4 ms·

ProtonMail's response: https://news.ycombinator.com/item?id=18492982 https://news.ycombinator.com/item?id=18492982

by r721 8y ago

pmoriarty 8y ago
This response does not directly address Kobeissi's points. It rephrases and generalizes his points rather than tackling them head-on. Kobeissi's main point is that ProtonMail could serve up any javascript they want to the client, including javascript that compromises the encryption or which hands over the encryption keys to ProtonMail. Nowhere in ProtonMail's response is this point ever directly addressed or even acknowledged.
- protonmail 8y ago
  This point has been acknowledged since day one though, and it is not a point specific to ProtonMail. Any E2EE service that has a webapp is susceptible to this, and that's essentially all E2EE services out there. The only way to address this point, with current technology and current standards, is to discontinue the webapp and force everybody to the native apps on desktop and mobile. It is the opinion of almost everybody in the industry that webapps are necessary, and that's why we, WhatsApp, etc, all provide webapps. So the point is acknowledged (and has always been acknowledged), but the opinion being expressed (remove the webapp) is not something that we agree with.
  - pmoriarty 8y ago
    If you acknowledge that you can serve up javascript which either compromises the encryption or gets the user's keys, then how can you claim that "we cannot decrypt and read your emails"? It sounds like you just admitted you could.
  - gambler 8y ago
    >The only way to address this point, with current technology and current standards, is to discontinue the webapp and force everybody to the native apps on desktop and mobile Browser extensions.
  - rqs 8y ago
    > Any E2EE service that has a webapp is susceptible to this But I don't think everybody are making webapps to service data of their E2EE product, isn't it? The key point is, if the webapp can be compromised by anybody who are in control of the front-end assets, then what's the point of the entire ProtonMail E2EE thing? Especially when you have other solutions like GPG which also is an open protocol?
    - protonmail 8y ago
      ProtonMail is based on GPG actually, and we also have native desktop and mobile apps. The webapp is just one platform that we support, out of many. E2EE services providing webapps is actually not uncommon, e.g. WhatsApp, Wire, etc.
  - red023 8y ago
    I think the "everbody does so we are cool with it" excuses pretty laughable to be honest. Not every webapp claims to be a most private and secure app out there so here we go again with "ease of use is more important then security". I thought Protonmail was different but its obviously not.
  - z_open 8y ago
    Is it possible to have a noscript version of the webapp?
    - LiterallyDoge 8y ago
      This is such a valid and even-keeled compromise. I'm sure you'll get absolutely no traction lol
- trash_panda 8y ago
  Not only do they not address the technical aspects of the paper, their response starts with a direct personal attack: "It seems Nadim (the author of this paper) took it really badly when we called him out for intentionally spreading fake news this weekend." [1] That's really low. The beautiful thing about computers is that we can prove each others right or wrong with technical arguments. If ProtonMail thinks Nadim has a personal grudge against them, wouldn't it be beautiful for them to disprove him with another professionally written paper as Nadim did? They can't. Also, I think Nadim knows more than anyone the dangers of pushing weak products and marketing them as secure. It happened to him with Cryptocat. It's a thing that can harm reputation and also harm users, Nadim went through that and I believe he has good intentions by presenting this paper. --- [1] https://www.reddit.com/r/ProtonMail/comments/9yqxkh/an_analysis_of_the_protonmail_cryptographic/ea3g0hm/ https://www.reddit.com/r/ProtonMail/comments/9yqxkh/an_analy...

ProtonMail's response: https://news.ycombinator.com/item?id=18492982 https://news.ycombinator.com/item?id=18492982

by r721 8y ago

ProtonMail's response: https://news.ycombinator.com/item?id=18492982 https://news.ycombinator.com/item?id=18492982

This response does not directly address Kobeissi's points. It rephrases and generalizes his points rather than tackling them head-on. Kobeissi's main point is that ProtonMail could serve up any javascript they want to the client, including javascript that compromises the encryption or which hands over the encryption keys to ProtonMail. Nowhere in ProtonMail's response is this point ever directly addressed or even acknowledged.

protonmail 8y ago
This point has been acknowledged since day one though, and it is not a point specific to ProtonMail. Any E2EE service that has a webapp is susceptible to this, and that's essentially all E2EE services out there. The only way to address this point, with current technology and current standards, is to discontinue the webapp and force everybody to the native apps on desktop and mobile. It is the opinion of almost everybody in the industry that webapps are necessary, and that's why we, WhatsApp, etc, all provide webapps. So the point is acknowledged (and has always been acknowledged), but the opinion being expressed (remove the webapp) is not something that we agree with.
- pmoriarty 8y ago
  If you acknowledge that you can serve up javascript which either compromises the encryption or gets the user's keys, then how can you claim that "we cannot decrypt and read your emails"? It sounds like you just admitted you could.
- gambler 8y ago
  >The only way to address this point, with current technology and current standards, is to discontinue the webapp and force everybody to the native apps on desktop and mobile Browser extensions.
- rqs 8y ago
  > Any E2EE service that has a webapp is susceptible to this But I don't think everybody are making webapps to service data of their E2EE product, isn't it? The key point is, if the webapp can be compromised by anybody who are in control of the front-end assets, then what's the point of the entire ProtonMail E2EE thing? Especially when you have other solutions like GPG which also is an open protocol?
  - protonmail 8y ago
    ProtonMail is based on GPG actually, and we also have native desktop and mobile apps. The webapp is just one platform that we support, out of many. E2EE services providing webapps is actually not uncommon, e.g. WhatsApp, Wire, etc.
- red023 8y ago
  I think the "everbody does so we are cool with it" excuses pretty laughable to be honest. Not every webapp claims to be a most private and secure app out there so here we go again with "ease of use is more important then security". I thought Protonmail was different but its obviously not.
- z_open 8y ago
  Is it possible to have a noscript version of the webapp?
  - LiterallyDoge 8y ago
    This is such a valid and even-keeled compromise. I'm sure you'll get absolutely no traction lol
trash_panda 8y ago
Not only do they not address the technical aspects of the paper, their response starts with a direct personal attack: "It seems Nadim (the author of this paper) took it really badly when we called him out for intentionally spreading fake news this weekend." [1] That's really low. The beautiful thing about computers is that we can prove each others right or wrong with technical arguments. If ProtonMail thinks Nadim has a personal grudge against them, wouldn't it be beautiful for them to disprove him with another professionally written paper as Nadim did? They can't. Also, I think Nadim knows more than anyone the dangers of pushing weak products and marketing them as secure. It happened to him with Cryptocat. It's a thing that can harm reputation and also harm users, Nadim went through that and I believe he has good intentions by presenting this paper. --- [1] https://www.reddit.com/r/ProtonMail/comments/9yqxkh/an_analysis_of_the_protonmail_cryptographic/ea3g0hm/ https://www.reddit.com/r/ProtonMail/comments/9yqxkh/an_analy...