2 ms·

> If you find it difficult to get the two applications above from AppStore or Google Play Store, please send a blank email to get@psiphon3.com or gettor@torproj

> If you find it difficult to get the two applications above from AppStore or Google Play Store, please send a blank email to get@psiphon3.com or gettor@torproject.org, respectively. You will then be sent an email with a direct and safe download link. How safe is this? I don’t know much about email security. Can the ISP intercept and edit the email message?

sieabahlpark 5y ago
adam-p 5y ago
For the Psiphon mail responder, we configure Postfix with `smtp_tls_security_level=verify` and `smtpd_tls_security_level=encrypt` (with three "may" domain exceptions, unfortunately). So, the email should be encrypted through the ISP. Of course, if your ISP is also your email provider (get a new email provider), then your ISP will be able to see and modify your email. We also sign our apps and provide detailed instructions for verifying the authenticity of them: https://psiphon.ca/en/faq.html#verify-psiphon-authentic https://psiphon.ca/en/faq.html#verify-psiphon-authentic (You can't get to that if you can't get to the internet, but it's hard to do much better. We can't email the instructions, since then the instructions could also be modified. But it's entirely possible for some users to be able to load a webpage but not download a 6MB binary.)
agucova 5y ago
Non-encrypted email in transit is a concern, but AFAIK most users should already be protected nowadays. (Google estimates [1] put it at around 9/10, tho probably not representative of Russia) A bigger concern might be Russian-monitored email servers, especially given that around 70% of the market share is occupied by Russian providers [2], and email isn't considered personal data in Russia [3]. [1]: https://transparencyreport.google.com/safer-email?hl=en https://transparencyreport.google.com/safer-email?hl=en [2]: https://help.returnpath.com/hc/en-us/articles/115001108411-Country-Overview-Russia https://help.returnpath.com/hc/en-us/articles/115001108411-C... [3]: https://www.plesner.com/insights/articles/2016/01/data-localisation-in-russia-email-addresses-are-not-considered-personal-data?sc_lang=en https://www.plesner.com/insights/articles/2016/01/data-local... Update: as for transit, see adam-p's comment.

sieabahlpark 5y ago

adam-p 5y ago

For the Psiphon mail responder, we configure Postfix with `smtp_tls_security_level=verify` and `smtpd_tls_security_level=encrypt` (with three "may" domain exceptions, unfortunately). So, the email should be encrypted through the ISP. Of course, if your ISP is also your email provider (get a new email provider), then your ISP will be able to see and modify your email. We also sign our apps and provide detailed instructions for verifying the authenticity of them: https://psiphon.ca/en/faq.html#verify-psiphon-authentic https://psiphon.ca/en/faq.html#verify-psiphon-authentic (You can't get to that if you can't get to the internet, but it's hard to do much better. We can't email the instructions, since then the instructions could also be modified. But it's entirely possible for some users to be able to load a webpage but not download a 6MB binary.)

agucova 5y ago

Non-encrypted email in transit is a concern, but AFAIK most users should already be protected nowadays. (Google estimates [1] put it at around 9/10, tho probably not representative of Russia) A bigger concern might be Russian-monitored email servers, especially given that around 70% of the market share is occupied by Russian providers [2], and email isn't considered personal data in Russia [3]. [1]: https://transparencyreport.google.com/safer-email?hl=en https://transparencyreport.google.com/safer-email?hl=en [2]: https://help.returnpath.com/hc/en-us/articles/115001108411-Country-Overview-Russia https://help.returnpath.com/hc/en-us/articles/115001108411-C... [3]: https://www.plesner.com/insights/articles/2016/01/data-localisation-in-russia-email-addresses-are-not-considered-personal-data?sc_lang=en https://www.plesner.com/insights/articles/2016/01/data-local... Update: as for transit, see adam-p's comment.