8 ms·

The new ProtonMail has passed its independent security audit

183 points by beermonster 5y ago

kylehotchkiss 5y ago
Wish this audit had more details about the encryption system implemented and whether the rebuild meets their public encryption implementation specs (https://protonmail.com/security-details https://protonmail.com/security-details). This seems to be more about general web app OWASP type security audit.
futevolei 5y ago
Can ProtonMail focus on getting mail right before adding calendar and vpn and whatever else they pump in their newsletter? Their mobile email is atrocious- hello threading email chains? I was hoping to use this as a gmail replacement but it’s not even capable of replacing my spam yahoo account at this point. I support the cause but it seems like they are trying to do too much with too little.
- moeadham 5y ago
  Yeah, I wish more effort was spent on search and spam. Very glad to see the security audit in any case.
- codesuki 5y ago
  The missing threading on mobile and overall app experience was what made me not switch to protomail. It wasn't the actual missing feature but the fact that when I googled for it I found people requesting this feature several years ago (maybe 2016) up until now and staff doesn't give any answer. So I thought it might not be the most customer focused business.
- yosito 5y ago
  Proton Mail, if you're listening, the terrible mobile experience is why I'm switching providers. You promised a new mobile app, but it's been years and you've got nothing to show for it.
  - acover 5y ago
    Would using the default app with IMAP provide threading?
    - beermonster 5y ago
      Because IMAP requires a locally running daemon they call Bridge. So works for Desktop only not mobile
  - Fnoord 5y ago
    Its why I went away from ProtonVPN. No WireGuard support. Still not AFAIK.
    - anpago 5y ago
      The Android VPN app has just had wireguard added. It's not on the pc or iOS version I believe as of now
      - Fnoord 5y ago
        Heh, I need it in CLI, not Android. Practically the only thing I use VPN for is downloading some torrents, in a Docker container (Rtorrent). That they only now added it in Android makes me glad I left them approx 1,5 years ago.
- olaf 5y ago
  I agree, UI and usability design look amateurish to me. It is time for me to look for a better alternative, their speed of improvement in above mentioned areas is just one big disappointment.
- stingraycharles 5y ago
  Yeah I agree. I was trying to be a protonmail customer, but there was just too much friction. In addition to the subpar UI, I was trying to import my (admittedly large) gmail mailbox into Protonmail, and it just did not work. I let it run for days, had to restart it, repeated the process for weeks, and after about 4 weeks I just had to give up… It’s a shame because I really appreciate the security aspects of it, and the fact that they’re a small company / underdog. But there’s just too much friction.
- hhw3h 5y ago
  Agree. I wish they would focus and go deeper on fewer applications. Get email working well, then calendar, etc.
- traspler 5y ago
  The mobile app is so bad, nearly nothing works the way it should. Tap a Notification, you‘re lucky if the right mail opens, try to attach images on iOS? For while it sent HEIV images instead of jpegs, so normal people were out of luck; hope it doesn‘t crash? It does. The UI is also pretty ugly. But it‘s not only the app that is bad, the web client was quite functional for a while apart from the missing login persistence. Then came the new UI now it just kind of works. Try to move/tag many mails after each other? Now you also have to deal with clicking away success boxes as they start piling up and overlapping the very UI elements you are trying to reach. There are threads but for some reason they are way more cumbersome to use than GMail’s. Everything is gigantic now as well. I haven‘t checked yet but during the beta I could just not find some settings anymore. Hope they got added before launch.
  - CodeGlitch 5y ago
    Android user here. I've not used the iOS version so cannot say what the differences are, but it works really well and is highly rated within the Play store. I imagine however that iOS users have higher standards, because let's be honest the majority of apps on the play store are garbage.
- tzs 5y ago
