Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The FastMail Security Mindset

blog.fastmail.com

Post reply on HN
Print view View original

291–300 of 301 posts

Re: The FastMail Security Mindset

#291

Post by Tomte »

joshuamorton wrote: post #214
lvh wrote: post #201

Earlier quoted context omitted.

Unless you have a set of objectives that are very different from what I consider "as secure as e-mail gets", please consider GSuite and not Protonmail. (I don't speak for 'tptacek, but I'm pretty sure he'd agree.) As a corollary: if you really care, use Signal for stuff you can't say over e-mail. Whatsapp's fine too. But they solve a very different security problem than the one you need e-mail to solve, which is most…

Just gonna drive by mention https://landing.google.com/advancedprotection/ , which is a physical-2fa-security-key-only version of gmail. To my knowledge it also disallows mail forwarding, and the account recovery procedure in the event of losing both second factors is intended to be a long process that involves proof of identity and multiple attempts to notify the account owner. (I work on gmail, but I'm not intimate…

That also means you cannot this account as your Android phone account without an NFC U2F token, correct?

Re: The FastMail Security Mindset

#292

Post by mike-cardwell »

dewey wrote: post #145
mike-cardwell wrote: post #126

They should do PGP on the way in, for people who want it. It's trivial to set up. All they need to do is let people paste in a public PGP key and encrypt all incoming email with that key. Here's how I've been doing it for the last 7 years: https://www.grepular.com/Automatically_Encrypting_all_Incomi...

If it would be "trivial to set up" don't you think they would've already done it and offer it as an option?

Well, it is "trivial to set up" as per my link, and they don't offer it as an option, so apparently not.

Perhaps they don't think enough people use PGP to make this a worthwhile option to add. But given the service they are offering, it seems like an obvious feature and quick win to me.

Re: The FastMail Security Mindset

#293

Post by dewey »

mike-cardwell wrote: post #292
dewey wrote: post #145

Earlier quoted context omitted.

If it would be "trivial to set up" don't you think they would've already done it and offer it as an option?

Well, it is "trivial to set up" as per my link, and they don't offer it as an option, so apparently not. Perhaps they don't think enough people use PGP to make this a worthwhile option to add. But given the service they are offering, it seems like an obvious feature and quick win to me.

"trivial to set up" on your own mail server with you as the only user is slightly easier than rolling it out to thousands of customers, testing it, make sure backups are all working, write documentation for users, collect public keys of users, ...

You can't just add a single line with your perl script to production and hope it works for everyone...

Re: The FastMail Security Mindset

#294

Post by rahimnathwani »

brongondwana wrote: post #288
rahimnathwani wrote: post #276

Earlier quoted context omitted.

"We don't use the 100 points of ID system of course, because we're an online service. Right, but you said you're a 'great fan' of it. My reading of the wikipedia description that you linked suggests that the system is wholly inadequate (mainly as you can satisfy the 100 points without photo ID). So I'd like to know: are you really a fan of that system (the particulars of its rules), or just a fan of the idea behind i…

Tell me how you bootstrap photo ID in your country, and I'll tell you whether I think photo ID means anything. In our case, we don't care at all what you look like, just that you're the same person we were talking to earlier - and ideally that you're the owner of the method being used to pay, though that's not always true or necessary. So the photo is meaningless to us. Besides: who is looking at the photo and confir…

I think we're talking past each other. I'm saying the Australian 100 points system isn't adequate for bank account opening, because it doesn't have photo ID, so I'm not sure why you admire it.

You're saying that you don't need photo ID for your use case. I agree with that for your purpose, but it's not relevant to my criticism of the 100 points system for its purpose.

Re: The FastMail Security Mindset

#295

Post by arghwhat »

danenania wrote: post #282
arghwhat wrote: post #274

Earlier quoted context omitted.

That will break the app if it wasn't written for it. It doesn't change the argument, though. I'm arguing that it is relatively easy to deal with within the limits of what can be dealt with. If a strict content security policy can be applied, it just gets even easier.

I'd say that a csp is the only reasonable way to verify for a non-trivial app. A deep audit of every line of the app plus the whole dependency graph (that must be repeated on the diffs for every update) is not how I would define 'relatively easy'. And yes, I know it will break if not written for it--I'm saying that coding to fit a strict csp is the only way to have a verifiably secure js app. Without it, you're in th…

I don't mind the CSP approach, I was just stating that with it, the app either works, or everything breaks.

However, two things:

1. Nothing here requires a deep audit. Finding every execution point can be done with a bit of patience and "git grep". Some terrible frameworks, such as jQuery, can obscure things a bit, in which case knowledge of them speeds things up.

2. This may be a simple slip of words, but CSP does not in any way make your app verifiable secure. Coding towards a strict CSP is more about responsible coding and risk reduction/threat containment, by making foreign JavaScript execution non-trivial. There is nothing in a browser that lets you make something verifiably secure.

Re: The FastMail Security Mindset

#296

Post by danenania »

arghwhat wrote: post #295
danenania wrote: post #282

Earlier quoted context omitted.

