Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Skiff: Various Privacy Failures

grepular.com

Post reply on HN
Print view View original

11–20 of 29 posts

Re: Skiff: Various Privacy Failures

#11

Post by forwardemail »

forwardemail wrote: post #10
cedws wrote: post #9

Earlier quoted context omitted.

This is really nice, but the blog does not address the weakest link in the chain: what if you receive a warrant from the US government? The SMTP server would be able to collect inbound/outbound emails in plaintext.

That is not true. You can upload a PGP key and all your email written to SQLite (IMAP/POP3) will be stored with your PGP key. Not plain text. SMTP is for outbound, IMAP/POP3 is for inbound. https://forwardemail.net/en/faq#do-you-support-openpgpmime-e...

[dead]

Re: Skiff: Various Privacy Failures

#12

Post by cedws »

forwardemail wrote: post #10
cedws wrote: post #9

Earlier quoted context omitted.

This is really nice, but the blog does not address the weakest link in the chain: what if you receive a warrant from the US government? The SMTP server would be able to collect inbound/outbound emails in plaintext.

That is not true. You can upload a PGP key and all your email written to SQLite (IMAP/POP3) will be stored with your PGP key. Not plain text. SMTP is for outbound, IMAP/POP3 is for inbound. https://forwardemail.net/en/faq#do-you-support-openpgpmime-e...

Right, but inbound emails over POP/IMAP will be TLS encrypted. You're saying emails are encrypted at rest, but they cannot be encrypted in-flight because it's forwardemail that holds the TLS private key.

Re: Skiff: Various Privacy Failures

#13

Post by forwardemail »

cedws wrote: post #9
forwardemail wrote: post #8

Forward Email team here ( https://forwardemail.net ), we have a write-up and comparison @ https://forwardemail.net/en/blog/docs/best-quantum-safe-encr... We've considered adding a E2EE comparison column as well (with the issues such as Proton rewriting your emails @ http://jfloren.net/b/2023/7/7/0 highlighted). Privacy Guides Discussion @ https://discuss.privacyguides.net/t/forward-email-email-prov... Unlike Skiff, P…

This is really nice, but the blog does not address the weakest link in the chain: what if you receive a warrant from the US government? The SMTP server would be able to collect inbound/outbound emails in plaintext.

@cedws I think one of us might be confused with the context here (?) TLS is just a form of encryption to establish socket connections. Please thoroughly read through our article and our source code.

A PGP encrypted email doesn't get "decrypted" when it's being transferred. That's the whole purpose of PGP encryption, to encrypt it before it even gets transferred or stored, which is what we do. If you set up a PGP key, use WKD, then your emails will be stored as encrypted (not only is your database encrypted with your password, but the emails themselves can be PGP encrypted this way), and any sender attempting to send to you will automatically have their message PGP encrypted to you, if it is not already (in case their mail client doesn't use WKD).

Re: Skiff: Various Privacy Failures

#14

Post by cedws »

forwardemail wrote: post #13
cedws wrote: post #9

Earlier quoted context omitted.

This is really nice, but the blog does not address the weakest link in the chain: what if you receive a warrant from the US government? The SMTP server would be able to collect inbound/outbound emails in plaintext.

@cedws I think one of us might be confused with the context here (?) TLS is just a form of encryption to establish socket connections. Please thoroughly read through our article and our source code. A PGP encrypted email doesn't get "decrypted" when it's being transferred. That's the whole purpose of PGP encryption, to encrypt it before it even gets transferred or stored, which is what we do. If you set up a PGP key,…

I think there is a miscommunication. I am not talking about PGP encrypted emails - sure, those can be decrypted client side. Plaintext emails, as the majority of emails are, will be received by your server in plaintext, minus transport encryption. How can you guarantee those will not be intercepted by authorities?

Re: Skiff: Various Privacy Failures

#15

Post by forwardemail »

cedws wrote: post #14
forwardemail wrote: post #13

Earlier quoted context omitted.

