5 ms·

Introducing ProtonMail Contacts

95 points by artsandsci 9y ago

shao87 9y ago
Calling it the 'first encrypted contacts manager' is preposterous. What about Tutanota and Posteo? The contacts there have been encrypted all along.
- chrisballinger 9y ago
  Also Flock by Open Whisper Systems, which did end-to-end encrypted WebDAV sync for Android's Contacts and Calendars. (now discontinued) 1. https://github.com/WhisperSystems/Flock https://github.com/WhisperSystems/Flock 2. https://signal.org/blog/flock/ https://signal.org/blog/flock/
- shao87 9y ago
  Also email addresses and names are not encrypted in PM. What's the use then?
useranme 9y ago
I'd like to know more about how it works. "The private key is generated on the client side". Does this mean it gets generated with Javascript sent from the server? What if the server gets hacked?
- hobarrera 9y ago
  It's never sent to the server; the key is derived from your passphrase, so it's never sent anywhere. It's still possible for a sophisticated MITM to replace the JS code so that is DOES send the key somewhere.
  - amenghra 9y ago
    fun fact: the webcrypto api does allow marking a key as non-exportable. So you could imagine deriving the key from the passphrase and having it only exist within the WebCrypto framework. It is however going to be hard to prevent a malicious active attacker from stealing the passphrase.
    - AgentME 9y ago
      The webcrypto api also can't stop the server from sending malicious javascript to a user which when run uses the webcrypto key to decrypt the user's data and send it back to the server. Also, if the server is malicious on the first connection, then the server could just not use the webcrypto api to begin with, and just make use a key that the server knows instead. The webcrypto api is still pretty cool though. I've been hoping for an excuse to use it sometime.
      - carussell 9y ago
        This is why we need resource pinning in the browser. The webservice would assert that the resources it's sending now are the same resources it will continue to send in the future. The browser is in a prime position to enforce this. In the event the resources ever change, then the browser should refuse to allow the changed resources to run and notifies the user what has happened in a way that is at least as scary as broken TLS. If it's a legit deployment (say, because the service has updated the backend), then this should be independently verifiable out of band e.g. via a blog post, a public changelog, etc. The process to accept the new deployment would need to be opt-in. If the user choices not to opt-in, the browser may continue using the old resources that were being served up in the past. Without some mechanism like this, verification of the claims that services like ProtonMail makes remains intractable.
        hdhzy 9y ago
        I don't want to sound negative but I guess almost 100% of the web relies on quickly updating resources and being fresh so I wouldn't hold my breath for when "resource pinning" would happen. For the record one can already do it if all resources would use Subresource Integrity. Hashes of leaf resources would be embedded in parent resources up to the root document that you could announce out-of-band (e.g. https://example.com https://example.com on 23rd of November 2017 has hash 1234566...). Then you'd have a cryptographic proof (like a Merkle tree) that nothing in the page changed.
        9y ago
  - stabbles 9y ago