  > Can ProtonMail focus on getting mail right before adding calendar and vpn and whatever else they pump in their newsletter? Once companies grow past a handful of employees they usually go from everyone being a generalist who can work on every part of all their product to having specialists who only can deal with some of what the company does. The various sites that report corporate information put the number of Proton employees in the 160-250 range. They are almost certainly well into the specialist phase. The people working on calendar and VPN and whatever would likely not be able to help with mobile email if they were shifted to that. If mobile email needs more work than those currently working on it can do, Proton needs to bring in more mobile and/or email specialists. It would only make sense then to stop calendar and VPN work if they do not have sufficient budget to bring in people to help with mobile email and need to lay off people from other projects to free up the money.
  - cutemonster 5y ago
    > they usually go from everyone being a generalist Interesting point. At the same time, I think it won't take long at all for someone who develops a calendar mobile app to switch to working on an email mobile app. -- But maybe you meant the email web client? (Web vs native development?) I think you're right that a VPN and related Linux kernel and networking is a different type of specialization, yes.
- Rd6n6 5y ago
  In contrast, I used to find pm email to be fine. I left the service for fastmail because I wanted a calendar built in. I’m considering going back now
- 40four 5y ago
  Wow so much hate for the mobile email client. I’ve been a happy user for a couple years now, I’m surprised there is so much distaste. Maybe I’m just not that picky? :) On this subject, I thought the recent upgrade of the email web client was nice. Maybe we can hope for something similar with mobile soon?
  - cutemonster 5y ago
    Makes me wonder, maybe they get more emails and then get more frustrated about problems (How many emails do you get per day?)
    - 40four 5y ago
      I suspect you are right. I’m definitely not an email ‘power user’, not getting a huge volume of emails. So the issues aren’t as obvious to me.
blunte 5y ago
I wanted to like PM and became a visionary subscriber years ago. But I left after painfully discovering that their web client (which was the only option at that time) was just not built for busy inboxes. Even today, many of the original pain points exist. The UI is still clunky, and paging through the inbox is really terrible. Now they will promote their bridge to allow you to use Outlook or whatever, but that's not a solution for some of us. I assume their need for revenue is what drives the features-before-improvements approach, but I know it is costing them some potential customers. Nowadays I only use PM for special occasions, such as needing a temporary private email conversation with someone (who also sets up a new temp PM account). I have found Tutanota to be much better in terms of usability. I can't speak for their security quality compared to PM, but honestly, unless you're only communicating with other local users, your emails are unencrypted at the other end. So the whole encryption topic is moot in many cases.
- tomrod 5y ago
  They have a mobile app that works great on Android. What am I missing?
  - rovr138 5y ago
    Someone that wants to use their email on a computer.
    - beermonster 5y ago
      You can access PM on a computer from either a) web UI b) bridge
      - rovr138 5y ago
        Did you read the original comment? The whole complaint above is about the web UI and mentions that the bridge isn't an option/solution for everyone.
  - diogenesjunior 5y ago
roenxi 5y ago
Reading through this and thinking about my own needs (currently upgrading family members away from Gmail) - it looks like Proton Mail hasn't solved the graceful upgrade path from insecure to secure email. Really what would be better called for here is a new protocol that can degrade gracefully, but it seems they've only given us a new app. Still it is nice to have people working on the problem.
- dane-pgp 5y ago
  > a new protocol that can degrade gracefully Does Autocrypt meet that definition? https://autocrypt.org/ https://autocrypt.org/ Sadly, for the last 3 years, ProtonMail has resisted implementing it (unlike Posteo, for example), using FUD tactics to justify themselves: https://github.com/ProtonMail/WebClient/issues/120 https://github.com/ProtonMail/WebClient/issues/120
  - roenxi 5y ago
    Thankyou! That is making for interesting reading.
traspler 5y ago
I don‘t know what exactly it is but the posts on their blog always make me frustrated and angry. The mix of content marketing and technical details is just infuriating. It just feels like they start with an immense heap of bullshit and then start weaving in some nuggets of information.
- xwdv 5y ago
  It's built for SEO. Pretty standard.
iluvcommunism 5y ago