I'd say that a csp is the only reasonable way to verify for a non-trivial app. A deep audit of every line of the app plus the whole dependency graph (that must be repeated on the diffs for every update) is not how I would define 'relatively easy'. And yes, I know it will break if not written for it--I'm saying that coding to fit a strict csp is the only way to have a verifiably secure js app. Without it, you're in th…

I don't mind the CSP approach, I was just stating that with it, the app either works, or everything breaks. However, two things: 1. Nothing here requires a deep audit. Finding every execution point can be done with a bit of patience and "git grep". Some terrible frameworks, such as jQuery, can obscure things a bit, in which case knowledge of them speeds things up. 2. This may be a simple slip of words, but CSP does n…

1 - Theoretically yes, but this is highly error prone and needs to be repeated on every update. Taking human factors into account, it's not a reliable strategy imho.

2 - My point isn't that a strict CSP makes the app magically secure, just that without it there's realistically no hope, and there's no point in wasting energy on trying to run a nontrivial app that doesn't have a strict CSP locally with the hope of getting around the security concerns of remotely hosted html/js.

If you load a local html file with a strict CSP into Chrome with no extensions installed, that's actually a pretty darn secure execution environment. It's much easier to verify than a native app, for example, and it can do a lot less damage. Based on a single line at the top of the file, you can be certain that the app doesn't load remote js or css, doesn't use eval, only communicates with specific domains, etc. It isn't magic, but it can get you a long way and it does offer numerous clear, concrete benefits vs. a remotely hosted app.

Re: The FastMail Security Mindset

#297

Post by xmodem »

sigzero wrote: post #207
xmodem wrote: post #181

Earlier quoted context omitted.

If a well-resourced attacker was targeting me specifically, it wouldn't be too difficult for them to find out about my short-to-medium term travel plans. A bit of social engineering with the airlines could tell them exactly which flight I'm on. They could also compromise other people who need to know my plans and don't have the same security practises as me. I think about this stuff and minimise as best I can, but my…

If a "well-resourced attacker" was targeting you specifically, you're toast. Period.

Attackers come in all shapes and sizes. If the NSA comes after you, you’re toast, but there’s a lot of high level organized crime out there as well.

Re: The FastMail Security Mindset

#298

Post by brongondwana »

rahimnathwani wrote: post #294
brongondwana wrote: post #288

Earlier quoted context omitted.

Tell me how you bootstrap photo ID in your country, and I'll tell you whether I think photo ID means anything. In our case, we don't care at all what you look like, just that you're the same person we were talking to earlier - and ideally that you're the owner of the method being used to pay, though that's not always true or necessary. So the photo is meaningless to us. Besides: who is looking at the photo and confir…

I think we're talking past each other. I'm saying the Australian 100 points system isn't adequate for bank account opening, because it doesn't have photo ID, so I'm not sure why you admire it. You're saying that you don't need photo ID for your use case. I agree with that for your purpose, but it's not relevant to my criticism of the 100 points system for its purpose.

I'm wondering how exactly you GET a photo ID in the first place. You need to identify yourself to whoever is taking that photo.

I lived in Norway for a couple of years. There I just opened a bank account online, giving them my person number - and they posted something to my address as registered with the government. But in Australia our privacy advocates killed the "Australia Card" idea, so instead we have a tax file number with all the disadvantages of a national ID number and none of the advantages...

Anyway, back the main point. To be totally frank with you I think photo IDs are largely bullshit security theatre. You're asking a human factor[tm] to look at a fuzzy photo taken 10 years ago and confirm that it looks similar enough to the person in front of them.

Re: The FastMail Security Mindset

#299

Post by xmodem »

qume wrote: post #244
sigzero wrote: post #207

Earlier quoted context omitted.

If a "well-resourced attacker" was targeting you specifically, you're toast. Period.

I wish more people understood this.

This is like the employer I used to work with who said "well google has been hacked so therefore us storing passwords in plaintext is okay". Maybe I'm toast if the NSA takes an interest, but there are an awful lot of bad actors out there without the level of funding or resources of the NSA. Of course I'll never be "100% secure", but making it as impossible, or at least as difficult as possible, for someone in Russia to socially engineer their way into my email is worth spending time and money on.

Re: The FastMail Security Mindset

#300

Post by rahimnathwani »

brongondwana wrote: post #298
rahimnathwani wrote: post #294

Earlier quoted context omitted.

I think we're talking past each other. I'm saying the Australian 100 points system isn't adequate for bank account opening, because it doesn't have photo ID, so I'm not sure why you admire it. You're saying that you don't need photo ID for your use case. I agree with that for your purpose, but it's not relevant to my criticism of the 100 points system for its purpose.

I'm wondering how exactly you GET a photo ID in the first place. You need to identify yourself to whoever is taking that photo. I lived in Norway for a couple of years. There I just opened a bank account online, giving them my person number - and they posted something to my address as registered with the government. But in Australia our privacy advocates killed the "Australia Card" idea, so instead we have a tax file…

"I'm wondering how exactly you GET a photo ID in the first place."

In the UK, for a passport, there's a chain of trust. You need a professional or some other trusted community member (vicar, doctor, lawyer etc.) to sign the back of the photo saying it's you, and to provide their contact info for further verification.

Not perfect, but I don't think many people are skilled enough to successfully procure a passport where the photo isn't of the named person).

"To be totally frank with you I think photo IDs are largely bullshit security theatre."

They're not 100% reliable, sure, but they're extremely useful in establishing whether the person in front of you matches a particular identity.

One excellent use case for photo ID: consumer lending. If you lend someone money, you need to establish that the person you give the money to is actually agreeing to pay you back, and to pay you interest.

Post reply on HN