5 ms·

I'm also a Protonmail customer. Tor solves this. Protonmail's Tor support is lukewarm. They have a Tor based login without captchas. It's mentioned on their ho

I'm also a Protonmail customer. Tor solves this. Protonmail's Tor support is lukewarm. They have a Tor based login without captchas. It's mentioned on their homepage in the bottom menu under "Onion Site", (/tor). And there's one blog post from 2017 that still promotes their v2/shorter onion address. I expect Protonmail to push its users to login through Tor. "Don't trust us, trust math". Embed Tor support in their apps as well. Rebuild their iOS app to offer to drive all connections through Tor. And frankly, for $50 a year for email, I expect Protonmail to be thinking ahead about this, rather than me coming up with dumb ideas on a forum. Protonmail was neat in 2018 but 3 years later it's stagnant.

Aachen 5y ago
How is that lukewarm? Sounds like first class support if they have a dedicated onion address and not just let you connect to the regular clearnet. Or is that address only in that old blog post and not mentioned in places you'd usually look? It's a bit unclear to me.
- istingray 5y ago
  It's lukewarm because what less could you do besides not support Tor? Tor is mentioned on their homepage in the bottom menu under "Onion Site". However, this menu link redirects to their Tor placeholder page, rather than directly to the Tor service: https://protonmail.com/tor https://protonmail.com/tor There's one blog post from 2017 that still promotes their old v2 onion address: https://protonmail.com/blog/tor-encrypted-email/ https://protonmail.com/blog/tor-encrypted-email/ Protonmail's Tor service is located at: https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/ https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7...
  - yunohn 5y ago
    > It's lukewarm because what less could you do besides not support Tor? Alright then, what more do you want them to do? Spend millions in court fighting every warrant issued for their users and go bankrupt defending criminal activity?
cortesoft 5y ago
What does using Tor have to do with trusting math?
- istingray 5y ago
  "What makes Tor different from the usual thesaurus-full of government projects is that Tor is essentially a very elaborate math trick, using layers of math puzzles to create a network-within-the-network. That math is being implemented in front of a global audience of millions of sophisticated watchers. It is likely the most examined codebase in the world. It has been subjected to multiple public audits. The math, well known and widely standardized, will work for everyone, or it will not, whoever pays the bills." from https://pando.com/2014/12/09/clearing-the-air-around-tor/ https://pando.com/2014/12/09/clearing-the-air-around-tor/
  - sweetbitter 5y ago
    "Trusting mathematics" would be a much more accurate claim if we were talking about mix networks, such as Loopix (https://arxiv.org/abs/1703.00536 https://arxiv.org/abs/1703.00536). But Tor is vulnerable to confirmation attacks to varying degrees, (depending on whether you are accessing clearnet or not, of course) which is very much worth noting in the context of a global passive adversary.
PeterisP 5y ago
Aren't a big part of Tor entry/exit nodes considered to be monitored or even operated by the authorities?
- pabs3 5y ago
  The authorities don't need to run exit nodes, they just pwn enough routers, have enough interception devices or buy enough netflow data that they can trace data flowing through the Tor work back to its original location.
- DocTomoe 5y ago
  Sure, but if that becomes a problem for you depends on 1. whether or not your request stays within the tor network or not (if you use the .onion address, no need for an exit node) 2. given both entry and exit nodes can be literally all over the world: your threat opposition level. I doubt the NSA will be happy to help French authorities trying to catch a teenager who blockaded a government parking garage).

Aachen 5y ago

How is that lukewarm? Sounds like first class support if they have a dedicated onion address and not just let you connect to the regular clearnet. Or is that address only in that old blog post and not mentioned in places you'd usually look? It's a bit unclear to me.

istingray 5y ago
It's lukewarm because what less could you do besides not support Tor? Tor is mentioned on their homepage in the bottom menu under "Onion Site". However, this menu link redirects to their Tor placeholder page, rather than directly to the Tor service: https://protonmail.com/tor https://protonmail.com/tor There's one blog post from 2017 that still promotes their old v2 onion address: https://protonmail.com/blog/tor-encrypted-email/ https://protonmail.com/blog/tor-encrypted-email/ Protonmail's Tor service is located at: https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/ https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7...
- yunohn 5y ago
  > It's lukewarm because what less could you do besides not support Tor? Alright then, what more do you want them to do? Spend millions in court fighting every warrant issued for their users and go bankrupt defending criminal activity?

cortesoft 5y ago

What does using Tor have to do with trusting math?

istingray 5y ago
"What makes Tor different from the usual thesaurus-full of government projects is that Tor is essentially a very elaborate math trick, using layers of math puzzles to create a network-within-the-network. That math is being implemented in front of a global audience of millions of sophisticated watchers. It is likely the most examined codebase in the world. It has been subjected to multiple public audits. The math, well known and widely standardized, will work for everyone, or it will not, whoever pays the bills." from https://pando.com/2014/12/09/clearing-the-air-around-tor/ https://pando.com/2014/12/09/clearing-the-air-around-tor/
- sweetbitter 5y ago
  "Trusting mathematics" would be a much more accurate claim if we were talking about mix networks, such as Loopix (https://arxiv.org/abs/1703.00536 https://arxiv.org/abs/1703.00536). But Tor is vulnerable to confirmation attacks to varying degrees, (depending on whether you are accessing clearnet or not, of course) which is very much worth noting in the context of a global passive adversary.

PeterisP 5y ago

Aren't a big part of Tor entry/exit nodes considered to be monitored or even operated by the authorities?

pabs3 5y ago
The authorities don't need to run exit nodes, they just pwn enough routers, have enough interception devices or buy enough netflow data that they can trace data flowing through the Tor work back to its original location.
DocTomoe 5y ago
Sure, but if that becomes a problem for you depends on 1. whether or not your request stays within the tor network or not (if you use the .onion address, no need for an exit node) 2. given both entry and exit nodes can be literally all over the world: your threat opposition level. I doubt the NSA will be happy to help French authorities trying to catch a teenager who blockaded a government parking garage).