Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail now offers elliptic curve cryptography

protonmail.com

Post reply on HN
Print view View original

61–70 of 148 posts

Re: ProtonMail now offers elliptic curve cryptography

#61

Post by really3452 »

brendyn wrote: post #50

I was silly enough to sign up without looking in to it because it was recommended on HN. Then I realised they need this bridge software to connect. I asked about it stating I'd like to build it my self and confirm it is libre software. They just sent back a generic link to a .deb beta file. I had a look and its got this eula.txt with the standard you-have-no-rights. Messaged them again asking what they intended to do…

Seconded. Anyone know of a good email workflow? Rolling your own server no longer seems practical. From what I have read most email providers now simply blacklist the email address of an email from sent from a non-major email service.

Re: ProtonMail now offers elliptic curve cryptography

#62

Post by dontbenebby »

Abishek_Muthian wrote: post #32
tristor wrote: post #29

Earlier quoted context omitted.

There’s two separate passwords. If you reset your encryption password it’s supposed to make all prior received mail unreadable. Was this the case for you?

Correct, existing emails become inaccessible when the mailbox is reset. Can be recovered though, if there's a backup & the original decryption password is found again.

But is your threat model someone reading your old email?

For most people the big risk is that their email can be leveraged to gain access to banks, social media etc through password resets.

Re: ProtonMail now offers elliptic curve cryptography

#63

Post by justusthane »

brendyn wrote: post #50

I was silly enough to sign up without looking in to it because it was recommended on HN. Then I realised they need this bridge software to connect. I asked about it stating I'd like to build it my self and confirm it is libre software. They just sent back a generic link to a .deb beta file. I had a look and its got this eula.txt with the standard you-have-no-rights. Messaged them again asking what they intended to do…

What's your take on Fastmail? I guess Australian privacy laws might be a concern.

Re: ProtonMail now offers elliptic curve cryptography

#64

Post by glaurung_ »

KirinDave wrote: post #44

This announcement is an example of why I am not using ProtonMail anymore. There are a lot of things they do that sound very good on marketing materials, but upon examination are security theater. For example, they claim, "We have chosen a particular elliptic curve system known as X25519, which is fast, secure, and particularly resistant to timing attacks. It’s simple to implement". However, previously they've said th…

Out of curiosity, what did you switch to? I'd like to leave Gmail and Proton Mail seems to be pretty well recommended. Is Fast Mail a better option?

Re: ProtonMail now offers elliptic curve cryptography

#65

Post by Boulth »

lvh wrote: post #57
Forbo wrote: post #42

Earlier quoted context omitted.

Shouldn't it be possible to have the library built in to the browser? I can't seem to find any information on attempts to make that happen, either directly by browser developers or as an add-on.

Sure: that’s WebCrypto. The main problem it solves is that you don’t really want your AES implementation to be in JS which is only a small part of the problem. You still have the problem that the site would be telling you to do with all of that good crypto, and you still need to do key management. You could do all of this well if WebCrypto was good and you had a WebExtension, or an Electron app, or some other way whe…

Interestingly there is such an extension: https://github.com/tasn/webext-signed-pages

tl;dr version is one pins all resources on the page with Subresource Integrity hashes and signs the page. The extension verifies the signature matches before rendering anything.

Re: ProtonMail now offers elliptic curve cryptography

#66

Post by dontbenebby »

throwaway_x13zd wrote: post #16
keiferski wrote: post #4

This gets asked often, but as someone wanting to get away from Gmail, any thoughts on Fastmail vs. ProtonMail?

I use both. Fastmail is more compatible with clients and has a good per-client security model. However it is based in Australia, which has increasingly insane digital privacy laws. Proton mail has more advanced cryptographic features and my understanding is that your email is encrypted so they can't offer it up to third parties without your consent (or at least stealing your password.) The usability is not as good: s…

Are entire emails encrypted, or is the metadata in the clear?

(Ex: I could search by the [Mailing-List-Tag] + date range, from address etc)

Re: ProtonMail now offers elliptic curve cryptography

#67

Post by rmdashrfstar »

glaurung_ wrote: post #64
KirinDave wrote: post #44

This announcement is an example of why I am not using ProtonMail anymore. There are a lot of things they do that sound very good on marketing materials, but upon examination are security theater. For example, they claim, "We have chosen a particular elliptic curve system known as X25519, which is fast, secure, and particularly resistant to timing attacks. It’s simple to implement". However, previously they've said th…

Out of curiosity, what did you switch to? I'd like to leave Gmail and Proton Mail seems to be pretty well recommended. Is Fast Mail a better option?

I've been using fastmail for 2 years and haven't had any problems with it, but I've no input on security or similar concerns.

Re: ProtonMail now offers elliptic curve cryptography

#68

Post by wolco »

really3452 wrote: post #61
brendyn wrote: post #50

I was silly enough to sign up without looking in to it because it was recommended on HN. Then I realised they need this bridge software to connect. I asked about it stating I'd like to build it my self and confirm it is libre software. They just sent back a generic link to a .deb beta file. I had a look and its got this eula.txt with the standard you-have-no-rights. Messaged them again asking what they intended to do…

Seconded. Anyone know of a good email workflow? Rolling your own server no longer seems practical. From what I have read most email providers now simply blacklist the email address of an email from sent from a non-major email service.

Use your isp for emailing out and receive email on your own server.

Re: ProtonMail now offers elliptic curve cryptography

#69

Post by Slippery_John »

nothrabannosir wrote: post #35
oedmarap wrote: post #33

Earlier quoted context omitted.

I use a ProtonMail address for online accounts whose content I don't need intermingled with my personal mail. I also use a ProtonMail "+" alias when signing up for a totally new service (with a filter to place emails from that alias directly in Spam; as all it does is handle account signup/verify). If I can't change my email after signing up for a service I don't continue using that service, as I define that to be us…

Outlook has an amazing feature that allows you to make top level whateveryouwant@outlook.com aliases. Make one for the service, sign up, delete it. This guards you from spammers stripping the + label, which I’m sure they all do by now.

You can use catchall addresses for this. Any ol email @ that domain that doesn't have an associated account gets routed to the catchall account. Protonmail supports this if you pay, as do a few others.

Re: ProtonMail now offers elliptic curve cryptography

#70

Post by Semaphor »

justusthane wrote: post #63
brendyn wrote: post #50

I was silly enough to sign up without looking in to it because it was recommended on HN. Then I realised they need this bridge software to connect. I asked about it stating I'd like to build it my self and confirm it is libre software. They just sent back a generic link to a .deb beta file. I had a look and its got this eula.txt with the standard you-have-no-rights. Messaged them again asking what they intended to do…

What's your take on Fastmail? I guess Australian privacy laws might be a concern.

They say it doesn't matter for them as they comply with all lawful requests anyway. Haven't seen any comment regarding the need to build full backdoors, but the insidious part about that dumb law is that they wouldn't be allowed to talk about that anyway.
Post reply on HN