ProtonMail takes aim at Google with an encrypted calendar

#1

Post by vabmit » Mon, Dec 30, 2019, 3:37 PM UTC

ProtonMail takes aim at Google with an encrypted calendar
venturebeat.com

Re: ProtonMail takes aim at Google with an encrypted calendar

#2

Post by vabmit » Mon, Dec 30, 2019, 2:31 PM UTC

Here is their write up of the security model: https://protonmail.com/blog/protoncalendar-security-model/

Re: ProtonMail takes aim at Google with an encrypted calendar

#3

Post by asdf21 » Mon, Dec 30, 2019, 3:41 PM UTC

Did anyone else notice ProtonMail being used in the movie "Knives Out" to send the ransom note? Cracked me up..

Re: ProtonMail takes aim at Google with an encrypted calendar

#4

Post by bfrog » Mon, Dec 30, 2019, 3:50 PM UTC

I switched to tutanota for the price and features already provided, protonmail is really quite nice though. I'd love to better understand the legal implications of the hosting countries laws better.

Re: ProtonMail takes aim at Google with an encrypted calendar

#5

Post by nennes » Mon, Dec 30, 2019, 3:55 PM UTC

bfrog wrote: post #4

I switched to tutanota for the price and features already provided, protonmail is really quite nice though. I'd love to better understand the legal implications of the hosting countries laws better.

Same here, using tutanota for the last year. They also offer a calendar, which I haven't tried but assume is encrypted.

Re: ProtonMail takes aim at Google with an encrypted calendar

#6

Post by slhck » Mon, Dec 30, 2019, 4:04 PM UTC

nennes wrote: post #5

bfrog wrote: post #4

I switched to tutanota for the price and features already provided, protonmail is really quite nice though. I'd love to better understand the legal implications of the hosting countries laws better.

Same here, using tutanota for the last year. They also offer a calendar, which I haven't tried but assume is encrypted.

It says "Free Encrypted Calendar" on their website.

Re: ProtonMail takes aim at Google with an encrypted calendar

#7

Post by jamwaffles » Mon, Dec 30, 2019, 4:23 PM UTC

I moved over to Fastmail from ProtonMail a few weeks ago. I think if you value the encryption and privacy and don’t mind the lack of basic stuff like threading in the mobile app or IMAP integration, ProtonMail is fully worth it. That said, for me I just want a well featured email/calendar service that can replace gmail once Gewgle fucked us over with Inbox. Fastmail does that for me and provides a lot less friction whilst doing so.

ProtonMail feels like a one-trick pony to me. They’re cruising on the allure of privacy features but they have a ways to go on other basics.

Re: ProtonMail takes aim at Google with an encrypted calendar

#8

Post by EduardoBautista » Mon, Dec 30, 2019, 4:26 PM UTC

I recently left ProtonMail and went back to Fastmail. My reason was that they will never be able to fully support IMAP and now CalDAV because of the encryption they use. I grew to accept that email is not for secure messaging and my paranoia of "I'm being watched" just went away.

If you need secure messaging, use something other than email.

Re: ProtonMail takes aim at Google with an encrypted calendar

#9

Post by lvh » Mon, Dec 30, 2019, 4:27 PM UTC

Article is light on the details, but ProtonMail has published some here: https://protonmail.com/blog/protoncalendar-security-model/

> This calendar key will then be symmetrically encrypted (PGP standard) using a 32-byte passphrase that is randomly generated on your device. Once it is encrypted, your calendar key will be stored on the ProtonCalendar backend server.

32-byte passphrase: might be fine, depending on what those bytes are; the interesting question is how much entropy it got generated from.

> Each member of a calendar will have a copy of the same passphrase that is encrypted and signed using their primary address key. The signature ensures that no one, not our server or any third-party adversary, changed the passphrase.

This is where it gets weird. Why do both? The obvious way to encrypt with an ECC key comes with authentication for free. Signing mostly has negative privacy implications. (I think the answer is "we incorrectly decided PGP was a good idea a long time ago and now we are stuck with its problems, which include being wrong about authenticators".)

> The invited member, if they decide to join the calendar, can decrypt the passphrase using their address key. They can also verify that the signature on the passphrase belongs to your email address key. This lets the invited member cryptographically verify that you invited them. To accept the invitation, ProtonCalendar will then pin the passphrase for the invited member by replacing your signature with one created using their own email address key. This signature will later be used by the invited member to verify the passphrase at each application start.

Again, with designs less than twenty years old you can do that without a signature.

> To accept the invitation, ProtonCalendar will then pin the passphrase for the invited member by replacing your signature with one created using their own email address key. This signature will later be used by the invited member to verify the passphrase at each application start.

what

I'm reviewing the attendee scheme next, but I need more coffee first.

Re: ProtonMail takes aim at Google with an encrypted calendar

#10

Post by sverige » Mon, Dec 30, 2019, 4:28 PM UTC

This is a welcome development. ProtonMail has worked well for me. Now if I could only find a way to make a Pixel phone accept that email address instead of one of my several one-off fake name gmail addresses that I use for such things.