Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why ProtonMail is more secure than Gmail

protonmail.com

Post reply on HN
Print view View original

251–260 of 314 posts

Re: Why ProtonMail is more secure than Gmail

#251

Post by kllrnohj »

arglebarnacle wrote: post #130
3pt14159 wrote: post #119

Earlier quoted context omitted.

Uncle Sam can root your machine. If Uncle Sam is the threat vector you're better off using pen and paper.

This comment seems to conflate resistance to mass surveillance with resistance to targeted surveillance. It's almost as if the fact that I'll never be able to resist a targeted attack means that I shouldn't attempt to have any privacy at all, but surely that's not right. Encrypted messaging apps and services like ProtonMail have never been primarily to help people with Snowden's threat model. They're for people like…

> This comment seems to conflate resistance to mass surveillance with resistance to targeted surveillance.

ProtonMail doesn't meaningfully address the mass surveillance aspect, though. Most emails still hit its servers in plain-text form. Encrypting once it hits their server doesn't help the mass surveillance aspect, it only helps the targeted surveillance when a warrant comes in.

And if you're willing/able to get everyone that emails you to switch to PGP to get real end-to-end encryption then protonmail is worth even less, since none of their benefits matter anymore (google is obviously not able to decrypt your PGP emails, either).

Re: Why ProtonMail is more secure than Gmail

#252

Post by DavideNL »

blfr wrote: post #46
someguydave wrote: post #8

Earlier quoted context omitted.

That's a fair criticism. I don't think the Gmail glossy brochure mentions its threat model either.

They do for their new Advanced Protection Program[1]. The regular Gmail service is not really marketed to the security concious users. It's like comparing Android to Qubes OS. Not really fair. For what they are, Google products are surprisingly secure. [1] https://landing.google.com/advancedprotection/

> "Google products are surprisingly secure"

For one their products are not "secured" from Google seeing your private data...

Re: Why ProtonMail is more secure than Gmail

#253

Post by bhassel »

maxk42 wrote: post #223
reacharavindh wrote: post #217

Earlier quoted context omitted.

Have you tried searching for a keyword that is only in the content of the email and NOT on the subject? I tried even now. It doesn’t work for me.

I have: It works.

I'm curious how? This FAQ page on their site claims you cannot search email contents, although they plan to support that in their upcoming Protonmail Bridge (which works with a desktop client to search locally): https://protonmail.com/support/knowledge-base/search/

That is what I'd expect, since obviously they cannot build a search index over text they cannot read. Transferring the entire contents of your emails to your web browser to search locally would be slow and impractical on anything but a very fast connection.

Re: Why ProtonMail is more secure than Gmail

#254

Post by geocar »

benwilber0 wrote: post #145
tony101 wrote: post #83

Earlier quoted context omitted.

I'm not sure there is a legal mechanism to force ProtonMail to add a backdoor... > "Nearly every country in the world has laws governing lawful interception of electronic communications. In Switzerland, these regulations are set out in the Swiss Federal Act on the Surveillance of Postal and Telecommunications Traffic (SPTT) last revised in 2012. In the SPTT, the obligation to provide the technical means for lawful in…

If a government really wanted access to a specific user's ProtonMail account, couldn't they get a court order from a domestic CA, say Verisign, to generate a fake certificate that they can use to MITM a browser session, and deliver key-stealing javascript to the user? I'm not sure what the state of certificate pinning is, but it seems that for the "uber security conscious users" they have instructions to check the SH…

> If a government really wanted access to a specific user's ProtonMail account, couldn't they get a court order from a domestic CA

Why bother?

If they can MITM ProtonMail, they might as well use letsencrypt which just requires you control the domain name (for some definition of control).

> I'm not sure what the state of certificate pinning is,

    Public-Key-Pins-Report-Only: pin-sha256="Jh0ZSUYEc97HRYcwZIOkH2jKOUpmQhLO48MYd1s5pRM="; pin-sha256="2ZnCTNQBrKShr4c1olKfwNG53KiL6qoNcQi65YGRBn8="; pin-sha256="1D76xWwHug9p4iQWVBiDZF+e3UcxtPte/ig5pkYnmRU="; max-age=300; report-uri="https://protonmail.com/pkp-report"
Looks like they want to know about violations...

Re: Why ProtonMail is more secure than Gmail

#255

Post by bhandziuk »

linkregister wrote: post #110
skybrian wrote: post #65

Earlier quoted context omitted.

"Without any warrant": what do you mean?