    They private key is being sent to the server. Can't stress this enough. How else can you access your mail on a new device with your primary device disconnected? "Your ProtonMail private key is stored encrypted on your browser using your mailbox password. It is sent to our servers in the encrypted form. The only time it is decrypted is when you correctly enter your mailbox password." [1] [1] https://protonmail.com/support/knowledge-base/how-is-the-private-key-stored/ https://protonmail.com/support/knowledge-base/how-is-the-pri...
throwaway4564 9y ago
I'm curious why you chose to use asymmetric crypto for this instead of symmetric (for example, encrypting a secondary key using the primary one, and then using that with an authenticated encryption mode like AES-GCM to give confidentiality/integrity). Are there plans to have the protonmail service provisionally add contact info for the user, then have the user accept this by signing it with their private key?
- badrabbit 9y ago
  I can only presume,but I believe they simply want it to integrate well with the existing protonmail public key system. Also,maybe they plan on letting protonmail users share or send contacts(non-repudiation and authentication).
- emersion 9y ago
  Encrypted contacts uses PGP, which in turn uses symmetric crypto internally (the symmetric key is encrypted using the asymmetric private key). So it's both standards compliant and fast.
maggit 9y ago
I'm a paying would-be user of ProtonMail. "Would-be" because it is simply not reliable enough. It is frustrating that they are diversifying (contacts, vpn) when I find the core product too unreliable to depend on. I mainly have two problems: 1. The mobile client logs out spontaneously (or crashes and logs out) every once in a while and I have to reenter both the password and the TOTP code. Cumbersome, and really inconvenient if I'm on the go and for example my plane ticket is in ProtonMail. (I don't know my password and keep it in a password manager, inaccessible from my mobile), 2. The web client logs out whenever the browser is restarted. The web browser at least remembers the password, but I need to interact with my phone to get the TOTP code in. This means that I end up in a state where I don't get notifications for new mails, and I have to go and deal with it proactively. They recently released the "bridge", which runs as a daemon and lets me access the mail via IMAP. This alleviates the problem, but it is unfortunately still unavailable for Linux. Are there any other happy or unhappy ProtonMail users out there? Am I alone in these frustrations?
- stabbles 9y ago
  I'm happy to use a service that is not Gmail or Outlook. And I like the fact that I can use my custom domain easily. In the end I'm not really using it though, simply because none of my contacts uses it. In that case ProtonMail is simply begging the question when it comes to privacy and security: You can set an expiry for emails to non-Protonmail recipients, meaning they just receive a link to the contents of the email. Obviously you must also password protect it (otherwise gmail / outlook will just follow the link). Now the point is: how do you safely communicate the password? Either you know how to safely communicate a password; in that case why not send the message without ProtonMail? Or you do not know how to safely communicate a password; what security does ProtonMail offer then?
  - nothrabannosir 9y ago
    Depends on your threat model. If you're protecting against dragnet surveillance and retroactive targeted surveillance, after your link expires, then just putting the password right there in the e-mail body, with an expiring link, should work fine. For now. Especially if it's not life-or-death, but you'd just "rather not appear in the data set, if avoidable." To each their own :)

