4 ms·

Eh, we are entering an area of speculation. The right answer is 'only google knows', but since you are asking twice this question, let me try to take a wild gue

Eh, we are entering an area of speculation. The right answer is 'only google knows', but since you are asking twice this question, let me try to take a wild guess: - Google, an advertising company, benefits from having access to the plaintext of people's messages. They can advertise this as 'secure' but only for the comm channel. - Proton mail, advertises itself as: "ProtonMail is the world's largest secure email service, developed by CERN and MIT scientists. We are open source and protected by Swiss privacy law.", featuring end to end encryption, anonymous email, mobile clients etc. - Fastmail: "Secure, reliable email hosting for businesses, families and professionals. Premium email with no ads, excellent spam protection and rapid personal support." If I'm a product manager of GMail, I'd be more scared from Proton mail than FastMail. In fact, anything featuring end-to-end encryption will be approached with negativity, because then GMail can't target ads, which are the main cash cow for google.

puzzle 10y ago
And a product manager for Gmail can affect ranking of a random website exactly how?
- tedunangst 10y ago
  They just pop over to the search fixer dashboard and drag protonmail into the penalty box. Two clicks, boom, boom.
twr 10y ago
Protonmail is another crappy provider filling the void left by Lavabit. It doesn't have any additional security benefits beyond regular webmail providers that provide TLS: - Encryption is performed inside the browser. By delivering a modified JavaScript payload, it can steal encryption keys. - No support for POP, IMAP, or SMTP. If you want to use GPG, you can't. To see it being compared to Fastmail and Gmail, which don't engage in parlor tricks, is a travesty.
- matt4077 10y ago
  I can see all sorts of criticism leveled at ProtonMail, but this seems a bit disingenuous. They're trying something different than GPG, which had 20 years to prove itself and failed to gain any traction. Sure, you have to trust their software, but is that fundamentally different than trusting the GPG software, or did you do a full audit of that?
  - twr 10y ago
    GPG, when used correctly, is theoretically secure. Protonmail, like Lavabit, is insecure by design. They make no mention of this; they claim the inability to read your messages, which is trivially false. GPG has a track record of being secure against many adversaries, including the NSA. It's used by most Linux distributions for package signing, so you probably already depend on it -- even if indirectly. I don't expect GPG to be completely secure. But it's not based on deception.
    - matt4077 10y ago
      The trivial attack is based on them sending you compromised code, right? Because that seems to comparable to an attack on GPG where their downloads are compromised. I get that there's a difference in degree, i. e. GPG binaries being checked against hashes and having a long track record as an organization, but is that fundamentally different? I could see ProtonMail evolving to, for example, using a browser extension that allows you to use a known-good version of the crypto library, and informing you of changes. Point being: it isn't perfect and I'd prefer something based on standards. But e-mail encryption has failed, even though it is often more personal than websites where TLS has been successful. ProtonMail is a legitimate attempt in a space that seems to need a new approach.
      - twr 10y ago
        I think it's different, because Protonmail can target you, individually, at any time. Like, for example, upon receipt of a NSL. GPG is used asynchronously. In many cases, everyone would need to be compromised to go after one person. That raises the chance of discovery. A browser extension is a fantastically better idea. Google previously prototyped most of the work for this: https://github.com/google/end-to-end https://github.com/google/end-to-end

puzzle 10y ago

And a product manager for Gmail can affect ranking of a random website exactly how?

tedunangst 10y ago
They just pop over to the search fixer dashboard and drag protonmail into the penalty box. Two clicks, boom, boom.

twr 10y ago

Protonmail is another crappy provider filling the void left by Lavabit. It doesn't have any additional security benefits beyond regular webmail providers that provide TLS: - Encryption is performed inside the browser. By delivering a modified JavaScript payload, it can steal encryption keys. - No support for POP, IMAP, or SMTP. If you want to use GPG, you can't. To see it being compared to Fastmail and Gmail, which don't engage in parlor tricks, is a travesty.

matt4077 10y ago
I can see all sorts of criticism leveled at ProtonMail, but this seems a bit disingenuous. They're trying something different than GPG, which had 20 years to prove itself and failed to gain any traction. Sure, you have to trust their software, but is that fundamentally different than trusting the GPG software, or did you do a full audit of that?
- twr 10y ago
  GPG, when used correctly, is theoretically secure. Protonmail, like Lavabit, is insecure by design. They make no mention of this; they claim the inability to read your messages, which is trivially false. GPG has a track record of being secure against many adversaries, including the NSA. It's used by most Linux distributions for package signing, so you probably already depend on it -- even if indirectly. I don't expect GPG to be completely secure. But it's not based on deception.
  - matt4077 10y ago
    The trivial attack is based on them sending you compromised code, right? Because that seems to comparable to an attack on GPG where their downloads are compromised. I get that there's a difference in degree, i. e. GPG binaries being checked against hashes and having a long track record as an organization, but is that fundamentally different? I could see ProtonMail evolving to, for example, using a browser extension that allows you to use a known-good version of the crypto library, and informing you of changes. Point being: it isn't perfect and I'd prefer something based on standards. But e-mail encryption has failed, even though it is often more personal than websites where TLS has been successful. ProtonMail is a legitimate attempt in a space that seems to need a new approach.
    - twr 10y ago
      I think it's different, because Protonmail can target you, individually, at any time. Like, for example, upon receipt of a NSL. GPG is used asynchronously. In many cases, everyone would need to be compromised to go after one person. That raises the chance of discovery. A browser extension is a fantastically better idea. Google previously prototyped most of the work for this: https://github.com/google/end-to-end https://github.com/google/end-to-end