3 ms·
Has ProtonMail become a really secure? Since when I last time checked web client I noticed that PGP keys are being passed over the internet when you do login (p
by vladimir-y 10y ago
Has ProtonMail become a really secure? Since when I last time checked web client I noticed that PGP keys are being passed over the internet when you do login (private key), which doesn't look like a true end-to-end encryption since private key should be kept locally and never be passed over the internet. Please correct me if I'm wrong, I'm note very well versed in the encryption matters.
- tinodotim 10y agoThe private key is encrypted using your mailbox password (a 2nd password, not the login password) and that is not stored on their servers. So they only store and pass the private key encrypted. So it should be secure enough but for sure, the implementation is still not perfect at all, especially if you want to communicate with non-protonmail users.
- vladimir-y 10y ago> So they only store and pass the private key encrypted. I remember I was able to get key passed through the network in the not encrypted form, I was looking into the network tab of the browser's dev console. When you do login look at the response of the https://mail.protonmail.com/api/auth https://mail.protonmail.com/api/auth POST query.