95 points by artsandsci 9y ago

Calling it the 'first encrypted contacts manager' is preposterous. What about Tutanota and Posteo? The contacts there have been encrypted all along.

chrisballinger 9y ago
Also Flock by Open Whisper Systems, which did end-to-end encrypted WebDAV sync for Android's Contacts and Calendars. (now discontinued) 1. https://github.com/WhisperSystems/Flock https://github.com/WhisperSystems/Flock 2. https://signal.org/blog/flock/ https://signal.org/blog/flock/
shao87 9y ago
Also email addresses and names are not encrypted in PM. What's the use then?

useranme 9y ago

I'd like to know more about how it works. "The private key is generated on the client side". Does this mean it gets generated with Javascript sent from the server? What if the server gets hacked?

hobarrera 9y ago
It's never sent to the server; the key is derived from your passphrase, so it's never sent anywhere. It's still possible for a sophisticated MITM to replace the JS code so that is DOES send the key somewhere.
- amenghra 9y ago
  fun fact: the webcrypto api does allow marking a key as non-exportable. So you could imagine deriving the key from the passphrase and having it only exist within the WebCrypto framework. It is however going to be hard to prevent a malicious active attacker from stealing the passphrase.
  - AgentME 9y ago
    The webcrypto api also can't stop the server from sending malicious javascript to a user which when run uses the webcrypto key to decrypt the user's data and send it back to the server. Also, if the server is malicious on the first connection, then the server could just not use the webcrypto api to begin with, and just make use a key that the server knows instead. The webcrypto api is still pretty cool though. I've been hoping for an excuse to use it sometime.
    - carussell 9y ago
      This is why we need resource pinning in the browser. The webservice would assert that the resources it's sending now are the same resources it will continue to send in the future. The browser is in a prime position to enforce this. In the event the resources ever change, then the browser should refuse to allow the changed resources to run and notifies the user what has happened in a way that is at least as scary as broken TLS. If it's a legit deployment (say, because the service has updated the backend), then this should be independently verifiable out of band e.g. via a blog post, a public changelog, etc. The process to accept the new deployment would need to be opt-in. If the user choices not to opt-in, the browser may continue using the old resources that were being served up in the past. Without some mechanism like this, verification of the claims that services like ProtonMail makes remains intractable.
      - hdhzy 9y ago
        I don't want to sound negative but I guess almost 100% of the web relies on quickly updating resources and being fresh so I wouldn't hold my breath for when "resource pinning" would happen. For the record one can already do it if all resources would use Subresource Integrity. Hashes of leaf resources would be embedded in parent resources up to the root document that you could announce out-of-band (e.g. https://example.com https://example.com on 23rd of November 2017 has hash 1234566...). Then you'd have a cryptographic proof (like a Merkle tree) that nothing in the page changed.
        9y ago
- stabbles 9y ago
  They private key is being sent to the server. Can't stress this enough. How else can you access your mail on a new device with your primary device disconnected? "Your ProtonMail private key is stored encrypted on your browser using your mailbox password. It is sent to our servers in the encrypted form. The only time it is decrypted is when you correctly enter your mailbox password." [1] [1] https://protonmail.com/support/knowledge-base/how-is-the-private-key-stored/ https://protonmail.com/support/knowledge-base/how-is-the-pri...

throwaway4564 9y ago

I'm curious why you chose to use asymmetric crypto for this instead of symmetric (for example, encrypting a secondary key using the primary one, and then using that with an authenticated encryption mode like AES-GCM to give confidentiality/integrity). Are there plans to have the protonmail service provisionally add contact info for the user, then have the user accept this by signing it with their private key?

badrabbit 9y ago
I can only presume,but I believe they simply want it to integrate well with the existing protonmail public key system. Also,maybe they plan on letting protonmail users share or send contacts(non-repudiation and authentication).
emersion 9y ago
Encrypted contacts uses PGP, which in turn uses symmetric crypto internally (the symmetric key is encrypted using the asymmetric private key). So it's both standards compliant and fast.

maggit 9y ago

I'm a paying would-be user of ProtonMail. "Would-be" because it is simply not reliable enough. It is frustrating that they are diversifying (contacts, vpn) when I find the core product too unreliable to depend on. I mainly have two problems: 1. The mobile client logs out spontaneously (or crashes and logs out) every once in a while and I have to reenter both the password and the TOTP code. Cumbersome, and really inconvenient if I'm on the go and for example my plane ticket is in ProtonMail. (I don't know my password and keep it in a password manager, inaccessible from my mobile), 2. The web client logs out whenever the browser is restarted. The web browser at least remembers the password, but I need to interact with my phone to get the TOTP code in. This means that I end up in a state where I don't get notifications for new mails, and I have to go and deal with it proactively. They recently released the "bridge", which runs as a daemon and lets me access the mail via IMAP. This alleviates the problem, but it is unfortunately still unavailable for Linux. Are there any other happy or unhappy ProtonMail users out there? Am I alone in these frustrations?

stabbles 9y ago
I'm happy to use a service that is not Gmail or Outlook. And I like the fact that I can use my custom domain easily. In the end I'm not really using it though, simply because none of my contacts uses it. In that case ProtonMail is simply begging the question when it comes to privacy and security: You can set an expiry for emails to non-Protonmail recipients, meaning they just receive a link to the contents of the email. Obviously you must also password protect it (otherwise gmail / outlook will just follow the link). Now the point is: how do you safely communicate the password? Either you know how to safely communicate a password; in that case why not send the message without ProtonMail? Or you do not know how to safely communicate a password; what security does ProtonMail offer then?
- nothrabannosir 9y ago
  Depends on your threat model. If you're protecting against dragnet surveillance and retroactive targeted surveillance, after your link expires, then just putting the password right there in the e-mail body, with an expiring link, should work fine. For now. Especially if it's not life-or-death, but you'd just "rather not appear in the data set, if avoidable." To each their own :)