Live data from Hacker News

Why ProtonMail is more secure than Gmail

protonmail.com

151–160 of 314 posts

Re: Why ProtonMail is more secure than Gmail

#151
post #103

Here's the thing with email. You can sign up for Protonmail ... but you've still got to use email to correspond with others. And in all likelihood many of those individuals will be on GMail or some other less-secure provider unless you're using Protonmail as an enterprise solution, in which case the ratio of "secured" vs. "unsecured" recipients would likely tilt towards secured. Email is insecure, and most users don'…

This was probably the biggest unsolved issue I had when seeking out a new email provider.

"Switch to this other email provider" is not going to get much of a result from your gmail/outlook-using contacts (especially if money is involved), and wouldn't even solve this issue unless you convert absolutely everyone to, for example, Protonmail. "Hey man can you set up this thing called PGP?" is probably even worse unless your social circle is all technically minded already. Even in a group of "nerds that play video games", I'd be surprised if even half of the group even know what PGP is.

So long as we're stuck with email as we know it today, it really seems like there is just no bolt-on solution that can be used to "fix" it.

Re: Why ProtonMail is more secure than Gmail

#153
post #52

Earlier quoted context omitted.

That's a fair criticism. I don't think the Gmail glossy brochure mentions its threat model either.

Gmail isn't floating around any brochures on security though - it's pitch to the majority of its users is "It's Google and Mail and where most people have their emails. You don't want to be that one weirdo at @yahoo.com do you?" and that just about does it. ProtonMail is trying to recruit users with the brochure. That said, even though the argument is a bit flawed here, I think most attracted by it would still prefer…

Do you really believe people use gmail because of its brand?

I don't know about any security brochure, but I know I can setup 2FA to use push notifications (not an insecure SMS number), and can check where all of my logins are from, and have "suspicious" logins blocked automatically, etc, etc. I can also create single-use passwords for insecure devices (such as a youtube password just for my apple TV). Not to mention how amazing they are about spam detection.

I think their security posture is actually excellent.

Re: Why ProtonMail is more secure than Gmail

#154
post #125

Earlier quoted context omitted.

You are correct in your assessment, but this statement holds true for any application. You must read the source before executing it -- and en suite you need to trust the hardware that's executing said code. As it stands you don't send your password to proton -- they send you an encrypted private key that the password you type decrypts (at email creation time you generated that private key in your browser via openppg.…

The lack of code signing in web apps and the added attack surface of having your web and application server (which are in control of the code that users run) exposed to the internet matter a lot in this context. Attacks on build systems of native applications aren't unheard of (CCleaner, that Ukrainian tax software, etc.), but it's far more involved and more likely to be detected, whereas web app backdoors can easily…

I've been working on adding code signing to web apps, using Service Workers: http://blog.airbornos.com/post/2017/08/03/Transparent-Web-Ap...

The main blocker is https://github.com/w3c/ServiceWorker/issues/1208 (which would fix the non-critical but less-than-ideal issue described under "Service Worker lifecycle" in the blog post).

Re: Why ProtonMail is more secure than Gmail

#155

Earlier quoted context omitted.

Uncle Sam can't root everyone's machines at once. If Uncle Sam wants mass surveillance it's going be through the provider.

Intel Management Engine.

That is only remotely exploitable if you use Intel network cards.

There’s a reason all my systems use other cards, and are behind a hardware firewall specifically configured for my use cases.

Re: Why ProtonMail is more secure than Gmail

#156
post #2

This post would be improved by discussing that their [threat model]( https://en.wikipedia.org/wiki/Threat_model ) is so different than Google's that it regards some of Google's business practices as threats. And that, in turn, there are threats that Google treats as much bigger threats, bringing their own world-class security team to. Calling this fundamental difference in approach "more secure" manipulates the less-…

It can be simplified to: Gmail + 0$ per month = zero privacy for you and anyone who emails you, plus Uncle Sam has full access to your life. Protonmail + 4$ per month = you will never see ads for a like the one you just bought, plus you will be driving Uncle Sam crazy!

This is not a good heuristic, for several reasons.

