Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenPGPjs has passed an independent security audit

protonmail.com

Post reply on HN
Print view View original

51–60 of 128 posts

Re: OpenPGPjs has passed an independent security audit

#51

Post by fmpwizard »

amaccuish wrote: post #5
bankspot wrote: post #2

Have any current protonmail users experienced denial of service from online providers solely because of their email address?

Yupp. My account at a particular website was terminated. They pointed to their TOS, where "anonymous" address are not allowed. Wasn't even given the chance to keep the account and change the email to an "acceptable" one.

why do they say it's anonymous? I use proton, it's encrypted but not anonymous. (unless you used the hash option someone else posted (I didn't know that was a feature)

Re: OpenPGPjs has passed an independent security audit

#52

Post by cortesoft »

peterwwillis wrote: post #47
woranl wrote: post #14

Earlier quoted context omitted.

The same can be said for any software that auto update (i.e. Chrome), no?

Attack vectors for replacing Chrome: - Hack Google Attack vectors for replacing OpenPGPjs: - Hack the servers hosting OpenPGPjs - Hack the browser to inject or replace content across domains, sandboxes, other security barriers It's a subtle difference, but delivering applications dynamically via web browsing is much more precarious than natively hosted applications. Another way to think of it is if your entire Linux…

You don't have to hack google to replace chrome. You just have to hack a trusted cert provider and DNS and/or BGP. Those two things are not unheard of.

Re: OpenPGPjs has passed an independent security audit

#53

Post by crankylinuxuser »

rasengan wrote: post #44
prophesi wrote: post #16

Earlier quoted context omitted.

Please, that's not a verified claim[0], and you shouldn't trust any VPN service that isn't operated by you in the first place. [0]: Plus, it was raised by a competitor, Private Internet Access, so it makes it even more difficult to get the facts straight.

> it was raised by a competitor, Private Internet Access Focus on the facts. Not the messenger. Secondly, I admire your love of this discussion [1]. [1] https://news.ycombinator.com/item?id=17497912

     1. You are the user in question that is a co-founder for PIA. 
     2. You are a direct competitor to Proton*
     3. "Messengers", especially in the position of founder of the competitor, have significant bias. 
     4. You have a fiduciary reason for them to fail.
     5. user protonmail has noted significant harassment regarding this issue
Im inclined to distrust both of you. I find that your arguments might have merit. But I also see you as a digital aggressor. I don't particularly like either.

Re: OpenPGPjs has passed an independent security audit

#54

Post by peterwwillis »

cortesoft wrote: post #52
peterwwillis wrote: post #47

Earlier quoted context omitted.

Attack vectors for replacing Chrome: - Hack Google Attack vectors for replacing OpenPGPjs: - Hack the servers hosting OpenPGPjs - Hack the browser to inject or replace content across domains, sandboxes, other security barriers It's a subtle difference, but delivering applications dynamically via web browsing is much more precarious than natively hosted applications. Another way to think of it is if your entire Linux…

You don't have to hack google to replace chrome. You just have to hack a trusted cert provider and DNS and/or BGP. Those two things are not unheard of.

They're using key pinning, so you would have to use one of Google's keys and use one of Google's authorized CAs. But second, I imagine the auto-update process is using a non-TLS certificate to verify the signed binaries. Either way you have to hack Google.

It would actually be much easier to just find a vuln in Chrome that can break out of sandbox and get root.

Re: OpenPGPjs has passed an independent security audit

#55

Post by rasengan »

crankylinuxuser wrote: post #53
rasengan wrote: post #44

Earlier quoted context omitted.

> it was raised by a competitor, Private Internet Access Focus on the facts. Not the messenger. Secondly, I admire your love of this discussion [1]. [1] https://news.ycombinator.com/item?id=17497912

1. You are the user in question that is a co-founder for PIA. 2. You are a direct competitor to Proton* 3. "Messengers", especially in the position of founder of the competitor, have significant bias. 4. You have a fiduciary reason for them to fail. 5. user protonmail has noted significant harassment regarding this issue Im inclined to distrust both of you. I find that your arguments might have merit. But I also see…

Nothing you said here addressed the facts that were provided. Good luck!

Re: OpenPGPjs has passed an independent security audit

#56

Post by [deleted] »

krn wrote: post #40
driverdan wrote: post #25

Earlier quoted context omitted.

They explained it quite clearly: > We used Tesonet as a local partner before we had an official Lithuanian subsidiary, and rented office space from them. We don't share employees, infrastructure, etc. We have had a similar temporary arrangements with local companies when we opened offices in other jurisdictions where we didn't have an official presence yet. This type of arrangement is common in the startup world.

The section from the "About" page of Tesonet (26 Apr 2018)[1], which got removed soon after that HN thread: "For the latest project, Tesonet is working together with an international brand from Switzerland to create a security product that helps users protect their network traffic. As part of this technical partnership, we are collaborating on datacenter and network infrastructure that can easily supply 10 Gbps worth…

[deleted]

Re: OpenPGPjs has passed an independent security audit

#57

Post by [deleted] »

syoc wrote: post #19
krn wrote: post #9

I have zero trust in Proton after learning, that the free ProtonVPN service is provided by a data mining company from Eastern Europe[1]. [1] https://news.ycombinator.com/item?id=17258203 (please turn on "showdead" in settings, to see the entire thread)

I agree that people should read the linked comments. I did not find the the evidence to be as clear cut or damning as OP seems to think at all after reading through it. Most claims are also put forward by a co founder of Private Internet Access. A direct competitor.

[deleted]

Re: OpenPGPjs has passed an independent security audit

#58

Post by kawsper »

cortesoft wrote: post #52
peterwwillis wrote: post #47

Earlier quoted context omitted.

Attack vectors for replacing Chrome: - Hack Google Attack vectors for replacing OpenPGPjs: - Hack the servers hosting OpenPGPjs - Hack the browser to inject or replace content across domains, sandboxes, other security barriers It's a subtle difference, but delivering applications dynamically via web browsing is much more precarious than natively hosted applications. Another way to think of it is if your entire Linux…

You don't have to hack google to replace chrome. You just have to hack a trusted cert provider and DNS and/or BGP. Those two things are not unheard of.

So Chrome doesn't use certificate pinning for distributing updates?

Re: OpenPGPjs has passed an independent security audit

#59

Post by peterwwillis »

digianarchist wrote: post #8
Sir_Cmpwn wrote: post #4

Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.

Remember when Hushmail backdoored their client-side applet to capture unencrypted emails and passwords?

It appears they were actually just hosting a web app and users were sending their decryption password to Hushmail. I don't see a reference to backdooring the Java client, though obviously since they delivered it, they could do that too. https://www.wired.com/2007/11/encrypted-e-mai/

Re: OpenPGPjs has passed an independent security audit

#60

Post by pera »

tlrobinson wrote: post #15
Sir_Cmpwn wrote: post #4

Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened. And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.

This (rightfully) comes up every time some browser-based encryption tool is posted. It seems like the desire for such tools isn’t going to go away. Is anyone working on solutions for making distribution of JavaScript applications more secure? There’s a range of assurances you could try to provide, e.x. signatures from the author (or even 3rd parties), prompting for updates, etc. It would likely require support from b…

A browser add-on that is manually installed (which I believe would stop any potential insecure/unintended automatic update) could check a digital signature embedded in a formatted comment inside the JS file. That is relatively easy to implement, but you will also want some sort of PKI for key distribution and revocation.
Post reply on HN