My only complaint about PM is their spam handling. I continue to get spam, using the same exact body text, and it goes right to my inbox. Even after reporting. Their response is for me to continue reporting spam. This has been going on for months. No point in reporting spam if you will not even block it.
- dboreham 5y ago
  Spam filtering with zero false positives is an unsolved problem. So having some false negatives would tell me that this is a high quality service. Google et al just send job offers, credit card payment due reminders and high value customer queries to spam.
  - schipplock 5y ago
    You are correct. However, iluvcommunism is criticizing the fact that ProtonMail isn't improving on filtering out real spam. Getting duplicate spam, again and again, is a waste of time. I would look at the spam folder once a day instead of deleting n-numbers of spam mails in the inbox. When I moved an old e-mail domain to ProtonMail, the number of spam e-mails hitting my inbox increased dramatically. So it's not even close to as good as its competitors in this regard. I moved to Tutanota. I now get even more spam :(. Google, Zoho and Yandex handle spam better (IMHO). Regarding ProtonMail, they will tell you something like this: Moving the messages to spam will automatically add the address to your blacklist. And as we all know, spam is always sent from the same address, right? The Blocklist is useless in this context. They just need to improve their spam filter. The rest is fine (IMHO).
    - Avamander 5y ago
      > The Blocklist is useless in this context. All blocklists are useless in some contexts. There's not even a silver-ish bullet against spam. Sender blacklist however is one of the most effective ones, but at some point yeah you might have to create filters to match certain subjects and stuff. I guess ProtonMail could hire someone to just improve spam filtering, that'd be the only thing that'd rise the filtering quality really.
dane-pgp 5y ago
One security aspect that I guess is out of scope for the audit is dealing with the threat model of a compromised server, which can insert a backdoor into the JavaScript code it delivers to the user. A possible mitigation for this would be to support loading the site as a Secure Bookmark.[0] There might be technical and UX issues with doing this, but it would be interesting to know if it was at least possible to make it available as an option. [0] https://coins.github.io/secure-bookmark/ https://coins.github.io/secure-bookmark/
- warent 5y ago
  Are there recorded cases of this ever happening?
  - sandworm101 5y ago
    Lavabit. Iirc they were asked to compromise thier own server as part of the snowden investigation. Instead they closed up shop. I lost a couple email addresses with the, but was glad to do so rather than explain to legal clients how thier data was on an fbi-controlled sever. Sometimes the only way to win is not to play. https://www.cbc.ca/news/business/lavabit-founder-fought-9-month-legal-battle-with-fbi-1.2658374 https://www.cbc.ca/news/business/lavabit-founder-fought-9-mo...
    - forkerenok 5y ago
      With your nickname the comment makes for an eerie read :) https://en.wikipedia.org/wiki/Sandworm_(hacker_group) https://en.wikipedia.org/wiki/Sandworm_(hacker_group)
      - sandworm101 5y ago
        It is also one of the oldest concepts in scifi. I never met a hacker who wasnt also some sort of scifi fan. The people picking hacker groups names all read Hebert long ago. If you are old enough to have used lavabit, you probably know about sandworms.
      - 5y ago
ashtonkem 5y ago
I find it kind of surprising how many people are angry at the mobile experience here. Works just fine for me in iOS, what am I missing?
- Shacklz 5y ago
  Same here, on Android. But I mostly receive email and almost never send out emails on the phone; so I can see that others might need features that are totally irrelevant for me.
- jpe-210 5y ago
  I think that for those of us without busy inboxes it’s not that bad of an experience. The only thing I ask myself is if it’s worth paying for a service such as this if I’m not as busy as other people seem to be.
exp1orer 5y ago
Several other protonmail accounts have set up auto-forwarding to my protonmail inbox (whether accidentally or maliciously I don't know). PM has a feature that allows me to see who they are, but not remove the forwarding automatically. There does not seem to be any confirmation required to set up the forwarding, or any guard rails at all on the process. While this is unrelated to the core security of the application from a technical perspective, to me it seems shockingly sloppy and evidence of a severe lack of security mindset within the development organization. For comparison, gmail sends a confirmation code to the destination inbox that must be entered into the source email account.
- deleted 5y ago