Under the Stored Communications Act, law enforcement may get emails or other information under third party control with only a subpoena. Retrieving email via the POP3 protocol typically deletes the email upon retrieval, making it impossible for the third party to comply with requests for already-retrieved emails.

>POP3 protocol typically deletes the email upon retrieval

What POP3 client are you using that does this? I've not seen it before. It gets marked as read but that's it.

Re: Why ProtonMail is more secure than Gmail

#256

Post by bascule »

DavideNL wrote: post #252
blfr wrote: post #46

Earlier quoted context omitted.

They do for their new Advanced Protection Program[1]. The regular Gmail service is not really marketed to the security concious users. It's like comparing Android to Qubes OS. Not really fair. For what they are, Google products are surprisingly secure. [1] https://landing.google.com/advancedprotection/

> "Google products are surprisingly secure" For one their products are not "secured" from Google seeing your private data...

Neither is ProtonMail. They see all email plaintexts unless you're using end-to-encryption like GPG/PGP. They only encrypt data at rest, and we can only take them at their word that they're even doing that.

Re: Why ProtonMail is more secure than Gmail

#257

Post by kazen44 »

heisenbit wrote: post #183
tony101 wrote: post #92

Earlier quoted context omitted.

I'm not sure there is a legal mechanism to force ProtonMail to add a backdoor... > "Nearly every country in the world has laws governing lawful interception of electronic communications. In Switzerland, these regulations are set out in the Swiss Federal Act on the Surveillance of Postal and Telecommunications Traffic (SPTT) last revised in 2012. In the SPTT, the obligation to provide the technical means for lawful in…

Not all governments restrict themselves to legal means. Turkey for example has recently started abusing Interpol search warrants to go after people outside their jurisdiction. The country of citizenship is usually clued in and is resisting but dare to go on vacation in a another country. Not all actions of the US government have survived legal review and some may argue the latest administration is more prone to such…

But then it becomes more a question of politics instead of (inter)national law.

Heck, the EU and US are already not on good terms on the subject of privacy/intelligence gathering, so i doubt this would be done so easily. Especially with the current US administration.

Re: Why ProtonMail is more secure than Gmail

#258

Post by tony101 »

benwilber0 wrote: post #145
tony101 wrote: post #83

Earlier quoted context omitted.

I'm not sure there is a legal mechanism to force ProtonMail to add a backdoor... > "Nearly every country in the world has laws governing lawful interception of electronic communications. In Switzerland, these regulations are set out in the Swiss Federal Act on the Surveillance of Postal and Telecommunications Traffic (SPTT) last revised in 2012. In the SPTT, the obligation to provide the technical means for lawful in…

If a government really wanted access to a specific user's ProtonMail account, couldn't they get a court order from a domestic CA, say Verisign, to generate a fake certificate that they can use to MITM a browser session, and deliver key-stealing javascript to the user? I'm not sure what the state of certificate pinning is, but it seems that for the "uber security conscious users" they have instructions to check the SH…

EV certificates must be submitted to CT logs, which means ProtonMail and the public will be able to detect the malicious certificate. If it's not a EV certificate, the browser user interface changes and a security-conscious user may notice. That said, if a powerful government is after a user specifically, it is just a matter of time and effort before the government gets in.

Re: Why ProtonMail is more secure than Gmail

#259

Post by kazen44 »

cwyers wrote: post #113

I would not view being hosted outside of the US as an unalloyed good, especially for a US citizen. Legally, the NSA has a much freer hand in terms of surveillance of targets outside of the US. Putting your e-mail traffic outside of the US is no guarantee of anything, it's a set of tradeoffs. As others have noted, security isn't absolute, and depends on your threat model.

For a non US citizen however, Not having your mail hosted in the US atleast makes spying not completely automatic. Because in the US, the NSA has the legal right to wiretap all foreigh communications.

Re: Why ProtonMail is more secure than Gmail

#260

Post by B1FF_PSUVM »

myrandomcomment wrote: post #209
njarboe wrote: post #188

Earlier quoted context omitted.

From the link: "G Suite’s Gmail is already not used as input for ads personalization, and Google has decided to follow suit later this year in our free consumer Gmail service." They are definitely still reading your gmail. How else would the spam and other filters work? They can also use it under this policy for anything but "ads personalization". Machine learning, Google product integration, other recommendation not…

So I ordered some cigars online the other day. I did this on a device not logged into google, in privacy mode. An email with the order went to my @gmail. The next day in my Youtube videos the ads where for stop smoking patches. They read email.

> They read email.

Sometimes hilariously. A few years ago a friend emailed me a barbershop quartet video, and I spent the next couple of weeks getting hairdresser ads ...

Post reply on HN