Hacker News Reader

Comment by chinathrow | Hacker News Reader

If they allow you to give them knowledge about you, then they're not zero knowledge, at all.

If they don't know your username they can't offer a service. Hence zero knowledge services cannot exist based on your line of argumentation.

I feel you are being disingenuous though and you perfectly know what is commonly referred to as "zero knowledge", and specifically that the critical point is always "what does the zero knowledge applies to?".

Proton sees your IP, your login, email headers, for example. They don't know your email body and can't hand it over.

They necessarily know the e-mail body when the (unencrypted) e-mail first comes in.

This applies only to emails sent from an external provider. Proton’s “secure email” functionality is limited to Proton addresses.

Exactly, and even in the case when the emails are coming from a non-Proton service, the incoming emails are encrypted immediately after being checked for spam, phishing or malware: https://proton.me/support/proton-mail-encryption-explained.

Even when you send a Proton-to-Proton e-mail, Proton’s e-mail client is encrypting that e-mail, so you still have to trust them.

Note that our cryptography is open-source and independently audited: https://openpgpjs.org/. The encryption keys are generated with your Proton account password, which we don't have access to, so we have no way to decrypt your content stored encrypted on our servers.

You are describing a problem without solution here. What is your preferred approach to this dilemma?

I’m just saying that you should be aware of it. Whether it’s a problem or not depends on your threat model, of course.

Reply on news.ycombinator.com