101–110 of 111 posts
Earlier quoted context omitted.
Thanks for taking the time to reply. Non-webmail may not be accessible from everywhere, paid-email entails money exchange which maybe traceable. Lavabit seems to have been secure enough for Snowden (for a while). So the question remains: Yes Free and/or Webmail are bad - which one is the LEAST bad from a privacy & security perspective?
There's a good list here that should allow you to decide for yourself: http://prxbx.com/email/
Earlier quoted context omitted.
If those commands are so simple, why are they not built into chrome? Honest question. It's where I actually write my emails.
If a browser provides an OpenPGP API, than how would I know whether or not a website uses it properly? What is to stop a compromised webmail provider from serving me a web page that claims to use this API to encrypt my message before sending it, but also simply sends the plain text message captured from the mail composition page along? You are typing your sensitive message right there in the browser, in the web page…
Earlier quoted context omitted.
If a browser provides an OpenPGP API, than how would I know whether or not a website uses it properly? What is to stop a compromised webmail provider from serving me a web page that claims to use this API to encrypt my message before sending it, but also simply sends the plain text message captured from the mail composition page along? You are typing your sensitive message right there in the browser, in the web page…
Welp, you successfully dissuaded me from ever looking into pgp.
Earlier quoted context omitted.
> If you install Debian you have to make sure that the ISO was not compromised. You can do that by calling a third-party and compare the published checksums or any out-of-band solution. Once this base of trust is established you are good to go. In fact updates are fetched over plain HTTP because all the updates are signed using GPG. It's hard to take this seriously - do you really call a third-party every-time you re…
There's really no comparison between the two scenarios. Hacking the MIT server or distros to replace the GPG code is an incredibly noisy attack, which will leave an evidence trail the size of Utah, home state of NSA. It's a risky attack because you don't have selectors (don't know to whom to provide the trojanized code) so you will necessarily infect more targets than necessary. There are also multiple manual and aut…
These guys got attacked recently by a DD4BC outfit and paid the ransom. I wouldn't trust them with a shopping list, let alone my email.
I haven't heard about this before and would like to know more if possible.
Earlier quoted context omitted.
> I contend that these are the same vulnerabilities someone faces downloading GnuPG from it's distribution sites, downloading Firefox/Chrome/IE, or even applying Windows/Linux updates. If you had in mind the typical Windows user who downloads programs from the internet without any security check, then you're right, but the typical Linux user doesn't do this and instead installs software via the package system provide…
But, where did you get that public key that you're using to verify the signatures? Personally, I got that public key because it was included in an ISO image that I downloaded over TLS from website. So, if that TLS session was compromised, a fake public key could have been inserted in the ISO. Or, the copy of GnuPG in that ISO could have been modified not to complain when the signature of certain pieces of code did no…
Which is why I said "There is of course the initial OS image that you need to find some other way to trust (but this is the same in your case)". I explicitely wrote my post to point out that ProtonMail has one additional, independent, vulnerability risk.
You were talking about the GnuPG or browser install, and I said that it would be wrong to claim that this is as vulnerable as getting the library from a web mail service if you're talking about decent OSes. This view is not invalidated by the risk of the initial OS install, since that's a different risk: you run the OS installation once every few years or so, but you check email every day. And if your OS is compromised, then you have lost in any case and could as well use Yahoo/Hotmail/Gmail/Facebook/postcards.
For the OS install you can also take precautions when getting the image (e.g. download or verify image over TOR, compare hash with results from search engines or other people), also in fact Debian does provide PGP signatures for their OS images[1].
[1] http://cdimage.debian.org/debian-cd/8.3.0/multi-arch/iso-cd/
> But, have you ever looked at the signatures on the public keys that most distributions use to validate their software releases?
Yes, I'm in fact always doing exactly that. Of course people who don't have a PGP implementation yet can't do it as easily. They can still take different precautions. Chicken and egg is not an absolute dilemma.
Also, Debian creates the above signature with a key that is signed by people I actually have a trust path to:
$ gpg SHA512SUMS.sign
gpg: Signature made Sun Jan 24 18:08:46 2016 GMT using RSA key ID 6294BE9B
gpg: Good signature from "Debian CD signing key "
$ gpg --list-sigs 6294BE9B | grep ^sig | cut -c14- | sort -u -k 2
C542CD59 2011-01-05 Adam D. Barratt
6294BE9B 2011-01-05 Debian CD signing key
A40F862E 2011-01-05 Neil McGovern
63C7CC90 2011-01-05 Simon McVittie
3442684E 2011-01-05 Steve McIntyre
1B3045CE 2011-01-07 Colin Tuckley
95861109 2011-01-23 Ben Hutchings (DOB: 1977-01-11)
30B94B5C 2011-02-08 [User ID not found]
9011A5AE 2011-05-02 [User ID not found]
53CD659C 2011-05-09 [User ID not found]
8143B682 2012-08-26 Neil Williams (Debian)
0125D5C0 2012-08-31 Philip Hands
046F070A 2013-04-22 [User ID not found]
5DF05C03 2013-06-11 [User ID not found]
C778A4AB 2013-07-06 [User ID not found]
10038D31 2013-07-23 [User ID not found]
Your remaining advantage could be that the Swiss CA that you're using provides more security than the potentially non-Swiss CA used for the website a "normal" user (who doesn't do further checks) is downloading his OS image from. At that point a risk calculation using probabilities would need to be done to see which solution looks more secure.
> Our primary datacenter is located under 1000 meters of granite rock in a heavily guarded bunker which can survive a nuclear attack. Would they seriously have done this on intent?
Some bad signs: 1. Hosted in Switzerland is advertised as a security feature. The point of e2e is that the servers are untrusted. If you need a "good jurisdiction" for your servers, it means they must be trusted. That's a problem, because sadly there are no good jurisdictions in today's world, and your jurisdiction doesn't help you if your servers are hacked. 2. It's webmail. That means the security of whatever e2e t…
Disclosure Note: I'm with ProtonMail. Please note that I don't officially speak for the company. But, I'm a crypto guy and this is Hackernews so... 1. While historically advertising a hosting location was a bit of a red flag for snake oil, the Snowden disclosures changed things for SaaS providers. Jurisdictional arbitrage is indeed a security feature of the service. I think you're missing the point a bit in that it g…
First I thank you for your work. Everybody that implments strong crypto for the masses should be commended.
1) Can I use my own GPG key, even if only for GPG users outside of ProtonMail?
2) Do you support access to Smartcards (NFC) or OpenKeychain (it supports Smartcards)?
3) Can I use TOTP/HTOP/U2F for app and/or web login, specifically U2F over NFC on Android (maybe Bluetooth LE on iOS).
4) Is your HTTPS connection pinned?
5) Do you live in Switzerland and if so, would you speek at a Hackerspace about ProtonMail crypto?
These guys got attacked recently by a DD4BC outfit and paid the ransom. I wouldn't trust them with a shopping list, let alone my email.
Do you have any sources for this? I haven't heard about this before and would like to know more if possible.