Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why ProtonMail is more secure than Gmail

protonmail.com

Post reply on HN
Print view View original

221–230 of 314 posts

Re: Why ProtonMail is more secure than Gmail

#221

Post by sixothree »

Niten wrote: post #149
sixothree wrote: post #36

Earlier quoted context omitted.

To add to the trust bundle a vendor needs to be accredited. The trust bundle holds the public key for every "email" address.

So it's a PKI, except obfuscated by a bunch of health industry acronyms and "accredited" logos?

It always surprises me how little this tech community knows about the Direct Project, especially considering how many hundreds of thousands of people have direct addresses assigned to them.

This thing is in production very wide usage by health industry. And the applications for it continue to grow. For example FHIR via Direct promises to empower patients.

But yes, this particular implementation especially is PKI with identity vetting. There are other trust bundles with different logos and requirements.

But the direct project defines more than just the PKI. It defines edge protocols such as XDR and IMAP. It also defines methods for message delivery and processed notifications.

And of course you can create your own trust bundle with whatever requirements you want.

This particular accredited portion means that these organizations have particular identity vetting processes for users, have on site visits to inspect servers, and adhere to a long list of privacy and security practices.

Re: Why ProtonMail is more secure than Gmail

#222

Post by rowyourboat »

KGIII wrote: post #218
efitz wrote: post #210

Earlier quoted context omitted.

SMTP has headers that are visible to the email provider while the email is in transit. The absence of logs, etc., goes far to mitigate this threat. As an added benefit, there is a lot of anti-spam functionality that can be used with only this metadata available, and only ephemerally. I don't think it's true that zero-knowledge at rest means inability to provide common email provider value adds like anti-spam.

To add to the above post, the headers have to be unencrypted, else they'd have no method to actually send the email. If it were encrypted, they'd have no idea what the address was, or who to bounce it to if the address doesn't exist. Email headers contain a lot of information. It has the various email addresses, servers involved, ip addresses, time stamps, subject, priority, and things like that. The body of the emai…

You are conflating the SMTP envelope and the mail headers. The SMTP envelope is necessary for delivery, the mail headers are not (the addressee information is duplicated)

Re: Why ProtonMail is more secure than Gmail

#223

Post by maxk42 »

reacharavindh wrote: post #217
seveneightn9ne wrote: post #128

Earlier quoted context omitted.

You can totally search email contents with ProtonMail -- it just does it clientside. I just tested with my 125MB of emails and it was fast (under 1s) but maybe if you have more emails it could be slower.

Have you tried searching for a keyword that is only in the content of the email and NOT on the subject? I tried even now. It doesn’t work for me.

I have: It works.

Re: Why ProtonMail is more secure than Gmail

#225

Post by kakarot »

_e wrote: post #93
feld wrote: post #70

Earlier quoted context omitted.

Qubes has a nice fat attack surface known as the hypervisor. I'm skeptical when people point to this as the panacea of computing security.

Yes, Qubes is only as secure as Xen which, itself, has had some pretty big security flaws pop up [1]. At the end of the day one has to decide what kind of trade offs they are willing to make in order to balance simple UX and security. [1] https://blog.quarkslab.com/xen-exploitation-part-2-xsa-148-f...

For Qubes 4, they are planning to deprecate the Xen paravirtual drivers in favor of the HVM drivers. These drivers are much more battle-tested and less complicated than PV drivers.

Also, with their recent foray into enterprise support, they will hopefully be able to expand their auditing efforts in the next couple of years.

Re: Why ProtonMail is more secure than Gmail

#226

Post by Fnoord »

criddell wrote: post #196
metalliqaz wrote: post #126

Earlier quoted context omitted.

Off the top of my head I think the number 1 "threat" that Google doesn't protect you from is privacy. They are actively watching your email with algorithms to use for advertising purposes. On the other hand, they have more resources than anyone else to protect against things like DDOS, nation-state hacking/phishing, and physical disasters. They also have a legion of lawyers to protect against improper legal requests,…

Protonmail says they have no access to user data and so I guess that means they offer zero protection from spam and emailed threats. One could argue that Google's filtering of spam and potentially harmful mail is a point in favor of Google.

Whatever happened to filtering client side?

Re: Why ProtonMail is more secure than Gmail

#227

Post by brightsize »

tony101 wrote: post #124
badminton1 wrote: post #39

Just a reminder that for it to work both the recipient and sender need to use Protonmail... across the full e-mail thread.

All your emails are stored encrypted with your public key when on ProtonMail's servers. And they do support end-to-end encryption with other email providers (with a user-specified passphrase).

FWIW, ProtonMail also allows you to export your public key from their service. People who you give the key to can use it to send PGP encrypted mail to your ProtonMail mailbox. Unfortunately this isn't bidirectional, there's no built-in way to send PGP-encrypted emails from your ProtonMail account to non-ProtonMail users.

Re: Why ProtonMail is more secure than Gmail

#228

Post by maxk42 »

SaltySolomon wrote: post #16

So, do they employ spam filters and they can still read messages before they encrypt them if the come from a third source, right?

Yes and yes.

The utility is not in magically making every email sent to or from you unreadable to 3rd parties. The utility is purely on the side or privacy intrusion: be it via court order or hacker. Nobody can compel them to decrypt any messages that have been sent to or from you and stored on their servers.

Protonmail will NOT: Prevent interception of your messages by 3rd-party MITM attacks.

Protonmail WILL: Protect your privacy versus legal authorities. Safeguard your stored communications against hacker breach. Provide a high-quality, ad-free email experience and multiple email addresses.

Re: Why ProtonMail is more secure than Gmail

#229

Post by snowpanda »

zabuni wrote: post #51

Web based encryption. Pointless. If you trust them enough not to send you bad Javascript, you trust them not to read your emails. You trust them with your private keys. If you trust them with all that why even encrypt the mail client side?

To be fair, ProtonMail Bridge is available in beta for all paid members right now, which will allow you to use it with Thunderbird.

https://www.reddit.com/r/ProtonMail/comments/77ifdx/protonma...

Re: Why ProtonMail is more secure than Gmail

#230

Post by myrandomcomment »

Gaelan wrote: post #216
myrandomcomment wrote: post #209

Earlier quoted context omitted.

So I ordered some cigars online the other day. I did this on a device not logged into google, in privacy mode. An email with the order went to my @gmail. The next day in my Youtube videos the ads where for stop smoking patches. They read email.

Google also allows ads targeting a list of emails. Could be that the cigar seller asked google to show you the ads.

Why would the cigar seller ask to show me an ad for a STOP SMOKING CIGARS product? Also as I said, this showed up in Youtube the day after I ordered and the email hit my gmail. Never seen those ads before.
Post reply on HN