Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail now offers elliptic curve cryptography

protonmail.com

Post reply on HN
Print view View original

101–110 of 148 posts

Re: ProtonMail now offers elliptic curve cryptography

#101

Post by JudgeWapner »

KirinDave wrote: post #79
glaurung_ wrote: post #64

Earlier quoted context omitted.

Out of curiosity, what did you switch to? I'd like to leave Gmail and Proton Mail seems to be pretty well recommended. Is Fast Mail a better option?

I use Gmail for most things, because in terms of account security it's probably the best in the world. I do not use email for discussing sensitive topics. It is not the right tool for the job.

Does anyone use gmail + PGP ? if the two parties understand how to send encrypted messages over web clients, isn't that still secure ? I haven't heard much about PGP for the past 5+ years. I realize PGP itself isn't a protocol, but there used to be a system where you'd publish your public key (irrespective of what protocol (RSA, ECDSA, etc) you use) somewhere and anyone could send you encrypted messages and paste the base64 text into insecure clients.

Re: ProtonMail now offers elliptic curve cryptography

#102

Post by arghwhat »

tptacek wrote: post #77
arghwhat wrote: post #59

Earlier quoted context omitted.

NIST curves like P-256 is generally not considered trustworthy, which is why the general consensus is to use Ed25519 for any elliptic curve cryptography. Using Ed25519 is by popular opinion the right choice. However, the concern about their use of indutny's library and the comment you link to is entirely separate. Choosing to have timing attacks for performance in a cryptographic library seems absolutely absurd, and…

That is not at all the case. P-256 is widely used and no cryptographer seriously believes there's anything "untrustworthy" about it. Rather, the problem with P-256 is that it's easy to misuse, like most curves . It's hard to implement in constant time and the NIST P-curves generally lend themselves to invalid curve attacks, which need to be guarded against. Curve25519 avoids these problems. But then, if you're using…

I'm sorry, I misworded myself:

There is general distrust in NIST, not any known issues with those curves. However, it is general consensus to prefer Ed25519 over NIST curves, specifically preferring it over P-256. The benefits of its implementation are a cherry on top. I have yet to see any suggestion or reason to pick P-256 when Ed25519 is available.

And yes, Ed25519 is the defacto standard. Hell, I don't even recall the last time I heard P-256 mentioned. It surprises me every time I stumble upon it. Picking anything other than Ed25519 means deviating from the norm, which would normally cause worry. Granted, P-256 is fine, but there is absolutely no argument for claiming Ed25519 was the wrong choice of algorithm.

And yes, I specifically refer to Ed25519 because it is the one relevant here. We're talking about signing, not key exchanges.

Re: ProtonMail now offers elliptic curve cryptography

#103

Post by xxpor »

detritus wrote: post #93
xxpor wrote: post #84

Earlier quoted context omitted.

I moved to fastmail from gmail to slightly de-google my life. The biggest issue i've had so far is the search is terrible , and the spam filtering has many more false positives.

I agree that the search in Fastmail is fairly bad - it does have an 'advanced' menu option that isn't immediately obvious, but it's still not super great. You made me panic when you mentioned Spam false positives, as I've never really bothered checking that folder! Thankfully I don't appear to have any so far. Better than bloody GMail arbitrarily deciding that subscriptions and emails I've long-since received from va…

> Better than bloody GMail arbitrarily deciding that subscriptions and emails I've long-since received from various sources being suddenly spam... .

That's in fact my exact issue. The newsletter from the mayor of Seattle regularly gets tagged, for example.

Re: ProtonMail now offers elliptic curve cryptography

#104

Post by lfms_dotfile »

wanderfowl wrote: post #94
Abishek_Muthian wrote: post #91

Earlier quoted context omitted.

I stand corrected[1], premium users can 'Combine multiple accounts into 1 account'. [1]: https://protonmail.com/support/knowledge-base/combine-accoun...

Yep, that's fine, but it's not much of a firewall. And unless I'm mis-reading this, this doesn't allow you to combine multiple domains.

I've setup multiple domains on the same Protonmail account. You can create new addresses (@protonmail.ch/protonmail.com/pm.me/domain) with a paid account (iirc up to 5 total addresses with Protonmail Plus).

Re: ProtonMail now offers elliptic curve cryptography

#105

Post by dontbenebby »

Abishek_Muthian wrote: post #83
dontbenebby wrote: post #62

Earlier quoted context omitted.

But is your threat model someone reading your old email? For most people the big risk is that their email can be leveraged to gain access to banks, social media etc through password resets.

I agree, access to other accounts is of greater threat. When I created this account, I wanted to build upon the premise of privacy of proton mail & so I created using VPN, with no personal link whatsoever (hence no recovery email). Unfortunately when my decryption password failed, I had no means of recovery until I attempted to talk through support successfully.

Hm. I once had an issue with a decryption password failing despite using a manager (not on Protonmail)

It ended up being that a trailing newline got added.

