4 ms·
The local stuff isn’t necessarily insecure (depending on your paranoia level). The security of your computer system is totally unrelated to the encryption of y
by chakalakasp 9y ago
The local stuff isn’t necessarily insecure (depending on your paranoia level). The security of your computer system is totally unrelated to the encryption of your mail - even with GPG most people are keeping their private key on the same system they use to read their mail. Full disk encryption with something like Veracrypt or bitlocker or file vault or LUKS should be more than enough to keep your decrypted emails safe when you are not using your computer.
- compsciphd 9y agoMy guess is that bridge is run as a service. i.e. you make reuests via web site which are encrypted with local javascript (so that proton mail can't interpose), protonmail forwards to the service user runs which provides an encrypted response which local javascript then decrypts and displays. In that case, you have to run a service that is always running that is effectively keeping the e-mails available in the clear. Is it better security than keeping them in the clear on a central server? sure. But is it really any different than running my own smtp/imap/webmail server on aws without encrypting any emails which I access? In practice it would seem to be a similar threat model and I'm not convinced many would view that to be particularly secure, just a tad more private.