Hacker News Reader

Comment by joering2 | Hacker News Reader

The difference was that number one Lavabit was made by a US citizen, and its servers were in the USA. Number two, Lavabit kept all keys to your email at their own premises and could de-crypt your email on their side. Protonmail cannot do so, because your password is a part of they key to decrypt email, and they do not know it, nor they can crack it in a reasonable amount of time, so AFAIK there is nothing they can provide LE with to decrypt your email on the go.

View on HN

If you access ProtonMail via their web app, all that's needed to steal your password and decrypt email at will is a few quick changes to the index.html they serve you. This could be targeted to specific users, and once the password is exfiltrated, the page can be reloaded, leaving no trace of the attack. Anyone with access to ProtonMail's back end code or infrastructure could do this. So at least in the case of their web app, they could absolutely provide LE with whatever they wanted in a way that would be quite difficult for the average user to detect.

I don't know whether their mobile apps also trust the server in the same way--by loading content or js from the server. If not, then those could potentially offer a more secure alternative since the same attack would now require an update for all users, which would leave evidence behind. Of course, you still have to trust that any users you're sending email to also never submit their passwords to the web app.

> If you access ProtonMail via their web app, all that's needed to steal your password and decrypt email at will is a few quick changes to the index.html they serve you. This could be targeted to specific users, and once the password is exfiltrated, the page can be reloaded, leaving no trace of the attack. Anyone with access to ProtonMail's back end code or infrastructure could do this. So at least in the case of their web app, they could absolutely provide LE with whatever they wanted in a way that would be quite difficult for the average user to detect.

There is no such issue if you use https://github.com/vladimiry/ElectronMail desktop app as it comes with static resources built on the CI server from the official source code repositories and embedded in then installation packages, see https://github.com/vladimiry/ElectronMail/issues/79 for details. See here https://github.com/vladimiry/ElectronMail/blob/d974b43908e10... the "ProtonMail Version 4.0-beta Web UI" versions embedded in the most recent v4.2.1 release.

The way of verifying that the installation packages attached to the releases have been assembled from the source code is being provided, see https://github.com/vladimiry/ElectronMail/issues/183.

And finally, the app is fully open-source creature, so anyone could assembly own package.

Have you considered how proton mail filters spam? It has to be stored in memory for this to happen before it's encrypted and flushed to the disk.

Unless your emails are encrypted for you on someone else's client before they're sent to your protonmail, in which case protonmail still has all of the metadata (time sent, where it was sent from, length of the message, etc.)

Do you believe proton mail can keep state level actors like Russia, China, and the United States out of their prod infra?

They may be "mostly" subpoena proof as in they can't disclose old emails, but do you trust them to not hand over your data before it's encrypted?

Do you use protonmail? I do, and I'm finding it actually refreshing to see spam and phishing emails in my inbox. At first I thought, why aren't they blocking this? Then I realized, "oh right, that's because they aren't reading it".

> Do you believe proton mail can keep state level actors like Russia, China, and the United States out of their prod infra?

No, I don't believe they'll be able to keep state actors out of their servers indefinitely. But it's more a matter of what the state actors find once they've gained access. As I understand it, the architecture of the service is what prevents protonmail themselves, as well as any intruder, from reading the encrypted mail files[0].

[0] https://protonmail.com/security-details

As long as you don't control the JavaScript that handles your keys, they can do whatever they like.

I actually do. I don't use their app, only the website. Their JS files are served from my own webserver so I do know their content. Besides, nothing stops someone super-paranoid to check the JS code upon login before they put their password in.

This case has been handled in ElectronMail. See https://news.ycombinator.com/item?id=22190710 for details.

> Protonmail cannot do so, because your password is a part of they key to decrypt email, and they do not know it, nor they can crack it in a reasonable amount of time, so AFAIK there is nothing they can provide LE with to decrypt your email on the go.

I don't think this is true. A hash of the password could be part of the key, but Protonmail already has that hash stored on its server (otherwise they would not be able to log you in when you send the password hash). If Protonmail would like to access your emails (or be asked to do so), I'm confident that they technically can. The only benefit is when a hacker get access to the email database, but not the password hash database, then in this case the hacker cannot read the emails.

> A hash of the password could be part of the key

Except when it's not (and the full password is used instead).

After looking at the doc, it seems Protonmail uses GPG and computes the keys on the client device. (So I was wrong in my reply earlier).

However, when you send an unencrypted email with Protonmail, they claim that they encrypt the email at rest, but the claim is not verifiable.

Reply on news.ycombinator.com