't reset their password and (2) supporting users who opt for manual key management (e.g. I own name@mydomain.com and I want to move from Google Apps + GPGtools to Lavaboom/Protonmail/etc).

https://github.com/lavab

our (brilliant) designer http://www.felixvonlooz.com/

Re: Improved Authentication for Email Encryption and Security

#34

Post by hobarrera »

vabmit wrote: post #25
drdaeman wrote: post #12

Earlier quoted context omitted.

One downside what totally prevents me from even giving ProtonMail a try is vendor lock-up. You'll be stuck with them with no option to migrate away while keeping historical data. No IMAP, no POP3, not even a proprietary backup format, nothing at all. One could probably automate a browser to log in, iterate mailbox and dump contents, but that certainly won't be fun. (Also, no way to use your own pre-existing key, only…

IMAP support is coming very soon. Engineers are working on the code, now. It's a more difficult task than people would imagine because the implementations of the IMAP standards by some clients (like Outlook) is a bit... "interesting".

How would this IMAP implementation work? Some kind of local proxy that does the decryption on-the-fly?

Re: Improved Authentication for Email Encryption and Security

#35

Post by hobarrera »

ShinyCyril wrote: post #10
Wonnk13 wrote: post #3

how practical is it to drop GMail for these guys? I'm tied fairly heavily to the Google ecosystem (Chome, Play, Finance, etc etc). They already have a mountain of data on me, but I really want to start taking encryption and privacy more seriously.

I didn't miss anything when I left Gmail, but I imagine it depends a lot on how you use email. I switched to Fastmail on my own domain and actually prefer the webmail interface over Gmail. I mainly use IMAP via Mail.app on my laptop and phone, Pantheon Mail (formerly Geary) on my desktop. I use PGP wherever I can. I haven't received any spam at all yet, so I can't comment on how their spam filters compare to Gmail. I…

Pretty much the same here, DDG, Fastmail, Firefox, and Here Maps and Movit for mapping/traveling.

Honestly, DDG surpassed google search years ago. I've preferred Firefox for a long time, and Fastmail's UI and service is incredibly superior to GMail. I guess the cost might be the only downside.

Re: Improved Authentication for Email Encryption and Security

#36

Post by binaryanomaly »

Wonnk13 wrote: post #3

how practical is it to drop GMail for these guys? I'm tied fairly heavily to the Google ecosystem (Chome, Play, Finance, etc etc). They already have a mountain of data on me, but I really want to start taking encryption and privacy more seriously.

No caldav and carddav implementation are available yet. So if you heavily depend on these it might not yet be ready for you yet. For occasional mailing I find protonmail pretty good - browser and apps.

Re: Improved Authentication for Email Encryption and Security

#37

Post by tux3 »

smnscu wrote: post #33

We had this at Lavaboom (German encrypted email, bankrupt) 2 years ago. Our designer came up with this idea, I initially wanted to implement the classic 2 password design. The tricky bits are (1) explaining to the users that they can't reset their password and (2) supporting users who opt for manual key management (e.g. I own name@mydomain.com and I want to move from Google Apps + GPGtools to Lavaboom/Protonmail/etc)…

>The tricky bits are (1) explaining to the users that they can't reset their password

So that's interesting, because as I understand it ProntonMail does allow users to reset their password using a recovery email, although the feature can be disabled in the settings.

Re: Improved Authentication for Email Encryption and Security

#38

Post by [deleted] »

smnscu wrote: post #33

We had this at Lavaboom (German encrypted email, bankrupt) 2 years ago. Our designer came up with this idea, I initially wanted to implement the classic 2 password design. The tricky bits are (1) explaining to the users that they can't reset their password and (2) supporting users who opt for manual key management (e.g. I own name@mydomain.com and I want to move from Google Apps + GPGtools to Lavaboom/Protonmail/etc)…

[deleted]

Re: Improved Authentication for Email Encryption and Security

#39

Post by jimktrains2 »

ComodoHacker wrote: post #13
jimktrains2 wrote: post #11

This all seems to be a web-based application ( https://github.com/ProtonMail/WebClient ). How are the security issues regarding knowing that you're always running that code and that the server isn't compromised and sending altered code? The arguments against server-supplied, js-in-the-browser crypto have been done to death. Why is this any different, and why am I wrong to dismiss it out-of-hand as (in)secure as simpl…

>Why is this any different Nobody says it's different >Why isn't this only an open-source, native app (where I can load a specific, known version instead of whatever is on the server). OK, let's suppose you're using a native app. One day vendor issues an update with some critical vulnerability patched. Unfortunately, another vulnerability (or even backdoor) sneaks into this update for whatever reasons. How is this an…

> Nobody says it's different

They why do all the extra work for no gain in security?

I think the sibling comment address your next comment well.

Re: Improved Authentication for Email Encryption and Security

#40

Post by benevol »

mark_l_watson wrote: post #28

"In ProtonMail’s one-password mode, the mailbox password is derived from the login password via a one-way cryptographic password hash." I wondered why they didn't do this. As a customer, this is a welcome change. One thing that is of general concern to me: I tend to use a lot of encrypted traffic because much of my work is done on SSH shells to servers, and some of my customers request encrypting work files and use V…

> With also using ProtonMail, I would expect to be on a government list of some sort.

Are you aware what kind of idea you are circulating here? It's the kind of idea citizens in totalitarian states would circulate, probably even in the hope to score points from their dictator, for participating in instilling "order".

Dude, wake up. This is sick.

Post reply on HN