  [deleted]
- deleted 5y ago
  [deleted]
jowlo 5y ago
So, the audit found (among other minor things) a pretty standard XSS vulnerability (on page 7) and lots of usages of `.innerHTML` which has been considered an insecure coding practice for eons. While errors always happen and it is a good thing they found them during beta, I would definitely not say "the final report was overwhelmingly positive, and the audit uncovered no major issues or security vulnerabilities" (blog post). Quite the opposite: XSS is the major attack vector of a web app for encrypted mail as it most probably enables access to plaintexts. Am I misunderstanding the report here? disclaimer: i work for a competitor and we discovered less severe attack vectors in the past but even then sent out notices to all users informing them about the timeframe of the vulnerability and such.
- throwaway192874 5y ago
  You forgot to read the sentence before that > Prior to their release, the source code of both the new ProtonMail and Proton Calendar underwent an extensive security audit. We are happy to announce the final report was overwhelmingly positive, and the audit uncovered no major issues or security vulnerabilities. This report was done before the release of the new software, and important issues fixed. What they said was accurate given there was only one medium severity finding, and no highs or critical. For example, the site now returns a CSP preventing inline JS so this wouldn't work anymore even if they didn't fix the underlying XSS. The fact that exploiting this required the user to intentionally right click and show the image in a new tab (since it already renders it inline w/o xss) is why it was categorized that way since it's unlikely someone would do this by default. Most companies never disclose anything like this, so them disclosing there was a vulnerability found in a report they paid for and then published isn't really a strike against them and I'm fine with this language. It's a little marketing speak but I don't agree it's inaccurate for them to say so
  - jowlo 5y ago
    > You forgot to read the sentence before that Oh, yes, I did, sorry! I thought this was found in production code. I do support them publishing this and like I said: The code is audited to find exactly these kinds of errors, so I am not at all trying to shame them here. Their process worked, they found and fixed the vulnerabilities. OTOH, not having a proper CSP preventing inline JS, the innerHTML usages and that XSS together does not go too well with the overall extremely positive sound of the headlines. All those three are in the 101 of secure web app development. Aaand, with the numbers of users they have, tons of them will right click and open in a new tab every hour. Its also easily exploitable: send an image with very small text. However, being in a different tab i am unsure how much info you would be able to steal, but sessions/tokens would be possible I guess.
tyingq 5y ago
I'm curious about the stories I've read about ProtonMail having connections to the Swiss Government, CIA, etc. One of those stories (there are more): https://privacy-watchdog.io/truth-about-protonmail/ https://privacy-watchdog.io/truth-about-protonmail/ Is this just conspiracy theories, or is there something to actually be concerned about?
- TingPing 5y ago
  The linked site is very low on info high on outrageous claims. It is not the same as gmail and protons response to that paper are accurate imo. The fact is web clients are inherently insecure but you can run your own client entirely afaik (https://github.com/ProtonMail/proton-mail https://github.com/ProtonMail/proton-mail). I don't think anybody has evidence of wrong doing but the service is proprietary so...
mark_l_watson 5y ago
I am a long time ProtonMail customer, but I admit to switching back to Gmail every few months, then a while later switching back. I mostly use Apple's Calendar. Because of the nature of their encryption, you can only search using email subject lines with their web clients. I run the Proton Bridge on my laptop just in case I need to search my email. Since most cellphones now have a lot of storage, I really wish the ProtonMail web client would optionally maintain a search index in local device storage (as an option). This would allow me to search my emails on any device. Or, they could make the Bridge available on iOS and Android - this would allow the use of any email clients on mobile and fix search.
aborsy 5y ago
PM iOS App works fine for me and frankly it’s nice. We need more people using end-to-end encrypted communication, for these technologies to be useful. They are not effective if only one side wants to encrypt. I think we should generally also support privacy products.

