Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail now offers elliptic curve cryptography

protonmail.com

Post reply on HN
Print view View original

121–130 of 148 posts

Re: ProtonMail now offers elliptic curve cryptography

#121

Post by arosier »

doomrobo wrote: post #95

Slightly OT, but I didn't see an important question being asked: What is the motivating threat model of ProtonMail? If I just want to access my email securely, that's done by HTTPS. If I want an end-to-end encrypted solution, ProtonMail can provide that, though only for emails between ProtonMail users. For e2e outside of ProtonMail, I can use PGP. From what I understand, ProtonMail makes all the PGP stuff easier by b…

ProtonMail employee here:

Are they encrypting incoming mail with recipient keys and throwing away the original?

Yes we do. This mainly protects against service level requests for data in the future.

Can I get similar security properties by periodically downloading my email and deleting it off the server (assuming the deletion is actually happening)?

Yup, assuming you want to deal with that. ProtonMail is designed to give you a privacy focused option for email.

Re: ProtonMail now offers elliptic curve cryptography

#122

Post by arosier »

Leace wrote: post #11
keiferski wrote: post #4

This gets asked often, but as someone wanting to get away from Gmail, any thoughts on Fastmail vs. ProtonMail?

They represent vastly different philosophies. Fastmail is direct alternative to Gmail with good UI and UX but they're based in Australia and against message encryption as it impacts their UX (for example it's not possible to index encrypted messages). Protonmail is an OpenPGP company (they directly invest in OpenPGP.js) but have issues supporting other standards. For example IMAP/SMTP is available only through a brid…

Full text search will be coming to ProtonMail later this year (already available using the bridge).

Re: ProtonMail now offers elliptic curve cryptography

#123

Post by arosier »

badpun wrote: post #43
maggit wrote: post #25

Earlier quoted context omitted.

About this point: "- can't really configure your chosen email client to it..." Do you have any experience with using the IMAP Bridge? It is a daemon you run locally that translates between Protonmail's internal protocol and IMAP, to let you use your email client of choice. I'm using it and it seems to be working OK in my experience, but I don't use my Protonmail account heavily.

My experience with the bridge (on an account with maybe 10k emails) was that it was unfortunately unusable.

Did you try the bridge recently? The last update should have fixed this issue for large accounts.

Re: ProtonMail now offers elliptic curve cryptography

#124

Post by tptacek »

a1369209993 wrote: post #107
tptacek wrote: post #77

Earlier quoted context omitted.

That is not at all the case. P-256 is widely used and no cryptographer seriously believes there's anything "untrustworthy" about it. Rather, the problem with P-256 is that it's easy to misuse, like most curves . It's hard to implement in constant time and the NIST P-curves generally lend themselves to invalid curve attacks, which need to be guarded against. Curve25519 avoids these problems. But then, if you're using…

Actually, Ed25519 is the Edwards curve isomorphic to Curve25519 (which IIRC is a Montgomery curve). Edwards is faster than Montgomery for signature, but not significantly slower for key agreement. You can use it for ECDH, and unless I've missed some non-obvious attack (which is of course, entirely possible) you probably should, since that allows you to use (mostly) the same elliptic curve math primitives for key agre…

My understanding is that Ed25519 is birational to Curve25519, not actually isomorphic, but also that the difference between the two ("almost" vs "perfectly" isomorphic) is not really all that interesting. I thought Ed25519 was better for multiple-base operations used in signing, but slower for variable-base operations in ECDH.

Re: ProtonMail now offers elliptic curve cryptography

#125

Post by tptacek »

arghwhat wrote: post #102
tptacek wrote: post #77

Earlier quoted context omitted.

