5 ms·

This article is crap: 1) Claimed redirection from .onion to .com does not deanonymize the user. 2) Protonmail does provide e2e encryption. It's just that you au

This article is crap: 1) Claimed redirection from .onion to .com does not deanonymize the user. 2) Protonmail does provide e2e encryption. It's just that you auto-update your client (a JavaScript app) every time you visit the website, so you have no chance to discover potential targeted backdoors.

stabbles 5y ago
Point 2 is very problematic though, you can write a browser extension that compares the checksum of app.js, but if it changes and it is just minified obfuscated code, how will you know it's safe to execute. You don't. Same applies of course to chat apps that offer end to end encryption. Maybe it's safe for messages to be intercepted, but can you trust the application decrypting messages and displaying to do just that?
- NotEvil 5y ago
  You can use the mobile apps for kind of migrating it. And for point 1) through. I get that it's the same infrastructure but surely they could find a way to disable ssl on onion
3xccc 5y ago
Thanks, I was looking for someone pointing out 1). I thought I miss something.
tyingq 5y ago
>1) Claimed redirection from .onion to .com does not deanonymize the user. Is is clear why they do the redirect?
- aijony 5y ago
  To prevent abuse: https://old.reddit.com/r/ProtonMail/comments/62rfta/comment/dfp53ol/?utm_source=share&utm_medium=web2x&context=3 https://old.reddit.com/r/ProtonMail/comments/62rfta/comment/...
  - mindslight 5y ago
    "Preventing abuse" is generally equivalent to surveillance - identifying a session as being associated with some longer lived identities. Their explanation makes me less comfortable for why they're doing it! Redirecting to the https site is a bit less secure than the hidden service, in that your traffic will only go over 3 hops (TOR client) rather than 6 (TOR client + hidden service circuit). But AFAIK they could also write a modified TOR client that served a hidden service without any additional hops. Those additional hops are best seen as security for the hidden service rather than the user. Also, a hidden service for a well known business is kind of a pointless marketing gimmick.

stabbles 5y ago

Point 2 is very problematic though, you can write a browser extension that compares the checksum of app.js, but if it changes and it is just minified obfuscated code, how will you know it's safe to execute. You don't. Same applies of course to chat apps that offer end to end encryption. Maybe it's safe for messages to be intercepted, but can you trust the application decrypting messages and displaying to do just that?

NotEvil 5y ago
You can use the mobile apps for kind of migrating it. And for point 1) through. I get that it's the same infrastructure but surely they could find a way to disable ssl on onion

3xccc 5y ago

Thanks, I was looking for someone pointing out 1). I thought I miss something.

tyingq 5y ago

>1) Claimed redirection from .onion to .com does not deanonymize the user. Is is clear why they do the redirect?

aijony 5y ago
To prevent abuse: https://old.reddit.com/r/ProtonMail/comments/62rfta/comment/dfp53ol/?utm_source=share&utm_medium=web2x&context=3 https://old.reddit.com/r/ProtonMail/comments/62rfta/comment/...
- mindslight 5y ago
  "Preventing abuse" is generally equivalent to surveillance - identifying a session as being associated with some longer lived identities. Their explanation makes me less comfortable for why they're doing it! Redirecting to the https site is a bit less secure than the hidden service, in that your traffic will only go over 3 hops (TOR client) rather than 6 (TOR client + hidden service circuit). But AFAIK they could also write a modified TOR client that served a hidden service without any additional hops. Those additional hops are best seen as security for the hidden service rather than the user. Also, a hidden service for a well known business is kind of a pointless marketing gimmick.