183 points by beermonster 5y ago

Wish this audit had more details about the encryption system implemented and whether the rebuild meets their public encryption implementation specs (https://protonmail.com/security-details https://protonmail.com/security-details). This seems to be more about general web app OWASP type security audit.

futevolei 5y ago

Can ProtonMail focus on getting mail right before adding calendar and vpn and whatever else they pump in their newsletter? Their mobile email is atrocious- hello threading email chains? I was hoping to use this as a gmail replacement but it’s not even capable of replacing my spam yahoo account at this point. I support the cause but it seems like they are trying to do too much with too little.

moeadham 5y ago
Yeah, I wish more effort was spent on search and spam. Very glad to see the security audit in any case.
codesuki 5y ago
The missing threading on mobile and overall app experience was what made me not switch to protomail. It wasn't the actual missing feature but the fact that when I googled for it I found people requesting this feature several years ago (maybe 2016) up until now and staff doesn't give any answer. So I thought it might not be the most customer focused business.
yosito 5y ago
Proton Mail, if you're listening, the terrible mobile experience is why I'm switching providers. You promised a new mobile app, but it's been years and you've got nothing to show for it.
- acover 5y ago
  Would using the default app with IMAP provide threading?
  - beermonster 5y ago
    Because IMAP requires a locally running daemon they call Bridge. So works for Desktop only not mobile
- Fnoord 5y ago
  Its why I went away from ProtonVPN. No WireGuard support. Still not AFAIK.
  - anpago 5y ago
    The Android VPN app has just had wireguard added. It's not on the pc or iOS version I believe as of now
    - Fnoord 5y ago
      Heh, I need it in CLI, not Android. Practically the only thing I use VPN for is downloading some torrents, in a Docker container (Rtorrent). That they only now added it in Android makes me glad I left them approx 1,5 years ago.
olaf 5y ago
I agree, UI and usability design look amateurish to me. It is time for me to look for a better alternative, their speed of improvement in above mentioned areas is just one big disappointment.
stingraycharles 5y ago
Yeah I agree. I was trying to be a protonmail customer, but there was just too much friction. In addition to the subpar UI, I was trying to import my (admittedly large) gmail mailbox into Protonmail, and it just did not work. I let it run for days, had to restart it, repeated the process for weeks, and after about 4 weeks I just had to give up… It’s a shame because I really appreciate the security aspects of it, and the fact that they’re a small company / underdog. But there’s just too much friction.
hhw3h 5y ago
Agree. I wish they would focus and go deeper on fewer applications. Get email working well, then calendar, etc.
traspler 5y ago
The mobile app is so bad, nearly nothing works the way it should. Tap a Notification, you‘re lucky if the right mail opens, try to attach images on iOS? For while it sent HEIV images instead of jpegs, so normal people were out of luck; hope it doesn‘t crash? It does. The UI is also pretty ugly. But it‘s not only the app that is bad, the web client was quite functional for a while apart from the missing login persistence. Then came the new UI now it just kind of works. Try to move/tag many mails after each other? Now you also have to deal with clicking away success boxes as they start piling up and overlapping the very UI elements you are trying to reach. There are threads but for some reason they are way more cumbersome to use than GMail’s. Everything is gigantic now as well. I haven‘t checked yet but during the beta I could just not find some settings anymore. Hope they got added before launch.
- CodeGlitch 5y ago
  Android user here. I've not used the iOS version so cannot say what the differences are, but it works really well and is highly rated within the Play store. I imagine however that iOS users have higher standards, because let's be honest the majority of apps on the play store are garbage.
tzs 5y ago
> Can ProtonMail focus on getting mail right before adding calendar and vpn and whatever else they pump in their newsletter? Once companies grow past a handful of employees they usually go from everyone being a generalist who can work on every part of all their product to having specialists who only can deal with some of what the company does. The various sites that report corporate information put the number of Proton employees in the 160-250 range. They are almost certainly well into the specialist phase. The people working on calendar and VPN and whatever would likely not be able to help with mobile email if they were shifted to that. If mobile email needs more work than those currently working on it can do, Proton needs to bring in more mobile and/or email specialists. It would only make sense then to stop calendar and VPN work if they do not have sufficient budget to bring in people to help with mobile email and need to lay off people from other projects to free up the money.
- cutemonster 5y ago
  > they usually go from everyone being a generalist Interesting point. At the same time, I think it won't take long at all for someone who develops a calendar mobile app to switch to working on an email mobile app. -- But maybe you meant the email web client? (Web vs native development?) I think you're right that a VPN and related Linux kernel and networking is a different type of specialization, yes.
Rd6n6 5y ago
In contrast, I used to find pm email to be fine. I left the service for fastmail because I wanted a calendar built in. I’m considering going back now
40four 5y ago
Wow so much hate for the mobile email client. I’ve been a happy user for a couple years now, I’m surprised there is so much distaste. Maybe I’m just not that picky? :) On this subject, I thought the recent upgrade of the email web client was nice. Maybe we can hope for something similar with mobile soon?
- cutemonster 5y ago
  Makes me wonder, maybe they get more emails and then get more frustrated about problems (How many emails do you get per day?)
  - 40four 5y ago
    I suspect you are right. I’m definitely not an email ‘power user’, not getting a huge volume of emails. So the issues aren’t as obvious to me.