It's a long shot but worth looking into...

Re: ProtonMail now offers elliptic curve cryptography

#106

Post by TimTheTinker »

deagle50 wrote: post #51
KirinDave wrote: post #48

Earlier quoted context omitted.

I don't know OSX very well these days. Is that... is that actually installing a new global SSL trust root? Doesn't that mean ProtonMail now can seamlessly MitM all SSL connections on that machine? Please tell me I'm reading that wrong, because I don't recall doing this for ProtonVPN on linux.

In the instructions they ask the user to "always trust" the cert for all use cases, including SSL. If you do that, any app that uses OS certs can be MITMed. It should be enough to trust the cert for IPSec only.

My knowledge is limited in crypto, but I'm pretty sure you should never trust a root cert (even for "IPSec only") unless it carries responsibility and public scrutiny equal to or greater than a standard CA. (Unless it's the owner of the device [including you] or a close associate you trust.)

Re: ProtonMail now offers elliptic curve cryptography

#107

Post by a1369209993 »

tptacek wrote: post #77
arghwhat wrote: post #59

Earlier quoted context omitted.

NIST curves like P-256 is generally not considered trustworthy, which is why the general consensus is to use Ed25519 for any elliptic curve cryptography. Using Ed25519 is by popular opinion the right choice. However, the concern about their use of indutny's library and the comment you link to is entirely separate. Choosing to have timing attacks for performance in a cryptographic library seems absolutely absurd, and…

That is not at all the case. P-256 is widely used and no cryptographer seriously believes there's anything "untrustworthy" about it. Rather, the problem with P-256 is that it's easy to misuse, like most curves . It's hard to implement in constant time and the NIST P-curves generally lend themselves to invalid curve attacks, which need to be guarded against. Curve25519 avoids these problems. But then, if you're using…

Actually, Ed25519 is the Edwards curve isomorphic to Curve25519 (which IIRC is a Montgomery curve). Edwards is faster than Montgomery for signature, but not significantly slower for key agreement.

You can use it for ECDH, and unless I've missed some non-obvious attack (which is of course, entirely possible) you probably should, since that allows you to use (mostly) the same elliptic curve math primitives for key agreement as for signature.

(That is, you should use Edwards form points as shared-secret output. It's possible to implement Curve25519 using Ed25519 internally, but probably not a good idea.)

Re: ProtonMail now offers elliptic curve cryptography

#108

Post by doomrobo »

scotch_drinker wrote: post #97
doomrobo wrote: post #95

Slightly OT, but I didn't see an important question being asked: What is the motivating threat model of ProtonMail? If I just want to access my email securely, that's done by HTTPS. If I want an end-to-end encrypted solution, ProtonMail can provide that, though only for emails between ProtonMail users. For e2e outside of ProtonMail, I can use PGP. From what I understand, ProtonMail makes all the PGP stuff easier by b…

I'm using ProtonMail because I'm trying to de-Google-Amazon-Facebook my life somewhat as another user mentions. I'm tired of being the product and am willing to pay for certain things.

So why ProtonMail over any other email provider, besides GMail? Would you be willing to pay for email?

Re: ProtonMail now offers elliptic curve cryptography

#109

Post by arosier »

morrbo wrote: post #52
wil421 wrote: post #2

Anyone using ProtonMail regularly? I created an account but haven’t used it much. How are your experiences? Any iOS users who can comment on their experience with proton mail and the default mail client? I don’t went to switch to something that won’t be around in a decade or so.

We use proton for our business mail (small startup The idea is great, works well, and we support it as best we can. However they REALLY need to step up their game in terms of making it easy to manage as opposed to just "moar security!". I put in tickets for each of the aforementioned pain points 6 months ago, and heard nothing back really. I doubt the developers ever got to see them. If they want more money and more…

Hey, I work with ProtonMail. Sorry you haven't heard back from support. Would you mind sending the feedback to enterprise@protonmail.com? We're actively working on getting most of the mentioned features out the door, but would love to get some specifics from you.

In case I don't hear from you, HTML Signatures are live.

Thanks!

Re: ProtonMail now offers elliptic curve cryptography

#110

Post by arosier »

wanderfowl wrote: post #45
wil421 wrote: post #2

Anyone using ProtonMail regularly? I created an account but haven’t used it much. How are your experiences? Any iOS users who can comment on their experience with proton mail and the default mail client? I don’t went to switch to something that won’t be around in a decade or so.

One major issue with the iOS client is that it cannot handle more than one Inbox. So, if you use two accounts (e.g. home and work), you can only be logged in in one at a time, and have to go through the full sign-in-sign-out process each time you want to switch. And my understanding is that the iOS app doesn't actually cache email offline, so it's not terribly possible to work on an airplane, etc. Also, understand th…

We are currently working on adding multiple user support for mobile clients, should be released in a few months.

Have you tried the Bridge? We are putting a lot of development effort into making that UX very seamless.

Post reply on HN