@cedws I think one of us might be confused with the context here (?) TLS is just a form of encryption to establish socket connections. Please thoroughly read through our article and our source code. A PGP encrypted email doesn't get "decrypted" when it's being transferred. That's the whole purpose of PGP encryption, to encrypt it before it even gets transferred or stored, which is what we do. If you set up a PGP key,…

I think there is a miscommunication. I am not talking about PGP encrypted emails - sure, those can be decrypted client side. Plaintext emails, as the majority of emails are, will be received by your server in plaintext, minus transport encryption. How can you guarantee those will not be intercepted by authorities?

We use MTA-STS (for inbound AND outbound) with our mode set to enforce[1], to require senders to communicate with us only using TLS encrypted sockets. There is no legal precedence currently requiring software services to implement backdoors.

[1]: https://github.com/forwardemail/mta-sts.forwardemail.net/blo...

Re: Skiff: Various Privacy Failures

#16

Post by captainmisery »

forwardemail wrote: post #8

Forward Email team here ( https://forwardemail.net ), we have a write-up and comparison @ https://forwardemail.net/en/blog/docs/best-quantum-safe-encr... We've considered adding a E2EE comparison column as well (with the issues such as Proton rewriting your emails @ http://jfloren.net/b/2023/7/7/0 highlighted). Privacy Guides Discussion @ https://discuss.privacyguides.net/t/forward-email-email-prov... Unlike Skiff, P…

Isn't this just advertising your own company?

Re: Skiff: Various Privacy Failures

#17

Post by mweidner »

cedws wrote: post #7

I see Skiff also advertises itself as "end-to-end" encrypted. This is the same misleading advertising as ProtonMail is guilty of. Traditional email cannot be E2E encrypted because of protocol limitations. You can technically achieve E2E encryption if using PGP, but if the private keys are not in your control then it is effectively pointless. ProtonMail can only guarantee E2E encryption without PGP if you are sending…

The product page is clearer (https://skiff.com/mail):

> All emails between Skiff users are end-to-end encrypted, including both subject and contents. External mail is encrypted with your keys on receipt, keeping it private.

Re: Skiff: Various Privacy Failures

#18

Post by [deleted] »

captainmisery wrote: post #16
forwardemail wrote: post #8

Forward Email team here ( https://forwardemail.net ), we have a write-up and comparison @ https://forwardemail.net/en/blog/docs/best-quantum-safe-encr... We've considered adding a E2EE comparison column as well (with the issues such as Proton rewriting your emails @ http://jfloren.net/b/2023/7/7/0 highlighted). Privacy Guides Discussion @ https://discuss.privacyguides.net/t/forward-email-email-prov... Unlike Skiff, P…

Isn't this just advertising your own company?

[deleted]

Re: Skiff: Various Privacy Failures

#19

Post by jacooper »

forwardemail wrote: post #8

Forward Email team here ( https://forwardemail.net ), we have a write-up and comparison @ https://forwardemail.net/en/blog/docs/best-quantum-safe-encr... We've considered adding a E2EE comparison column as well (with the issues such as Proton rewriting your emails @ http://jfloren.net/b/2023/7/7/0 highlighted). Privacy Guides Discussion @ https://discuss.privacyguides.net/t/forward-email-email-prov... Unlike Skiff, P…

This looks cool, but do you have any plans to support reverse aliases like simplelogin does? So users can reply from their emails even if an email is aliased, without having to add forward email SMTP settings.

Re: Skiff: Various Privacy Failures

#20

Post by azeemba »

captainmisery wrote: post #16
forwardemail wrote: post #8

Forward Email team here ( https://forwardemail.net ), we have a write-up and comparison @ https://forwardemail.net/en/blog/docs/best-quantum-safe-encr... We've considered adding a E2EE comparison column as well (with the issues such as Proton rewriting your emails @ http://jfloren.net/b/2023/7/7/0 highlighted). Privacy Guides Discussion @ https://discuss.privacyguides.net/t/forward-email-email-prov... Unlike Skiff, P…

Isn't this just advertising your own company?

That's not inherently bad if the comment is relevant and the relationship is made clear in the comment.
Post reply on HN