Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Skiff – Privacy-first end-to-end encrypted email

skiff.com

Post reply on HN
Print view View original

171–180 of 201 posts

Re: Skiff – Privacy-first end-to-end encrypted email

#171

Post by nicce »

amilich wrote: post #147
ignoramous wrote: post #60

Earlier quoted context omitted.

> That's not end-to-end encryption. What do I have wrong here? Apparently, email may not their main e2ee usecase. The CEO at Skiff wrote this on PrivacyGuides forums: Our solution for external sharing was not intended for email. It is much more powerful to share E2EE real-time collaborative docs/files with subpages, embedded E2EE files, and so much more. Curiously, in the same thread, there's is a mention of Trail of…

See https://skiff.com/transparency , Trail of Bits has performed 2 audits, Cure53 1 audit, and we had an additional audit 2.5 years ago.

It is misleading to tell about audits in this context.

Your transparency statement clearly says that Security audits. This is different than privacy audits. You cannot audit privacy, since you can intentionally change the functionality of your software right after the audit.

For the same reason, you cannot share open-source version of your software and say that it respects privacy. That can be only said if you use reproducible builds, and for client software only.

Both security audits and sharing your software as open, is about security, not the privacy. Open-source software and security audits help to reduce unintentional issues. And in this context it means a lot.

Re: Skiff – Privacy-first end-to-end encrypted email

#172

Post by tptacek »

amilich wrote: post #147
ignoramous wrote: post #60

Earlier quoted context omitted.

> That's not end-to-end encryption. What do I have wrong here? Apparently, email may not their main e2ee usecase. The CEO at Skiff wrote this on PrivacyGuides forums: Our solution for external sharing was not intended for email. It is much more powerful to share E2EE real-time collaborative docs/files with subpages, embedded E2EE files, and so much more. Curiously, in the same thread, there's is a mention of Trail of…

See https://skiff.com/transparency , Trail of Bits has performed 2 audits, Cure53 1 audit, and we had an additional audit 2.5 years ago.

You haven't published the reports, scope, and full findings. We don't even know what Trail was testing. I don't think the security audit stuff matters at all, and Trail is a fine firm, but you can't use the mere existence of a pentest project this way.

Re: Skiff – Privacy-first end-to-end encrypted email

#173

Post by amilich »

onereplyac2 wrote: post #151
amilich wrote: post #144

Earlier quoted context omitted.

Before this basic cryptography was downloaded via JS files which yields no security and gave web cryptography a bad reputation. That is not true now.

Huh? It is very concerning to hear this from a founder. It is the same exact level of security as it is executing the same code, just at a different level. Really does not matter what crypto lib you are using if at the end of the day the surrounding code dictates all the security. Regardless of all this, your open source crypto library doesn't even use the Web Crypto APIs at all, but rather the dreaded js based crypt…

That's just false. Downloading crypto libraries over the web plagued Javascript crypto for years. We use tweetnacl, stablelib, and webcrypto - and tweetnacl also uses webcrypto!

Re: Skiff – Privacy-first end-to-end encrypted email

#174

Post by amilich »

nicce wrote: post #171
amilich wrote: post #147

Earlier quoted context omitted.

See https://skiff.com/transparency , Trail of Bits has performed 2 audits, Cure53 1 audit, and we had an additional audit 2.5 years ago.

It is misleading to tell about audits in this context. Your transparency statement clearly says that Security audits . This is different than privacy audits. You cannot audit privacy, since you can intentionally change the functionality of your software right after the audit. For the same reason, you cannot share open-source version of your software and say that it respects privacy. That can be only said if you use r…

Actually, that's completely false. Security audits are a standard, reputable process for software. Trail of Bits is probably the best (or one of very few top) firms in this category. Check out: https://github.com/trailofbits

Re: Skiff – Privacy-first end-to-end encrypted email

#175

Post by amilich »

tptacek wrote: post #172
amilich wrote: post #147

Earlier quoted context omitted.

See https://skiff.com/transparency , Trail of Bits has performed 2 audits, Cure53 1 audit, and we had an additional audit 2.5 years ago.

You haven't published the reports, scope, and full findings. We don't even know what Trail was testing. I don't think the security audit stuff matters at all, and Trail is a fine firm, but you can't use the mere existence of a pentest project this way.

Any security engineer would have a heart attack if any employee, friend, or colleague said "security audit stuff [doesn't] matter." I wouldn't use software that doesn't undergo security audits.

Also, pentest ≠ audit. Completely different!

Re: Skiff – Privacy-first end-to-end encrypted email

#176

Post by amilich »

mike-cardwell wrote: post #170
amilich wrote: post #167

Earlier quoted context omitted.

Yes - privacy focused mail providers offer this as an option but do not enable it by default. Mainstream mail providers do not even have it as an option.

Are you joking? I've never even come across an email client or provider that doesn't have options to toggle loading remote images. What mainstream mail providers don't have this option? The only difference between your option and other providers are: 1. Yours doesn't even work. It still loads the remote images. It just doesn't display them 2. Yours has the wrong default. Your "block remote content" option is even wor…

No, I'm not joking. We do have this option, and it's consistent with the defaults across private mail providers. Still waiting for your list of the ones that don't load images by default.

It does not load the images. That's just patently false disinfo.

Re: Skiff – Privacy-first end-to-end encrypted email

#177

Post by nicce »

amilich wrote: post #174
nicce wrote: post #171

Earlier quoted context omitted.

It is misleading to tell about audits in this context. Your transparency statement clearly says that Security audits . This is different than privacy audits. You cannot audit privacy, since you can intentionally change the functionality of your software right after the audit. For the same reason, you cannot share open-source version of your software and say that it respects privacy. That can be only said if you use r…

Actually, that's completely false. Security audits are a standard, reputable process for software. Trail of Bits is probably the best (or one of very few top) firms in this category. Check out: https://github.com/trailofbits

Is Trail of Bits doing random checks on your running infrastucture to verify that you are not changing your software against your users?

No. That is not what security audits are. Security audits ensure that software does safely what you, as service orderer claim, in a single moment. Usually including checklist.

But they cannot guarantee that you don’t change software between audits.

That is why E2EE exists as then it does not matter and we don’t need to trust.

Open-source, security audited client for E2EE communication with reproducible builds is the magical, correct combination to ensure both security and privacy.

Re: Skiff – Privacy-first end-to-end encrypted email

#179

Post by marvinalegre »

m00dy wrote: post #119
amilich wrote: post #12

Earlier quoted context omitted.

Hello! Yes, we're working on this. Note that our UI, cryptography, and editor libraries are MIT licensed.

hello, how can I be sure the service mentioned above is really e2e encrypted ?

how can we verify that the server side code they/they will publish is what they are running on their servers?

Re: Skiff – Privacy-first end-to-end encrypted email

#180

Post by onereplyac2 »

amilich wrote: post #173
onereplyac2 wrote: post #151

Earlier quoted context omitted.

Huh? It is very concerning to hear this from a founder. It is the same exact level of security as it is executing the same code, just at a different level. Really does not matter what crypto lib you are using if at the end of the day the surrounding code dictates all the security. Regardless of all this, your open source crypto library doesn't even use the Web Crypto APIs at all, but rather the dreaded js based crypt…

That's just false. Downloading crypto libraries over the web plagued Javascript crypto for years. We use tweetnacl, stablelib, and webcrypto - and tweetnacl also uses webcrypto!

From your source, chacha20 is used, which is literally not supported by web crypto apis. Again, this makes 0 difference as higher level implementation makes or breaks your crypto.
Post reply on HN