4 ms·
You're asking for a negative proof. How do you want an email provider to demonstrate they are not storing your nonhashed password? I don't see how that's feasib
by illiac786 3y ago
You're asking for a negative proof. How do you want an email provider to demonstrate they are not storing your nonhashed password? I don't see how that's feasible. Audits are a step in that direction, but it's not like mathematical proof.
- ImJamal 3y agoThat is my point. The protonmail person said they never have access to the decrypted key. As far as I can tell they can't prove it.
- illiac786 3y agoSo we agree you are asking for something impossible to prove? Not sure you got my point.
- ImJamal 3y agoI agree it is impossible. I don't like their claims that they don't have access to the decrypted keys and we can prove it by looking at the code. They could have access to the keys and looking at the code wouldn't prove they don't.
- illiac786 3y agoI understand but I read the statement differently. It's a description of their security model simply. Sure they could be lying like any other company, so a certain amount of trust is required. Unless you read and compiled the code yourself and run it locally, some level of trust is always required.