Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Skiff – Privacy-first end-to-end encrypted email

skiff.com

Post reply on HN
Print view View original

131–140 of 201 posts

Re: Skiff – Privacy-first end-to-end encrypted email

#131

Post by jacooper »

taskforcegemini wrote: post #118
Youden wrote: post #116

After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in. ProtonMail does have import/export and the SMTP bridge (for paid users) and those things work but ProtonMail mangles emails: it removes plaintext body where there's a HTML body and it screws with headers. Ultim…

> After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in. wow, an e-mail service without smtp nor imap?? no thanks

You can't have SMTP if it's fully end-to-end encrypted. That's why proton has a bridge, it decrypts messages locally, then runs an SMTP server for your local clients.

Re: Skiff – Privacy-first end-to-end encrypted email

#132

Post by cracked-behem »

bastawhiz wrote: post #34
tptacek wrote: post #29

Earlier quoted context omitted.

Section 8.2 seems to talk about how you send plaintext email via SMTP to users who aren't using Skiff. But that's not what I'm talking about with respect to end-to-end encryption. The white paper refers repeatedly to "browser" users. Your server can feed arbitrary Javascript to browsers and subvert encryption in a variety of ways, can't it? I'm still not clear why you designed a new, simplistic cryptosystem at all he…

> Your server can feed arbitrary Javascript to browsers and subvert encryption in a variety of ways, can't it? That's how literally any website works. How do you encrypt in the browser if the server doesn't send JavaScript to encrypt data? You also trust Signal not to issue an update that sends data in plaintext over the network. Unless you're building an app from source, you implicitly trust the developer to some ex…

I built something that solves this problem. It uses an open source program installed on the client to encrypt and store data in a way that doesn't allow the website to access the plaintext data. https://redact.ws

Re: Skiff – Privacy-first end-to-end encrypted email

#133

Post by prophesi »

jacooper wrote: post #131
taskforcegemini wrote: post #118

Earlier quoted context omitted.

> After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in. wow, an e-mail service without smtp nor imap?? no thanks

You can't have SMTP if it's fully end-to-end encrypted. That's why proton has a bridge, it decrypts messages locally, then runs an SMTP server for your local clients.

You can if the service doesn't handle encryption with a proprietary protocol and instead helps you set up PGP. It certainly has its issues and limitations, but after trying ProtonMail/Tutanota/what-have-you, I have _never_ actually used their E2E encryption except when contacting support for that mail service.

Meanwhile with PGP I can post up my public key on my personal sites / resume / social accounts, and people actually have reached out. I also like that you don't even need to include your email address to prevent scrapers from harvesting it. If it's on one of the public keyservers, their client will find the email address for the respective public key.

Re: Skiff – Privacy-first end-to-end encrypted email

#134

Post by holmesworcester »

dannyobrien wrote: post #46
raggi wrote: post #37

Earlier quoted context omitted.

Signal doesn’t have a web client. Most of the stores it is distributed through have fairly strong resistance to compel orders.

Yep, but Signal is still a potential adversary, and could roll out a backdoor. A couple of things that are easier in a web-delivered tool is deliver a backdoor to a user or group of users (which Skiff can track), or deliver a backdoor over a particular window of time across many users to decrease the chance of detection. I know Skiff uses IPFS in some of parts of their solutions, and there's something they could do w…

Group invite links in Signal work similarly to Skiff: they reveal a key to the client side js so it can either present users with a Signal download link or open a URI, depending on whether they already have Signal or not. (Signal chooses not to use a URI in this case because it would break for anyone without Signal.)

So if a Signal group is using group invite links they have the same problem Skiff does.

What I would like to exist is something like Subresource Integrity [1] but for a URL itself, so that you could include a hash in a URL and let the browser warn you if the page source doesn't match the hash.

1. https://developer.mozilla.org/en-US/docs/Web/Security/Subres...