blunte 5y ago

I wanted to like PM and became a visionary subscriber years ago. But I left after painfully discovering that their web client (which was the only option at that time) was just not built for busy inboxes. Even today, many of the original pain points exist. The UI is still clunky, and paging through the inbox is really terrible. Now they will promote their bridge to allow you to use Outlook or whatever, but that's not a solution for some of us. I assume their need for revenue is what drives the features-before-improvements approach, but I know it is costing them some potential customers. Nowadays I only use PM for special occasions, such as needing a temporary private email conversation with someone (who also sets up a new temp PM account). I have found Tutanota to be much better in terms of usability. I can't speak for their security quality compared to PM, but honestly, unless you're only communicating with other local users, your emails are unencrypted at the other end. So the whole encryption topic is moot in many cases.

tomrod 5y ago
They have a mobile app that works great on Android. What am I missing?
- rovr138 5y ago
  Someone that wants to use their email on a computer.
  - beermonster 5y ago
    You can access PM on a computer from either a) web UI b) bridge
    - rovr138 5y ago
      Did you read the original comment? The whole complaint above is about the web UI and mentions that the bridge isn't an option/solution for everyone.
- diogenesjunior 5y ago

roenxi 5y ago

Reading through this and thinking about my own needs (currently upgrading family members away from Gmail) - it looks like Proton Mail hasn't solved the graceful upgrade path from insecure to secure email. Really what would be better called for here is a new protocol that can degrade gracefully, but it seems they've only given us a new app. Still it is nice to have people working on the problem.

dane-pgp 5y ago
> a new protocol that can degrade gracefully Does Autocrypt meet that definition? https://autocrypt.org/ https://autocrypt.org/ Sadly, for the last 3 years, ProtonMail has resisted implementing it (unlike Posteo, for example), using FUD tactics to justify themselves: https://github.com/ProtonMail/WebClient/issues/120 https://github.com/ProtonMail/WebClient/issues/120
- roenxi 5y ago
  Thankyou! That is making for interesting reading.

traspler 5y ago

I don‘t know what exactly it is but the posts on their blog always make me frustrated and angry. The mix of content marketing and technical details is just infuriating. It just feels like they start with an immense heap of bullshit and then start weaving in some nuggets of information.

xwdv 5y ago
It's built for SEO. Pretty standard.