First and foremost, despite widespread fetishization of things like end-to-end encryption, real world software rarely differentiates its security based on superior cryptography. Most security vulnerabilities occur at the endpoint level and are not even technical vulnerabilities, they're just successful, targeted phishing campaigns. The next most common set of vulnerabilities are in mundane software, typically in the infrastructure and peripheral logic. These are due to developer ignorance, misconfiguration or sometimes both. From there we have crypto implementation flaws, which are typically due to software engineers' fascination with implementing their own cryptography libraries or taking strange liberties with existing libraries that deviate from the explicit or implicit intentions of the original author. Finally, on a peak so remote and small it's scarcely visible from the ground, we have actual cryptography design flaws, where someone literally rolls their own crypto at the conceptual level and deploys it.

Second, email is a fundamentally antagonistic medium when it comes to end-to-end encryption. If you are actually concerned about your privacy and you're discussing something that warrants extreme care, email is the least user-friendly and most error-prone method of going about it. You should consider a synchronous medium with forward security if possible, probably based on a well-known and well-audited messaging protocol (to avoid a flame war I'm not going to suggest any particular one - do your research).

Third, if your threat model is honestly the US government, you need to significantly revise your opsec entirely if you're realistically considering Protonmail. Regardless of its actual security, you're (implicitly) saying that you trust Protonmail to be capable of withstanding the resources of a motivated three letter agency with an armada of security compromising tools at its disposal. Why trust a third party at all then? What makes you think the servers being in Switzerland is going to help you if you distrust the government this much? By all means, don't use Gmail either, but then Protonmail isn't really a coherent security measure either - again, use a synchronous messaging platform, or develop the opsec needed to consistently use PGP correctly on your own.

Given the foregoing, if your adversary is actually the US government, neither Gmail or Protonmail are effective strategies, and if your adversary is not the US government, Google's security team is vastly more qualified and has overwhelmingly more resources at its disposal to secure its email infrastructure.

Re: Why ProtonMail is more secure than Gmail

#158
post #47

Earlier quoted context omitted.

A missing threat model gives this more credit than it merits. You can replace 'zero knowledge' with 'military grade' and it will be just as meaningful (if somewhat more obviously poor). Plus, you could say they are describing a threat model. If ProtonMail were compromised in this one particular way the confidentiality of your mail would be 'stronger' or 'improved'. This should be as reassuring as 'Switzerland', which…

ProtonMail has a publicly available threat model: https://protonmail.com/blog/protonmail-threat-model/ Without a threat model (that is, the set of threats that one is trying to secure a system against), you have no idea what someone means by "secure". It could mean unpickable doorlocks, it could mean unbreakable windows, it could mean angry-Hippopotamus-proofing. It could mean that you smelly farts can't escape your…

Any claim of security without a thread-model

I'm not sure I understand what your counterpoint here is since we seem to be saying the same thing but I had to go back and fix 'thread model' twice myself. An underestimated threat model to commenting about threat models!

Re: Why ProtonMail is more secure than Gmail

#159
post #49

What are the security guarantees when emailing someone who does not use ProtonMail? If there is an encrypted mode, can this mode be turned off? This is critically important, and yet most of these email providers who talk up their security fail to bring it up. This article is the same.

Effectively, none, as with any messaging outside a secured perimeter.

Protonmail doesn't afaict encrypt to external keys (PGP, GPG, SMIME), so you're limited to the remote provider's capabilities and practices.

(I'm a Protonmail user.)

Re: Why ProtonMail is more secure than Gmail

#160

Earlier quoted context omitted.

> Arent there many (difficult to judge how many) cases of people losing access to their Google account, and therefore about everything they had online (photos, email, videos, etc...). That is also scary enough, especially when it happens randomly with no clear reason why and the support of Google seems to be limited to sending info via forms in the hope of a future human interaction. There are, but that's not incorpo…

Denial of service (or access) is one of several possible security threats. Unauthorised access, content modification or deletion, impersonation, and several other categories of security policy violations are also fairly typical.

> Denial of service (or access) is one of several possible security threats. Unauthorised access, content modification or deletion, impersonation, and several other categories of security policy violations are also fairly typical.

Most of the cases of people losing access to their Google account that I've seen are not ones which would could feasibly be induced by a dedicated attacker unless they already had access to your account in the first place.

That may be a part of your personal threat model and also your decision-making, but from Google's perspective, that's not a security issue.

Post reply on HN