5 ms·

Has protonmail's advertising been misleading? I'm a happy user myself, but I don't think I've ever looked into their marketing.

by simias 5y ago

vmception 5y ago
People believe it is private and uncompromisable because of their use of client side encryption and claims of server side encryption and that their Switzerland location means they exist in a land where intelligence agencies won't coerce them or find a way to leak data. The reality is that they are forcing users to use client side javascript which can have anything in it. And Swiss privacy laws do not do what users claim. There is no way to verify the claims of privacy.
- arthurcolle 5y ago
  Not contradicting you in any way, but you can check out the javascript. Javascript deobfuscation is pretty sophisticated nowadays (maybe not) from my naive perception.
  - dane-pgp 5y ago
    I think the complaint is that it takes a lot of work to check, each time you visit the site, that the JavaScript your browser downloads is really the same as the published (and assumed secure) source code (plus obfuscation, as you mention). Ideally there would be a mechanism in browsers to pin a specific version of a web app, and only let that app update (to a version with a specific hash) if the user explicitly gives it permission to. The nearest thing we have to that right now is the SRI-bookmarklet trick: https://news.ycombinator.com/item?id=17776456 https://news.ycombinator.com/item?id=17776456
    - commoner 5y ago
      EteSync (an open source, end-to-end encrypted contact and calendar syncing service) developed a browser extension called Signed Pages to validate the integrity of its web app. This mechanism also works for any other website that implements it. https://github.com/tasn/webext-signed-pages https://github.com/tasn/webext-signed-pages HTML pages are PGP-signed by the website developer, and all of the resources embedded in the pages are validated by the browser using the Subresource Integrity feature: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
- simias 5y ago
  Oh I see. Yeah the "Swiss" thing is probably more folklore than anything, but admittedly for the client-side encryption you can use their IMAP bridge that's open source and therefore technically auditable and not quite as easy to modify on-the-fly. But any claim of security for emails will be contingent to a huge number of factors anyway lest you use end-to-end encryption so I see where you're coming from. Less technical people would probably have a hard time understanding the true security and privacy implications of protonmail.
Spooky23 5y ago
A lot of the implied security benefits are like the “100% fat free” labels on Swedish Fish. True, but of dubious value. People equate it with Swiss bank accounts, based on what they learned from James Bond movies.

Has protonmail's advertising been misleading? I'm a happy user myself, but I don't think I've ever looked into their marketing.

by simias 5y ago

Has protonmail's advertising been misleading? I'm a happy user myself, but I don't think I've ever looked into their marketing.

vmception 5y ago

People believe it is private and uncompromisable because of their use of client side encryption and claims of server side encryption and that their Switzerland location means they exist in a land where intelligence agencies won't coerce them or find a way to leak data. The reality is that they are forcing users to use client side javascript which can have anything in it. And Swiss privacy laws do not do what users claim. There is no way to verify the claims of privacy.

arthurcolle 5y ago
Not contradicting you in any way, but you can check out the javascript. Javascript deobfuscation is pretty sophisticated nowadays (maybe not) from my naive perception.
- dane-pgp 5y ago
  I think the complaint is that it takes a lot of work to check, each time you visit the site, that the JavaScript your browser downloads is really the same as the published (and assumed secure) source code (plus obfuscation, as you mention). Ideally there would be a mechanism in browsers to pin a specific version of a web app, and only let that app update (to a version with a specific hash) if the user explicitly gives it permission to. The nearest thing we have to that right now is the SRI-bookmarklet trick: https://news.ycombinator.com/item?id=17776456 https://news.ycombinator.com/item?id=17776456
  - commoner 5y ago
    EteSync (an open source, end-to-end encrypted contact and calendar syncing service) developed a browser extension called Signed Pages to validate the integrity of its web app. This mechanism also works for any other website that implements it. https://github.com/tasn/webext-signed-pages https://github.com/tasn/webext-signed-pages HTML pages are PGP-signed by the website developer, and all of the resources embedded in the pages are validated by the browser using the Subresource Integrity feature: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
simias 5y ago
Oh I see. Yeah the "Swiss" thing is probably more folklore than anything, but admittedly for the client-side encryption you can use their IMAP bridge that's open source and therefore technically auditable and not quite as easy to modify on-the-fly. But any claim of security for emails will be contingent to a huge number of factors anyway lest you use end-to-end encryption so I see where you're coming from. Less technical people would probably have a hard time understanding the true security and privacy implications of protonmail.

Spooky23 5y ago

A lot of the implied security benefits are like the “100% fat free” labels on Swedish Fish. True, but of dubious value. People equate it with Swiss bank accounts, based on what they learned from James Bond movies.