Improved Authentication for Email Encryption and Security • Hacker News Board

Re: Improved Authentication for Email Encryption and Security

#71

Post by saberlynx » Mon, Dec 05, 2016, 12:02 PM UTC

benevol wrote: post #52

mark_l_watson wrote: post #43

Earlier quoted context omitted.

In a world where both large Internet companies and governments collect meta data, possible collect more than meta data, set up fake cell towers, etc., I think it is naive to not think that they are also collecting statistics on the use of encryption. Perhaps you misunderstood me?

You're basically suggesting that using tools that strengthen democracy is to our disadvantage, because it does not please the government, and that we should therefor not use them to defend our rights. Basically, we should accept being manipulated by fear.

I use ProtonMail. I'm aware that puts me on a list in all likelihood. Still doing it however. I'm of the opinion that more encrypted private communication between citizens can only be a good thing for freedom even if it enables a few criminals. And I have to do my part.

Re: Improved Authentication for Email Encryption and Security

#72

Post by jimktrains2 » Mon, Dec 05, 2016, 12:18 PM UTC

bartbutler wrote: post #68

jimktrains2 wrote: post #65

Earlier quoted context omitted.

A mitm is an active attacker. If TLS fails, then the mitm could modify the code sent to the end user.

That's a limited definition of MITM. That would be an active attack, and yes, this does nothing for that for the web app--the native apps are a different story. However, there are plenty of corporate PCs and other machines with root certs installed in a way that a third party could, and often does, passively record traffic without modification for analysis later. SRP prevents those dumps from containing information t…

That is exactly what I'm describing though. The corporation could edit the page to do what they want. To claim otherwise is foolish and really makes me question proton's understanding of security.

Re: Improved Authentication for Email Encryption and Security

#73

Post by shshhdhs » Mon, Dec 05, 2016, 1:35 PM UTC

nickpsecurity wrote: post #54

mark_l_watson wrote: post #28

"In ProtonMail’s one-password mode, the mailbox password is derived from the login password via a one-way cryptographic password hash." I wondered why they didn't do this. As a customer, this is a welcome change. One thing that is of general concern to me: I tend to use a lot of encrypted traffic because much of my work is done on SSH shells to servers, and some of my customers request encrypting work files and use V…

"What our government should do is a moon-shot level of effort to promote strong encryption and very robust digital infrastructure." They did. It was called the Computer Security Initiative. It was the culmination of efforts starting with Anderson Report that collectively invented INFOSEC and deployed high-assurance versions. Early releases were secure messaging, the BLACKER VPN, MLS endpoints, private databases, and…

"At least the papers on requirements and methods for achieving that were all published."

Hi there! Ive seen you post on these before; do you have a collection of links or references to papers an infosec engineer interested in this should read? Ty

Re: Improved Authentication for Email Encryption and Security

#74

Post by vabmit » Mon, Dec 05, 2016, 2:30 PM UTC

hobarrera wrote: post #34

vabmit wrote: post #25

Earlier quoted context omitted.

IMAP support is coming very soon. Engineers are working on the code, now. It's a more difficult task than people would imagine because the implementations of the IMAP standards by some clients (like Outlook) is a bit... "interesting".

How would this IMAP implementation work? Some kind of local proxy that does the decryption on-the-fly?

Yes, exactly. The client is able to install and run a local proxy/translator application on their machine (currently, it's called a "bridge"). Their IMAP client connects to it and it interacts with ProtonMail's APIs over HTTPS. Since the bridge runs locally, the private key is locally decrypted with the client's password. The password is never sent to the server. The decryption takes place locally in the bridge software running on the client's computer.

Re: Improved Authentication for Email Encryption and Security

#75

Post by esseti » Mon, Dec 05, 2016, 4:08 PM UTC

I need a clarification

"In ProtonMail’s one-password mode, the mailbox password is derived from the login password via a one-way cryptographic password hash. The input to this hash includes a salt provided by the server on login but not stored in the client. In this way, compromise of the mailbox password does not automatically lead to compromise of the login password."

This means, if my password is "123hello" then the mailbox password is hash(derived("123hello"),secret_salt) where, hash is an hash algorithm (which one?), the secret_salt is a value stored in the server and never sent to the client, and the derived("123hello") is a password computed using the SRP protocol, which should be the session key explained here https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco..., correct? the part of the SRP and on how to genreate the password in SRP is a bit obscure to me, just trying to understand.

Re: Improved Authentication for Email Encryption and Security

#76

Post by nickpsecurity » Mon, Dec 05, 2016, 11:08 PM UTC

shshhdhs wrote: post #73

nickpsecurity wrote: post #54

Earlier quoted context omitted.

"What our government should do is a moon-shot level of effort to promote strong encryption and very robust digital infrastructure." They did. It was called the Computer Security Initiative. It was the culmination of efforts starting with Anderson Report that collectively invented INFOSEC and deployed high-assurance versions. Early releases were secure messaging, the BLACKER VPN, MLS endpoints, private databases, and…

"At least the papers on requirements and methods for achieving that were all published." Hi there! Ive seen you post on these before; do you have a collection of links or references to papers an infosec engineer interested in this should read? Ty

Send me an email at address in my profile. Ill send them to you as I dig them out.

Re: Improved Authentication for Email Encryption and Security

#77

Post by rethab » Thu, Dec 08, 2016, 11:42 AM UTC

nwuensche wrote: post #22

rethab wrote: post #14

Earlier quoted context omitted.

Yeah, but it's planned. They also mentioned the calendar coming in a recent blog post. In general, I should say I am pretty happy with protonmail. I've been using it for over a year now, however, in general I'm still pretty dependent on google for calendar, android, etc. When it comes to spam, my feeling is that I do get more now. But as long as it is properly categorized -- which it is -- I don't really mind getting…

Do you also get ads by protonmail itself or does it come from other websites? And is there any unsubscribe feature like in outlook?

No, these are not from protonmail. It's more like p-enlargements, pills etc.. As far as general marketing mails are concerned, no, I never saw an unsubscribe link.