Re: Skiff – Privacy-first end-to-end encrypted email

#135

Post by rmbyrro »

ekianjo wrote: post #67
ssddanbrown wrote: post #7

Their website describes this as open source but their linked repo is under CC BY-NC-SA 4.0 [1] so not commonly regarded as open source, but instead source available. They have been made aware of this [2]. Additionally, I think it may only be the front-end parts of their apps that are source available, I'm not sure the server-side parts of their app have sources published. [1] https://creativecommons.org/licenses/by-n…

Open source does not mean anything in the first place. Terms like Libre or Free Software exist for a reason.

Perhaps you mean "open source" doesn't mean anything to you.

Which is fine, but still quite surprising to hear in a hacker forum in 2023...

Re: Skiff – Privacy-first end-to-end encrypted email

#136

Post by c7DJTLrn »

jacooper wrote: post #131
taskforcegemini wrote: post #118

Earlier quoted context omitted.

> After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in. wow, an e-mail service without smtp nor imap?? no thanks

You can't have SMTP if it's fully end-to-end encrypted. That's why proton has a bridge, it decrypts messages locally, then runs an SMTP server for your local clients.

Well, ProtonMail isn't end-to-end encrypted anyway, even with Bridge. Unless you use PGP encryption. Emails are encrypted in-flight with TLS, but ProtonMail terminate that TLS connection.

Re: Skiff – Privacy-first end-to-end encrypted email

#137

Post by hiatus »

layer8 wrote: post #122
josephg wrote: post #95

Earlier quoted context omitted.

Not directly. They would have to roll out an update with the backdoor to the App Store. But as a user I’d be none the wiser. I wish there was some way on iOS to prove that some particular version of an app was built from a certain git hash. That way these sort of attacks would be easier to detect.

You can disable updates. As long as the servers (and the OS) don’t break compatibility, you can continue to use the same old likely-non-backdoored version.

Not for Signal. I was periodically prompted to update with the warning that I would lose access to signal if I didn't. Then I upgraded and they robbed me of SMS features. I would have been happy to remain on a previous version.

Re: Skiff – Privacy-first end-to-end encrypted email

#138

Post by hollerith »

ekianjo wrote: post #71
hollerith wrote: post #68

Earlier quoted context omitted.

"Open source" is defined by this page, which has been around since the 1990s: https://opensource.org/osd/

Yet it is so poorly understood and you see open source mentioned like here when its not meeting such definition. The name is just plain bad.

It is too late to change the name. Just because you and I would have chosen a different name if we could go back in time does not make it OK for you to assert that the name "does not mean anything in the first place".

Since the 1990s there has existed an entire non-profit organization dedicated to clarifying the meaning of the name.

Re: Skiff – Privacy-first end-to-end encrypted email

#139

Post by kbknapp »

layer8 wrote: post #122
josephg wrote: post #95

Earlier quoted context omitted.

Not directly. They would have to roll out an update with the backdoor to the App Store. But as a user I’d be none the wiser. I wish there was some way on iOS to prove that some particular version of an app was built from a certain git hash. That way these sort of attacks would be easier to detect.

You can disable updates. As long as the servers (and the OS) don’t break compatibility, you can continue to use the same old likely-non-backdoored version.

At least when downloading from the Play store, Google requires the application be updated every 90 days or so. I've run into this multiple times where the application ceases to function after the 90 day window until I go update.

Re: Skiff – Privacy-first end-to-end encrypted email

#140

Post by intc »

prophesi wrote: post #133
jacooper wrote: post #131

Earlier quoted context omitted.

You can't have SMTP if it's fully end-to-end encrypted. That's why proton has a bridge, it decrypts messages locally, then runs an SMTP server for your local clients.

You can if the service doesn't handle encryption with a proprietary protocol and instead helps you set up PGP. It certainly has its issues and limitations, but after trying ProtonMail/Tutanota/what-have-you, I have _never_ actually used their E2E encryption except when contacting support for that mail service. Meanwhile with PGP I can post up my public key on my personal sites / resume / social accounts, and people a…

One can use standard IMAPS/SMTPS/PGP compliant native email app with C1.FI.

I'm still contemplating about the E2E webmail app - No matter which way one looks it - It's a shaky concept...

BTW. Does anyone know what is the current state of WASM Constant Time proposal?

Post reply on HN