3 ms·
"As I understand it, they already have my keys." From: https://protonmail.com/security-details https://protonmail.com/security-details "ProtonMail's zero acce
by pmoriarty 6y ago
"As I understand it, they already have my keys."
From: https://protonmail.com/security-details https://protonmail.com/security-details
"ProtonMail's zero access architecture means that your data is encrypted in a way that makes it inaccessible to us. Data is encrypted on the client side using an encryption key that we do not have access to."
- bitdizzy 6y agoThat is a very interesting claim on their part considering that they hold the private PGP keys used by their service. I'll have to figure out what they mean by this. Edit: Ok I see. They store the PGP keys encrypted with your password. Like you said, they could just as well inject javascript to phish your password from your session. But this does seem to mean that if one uses their API directly it would be possible to securely use their service. Thanks for the heads up. There is a third party open source bridge that reverse engineers their API. I think I will look into it to see how authentication is done. https://github.com/emersion/hydroxide https://github.com/emersion/hydroxide