Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Skiff – Privacy-first end-to-end encrypted email

skiff.com

Post reply on HN
Print view View original

101–110 of 201 posts

Re: Skiff – Privacy-first end-to-end encrypted email

#101

Post by onereplyac »

amilich wrote: post #99
onereplyac wrote: post #87

Earlier quoted context omitted.

Depends, on an older phone, downloading all emails just to allow for searches locally won't be very efficient. Log out also becomes a problem, if emails are stored on one device that gets stolen, adversary now has access to the local index since all the keys or on the device usually with no FDE. Meanwhile with gmail a log-out would clear all traces instantly.

Emails are downloaded when you receive them. Isn't that how email works?

Normal email proiders don't dowbload all emails whenever a user logs into a new device

Re: Skiff – Privacy-first end-to-end encrypted email

#102

Post by nicce »

onereplyac wrote: post #62
ginsbergjason wrote: post #57

Earlier quoted context omitted.

So gmail was making money off of personal emails as recently 2017. Why trust them? There is no good reason they shouldn’t e2ee that data.

Except there is a reason. Encrypting email has very little to no benefit, since it is transmitted in plaintext and usually stored in plaintext on the recipient's side, your emails almost always exist in unencrypted form. On top of that it has major usability drawbacks, for example you cant ask the server to search emails for you anymore - all emails have to be downloaded on all your devices to be able to search - whi…

> Except there is a reason. Encrypting email has very little to no benefit, since it is transmitted in plaintext and usually stored in plaintext on the recipient's side, your emails almost always exist in unencrypted form. On top of that it has major usability drawbacks, for example you cant ask the server to search emails for you anymore - all emails have to be downloaded on all your devices to be able to search - which is what skiff does. It will be okay at the start, and progressively get slower and use more space on your drive the more you use it.

This are just old technical problems which are already solved, for example by Tutanota. Mails are not send in plaintext if they are encrypted, and mailbox can be encrypted too. Plaintext version of your data exist only in the memory of your computer while the session for your mail client is open.

What it comes to the search - it does not matter anymore. We have enough computational power these days and storage to hold emails on devices. User experience is about the same. Increasingly, it is just optimisation problem which can be done right. Just don’t use Electron for your email app.

Re: Skiff – Privacy-first end-to-end encrypted email

#103

Post by raggi »

amilich wrote: post #81
raggi wrote: post #52

Earlier quoted context omitted.

To put this in context, the trivial example of a user with a 15gb account, say you happened to be using s3 for storage. They buy a new phone, that costs you ~$1.50 that month, or 50% of your revenue at current pricing. They buy a new iPad and a new laptop? You’re 50% in the red. Similarly you’ll have some users who are, say, content creators. They shove a 10gb video in their drive. Let’s say they have a laptop, a wor…

This isn't how it works at all? We don't pay for storage on users devices... buying the device = buying the storage. It's actually much more efficient than doing search through some massive database.

Based on the blog you referenced up thread:

I upload a large document to your drive product from my workstation. I go to search on my phone. My phone needs to download the content in order to index it. My phone downloads the content from you. You pay for the bandwidth.

If I provision a new device, and it needs a new search index, it needs to download all of my content once, in order to populate the local index of the content.

If I'm something like a youtube content producer, I might put extremely large files in the drive. Per the blog post all the other devices signed into drive will see this new file and pull it down to index it.

So if I upload a 15gb video from my iphone to later process it on the workstation, my laptop, ipad and workstation will all download it. That means you need to serve up 45gb of bandwidth. Cost of operation as described in post above.

Re: Skiff – Privacy-first end-to-end encrypted email

#104

Post by bjoli »

mrd3v0 wrote: post #69
amilich wrote: post #12

Earlier quoted context omitted.

Hello! Yes, we're working on this. Note that our UI, cryptography, and editor libraries are MIT licensed.

Good luck working on it! Global preference for open source aside, whichever license you pick, I'd recommend visiting https://joinup.ec.europa.eu/collection/eupl/solution/joinup-... for example, a great tool to find the appropriate license for your software. https://reuse.software/tutorial/ is a great read and a wonderful initiative to help with licensing and compliance. P.S: CC is not made for software.

I always end up with MPL whenever I do these kinds of selection guides and always wonder why it isn't more widely used. Is it because the lgpl covers a lot of the need for it, or because once you allow static linking you might as well go BSD?

Re: Skiff – Privacy-first end-to-end encrypted email

#105

Post by i_play_stax »

onereplyac wrote: post #31
wishywashy0 wrote: post #27

Earlier quoted context omitted.

Founding engineer at Skiff here. >From the white paper, it appears as if this system requires its users to trust the server. That's not end-to-end encryption. What do I have wrong here? It doesn't. All data is encrypted client side across all apps - Skiff Mail, Drive, Pages, and Calendar. For sending external, the whitepaper is very clear how this case is handled in section 8.2 as securely as possible (without having…

It really is not backed by cryptographic security at all. Since your server has access to plaintext emails when sending and recieving (99.99999% of email addresses would be outside skiff), which completely subverts the whole point of encryption. A vulnerability on the server could leak all user emails, without needing their keys.... This is a solution theoretically only as strong as encryption at rest.

Bro, did we read the same comment? The encryption is handled client side; the cyphertext is the only thing the server sees.

Re: Skiff – Privacy-first end-to-end encrypted email

#107

Post by virtualritz »

I get "Could not create account. Contact support@skiff.org for support." after entering my password for registering.

On that note: the passwort page for the registration form has terrible UX.

Paste is disabled for the 'Confirm password' field (Chrome, Android) but for not the first 'password' one. Rationale?

I use a decent-length generated password from KeePass.

Being forced to typing this out just plain sucks.

Edit: after reloading the page, paste works also on the 'Confirm password' field. Very strange. Account creation still fails with above error though.

Re: Skiff – Privacy-first end-to-end encrypted email

#108

Post by onereplyac »

i_play_stax wrote: post #105
onereplyac wrote: post #31

Earlier quoted context omitted.

It really is not backed by cryptographic security at all. Since your server has access to plaintext emails when sending and recieving (99.99999% of email addresses would be outside skiff), which completely subverts the whole point of encryption. A vulnerability on the server could leak all user emails, without needing their keys.... This is a solution theoretically only as strong as encryption at rest.

Bro, did we read the same comment? The encryption is handled client side; the cyphertext is the only thing the server sees.

The encryption happens after the server recieves the plaintext email and passes it to the client...

Re: Skiff – Privacy-first end-to-end encrypted email

#109

Post by onereplyac »

nicce wrote: post #102
onereplyac wrote: post #62

Earlier quoted context omitted.

Except there is a reason. Encrypting email has very little to no benefit, since it is transmitted in plaintext and usually stored in plaintext on the recipient's side, your emails almost always exist in unencrypted form. On top of that it has major usability drawbacks, for example you cant ask the server to search emails for you anymore - all emails have to be downloaded on all your devices to be able to search - whi…

> Except there is a reason. Encrypting email has very little to no benefit, since it is transmitted in plaintext and usually stored in plaintext on the recipient's side, your emails almost always exist in unencrypted form. On top of that it has major usability drawbacks, for example you cant ask the server to search emails for you anymore - all emails have to be downloaded on all your devices to be able to search - w…

Unfortunately not even close. When the server gets the email it is not encrypted (unless the sender has a skiff address too, which is a very tiny portion...). And when you send an email to anyone outside skiff it is the same problem, the email has to be unencrypted so the server can send it in a form readable by the recepient. Without anything like PGP the server does not know the reciepent's public key, so it is impossible to encrypt it.
Post reply on HN