Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Skiff: Various Privacy Failures

grepular.com

Post reply on HN
Print view View original

21–29 of 29 posts

Re: Skiff: Various Privacy Failures

#21

Post by forwardemail »

jacooper wrote: post #19
forwardemail wrote: post #8

Forward Email team here ( https://forwardemail.net ), we have a write-up and comparison @ https://forwardemail.net/en/blog/docs/best-quantum-safe-encr... We've considered adding a E2EE comparison column as well (with the issues such as Proton rewriting your emails @ http://jfloren.net/b/2023/7/7/0 highlighted). Privacy Guides Discussion @ https://discuss.privacyguides.net/t/forward-email-email-prov... Unlike Skiff, P…

This looks cool, but do you have any plans to support reverse aliases like simplelogin does? So users can reply from their emails even if an email is aliased, without having to add forward email SMTP settings.

Hi there @jacooper - we already support this via domain-wide catch-all passwords. We also support filtering such as you+filter@yourdomain.com.

Re: Skiff: Various Privacy Failures

#22

Post by shortformblog »

forwardemail wrote: post #8

Forward Email team here ( https://forwardemail.net ), we have a write-up and comparison @ https://forwardemail.net/en/blog/docs/best-quantum-safe-encr... We've considered adding a E2EE comparison column as well (with the issues such as Proton rewriting your emails @ http://jfloren.net/b/2023/7/7/0 highlighted). Privacy Guides Discussion @ https://discuss.privacyguides.net/t/forward-email-email-prov... Unlike Skiff, P…

Have you considered offering a bulk email service for folks who want to send newsletters? It looks like an interesting tool though it seems like you specifically ban that use case, even though it seems like it could be great for that.

Re: Skiff: Various Privacy Failures

#23

Post by forwardemail »

shortformblog wrote: post #22
forwardemail wrote: post #8

Forward Email team here ( https://forwardemail.net ), we have a write-up and comparison @ https://forwardemail.net/en/blog/docs/best-quantum-safe-encr... We've considered adding a E2EE comparison column as well (with the issues such as Proton rewriting your emails @ http://jfloren.net/b/2023/7/7/0 highlighted). Privacy Guides Discussion @ https://discuss.privacyguides.net/t/forward-email-email-prov... Unlike Skiff, P…

Have you considered offering a bulk email service for folks who want to send newsletters? It looks like an interesting tool though it seems like you specifically ban that use case, even though it seems like it could be great for that.

[dead]

Re: Skiff: Various Privacy Failures

#24

Post by binary132 »

forwardemail wrote: post #15
cedws wrote: post #14

Earlier quoted context omitted.

I think there is a miscommunication. I am not talking about PGP encrypted emails - sure, those can be decrypted client side. Plaintext emails, as the majority of emails are, will be received by your server in plaintext, minus transport encryption. How can you guarantee those will not be intercepted by authorities?

We use MTA-STS (for inbound AND outbound) with our mode set to enforce[1], to require senders to communicate with us only using TLS encrypted sockets. There is no legal precedence currently requiring software services to implement backdoors. [1]: https://github.com/forwardemail/mta-sts.forwardemail.net/blo...

Sorry but does that actually address cedws' question about subpoena?

Re: Skiff: Various Privacy Failures

#25

Post by forwardemail »

binary132 wrote: post #24
forwardemail wrote: post #15

Earlier quoted context omitted.

We use MTA-STS (for inbound AND outbound) with our mode set to enforce[1], to require senders to communicate with us only using TLS encrypted sockets. There is no legal precedence currently requiring software services to implement backdoors. [1]: https://github.com/forwardemail/mta-sts.forwardemail.net/blo...

Sorry but does that actually address cedws' question about subpoena?

Our policies for law enforcement are publicly available at https://forwardemail.net/en/report-abuse#for-law-enforcement

Also - you should note that we largely operate in-memory and don't store to disk any information or logs (unless essential, e.g. IMAP storage, or if they are error logs). We have all of this in our privacy policy and terms on our website. We are extremely transparent.

Re: Skiff: Various Privacy Failures

#26

Post by jacooper »

forwardemail wrote: post #21
jacooper wrote: post #19

Earlier quoted context omitted.

This looks cool, but do you have any plans to support reverse aliases like simplelogin does? So users can reply from their emails even if an email is aliased, without having to add forward email SMTP settings.

Hi there @jacooper - we already support this via domain-wide catch-all passwords. We also support filtering such as you+filter@yourdomain.com.

No i meant it differently.

I have an alias user@example.com which forwards to user@gmail.com

The idea is when user@gmail.com gets an email through the user@example.com alias, they can also reply to it and it will show up as user@example.com.

Simplelogin does this through a reverse alias, the reply to address is not the actual address, rather it's an alias for the reply-to address, so it can rewrite the message as if it came from the alias.

Re: Skiff: Various Privacy Failures

#27

Post by binary132 »

forwardemail wrote: post #25
binary132 wrote: post #24

Earlier quoted context omitted.

Sorry but does that actually address cedws' question about subpoena?

Our policies for law enforcement are publicly available at https://forwardemail.net/en/report-abuse#for-law-enforcement Also - you should note that we largely operate in-memory and don't store to disk any information or logs (unless essential, e.g. IMAP storage, or if they are error logs). We have all of this in our privacy policy and terms on our website. We are extremely transparent.

Memory can still be observed. Encrypted content in memory cannot.

Re: Skiff: Various Privacy Failures

#28

Post by protonmail »

cedws wrote: post #7

I see Skiff also advertises itself as "end-to-end" encrypted. This is the same misleading advertising as ProtonMail is guilty of. Traditional email cannot be E2E encrypted because of protocol limitations. You can technically achieve E2E encryption if using PGP, but if the private keys are not in your control then it is effectively pointless. ProtonMail can only guarantee E2E encryption without PGP if you are sending…

Regarding Proton Mail's encryption: Proton's servers don't hold your private key directly — it is generated client-side and stored encrypted with your password. You can also import your own keys: https://proton.me/support/pgp-key-management. That way, you can stay in full control of your keys.

Additionally, Proton Mail uses OpenPGP internally, so Proton-to-Proton messages are always protected by PGP. Even for external messages, contacts don't necessarily have to set up PGP encryption manually; the email client can do so, enabling the use of end-to-end encryption between different providers with minimal hassle.

Re: Skiff: Various Privacy Failures

#29

Post by Doxin »

mweidner wrote: post #17
cedws wrote: post #7

I see Skiff also advertises itself as "end-to-end" encrypted. This is the same misleading advertising as ProtonMail is guilty of. Traditional email cannot be E2E encrypted because of protocol limitations. You can technically achieve E2E encryption if using PGP, but if the private keys are not in your control then it is effectively pointless. ProtonMail can only guarantee E2E encryption without PGP if you are sending…

The product page is clearer ( https://skiff.com/mail ): > All emails between Skiff users are end-to-end encrypted, including both subject and contents. External mail is encrypted with your keys on receipt, keeping it private.

That is however, quite specifically, not end-to-end encryption. The whole entire point of end-to-end encryption is that no intermediary gets to see the unencrypted content.
Post reply on HN