Skiff – Privacy-first end-to-end encrypted email • Hacker News Board

Re: Skiff – Privacy-first end-to-end encrypted email

#81

Post by amilich » Wed, Aug 23, 2023, 4:15 AM UTC

raggi wrote: post #52

raggi wrote: post #50

Earlier quoted context omitted.

So if I have 15gb of email, I have to process all of that on every client bootstrap? How do you plan on scaling your service with respect to this problem? once you have a non-trivial user base with non-trivial data volumes this is likely to become a substantial problem.

To put this in context, the trivial example of a user with a 15gb account, say you happened to be using s3 for storage. They buy a new phone, that costs you ~$1.50 that month, or 50% of your revenue at current pricing. They buy a new iPad and a new laptop? You’re 50% in the red. Similarly you’ll have some users who are, say, content creators. They shove a 10gb video in their drive. Let’s say they have a laptop, a wor…

This isn't how it works at all? We don't pay for storage on users devices... buying the device = buying the storage. It's actually much more efficient than doing search through some massive database.

Re: Skiff – Privacy-first end-to-end encrypted email

#82

Post by mgraczyk » Wed, Aug 23, 2023, 4:15 AM UTC

amilich wrote: post #77

mgraczyk wrote: post #53

Earlier quoted context omitted.

Worth noting that Google does not do what you're describing. Google has never literally "sold" data from Gmail and stopped using it for their own ads ~6 years ago.

https://www.theverge.com/2023/5/5/23712440/gmail-ads-more-an... this is from 2023...

This is about displaying ads in the Gmail UI, not reading email content.

Re: Skiff – Privacy-first end-to-end encrypted email

#83

Post by mgraczyk » Wed, Aug 23, 2023, 4:17 AM UTC

em-bee wrote: post #65

onereplyac wrote: post #62

Earlier quoted context omitted.

Except there is a reason. Encrypting email has very little to no benefit, since it is transmitted in plaintext and usually stored in plaintext on the recipient's side, your emails almost always exist in unencrypted form. On top of that it has major usability drawbacks, for example you cant ask the server to search emails for you anymore - all emails have to be downloaded on all your devices to be able to search - whi…

i have 2.5 million emails in a 32GB datastore. no mailprovider is going to allow me to store that much mail, and search is actually quite fast. if it isn't for you, then get a better mail client.

Google's cheapest paid plan ($6/month) gives you 30GB. The $12/month plan is 2TB of storage. I currently have over 30GB of email in Gmail and everything works fine.

Re: Skiff – Privacy-first end-to-end encrypted email

#84

Post by upofadown » Wed, Aug 23, 2023, 4:19 AM UTC

amilich wrote: post #24

LWIRVoltage wrote: post #22

Looked into this, ...it looks interesting. ..Personally, this looks promising. I am going to say it though- Skiff needs some sort of mechanism to use PGP if for nothing else, then to communicate with Protonmail email addresses specifically. I see they are taking the stance its's time to move to something beyond PGP- but given the extremely large userbase that is Protonmail- I think their target market would feel bett…

I definitely agree, we are considering what to do here. I think there is a lot to improve with PGP ( https://latacora.micro.blog/2019/07/16/the-pgp-problem.html ), but I agree with the problem. Right now, you can use Skiff Pages for this. You can share public links that have E2EE using link fragments, add passwords, and collaborate in real-time.

Well not that much to improve:

* https://articles.59.ca/doku.php?id=pgpfan:tpp

Re: Skiff – Privacy-first end-to-end encrypted email

#85

Post by tptacek » Wed, Aug 23, 2023, 4:21 AM UTC

amilich wrote: post #73

akerl_ wrote: post #72

Earlier quoted context omitted.

Lavabit is the one that used user passwords to encrypt the messages, thus ensuring that they had access to all the necessary secrets to decrypt user messages any time the user was viewing them? And that had complied previously with US government subpoenas to provide metadata and data for users?

+1

Isn't that what you're Skiff is doing too? It seems like it's just the Lavabit design with a some 2010 cryptography layered on top.

Re: Skiff – Privacy-first end-to-end encrypted email

#86

Post by tptacek » Wed, Aug 23, 2023, 4:22 AM UTC

amilich wrote: post #75

ignoramous wrote: post #51

Earlier quoted context omitted.

> How do you encrypt in the browser if the server doesn't send JavaScript to encrypt data? Meta has done some work along with Cloudflare on this for WhatsApp Web, specifically. In general, JS crypto is always going to be suspect if the threat model involves distrusting the server (like in e2ee protocols like Signal).

JS crypto functions now interface with browser crypto functions for the last decade or so. https://developer.mozilla.org/en-US/docs/Web/API/Crypto

What difference does this make to the thread model in the previous comment?

Re: Skiff – Privacy-first end-to-end encrypted email

#87

Post by onereplyac » Wed, Aug 23, 2023, 4:31 AM UTC

amilich wrote: post #81

raggi wrote: post #52

Earlier quoted context omitted.

To put this in context, the trivial example of a user with a 15gb account, say you happened to be using s3 for storage. They buy a new phone, that costs you ~$1.50 that month, or 50% of your revenue at current pricing. They buy a new iPad and a new laptop? You’re 50% in the red. Similarly you’ll have some users who are, say, content creators. They shove a 10gb video in their drive. Let’s say they have a laptop, a wor…

This isn't how it works at all? We don't pay for storage on users devices... buying the device = buying the storage. It's actually much more efficient than doing search through some massive database.

Depends, on an older phone, downloading all emails just to allow for searches locally won't be very efficient. Log out also becomes a problem, if emails are stored on one device that gets stolen, adversary now has access to the local index since all the keys or on the device usually with no FDE. Meanwhile with gmail a log-out would clear all traces instantly.

Re: Skiff – Privacy-first end-to-end encrypted email

#88

Post by doodlebugging » Wed, Aug 23, 2023, 5:13 AM UTC

Looks nice. I might give this a try.

I noticed on your home page near the bottom under the "Getting the Latest in Privacy" subheading your list of scrollables begins to duplicate entries if you keep clicking the right arrow after the "Brave Talk X Skiff" panel. From that point on, most of the entries are twinned until you reach the end of the list.

I'm a button clicker. It's a bad habit.

Re: Skiff – Privacy-first end-to-end encrypted email

#89

Post by YousefED » Wed, Aug 23, 2023, 5:14 AM UTC

amilich wrote: post #12

ssddanbrown wrote: post #7

Their website describes this as open source but their linked repo is under CC BY-NC-SA 4.0 [1] so not commonly regarded as open source, but instead source available. They have been made aware of this [2]. Additionally, I think it may only be the front-end parts of their apps that are source available, I'm not sure the server-side parts of their app have sources published. [1] https://creativecommons.org/licenses/by-n…

Hello! Yes, we're working on this. Note that our UI, cryptography, and editor libraries are MIT licensed.

Do you have a link to the MIT license of the editor? As far as I can see its also CC NC

Re: Skiff – Privacy-first end-to-end encrypted email

#90

Post by amilich » Wed, Aug 23, 2023, 5:17 AM UTC

doodlebugging wrote: post #88

Looks nice. I might give this a try. I noticed on your home page near the bottom under the "Getting the Latest in Privacy" subheading your list of scrollables begins to duplicate entries if you keep clicking the right arrow after the "Brave Talk X Skiff" panel. From that point on, most of the entries are twinned until you reach the end of the list. I'm a button clicker. It's a bad habit.

Darn. Will have to fix it. Thanks.