4 ms·
Do you know how Proton Mail actually works? Encryption keys are encrypted client side so Proton never has access to your private key, just an encrypted copy tha
by protonmail 3y ago
Do you know how Proton Mail actually works? Encryption keys are encrypted client side so Proton never has access to your private key, just an encrypted copy that cannot be decrypted server side.
- ImJamal 3y agoI might be missing something, but how are the keys decrypted? Isn't it using the password? I assume the passwords are hashed on the server, but how would we know if you are storing the nonhashed password when we log in?
- protonmail 3y agoProton Mail is open source, anybody can review the code to see that that clearly is not the case.
- ImJamal 3y agoI haven't reviewed all the code, but my question would be related to the back end which I can't find the source for. Even if the back end is open source we wouldn't know if that is the same code on the servers.
- illiac786 3y agoYou're asking for a negative proof. How do you want an email provider to demonstrate they are not storing your nonhashed password? I don't see how that's feasible. Audits are a step in that direction, but it's not like mathematical proof.
- ImJamal 3y agoThat is my point. The protonmail person said they never have access to the decrypted key. As far as I can tell they can't prove it.
- illiac786 3y agoSo we agree you are asking for something impossible to prove? Not sure you got my point.
- ImJamal 3y agoI agree it is impossible. I don't like their claims that they don't have access to the decrypted keys and we can prove it by looking at the code. They could have access to the keys and looking at the code wouldn't prove they don't.
- illiac786 3y agoI understand but I read the statement differently. It's a description of their security model simply. Sure they could be lying like any other company, so a certain amount of trust is required. Unless you read and compiled the code yourself and run it locally, some level of trust is always required.