Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The ProtonMail Android app is now open source

protonmail.com

Post reply on HN
Print view View original

61–70 of 84 posts

Re: The ProtonMail Android app is now open source

#61

Post by dyingkneepad »

frodprefect wrote: post #41
dyingkneepad wrote: post #27

Earlier quoted context omitted.

Oh, bad timing. Just a few months ago I was on the fence about Protonmail vs Fastmail (vs all others) and ended jumping to Fastmail: the privacy pro didn't seem to outweigh the cons. Now with open sourcing stuff the pros do get somewhat better... But reevaluating and switching would be troublesome.... Maybe in a few years I'll revisit it :)

The pricing is very different. Fastmail allows unlimited domains where proton is almost double the cost for two.

Well, not just pricing or privacy or domains, there's a lot that's different. That's why I mentioned weighing pros vs cons.

Re: The ProtonMail Android app is now open source

#63

Post by kelnos »

app4soft wrote: post #54
complexworld wrote: post #13

Previous discussions about PM 2018 - Ask HN: How secure is Protonmail really? https://news.ycombinator.com/item?id=18101090 2019 - Ask HN: FastMail vs. ProtonMail? https://news.ycombinator.com/item?id=19372882 How secure would it be to use PM if the following conditions were met? - you only used one of the open-source native PM apps - you only emailed other PM users - someone you trust audited the PM source code for…

- your messages always processed by proprietary/closed source server So, it just like Telegram (or any other proprietary cloud/VPN/proxy service) - you really don't know what has happen on server side.

True, but if you do audit the client software, you can verify:

* Your e2e encryption key never gets sent to the server.

* Data is actually strongly encrypted using that key before leaving the client.

Then isn't that sufficient to prove that the server can't do anything nefarious, even if it wanted to?

Re: The ProtonMail Android app is now open source

#64

Post by kelnos »

stjohnswarts wrote: post #48
aaronscott wrote: post #15

I'm happy to see ProtonMail getting exposure. I moved over from gmail about a year ago, and have been quite pleased with their service. Only downside I've seen is that there isn't a clear way to increase available data storage, independent of other billable line items (like number of users etc). Other items on my wish list would be more customizable email filtering, I'd love to be able to create filters such as 'is t…

to get more storage you have to buy a higher priced account.

From their pricing page[0] it looks like their highest-priced plan only goes to 20GB. That's an order of magnitude too little for me just for the current size of all my mail.

(And no, I don't want to clean up 20+ years of email. I want to pay someone else to handle archiving and indexing it and not think about it.)

[0] https://protonmail.com/pricing

Re: The ProtonMail Android app is now open source

#65

Post by kelnos »

bflesch wrote: post #50
pixxel wrote: post #45

Earlier quoted context omitted.

I missed this. What’s the fiasco?

"Crypto AG was a Swiss company specialising in communications and information security. It was secretly jointly owned by the American Central Intelligence Agency (CIA) and West German Federal Intelligence Service (BND) from 1970 until about 1993, with the CIA continuing as sole owner until about 2018.[1] With headquarters in Steinhausen, the company was a long-established manufacturer of encryption machines and a wid…

At least now that all PM's non-beta apps are open source, you (or someone) can audit all their client-side apps to ensure that it doesn't matter if the sever is trying to do something nefarious. As long as your encryption key and plaintext mail never leaves the client, and the encryption being used is sound, you should be safe.

Now, if it's run by the CIA/NSA/whatever, and they have found vulnerabilities in state-of-the-art encryption algorithms that we don't know about, you're hosed. But we're still hosed even if they aren't running the mail server (that just makes it easier for them to get hold of the data), so I'm not sure that's a threat model the average person could reasonably protect against anyway.

Re: The ProtonMail Android app is now open source

#66

Post by underthensun »

fullstop wrote: post #35
aaronscott wrote: post #15

I'm happy to see ProtonMail getting exposure. I moved over from gmail about a year ago, and have been quite pleased with their service. Only downside I've seen is that there isn't a clear way to increase available data storage, independent of other billable line items (like number of users etc). Other items on my wish list would be more customizable email filtering, I'd love to be able to create filters such as 'is t…

I use both protonmail and gmail, with protonmail used for things that I feel require more privacy, such as banking. One thing that I really do miss, and I understand the reasoning, is being able to effectively search for an email. Since the content is encrypted you can only search for what is in the headers.

Can not you use MS Outlook as email reader then search using it?

Re: The ProtonMail Android app is now open source

#67

Post by underthensun »

aaronscott wrote: post #15

I'm happy to see ProtonMail getting exposure. I moved over from gmail about a year ago, and have been quite pleased with their service. Only downside I've seen is that there isn't a clear way to increase available data storage, independent of other billable line items (like number of users etc). Other items on my wish list would be more customizable email filtering, I'd love to be able to create filters such as 'is t…

That's interesting. I don't use Gmail but mail.com. I'm considering to move from mail.com to prontonmail.

Re: The ProtonMail Android app is now open source

#68

Post by app4soft »

kelnos wrote: post #63
app4soft wrote: post #54

Earlier quoted context omitted.

- your messages always processed by proprietary/closed source server So, it just like Telegram (or any other proprietary cloud/VPN/proxy service) - you really don't know what has happen on server side.

True, but if you do audit the client software, you can verify: * Your e2e encryption key never gets sent to the server. * Data is actually strongly encrypted using that key before leaving the client. Then isn't that sufficient to prove that the server can't do anything nefarious, even if it wanted to?

> Data is actually strongly encrypted using that key before leaving the client.

Except "strongly encrypted message" you should send some extra info for server. And I'm not sure how those two types of info separated in Proton's communication protocol, so binary diff between those "parts" could be a key to select decrypt method.

Re: The ProtonMail Android app is now open source

#69

Post by zaarn »

app4soft wrote: post #68
kelnos wrote: post #63

Earlier quoted context omitted.

True, but if you do audit the client software, you can verify: * Your e2e encryption key never gets sent to the server. * Data is actually strongly encrypted using that key before leaving the client. Then isn't that sufficient to prove that the server can't do anything nefarious, even if it wanted to?

> Data is actually strongly encrypted using that key before leaving the client. Except "strongly encrypted message" you should send some extra info for server. And I'm not sure how those two types of info separated in Proton's communication protocol, so binary diff between those "parts" could be a key to select decrypt method.

Their key encryption is fairly safe, if you use one-password mode, they could intercept your password from the webinterface if they wanted, but the password exchange is solid and doesn't reveal the password while still allowing to decrypt the key.

Two password mode is technically more secure since even if the authentication exchange is cracked, the decryption key doesn't touch anything the server can see, it's locally decrypted.

There isn't any meaningful diff you could make.

Re: The ProtonMail Android app is now open source

#70

Post by zaarn »

kelnos wrote: post #64
stjohnswarts wrote: post #48

Earlier quoted context omitted.

to get more storage you have to buy a higher priced account.

From their pricing page[0] it looks like their highest-priced plan only goes to 20GB. That's an order of magnitude too little for me just for the current size of all my mail. (And no, I don't want to clean up 20+ years of email. I want to pay someone else to handle archiving and indexing it and not think about it.) [0] https://protonmail.com/pricing

Professional can go up to 500GB, Plus only goes to 20GB, but that's set manually in their dashboard.
Post reply on HN