3 ms·

I was planning to migrate to Tutanota, I guess I will not be doing so after all

• deleted 6y ago
  [deleted]
• gruez 6y ago
  Realistically speaking, is there jurisdiction where this isn't a threat? Most governments allow for wiretaps (basically what this "backdoor" is) when there's a warrant, so I'm not sure what the alternative is. Not even self-hosting works because they can seize your server/ip/domain name and install a backdoor there.
  • betaby 6y ago
    Unless if your server has full drive encryption
    • gruez 6y ago
      That does nothing for mail delivered after the warrant has been issued, which is what's being discussed in this post.
  • welterde 6y ago
    Doing this without being noticed will be somewhat difficult to do though. Passive sniffing is likely not going to be enough since opportunistic TLS usage is on the rise..
• sneak 6y ago
  This vulnerability exists for all email hosts. There is no way for a provider to prove to you they didn't silently escrow your plaintext.
  • beezle 6y ago
    If I read Tutanota's explanation of encryption correctly, messages sent between users are encrypted on the client side. While it would be obvious in network traffic if they sent back plain text to their server, it is possible to encrypt txt with multiple keys, ie their key as well as the intended recipient's. Would something like that be able to be detected on the client side, in particular for one user? I'm guessing yes but it would require verifying the js everytime you used their service, right? (asking) (added 'correctly')