Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Security experts declare all Proton apps secure after security audit

protonmail.com

Post reply on HN
Print view View original

11–20 of 49 posts

Re: Security experts declare all Proton apps secure after security audit

#11

Post by sodality2 »

capableweb wrote: post #10
sodality2 wrote: post #3

Declaring it secure after an audit is like writing 100% coverage tests and saying it's bug-free. You can't prove absence, only presence. This title is the definition of sensationalism and only by reading the article do you find the truth: "Their tests uncovered no major issues or security vulnerabilities". This is a bad look for them and I'm wary of their company now...

I agree with you that the title is a bit sensationalist. But if independent security audits with no major issues uncovered cannot make you claim something is secure, when can you claim something as secure? Or are you of the opinion that nothing ever can be claimed to be secure as there can always be holes that could be uncovered in the future? Using openssh as an example, would you say it's secure when you're using p…

> But if independent security audits with no major issues uncovered cannot make you claim something is secure, when can you claim something as secure?

Nothing at all; it's a broken model. The server can at any time start serving malicious payloads [0]. The server hosts your mail but they also serve the webapp. The clientside decrypts the mail, but the server hosts the client code...

It's a fundamentally flawed idea, trying to retrofit encryption into email in this way, when the server essentially has to hold all of your mail. In this case, the only thing that would make me feel secure in using it, is a third-party OSS client that downloads the mail without using the webapp, using only client-side code. And even then, of course, the mail can simply just be not encrypted when being ingested by Proton. So even then I wouldn't really trust it without external encryption like PGP. In which case, why bother?

To be clear I do use private email services (protonmail, tutanota) but I am simply not going to fall for the illusion of guaranteed privacy; I just trust that they are what they say they are. They are still a better option IMO than something like Gmail, but I don't think they're a silver bullet.

[0]: If you think this is unlikely, see this: https://news.ycombinator.com/item?id=25337507

Re: Security experts declare all Proton apps secure after security audit

#12

Post by Macha »

orlp wrote: post #6

Technical nitpick purely on the wording of the title: the pentesters declared that "no important security issues were found during the pentest". Unfortunately in our current world that's about as good as you're going to get for a large software system, but that does not necessarily mean that Proton is secure. There could still be undiscovered vulnerabilities.

Yeah, it's a bit like when someone says their relative's doctor said their cancer was cured. This is basically an impossible statement for a doctor to make to medical standards which is why the best you're going to get from a doctor is a statement that someone is in remission or the latest scan did not find cancer cells.

When someone makes a stronger claim you're left wondering if it's the original source or the messenger that's after oversimplifying the situation and it looks bad for one or the other.

Re: Security experts declare all Proton apps secure after security audit

#13

Post by coffeeandbooks »

capableweb wrote: post #8
coffeeandbooks wrote: post #7

ProtonMail has a bad history of irresponsible sensationalism. It’s like constantly marketing yourself as the most private e-mail service “built by CERN scientists” but who will give information about you to authorities: https://www.engadget.com/protonmail-climate-activist-ip-swis... I know that ProtonMail doesn’t claim to protect your IP address, but I don’t expect the average user to make that distinction. This is a…

> ProtonMail has a bad history of irresponsible sensationalism. It’s like constantly marketing yourself as the most private e-mail service “built by CERN scientists” but who will give information about you to authorities: Well, conflating "security" with "following the law" seems odd. Do anyone realistically expect a legally incorporated company to not follow laws? They have to respond to lawful requests, otherwise t…

> Well, conflating "security" with "following the law" seems odd. Do anyone realistically expect a legally incorporated company to not follow laws?

I’m talking about privacy, not security. And again, this has nothing to do with their official policies listed on their website, but rather their tendency to market themselves as “a super private e-mail provider built by CERN scientists.”

I think for many use cases (e.g., political activism) most peoples intuitive idea of privacy does not align at all with what ProtonMail actually provides.

> In the end, if you rely on any single company for both your security and privacy, you're playing a loosing game. Not hiding your IP when signing up for something when you're planning to do illegal activities? Maybe time to reconsider your opsec strategy.

Totally agree. But again, this is less about getting the average individual to rethink their op sec strategies, and more or less about ProtonMails proclivity to market themselves as an organization that solves these opsec problems for you.

This article is yet another example.

Re: Security experts declare all Proton apps secure after security audit

#14

Post by vr46 »

nulbyte wrote: post #5
vr46 wrote: post #2

Unfortunately users declare Protonmail barely usable in terms of features and UX. After a decade of this, I’m shifting back to IMAP. My use case is better off with GPG than with Protonmail. I can’t usefully function without integration into the rest of my Mac or iOS. A secure walled garden with Apps that get worse over time? I’ll go with Apple’s version.

Protonmail user here, and I haven't declared any such thing. The complaints I see tend to center around the assumption that using the service is exactly the same as any other service, despite the lengths they go to tell you how it's different. The service and the app is very usable and there are more than enough features, without them getting in the way. I use the app and the bridge; both have served me well.

I was sarcastically riffing on the original title, but that aside, the differences between Protonmail are diverging year-on-year, with the new bridge providing features that don’t exist in the app. Adding Calendaring and Drive at the expense of improvements in the core Mail. There’s only so long they can go on touting supposed security benefits at the expense of interoperability and usability. Swipe to multiple actions, select multiple messages, opening calendar invites in other apps. I disagree that they go to lengths to explain how everything is different, a quick look says the opposite, and they don’t establish the trade-offs at all. If you want privacy for “everyone” you have to make hard things easy and not make easy things hard.

