Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail: End-to-end encrypted email

protonmail.ch

Post reply on HN
Print view View original

21–30 of 51 posts

Re: ProtonMail: End-to-end encrypted email

#21

Post by thecoffman »

x1798DE wrote: post #17
thecoffman wrote: post #13

> https://protonmail.ch/blog/protonmail-threat-model/ I'm always skeptical of browser/JS based crypto, but it is nice to see that they're at least upfront with the risks involved in doing such a thing. They probably downplay the risk of a MITM attack a little much, but otherwise I'm glad to see they're realistic about possible weaknesses of the platform.

Yes, but they are clearly playing a bit fast-and-loose with things here. The whole point of end-to-end encryption is that it's a "trust no third parties" model (other than whoever provided your crypto software, which you can verify anyway). This is slightly better than Lavabit, but you're still trusting ProtonMail, who are providing the crypto implementation to your browser every time you use it. Depending on how it'…

All very fair points!

Re: ProtonMail: End-to-end encrypted email

#22

Post by sudonim »

And none of the employees are US citizens that can be compelled by the US government in a way that they're not allowed to talk about it (even to other employees) to compromise the security of the service?

I'm not sure that having a Swiss company makes any difference in a case where people have ties to the US. Does anyone else know better than me on this topic?

edit: It looks like the goal is that you don't even have to trust protonmail: "For this reason, we are also unable to do password recovery. If you forget your decryption password, we cannot recover your data." https://protonmail.ch/pages/security_details.php

Re: ProtonMail: End-to-end encrypted email

#23

Post by reitanqild »

jfaucett wrote: post #19

This sounds really good. The only disappointment is that it seems there is no business model that allows email providers and services like this to provide Unlimited encrypted email (no limitations i.e. Gmail-esque) absolutely free to all users. I'd be willing to gamble that if anyone could sustain this for a couple years, people would leave Gmail in droves, no one I know likes having to use the USA/NSA/google/big bro…

I also was confused about the free forever part until I found they actually have a tiered pricing model.

Edit: here is what they say: "Forever Free

We believe privacy is a fundamental human right and should be available for everyone. That's why we offer multi-tiered pricing including a free version that anyone can use. Let's bring privacy back to the people!"

Re: ProtonMail: End-to-end encrypted email

#25

Post by e12e »

luxpir wrote: post #2

The security details page[1] makes for interesting reading. Hopefully the new norm is 'E2E' encryption. It's actually starting to feel inevitable, and the hopelessness that followed in the wake of the 'Summer of Security' is perhaps evaporating bit by bit, through universal encryption, bit by bit. - [1] https://protonmail.ch/pages/security_details.php

It's nice, but suffer from similar problems as all web apps: They have your encrypted keys, all they have to do is send you a different "client" (change the js/ui) the next time you log in, and they can snoop your encryption password. They can of course be forced to do this.

I also wonder about their claim to "expire" mails -- I assume they mean only for mails internal to protonmail -- as any other expiry would have to rely on the recipient using a cooperating pgp/gpg and/or cooperating pop/imap client.

Re: ProtonMail: End-to-end encrypted email

#26

Post by reitanqild »

sudonim wrote: post #22

And none of the employees are US citizens that can be compelled by the US government in a way that they're not allowed to talk about it (even to other employees) to compromise the security of the service? I'm not sure that having a Swiss company makes any difference in a case where people have ties to the US. Does anyone else know better than me on this topic? edit: It looks like the goal is that you don't even have…

There are some clues to be found on the page: "ProtonMail is developed both at CERN and MIT and is headquartered in Geneva, Switzerland. We were semifinalists in 2014 MIT 100K startup launch competition and are advised by the MIT Venture Mentoring Service." ProtonMail is developed both at CERN and MIT and is headquartered in Geneva, Switzerland. We were semifinalists in 2014 MIT 100K startup launch competition and are advised by the MIT Venture Mentoring Service.

Re: ProtonMail: End-to-end encrypted email

#27

Post by e12e »

sudonim wrote: post #22

And none of the employees are US citizens that can be compelled by the US government in a way that they're not allowed to talk about it (even to other employees) to compromise the security of the service? I'm not sure that having a Swiss company makes any difference in a case where people have ties to the US. Does anyone else know better than me on this topic? edit: It looks like the goal is that you don't even have…

I don't think you need to worry too much about the US secret services (directly). But you can worry about the Swiss secret services. And probably by extension the German and French secret services. Which means you have to (by extension) worry about the US secret services anyway.

Note that France and Germany probably have much more direct dealings with Switzerland than the US has -- so pressure from these governments/the EU is more likely to hold sway, than any direct pressure from the US (but, as with all things, if a nation state consider you a legitimate it's probably game over anyway).

[edit: see other comment wrt MIT -- I was probably too optimistic.]

Re: ProtonMail: End-to-end encrypted email

#28

Post by iodfgj »

xk28 wrote: post #18
iodfgj wrote: post #9

Earlier quoted context omitted.

Why not open source all of it? I find it hard to trust a closed service especially after what happened with gmail.

Curious, what happened with gmail?

Because of their little suicidal robots that scan the email and then go boom (targeted advertising), i keep getting viagra ads everywhere. Plus there's the whole NSA thing as well...

EDIT: Of course there's adblock and i dont see the ads on my main browser but when logging in on another computer in a public space... BAM, penis pills

Re: ProtonMail: End-to-end encrypted email

#30

Post by Xylakant »

From reading the service description, this is an encrypted messaging service that happens to have email notifications.

I can't write messages with my preferred mail client, can't read messages with my preferred mail client and I can't access my (old) messages while offline. non-protonmail-users will receive a notification with a link that they received a message, not the actual message that they can keep for archiving purposes, offline use etc. I wonder if and how they handle searching mailboxes.

Neat, but not mail.

edit: typo. darn.

Post reply on HN