141–150 of 201 posts
Yet the web UI downloads remote images by default.
Granted, it hides your IP address by proxying the request. But it still leaks that the message was read. I used https://www.emailprivacytester.com to test this. No image was fetched until I clicked the email to read it.
After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in. ProtonMail does have import/export and the SMTP bridge (for paid users) and those things work but ProtonMail mangles emails: it removes plaintext body where there's a HTML body and it screws with headers. Ultim…
Do you have a write-up about this? I've been wanting to host my own almost entirely for the extra control over incoming mail and have been held back by the same worries. I'd like to see what a success story looks like.
Underneath though, it's a pretty standard Postfix + Dovecot setup and there are plenty of those around.
[0]: https://docker-mailserver.github.io/docker-mailserver/latest...
After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in. ProtonMail does have import/export and the SMTP bridge (for paid users) and those things work but ProtonMail mangles emails: it removes plaintext body where there's a HTML body and it screws with headers. Ultim…
> After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in. wow, an e-mail service without smtp nor imap?? no thanks
Earlier quoted context omitted.
JS crypto functions now interface with browser crypto functions for the last decade or so. https://developer.mozilla.org/en-US/docs/Web/API/Crypto
What difference does this make to the thread model in the previous comment?
Earlier quoted context omitted.
Bro, did we read the same comment? The encryption is handled client side; the cyphertext is the only thing the server sees.
The encryption happens after the server recieves the plaintext email and passes it to the client...
From the white paper, it appears as if this system requires its users to trust the server. That's not end-to-end encryption. What do I have wrong here? Further, it looks like the email encryption provided by this system only works between users of Skiff. At that point, why use email at all? Why not use a real secure messenger? Instead of building an "encrypted email service", you could literally just build an email-f…
> That's not end-to-end encryption. What do I have wrong here? Apparently, email may not their main e2ee usecase. The CEO at Skiff wrote this on PrivacyGuides forums: Our solution for external sharing was not intended for email. It is much more powerful to share E2EE real-time collaborative docs/files with subpages, embedded E2EE files, and so much more. Curiously, in the same thread, there's is a mention of Trail of…
"privacy first" Yet the web UI downloads remote images by default. Granted, it hides your IP address by proxying the request. But it still leaks that the message was read. I used https://www.emailprivacytester.com to test this. No image was fetched until I clicked the email to read it.
I get "Could not create account. Contact support@skiff.org for support." after entering my password for registering. On that note: the passwort page for the registration form has terrible UX. Paste is disabled for the 'Confirm password' field (Chrome, Android) but for not the first 'password' one. Rationale? I use a decent-length generated password from KeePass. Being forced to typing this out just plain sucks. Edit:…
Earlier quoted context omitted.
Emails are downloaded when you receive them. Isn't that how email works?
Normal email proiders don't dowbload all emails whenever a user logs into a new device