iluvcommunism 5y ago

My only complaint about PM is their spam handling. I continue to get spam, using the same exact body text, and it goes right to my inbox. Even after reporting. Their response is for me to continue reporting spam. This has been going on for months. No point in reporting spam if you will not even block it.

dboreham 5y ago
Spam filtering with zero false positives is an unsolved problem. So having some false negatives would tell me that this is a high quality service. Google et al just send job offers, credit card payment due reminders and high value customer queries to spam.
- schipplock 5y ago
  You are correct. However, iluvcommunism is criticizing the fact that ProtonMail isn't improving on filtering out real spam. Getting duplicate spam, again and again, is a waste of time. I would look at the spam folder once a day instead of deleting n-numbers of spam mails in the inbox. When I moved an old e-mail domain to ProtonMail, the number of spam e-mails hitting my inbox increased dramatically. So it's not even close to as good as its competitors in this regard. I moved to Tutanota. I now get even more spam :(. Google, Zoho and Yandex handle spam better (IMHO). Regarding ProtonMail, they will tell you something like this: Moving the messages to spam will automatically add the address to your blacklist. And as we all know, spam is always sent from the same address, right? The Blocklist is useless in this context. They just need to improve their spam filter. The rest is fine (IMHO).
  - Avamander 5y ago
    > The Blocklist is useless in this context. All blocklists are useless in some contexts. There's not even a silver-ish bullet against spam. Sender blacklist however is one of the most effective ones, but at some point yeah you might have to create filters to match certain subjects and stuff. I guess ProtonMail could hire someone to just improve spam filtering, that'd be the only thing that'd rise the filtering quality really.

dane-pgp 5y ago

One security aspect that I guess is out of scope for the audit is dealing with the threat model of a compromised server, which can insert a backdoor into the JavaScript code it delivers to the user. A possible mitigation for this would be to support loading the site as a Secure Bookmark.[0] There might be technical and UX issues with doing this, but it would be interesting to know if it was at least possible to make it available as an option. [0] https://coins.github.io/secure-bookmark/ https://coins.github.io/secure-bookmark/

warent 5y ago
Are there recorded cases of this ever happening?
- sandworm101 5y ago
  Lavabit. Iirc they were asked to compromise thier own server as part of the snowden investigation. Instead they closed up shop. I lost a couple email addresses with the, but was glad to do so rather than explain to legal clients how thier data was on an fbi-controlled sever. Sometimes the only way to win is not to play. https://www.cbc.ca/news/business/lavabit-founder-fought-9-month-legal-battle-with-fbi-1.2658374 https://www.cbc.ca/news/business/lavabit-founder-fought-9-mo...
  - forkerenok 5y ago
    With your nickname the comment makes for an eerie read :) https://en.wikipedia.org/wiki/Sandworm_(hacker_group) https://en.wikipedia.org/wiki/Sandworm_(hacker_group)
    - sandworm101 5y ago
      It is also one of the oldest concepts in scifi. I never met a hacker who wasnt also some sort of scifi fan. The people picking hacker groups names all read Hebert long ago. If you are old enough to have used lavabit, you probably know about sandworms.
    - 5y ago

ashtonkem 5y ago

I find it kind of surprising how many people are angry at the mobile experience here. Works just fine for me in iOS, what am I missing?

Shacklz 5y ago
Same here, on Android. But I mostly receive email and almost never send out emails on the phone; so I can see that others might need features that are totally irrelevant for me.
jpe-210 5y ago
I think that for those of us without busy inboxes it’s not that bad of an experience. The only thing I ask myself is if it’s worth paying for a service such as this if I’m not as busy as other people seem to be.

exp1orer 5y ago

Several other protonmail accounts have set up auto-forwarding to my protonmail inbox (whether accidentally or maliciously I don't know). PM has a feature that allows me to see who they are, but not remove the forwarding automatically. There does not seem to be any confirmation required to set up the forwarding, or any guard rails at all on the process. While this is unrelated to the core security of the application from a technical perspective, to me it seems shockingly sloppy and evidence of a severe lack of security mindset within the development organization. For comparison, gmail sends a confirmation code to the destination inbox that must be entered into the source email account.