Re: Security experts declare all Proton apps secure after security audit

#15

Post by blablabla123 »

coffeeandbooks wrote: post #7

ProtonMail has a bad history of irresponsible sensationalism. It’s like constantly marketing yourself as the most private e-mail service “built by CERN scientists” but who will give information about you to authorities: https://www.engadget.com/protonmail-climate-activist-ip-swis... I know that ProtonMail doesn’t claim to protect your IP address, but I don’t expect the average user to make that distinction. This is a…

I agree with the sensationalism but it's a for-profit company after all. They definitely do more than the average email provider but it's certainly not the Tor equivalent of E-Mail.

Re: Security experts declare all Proton apps secure after security audit

#16

Post by yakak »

capableweb wrote: post #10
sodality2 wrote: post #3

Declaring it secure after an audit is like writing 100% coverage tests and saying it's bug-free. You can't prove absence, only presence. This title is the definition of sensationalism and only by reading the article do you find the truth: "Their tests uncovered no major issues or security vulnerabilities". This is a bad look for them and I'm wary of their company now...

I agree with you that the title is a bit sensationalist. But if independent security audits with no major issues uncovered cannot make you claim something is secure, when can you claim something as secure? Or are you of the opinion that nothing ever can be claimed to be secure as there can always be holes that could be uncovered in the future? Using openssh as an example, would you say it's secure when you're using p…

There is a framework for this:

https://en.wikipedia.org/wiki/Evaluation_Assurance_Level

Proton is claiming something similar to EAL4, which is not secure, there is an assurance that not all trained reviewers can find a vulnerability. Openssh is a little less secure than that formally, but has more trained reviewers informally, which probably cover some parts extremely well and other parts sparsely.

Re: Security experts declare all Proton apps secure after security audit

#17

Post by jsjohnst »

capableweb wrote: post #10
sodality2 wrote: post #3

Declaring it secure after an audit is like writing 100% coverage tests and saying it's bug-free. You can't prove absence, only presence. This title is the definition of sensationalism and only by reading the article do you find the truth: "Their tests uncovered no major issues or security vulnerabilities". This is a bad look for them and I'm wary of their company now...

I agree with you that the title is a bit sensationalist. But if independent security audits with no major issues uncovered cannot make you claim something is secure, when can you claim something as secure? Or are you of the opinion that nothing ever can be claimed to be secure as there can always be holes that could be uncovered in the future? Using openssh as an example, would you say it's secure when you're using p…

> when can you claim something as secure?

here’s a maybe wild take, uh, never?

Re: Security experts declare all Proton apps secure after security audit

#18

Post by capableweb »

jsjohnst wrote: post #17
capableweb wrote: post #10

Earlier quoted context omitted.

I agree with you that the title is a bit sensationalist. But if independent security audits with no major issues uncovered cannot make you claim something is secure, when can you claim something as secure? Or are you of the opinion that nothing ever can be claimed to be secure as there can always be holes that could be uncovered in the future? Using openssh as an example, would you say it's secure when you're using p…

> when can you claim something as secure? here’s a maybe wild take, uh, never?

But you'd agree with me that some things are more secure than others right?

Re: Security experts declare all Proton apps secure after security audit

#19

Post by capableweb »

coffeeandbooks wrote: post #13
capableweb wrote: post #8

Earlier quoted context omitted.

> ProtonMail has a bad history of irresponsible sensationalism. It’s like constantly marketing yourself as the most private e-mail service “built by CERN scientists” but who will give information about you to authorities: Well, conflating "security" with "following the law" seems odd. Do anyone realistically expect a legally incorporated company to not follow laws? They have to respond to lawful requests, otherwise t…

> Well, conflating "security" with "following the law" seems odd. Do anyone realistically expect a legally incorporated company to not follow laws? I’m talking about privacy, not security. And again, this has nothing to do with their official policies listed on their website, but rather their tendency to market themselves as “a super private e-mail provider built by CERN scientists.” I think for many use cases (e.g.,…

Yeah, ProtonMail generally proclaims itself to be for privacy as well, but I think that's because of their focus on security, not anything else.

And this blogpost is strictly about security, not about privacy, so it seems maybe your comment was generally about ProtonMail, not specifically about this blogpost.

But yeah I agree, their marketing is a bit problematic, but I'm not sure you can blame them. They do have laws to adhere to, they do make it clear that if you are breaking the law and their receive lawful requests from authorities, they do have to comply, implicitly telling people to cover their tracks if they need to.

Re: Security experts declare all Proton apps secure after security audit

#20

Post by upofadown »

sodality2 wrote: post #11
capableweb wrote: post #10

Earlier quoted context omitted.

I agree with you that the title is a bit sensationalist. But if independent security audits with no major issues uncovered cannot make you claim something is secure, when can you claim something as secure? Or are you of the opinion that nothing ever can be claimed to be secure as there can always be holes that could be uncovered in the future? Using openssh as an example, would you say it's secure when you're using p…

> But if independent security audits with no major issues uncovered cannot make you claim something is secure, when can you claim something as secure? Nothing at all; it's a broken model. The server can at any time start serving malicious payloads [0]. The server hosts your mail but they also serve the webapp. The clientside decrypts the mail, but the server hosts the client code... It's a fundamentally flawed idea,…

It appears the audit was applied to the Android and iOS apps. So no comment is being made here about the security of the webapp.
Post reply on HN