Why ProtonMail is more secure than Gmail • Hacker News Board

Re: Why ProtonMail is more secure than Gmail

#301

Post by OoooooooO » Tue, Oct 24, 2017, 9:06 AM UTC

bigiain wrote: post #278

bascule wrote: post #256

Earlier quoted context omitted.

Neither is ProtonMail. They see all email plaintexts unless you're using end-to-encryption like GPG/PGP. They only encrypt data at rest, and we can only take them at their word that they're even doing that.

They claim (tho I haven't confirmed myself) to do encryption at the device - automatically between Protonmail accounts (right now though, they do not support sending pgp encrypted email to a protonmail account with a keypair not generated by them... Which seems a _very_ odd design decision): In simple terms, end-to-end encryption means that messages are encrypted on the sender’s device (before it even leaves their co…

Using keypairs generated by them is the same as not encrypting the emails at all ...

Re: Why ProtonMail is more secure than Gmail

#302

Post by londons_explore » Tue, Oct 24, 2017, 9:08 AM UTC

singron wrote: post #282

londons_explore wrote: post #127

Earlier quoted context omitted.

Around 100 people have root @ Google. They get a tshirt with it on. With months of effort researching tripwires and auditing systems, any of them could read your mail. There's a pretty good chance they'd get caught by some auditing or alerting system they were unaware of though. Many of those systems are kept secret from employees for obvious reasons. Any two employees collude to much more easily read your mail. Ther…

It's likely that reading Gmail data and other sensitive actions require significantly less privilege than some Google-wide "root".

Access controls are actually fairly locked down. I would guess the access control list for Gmail data is only ~10 people. If any of them were to make use of their access permissions, it would automatically trigger a review of their actions.

Re: Why ProtonMail is more secure than Gmail

#303

Post by ionised » Tue, Oct 24, 2017, 9:54 AM UTC

matt_wulfeck wrote: post #153

adjkant wrote: post #52

Earlier quoted context omitted.

Gmail isn't floating around any brochures on security though - it's pitch to the majority of its users is "It's Google and Mail and where most people have their emails. You don't want to be that one weirdo at @yahoo.com do you?" and that just about does it. ProtonMail is trying to recruit users with the brochure. That said, even though the argument is a bit flawed here, I think most attracted by it would still prefer…

Do you really believe people use gmail because of its brand? I don't know about any security brochure, but I know I can setup 2FA to use push notifications (not an insecure SMS number), and can check where all of my logins are from, and have "suspicious" logins blocked automatically, etc, etc. I can also create single-use passwords for insecure devices (such as a youtube password just for my apple TV). Not to mention…

> Do you really believe people use gmail because of its brand?

Absolutely. No doubt in my mind.

Re: Why ProtonMail is more secure than Gmail

#304

Post by ionised » Tue, Oct 24, 2017, 9:55 AM UTC

kbyatnal wrote: post #172

metalliqaz wrote: post #126

Earlier quoted context omitted.

Off the top of my head I think the number 1 "threat" that Google doesn't protect you from is privacy. They are actively watching your email with algorithms to use for advertising purposes. On the other hand, they have more resources than anyone else to protect against things like DDOS, nation-state hacking/phishing, and physical disasters. They also have a legion of lawyers to protect against improper legal requests,…

Except this is no longer true. Google does not read your gmail anymore. https://blog.google/products/gmail/g-suite-gains-traction-in...

Until it becomes lucrative to do so again.

Re: Why ProtonMail is more secure than Gmail

#305

Post by ionised » Tue, Oct 24, 2017, 9:56 AM UTC

mentat wrote: post #267

fauigerzigerk wrote: post #192

Earlier quoted context omitted.

That's a threat that Gmail faces as well though.

With a security budget several orders of more, yes.

It has to have a larger budget, it's operating on a larger scale.

Re: Why ProtonMail is more secure than Gmail

#306

Post by msl09 » Tue, Oct 24, 2017, 10:55 AM UTC

bigiain wrote: post #278

bascule wrote: post #256

Earlier quoted context omitted.

Neither is ProtonMail. They see all email plaintexts unless you're using end-to-encryption like GPG/PGP. They only encrypt data at rest, and we can only take them at their word that they're even doing that.

They claim (tho I haven't confirmed myself) to do encryption at the device - automatically between Protonmail accounts (right now though, they do not support sending pgp encrypted email to a protonmail account with a keypair not generated by them... Which seems a _very_ odd design decision): In simple terms, end-to-end encryption means that messages are encrypted on the sender’s device (before it even leaves their co…

> End-to-end encryption is done automatically without user interaction whenever messages are exchanged between ProtonMail users.

Which would correspond to a tiny fraction of all email a normal user exchanges and Even corporate users would be unprotected if they were to use protonmail to communicate with third parties such as service providers.

Re: Why ProtonMail is more secure than Gmail

#307

Post by xfer » Tue, Oct 24, 2017, 12:06 PM UTC

linkregister wrote: post #297

xfer wrote: post #296

Earlier quoted context omitted.

So you think google storage systems work like your normal filesystem?

You don’t think that files can be deleted from a Google file system? Does gmail even store email like that, in flat files?

They can be but not instantaneously, because of multiple replicated copies in a distributed environment.

Re: Why ProtonMail is more secure than Gmail

#308

Post by bhandziuk » Tue, Oct 24, 2017, 4:31 PM UTC

linkregister wrote: post #272

bhandziuk wrote: post #255

Earlier quoted context omitted.

>POP3 protocol typically deletes the email upon retrieval What POP3 client are you using that does this? I've not seen it before. It gets marked as read but that's it.

Geez, Eudora? Outlook Express maybe? I haven’t used POP3 in a decade. It used to delete from the server after downloading locally. This was when most email mailboxes had a capacity of 10MB.

I'm writing something that uses POP3 right now and thankfully it doesn't delete anything. I'd have to do things a lot differently if that were the case

Re: Why ProtonMail is more secure than Gmail

#309

Post by frestes725 » Tue, Oct 24, 2017, 6:00 PM UTC

Confront your cheating spouse with evidence, I was able to spy on my cheating ex phone without finding out.....it really helped me during my divorce ...you can contact hotcyberlord@gmail.com or call and text +1 5402277725 for spying and hacking social networks, school servers, icloud and much more, viber chats hack, Facebook messages and yahoo messenger, calls log and spy call recording, monitoring SMS text messages remotely, cell phone GPS location tracking, spy on Whats app Messages, services are AFFORDABLE

Re: Why ProtonMail is more secure than Gmail

#310

Post by ninegunpi » Wed, Oct 25, 2017, 4:47 PM UTC

twiss wrote: post #173

protonmail wrote: post #166

Earlier quoted context omitted.

PM team here, we just made an account to comment. We actually agree with some of the points made above, but we'd like to add the following commentary... Encrypting email while making it more usable than PGP is hard. There's no getting around that. Web crypto is always going to have some shortcomings, but web mail is on the rise, and at the end of the day, web crypto is better than no crypto. That said, we have been w…

I've been working on using Service Workers to fix the trust issues of web crypto: http://blog.airbornos.com/post/2017/08/03/Transparent-Web-Ap... Shoot me a message if you're interested in implementing something like that in ProtonMail.

Wow, this is very cool, I need to read more about that.