deleted 5y ago
[deleted]
deleted 5y ago
[deleted]

jowlo 5y ago

So, the audit found (among other minor things) a pretty standard XSS vulnerability (on page 7) and lots of usages of `.innerHTML` which has been considered an insecure coding practice for eons. While errors always happen and it is a good thing they found them during beta, I would definitely not say "the final report was overwhelmingly positive, and the audit uncovered no major issues or security vulnerabilities" (blog post). Quite the opposite: XSS is the major attack vector of a web app for encrypted mail as it most probably enables access to plaintexts. Am I misunderstanding the report here? disclaimer: i work for a competitor and we discovered less severe attack vectors in the past but even then sent out notices to all users informing them about the timeframe of the vulnerability and such.

throwaway192874 5y ago
You forgot to read the sentence before that > Prior to their release, the source code of both the new ProtonMail and Proton Calendar underwent an extensive security audit. We are happy to announce the final report was overwhelmingly positive, and the audit uncovered no major issues or security vulnerabilities. This report was done before the release of the new software, and important issues fixed. What they said was accurate given there was only one medium severity finding, and no highs or critical. For example, the site now returns a CSP preventing inline JS so this wouldn't work anymore even if they didn't fix the underlying XSS. The fact that exploiting this required the user to intentionally right click and show the image in a new tab (since it already renders it inline w/o xss) is why it was categorized that way since it's unlikely someone would do this by default. Most companies never disclose anything like this, so them disclosing there was a vulnerability found in a report they paid for and then published isn't really a strike against them and I'm fine with this language. It's a little marketing speak but I don't agree it's inaccurate for them to say so
- jowlo 5y ago
  > You forgot to read the sentence before that Oh, yes, I did, sorry! I thought this was found in production code. I do support them publishing this and like I said: The code is audited to find exactly these kinds of errors, so I am not at all trying to shame them here. Their process worked, they found and fixed the vulnerabilities. OTOH, not having a proper CSP preventing inline JS, the innerHTML usages and that XSS together does not go too well with the overall extremely positive sound of the headlines. All those three are in the 101 of secure web app development. Aaand, with the numbers of users they have, tons of them will right click and open in a new tab every hour. Its also easily exploitable: send an image with very small text. However, being in a different tab i am unsure how much info you would be able to steal, but sessions/tokens would be possible I guess.

tyingq 5y ago

I'm curious about the stories I've read about ProtonMail having connections to the Swiss Government, CIA, etc. One of those stories (there are more): https://privacy-watchdog.io/truth-about-protonmail/ https://privacy-watchdog.io/truth-about-protonmail/ Is this just conspiracy theories, or is there something to actually be concerned about?

TingPing 5y ago
The linked site is very low on info high on outrageous claims. It is not the same as gmail and protons response to that paper are accurate imo. The fact is web clients are inherently insecure but you can run your own client entirely afaik (https://github.com/ProtonMail/proton-mail https://github.com/ProtonMail/proton-mail). I don't think anybody has evidence of wrong doing but the service is proprietary so...

mark_l_watson 5y ago

I am a long time ProtonMail customer, but I admit to switching back to Gmail every few months, then a while later switching back. I mostly use Apple's Calendar. Because of the nature of their encryption, you can only search using email subject lines with their web clients. I run the Proton Bridge on my laptop just in case I need to search my email. Since most cellphones now have a lot of storage, I really wish the ProtonMail web client would optionally maintain a search index in local device storage (as an option). This would allow me to search my emails on any device. Or, they could make the Bridge available on iOS and Android - this would allow the use of any email clients on mobile and fix search.

aborsy 5y ago

PM iOS App works fine for me and frankly it’s nice. We need more people using end-to-end encrypted communication, for these technologies to be useful. They are not effective if only one side wants to encrypt. I think we should generally also support privacy products.