4 ms·

- your messages always processed by proprietary/closed source server So, it just like Telegram (or any other proprietary cloud/VPN/proxy service) - you really

• kelnos 7y ago
  True, but if you do audit the client software, you can verify: * Your e2e encryption key never gets sent to the server. * Data is actually strongly encrypted using that key before leaving the client. Then isn't that sufficient to prove that the server can't do anything nefarious, even if it wanted to?
  • app4soft 7y ago
    > Data is actually strongly encrypted using that key before leaving the client. Except "strongly encrypted message" you should send some extra info for server. And I'm not sure how those two types of info separated in Proton's communication protocol, so binary diff between those "parts" could be a key to select decrypt method.
    • zaarn 7y ago
      Their key encryption is fairly safe, if you use one-password mode, they could intercept your password from the webinterface if they wanted, but the password exchange is solid and doesn't reveal the password while still allowing to decrypt the key. Two password mode is technically more secure since even if the authentication exchange is cracked, the decryption key doesn't touch anything the server can see, it's locally decrypted. There isn't any meaningful diff you could make.