3 ms·
Is this service open source? How can we know it does what it says it does?
by dil8 11y ago
Is this service open source? How can we know it does what it says it does?
- novium 11y agoA few clicks and found this https://protonmail.com/blog/protonmail-open-source/ https://protonmail.com/blog/protonmail-open-source/
- zokier 11y ago> How can we know it does what it says it does? How does being open source help with that?
- infodroid 11y agoOpen source makes it is easier for security experts to review the code and determine whether it meets its security claims. If it is closed source, then there is no guarantee that the code the experts review is the same code that is used by the service. And also it is at the company's discretion whether to allow a security audit or not, and then which auditors to allow or exclude. But if the whole of the client software is open source, then it also eliminates the need to trust binaries provided by the vendor (which can be MITM) because you can build the software yourself or use a version audited by an entity that you do trust.
- mtgx 11y agoThat, also the fact that if they have it in their privacy policy and website, then we can call them out on it when they insert a backdoor or remove the encryption. We can't say the same about Whatsapp and its end-to-end encryption, because they never even publicly admitted to using it. How can we ever hold Whatsapp responsible for not using end-to-end encryption then? We can do that with Protonmail.
- davidkellis 11y agoOpen source really is irrelevant. We don't know what code they deployed - it could be an open source project (we hope so), it might be an open source project with some minor changes - an NSA-approved backdoor for example, etc. We don't have any guarantee, so far as I'm aware, of what they're running, much less that it does what it claims to do.
- vabmit 11y agohttps://github.com/ProtonMail https://github.com/ProtonMail