Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Skiff – Privacy-first end-to-end encrypted email

skiff.com

Post reply on HN
Print view View original

191–200 of 201 posts

Re: Skiff – Privacy-first end-to-end encrypted email

#191

Post by mike-cardwell »

amilich wrote: post #176
mike-cardwell wrote: post #170

Earlier quoted context omitted.

Are you joking? I've never even come across an email client or provider that doesn't have options to toggle loading remote images. What mainstream mail providers don't have this option? The only difference between your option and other providers are: 1. Yours doesn't even work. It still loads the remote images. It just doesn't display them 2. Yours has the wrong default. Your "block remote content" option is even wor…

No, I'm not joking. We do have this option, and it's consistent with the defaults across private mail providers. Still waiting for your list of the ones that don't load images by default. It does not load the images. That's just patently false disinfo.

> No, I'm not joking. We do have this option, and it's consistent with the defaults across private mail providers. Still waiting for your list of the ones that don't load images by default.

If you read back, you'll see I wrote email clients and providers. But I'll note that you have not provided a list of clients or providers with privacy defaults that are worse than yours.

> It does not load the images. That's just patently false disinfo.

It absolutely does. You have no idea how your own product works. I literally showed you a tool where you (or anyone else) can verify this yourself in a few minutes: https://www.emailprivacytester.com - By the way, I am the author of this tool, and your email product is the least privacy preserving email product on the market right now.

Re: Skiff – Privacy-first end-to-end encrypted email

#192

Post by jacooper »

c7DJTLrn wrote: post #136
jacooper wrote: post #131

Earlier quoted context omitted.

You can't have SMTP if it's fully end-to-end encrypted. That's why proton has a bridge, it decrypts messages locally, then runs an SMTP server for your local clients.

Well, ProtonMail isn't end-to-end encrypted anyway, even with Bridge. Unless you use PGP encryption. Emails are encrypted in-flight with TLS, but ProtonMail terminate that TLS connection.

I'm talking about zero knowledge encrypted email storage. Proton mail doesn't have access to your messages, and SMTP doesn't support that type of encryption.

Re: Skiff – Privacy-first end-to-end encrypted email

#194

Post by naveen-kumar »

amilich wrote: post #78
thecodeboy wrote: post #64

How has Skiff's email deliverability been? I'm curious if your emails go to spam more frequently, being a smaller player in an established hegemony. You have a generous free tier which may attract spammers. How do you deal with IP reputation?

Deliverability is a constant challenge for us to improve on. We have rate limits that do try to protect email deliverability. Things should be good today but it will always be something to watch.

@Amilich, what's your approach to companies wanting to use Skiff? I'm starting a company of my own and while I'd love to use Skiff, there are a bunch of blockers including email inbox warming. Without SMTP/IMAP support, no warming tool will work, and no API means no one can build scripts to do the same. This small case itself will be a blocker around adoption for companies right?

Re: Skiff – Privacy-first end-to-end encrypted email

#195

Post by naveen-kumar »

rnk wrote: post #11
amilich wrote: post #9

Earlier quoted context omitted.

Hello! I'm one of the founders. We do end-to-end encrypt email subjects. Sender/receiver addresses are not to ensure email goes to the right person. 10 GB drive is used across all Skiff products.

And domain support?

I've been using my personal domain on Skiff and been loving it personally! Simple to setup (nothing different to the usual) and it all works seamlessly!

Just that, it's one inbox in the Free tier. Since I'm using on my own domain, I prefer having one inbox for all addresses!

Re: Skiff – Privacy-first end-to-end encrypted email

#196

Post by amilich »

mike-cardwell wrote: post #191
amilich wrote: post #176

Earlier quoted context omitted.

No, I'm not joking. We do have this option, and it's consistent with the defaults across private mail providers. Still waiting for your list of the ones that don't load images by default. It does not load the images. That's just patently false disinfo.

> No, I'm not joking. We do have this option, and it's consistent with the defaults across private mail providers. Still waiting for your list of the ones that don't load images by default. If you read back, you'll see I wrote email clients and providers. But I'll note that you have not provided a list of clients or providers with privacy defaults that are worse than yours. > It does not load the images. That's just…

I just compared Skiff and Tutanota on your tool. The results were the same. Thank you for confirming this.

Re: Skiff – Privacy-first end-to-end encrypted email

#197

Post by mike-cardwell »

amilich wrote: post #196
mike-cardwell wrote: post #191

Earlier quoted context omitted.

> No, I'm not joking. We do have this option, and it's consistent with the defaults across private mail providers. Still waiting for your list of the ones that don't load images by default. If you read back, you'll see I wrote email clients and providers. But I'll note that you have not provided a list of clients or providers with privacy defaults that are worse than yours. > It does not load the images. That's just…

I just compared Skiff and Tutanota on your tool. The results were the same. Thank you for confirming this.

I just tested Tutanota and it does not have the same bug that skiff has. I think you must be having trouble understanding what the bug is. In skiff, even if you choose to not load remote images, when you view an email that has remote images, although it doesn't show the images, it does fetch them. I look at my web server logs, and I can see it happen. Emailprivacytester.com also shows it happen. I have tested this several times now.

I do not know what your difficulty is. Perhaps you should pass this on to somebody more technical than yourself at your organisation who can actually understand and diagnose the problem.

Re: Skiff – Privacy-first end-to-end encrypted email

#198

Post by mike-cardwell »

amilich wrote: post #196
mike-cardwell wrote: post #191

Earlier quoted context omitted.

> No, I'm not joking. We do have this option, and it's consistent with the defaults across private mail providers. Still waiting for your list of the ones that don't load images by default. If you read back, you'll see I wrote email clients and providers. But I'll note that you have not provided a list of clients or providers with privacy defaults that are worse than yours. > It does not load the images. That's just…

I just compared Skiff and Tutanota on your tool. The results were the same. Thank you for confirming this.

Also. Since you used Tutanota as an example. From https://tutanota.com/security

> by default, does not load external content from other servers (pictures and videos in emails). The user can choose to have external content shown with a single click or tap, if they trust the sender.

So there you go. An email company that does not load images by default. Whereas the default setting for Skiff is to load images automatically. So in this respect, Tutanota puts "privacy first" and Skiff doesn't.

Re: Skiff – Privacy-first end-to-end encrypted email

#199

Post by mike-cardwell »

amilich wrote: post #196
mike-cardwell wrote: post #191

Earlier quoted context omitted.

> No, I'm not joking. We do have this option, and it's consistent with the defaults across private mail providers. Still waiting for your list of the ones that don't load images by default. If you read back, you'll see I wrote email clients and providers. But I'll note that you have not provided a list of clients or providers with privacy defaults that are worse than yours. > It does not load the images. That's just…

I just compared Skiff and Tutanota on your tool. The results were the same. Thank you for confirming this.

I take it by your lack of response that you're just going to ignore this bug report and leave your users exposed to the privacy issue.

Here's a Youtube video I created of it happening: https://www.youtube.com/watch?v=P30Qi2MSbUQ

I'll be blogging this up unless it's acknowledged and fixed.

I assume that once you've fixed the bug you'll be contacting all of your users to let them know that they've been exposed to this privacy flaw. At least the ones that may have disabled remote content at some point.

Post reply on HN