That is not at all the case. P-256 is widely used and no cryptographer seriously believes there's anything "untrustworthy" about it. Rather, the problem with P-256 is that it's easy to misuse, like most curves . It's hard to implement in constant time and the NIST P-curves generally lend themselves to invalid curve attacks, which need to be guarded against. Curve25519 avoids these problems. But then, if you're using…

I'm sorry, I misworded myself: There is general distrust in NIST, not any known issues with those curves. However, it is general consensus to prefer Ed25519 over NIST curves, specifically preferring it over P-256. The benefits of its implementation are a cherry on top. I have yet to see any suggestion or reason to pick P-256 when Ed25519 is available. And yes, Ed25519 is the defacto standard. Hell, I don't even recal…

The article itself talks about X25519, which is Curve25519, not Ed25519.

Ed25519 is not in fact the de facto standard for signing on curves; that's clearly P-256 ECDSA. You're saying that Ed25519 is better, and I agree, but P-256 is much more prevalent.

Again, people don't use Ed25519 because they distrust NIST (although many people do distrust NIST). They use it because:

1. It's easier to implement in constant time.

2. It's derived (if that's the word) from a curve that was selected to avoid invalid curve attacks.

3. They want a more modern, Schnorr-based signature construction, and Ed25519 gives you that and a better curve at the same time.

For signatures, as opposed to key exchange, I think the tradeoffs are pretty much the same: by using a goofy JS library, you're giving up the implementation and side-channel advantage. You're left with the superior signing construction, but you can just use Pornin's deterministic DSA and neutralize most of that problem as well.

Re: ProtonMail now offers elliptic curve cryptography

#126

Post by cyphar »

brendyn wrote: post #50

I was silly enough to sign up without looking in to it because it was recommended on HN. Then I realised they need this bridge software to connect. I asked about it stating I'd like to build it my self and confirm it is libre software. They just sent back a generic link to a .deb beta file. I had a look and its got this eula.txt with the standard you-have-no-rights. Messaged them again asking what they intended to do…

I use mailbox.org. On the topic of crypro, they have a fairly neat feature where you can give them a PGP public key and they'll encrypt all plaintext messages you receive to your public key. Not perfect of course, but it means that your long-term message storage is encrypted on the server.

My only complaint with mailbox.org is that their 2FA system is really silly (you append your 2FA token to your passphrase, and there's no equivalent to Google's "app passwords").

Re: ProtonMail now offers elliptic curve cryptography

#127

Post by badpun »

arosier wrote: post #123
badpun wrote: post #43

Earlier quoted context omitted.

My experience with the bridge (on an account with maybe 10k emails) was that it was unfortunately unusable.

Did you try the bridge recently? The last update should have fixed this issue for large accounts.

Thanks, I tried the latest version just now and it synchronised all folders without crashing (never happened before for me).

Re: ProtonMail now offers elliptic curve cryptography

#128

Post by throwaway_x13zd »

dontbenebby wrote: post #66
throwaway_x13zd wrote: post #16

Earlier quoted context omitted.

I use both. Fastmail is more compatible with clients and has a good per-client security model. However it is based in Australia, which has increasingly insane digital privacy laws. Proton mail has more advanced cryptographic features and my understanding is that your email is encrypted so they can't offer it up to third parties without your consent (or at least stealing your password.) The usability is not as good: s…

Are entire emails encrypted, or is the metadata in the clear? (Ex: I could search by the [Mailing-List-Tag] + date range, from address etc)

From the search results I get, the body appears to be encrypted but things like sender/subject/etc. are in the clear and can be indexed.

This is why I hope they fix the bridge: I'd like to index my email fully and locally, but I'm not going to use thunderbird to do it.

Re: ProtonMail now offers elliptic curve cryptography

#130

Post by jszymborski »

Slippery_John wrote: post #69
nothrabannosir wrote: post #35

Earlier quoted context omitted.

Outlook has an amazing feature that allows you to make top level whateveryouwant@outlook.com aliases. Make one for the service, sign up, delete it. This guards you from spammers stripping the + label, which I’m sure they all do by now.

You can use catchall addresses for this. Any ol email @ that domain that doesn't have an associated account gets routed to the catchall account. Protonmail supports this if you pay, as do a few others.

beware the spam that comes with this... you'll want to block sales@example.com, etc...
Post reply on HN