91–100 of 148 posts
Earlier quoted context omitted.
Same with Android, only one account in free version. But I think when switched to pro, one can use more than 1 proton mail account in their app.
My understanding is that this isn't a free/pro distinction, but a "Feature on the Roadmap". But I'd be delighted to find out I'm wrong.
[1]:https://protonmail.com/support/knowledge-base/combine-accoun...
I was silly enough to sign up without looking in to it because it was recommended on HN. Then I realised they need this bridge software to connect. I asked about it stating I'd like to build it my self and confirm it is libre software. They just sent back a generic link to a .deb beta file. I had a look and its got this eula.txt with the standard you-have-no-rights. Messaged them again asking what they intended to do…
You could try Tutanota. Their Android app is even available on F-Droid and doesn't use Google Play Services.
Earlier quoted context omitted.
Out of curiosity, what did you switch to? I'd like to leave Gmail and Proton Mail seems to be pretty well recommended. Is Fast Mail a better option?
I moved to fastmail from gmail to slightly de-google my life. The biggest issue i've had so far is the search is terrible , and the spam filtering has many more false positives.
You made me panic when you mentioned Spam false positives, as I've never really bothered checking that folder!
Thankfully I don't appear to have any so far. Better than bloody GMail arbitrarily deciding that subscriptions and emails I've long-since received from various sources being suddenly spam... .
Earlier quoted context omitted.
My understanding is that this isn't a free/pro distinction, but a "Feature on the Roadmap". But I'd be delighted to find out I'm wrong.
I stand corrected[1], premium users can 'Combine multiple accounts into 1 account'. [1]: https://protonmail.com/support/knowledge-base/combine-accoun...
What is the motivating threat model of ProtonMail?
If I just want to access my email securely, that's done by HTTPS. If I want an end-to-end encrypted solution, ProtonMail can provide that, though only for emails between ProtonMail users. For e2e outside of ProtonMail, I can use PGP.
From what I understand, ProtonMail makes all the PGP stuff easier by baking it into their UI. Is there anything else it offers other than this convenience? Are they encrypting incoming mail with recipient keys and throwing away the original? If so, who is that protecting, and against whom? Presumably the plaintext was stored by the sender and possibly seen by intermediary servers. Can I get similar security properties by periodically downloading my email and deleting it off the server (assuming the deletion is actually happening)?
These are honest questions. I admit I'm skeptical of PM's utility, but I'd this fits someone's usecase and threat model, I can't argue with that.
Earlier quoted context omitted.
Interestingly there is such an extension: https://github.com/tasn/webext-signed-pages tl;dr version is one pins all resources on the page with Subresource Integrity hashes and signs the page. The extension verifies the signature matches before rendering anything.
Neat! I haven't audited it but a quick look through the README suggests the approach is sound.
Slightly OT, but I didn't see an important question being asked: What is the motivating threat model of ProtonMail? If I just want to access my email securely, that's done by HTTPS. If I want an end-to-end encrypted solution, ProtonMail can provide that, though only for emails between ProtonMail users. For e2e outside of ProtonMail, I can use PGP. From what I understand, ProtonMail makes all the PGP stuff easier by b…
Earlier quoted context omitted.
Interestingly there is such an extension: https://github.com/tasn/webext-signed-pages tl;dr version is one pins all resources on the page with Subresource Integrity hashes and signs the page. The extension verifies the signature matches before rendering anything.
Neat! I haven't audited it but a quick look through the README suggests the approach is sound.
Earlier quoted context omitted.
NIST curves like P-256 is generally not considered trustworthy, which is why the general consensus is to use Ed25519 for any elliptic curve cryptography. Using Ed25519 is by popular opinion the right choice. However, the concern about their use of indutny's library and the comment you link to is entirely separate. Choosing to have timing attacks for performance in a cryptographic library seems absolutely absurd, and…
I tweeted "They would have been better off with P-256, since that uses WebCrypto" after I inspected OpenPGP.js code because it's already implemented there (since it needs to support decryption from senders that use different curves) and uses WebCrypto API implementation. To me, it's a safer choice than the `elliptic` npm package that they use for X25519. If WebCrypto supported X25519, their choice would be a no-brain…
I still find the argument to be wrong, in the sense that picking Ed25519 is an entirely correct decision to make. Picking that library is not a correct decision, and that might lead to needing a different algo (I'd argue that WebCrypto needs to pick up its pace for common algorithms, rather than picking picking up whatever dropped fruit is available).
We shouldn't slander them for Ed25519 (although you are right that such claim about timing safety is borked—maybe that got lost in marketing). We should only target the library choice.
Plus, with WASM widely available, we should be able to port a constant-time of Ed25519 with good performance without much work. WebCrypto is just a cherry on top.
This announcement is an example of why I am not using ProtonMail anymore. There are a lot of things they do that sound very good on marketing materials, but upon examination are security theater. For example, they claim, "We have chosen a particular elliptic curve system known as X25519, which is fast, secure, and particularly resistant to timing attacks. It’s simple to implement". However, previously they've said th…
Out of curiosity, what did you switch to? I'd like to leave Gmail and Proton Mail seems to be pretty well recommended. Is Fast Mail a better option?
PM pricing is €48-288/y while TN is €12-60/y[4,5]. Both have freemium options too; I'm paying €12/y for TN just to receive support (more to be able to message them with feedback, really).
My only complaints w/TN is that it's a bit slow; notifications will remain even seconds after I'd read the mail, and sometimes (especially in the beginning) I would hit "Del" twice or more for the same email because it would remain in my inbox, ultimately accidentally deleting the emails after it in my inbox (something I noticed only after refreshing the tab, which -- annoyingly but also securely -- would cause me to have to log in again).
I ultimately went with TN because of one thing, however: I can export emails. Yes, it's a hassle, and yes, I have to generally do it by hand, bundle by bundle, but I love being able to have all my emails archived offline. Plus, with their new (beta) desktop client, this should be even easier[6]. I'm staying with them for now because they're the only ones (that I know of) who encrypt both your emails and your contacts, as well as the subjects, contents, and attachments of all the emails you send[7]. This is HUGE for me. However, the moment a better service comes along who does all this and who is smoother, faster, I won't mind switching ship. Especially because the name is so annoying to tell people, especially over the phone ("Puta? Duda? T like Dom or like Tom?"). Yes, I get it means "secure message" in Latin, but come on now. Just use a simple word already. Or do what PM did and enable a neat shorthand domain (pm.me, how neat is that?[8]). Though they also do offer custom domain names so I suppose this isn't too much of an issue, I just haven't had time to properly look into this yet.
After reading this thread though I'm curious to find out more about FastMail. But Australia, uhhh... Five Eyes, no thank you.
[0]: https://tutanota.com/security
[1]: https://tutanota.com/blog/posts/innovative-encryption
[2]: https://nordvpn.com/blog/tutanota
[3]: https://reddit.com/r/ProtonMail/comments/85vgca/cambridge_an...
[4]: https://protonmail.com/pricing
[5]: https://tutanota.com/pricing
[6]: https://tutanota.com/blog/posts/desktop-clients
[7]: https://tutanota.com/faq/#what-encrypted
[8]: https://pm.me