15 ms·

Skiff – Privacy-first end-to-end encrypted email

206 points by throwoutway 3y ago

Richard6544 3y ago
[dead]
Release0381 3y ago
I just wish they had bothered to integrate PGP, like Protonmail or Mailbox.org do. Right now it's yet another completely insular solution.
ifeja 3y ago
Skiff is very good so far.
aaravchen 3y ago
The website doesn't work on Firefox at all. It can't even be scrolled up or down on Firefox mobile or desktop, or any variant of Firefox.
yawnxyz 3y ago
Will you guys bring "multiplayer" mode like Front?
- amilich 3y ago
  We might! We actually have a collaborative, e2ee editor (skiff.com/pages)
n00bskoolbus 3y ago
Is the benefit of this over something like Protonmail or Tutanota the enterprise focus products? As an individual user seems like I may as well pocket the difference, right?
- esdf 3y ago
  Skiff says they encrypt email subjects while protonmail does not. I cannot determine from browsing if they encrypt the sender and receiver addresses. Skiff's free tier also has a 'generous' free tier with 4 aliases, 10GB of drive (only? combined with email?) storage, and custom domain support (? !)
  - amilich 3y ago
    Hello! I'm one of the founders. We do end-to-end encrypt email subjects. Sender/receiver addresses are not to ensure email goes to the right person. 10 GB drive is used across all Skiff products.
    - rnk 3y ago
      And domain support?
      - naveen-kumar 3y ago
        I've been using my personal domain on Skiff and been loving it personally! Simple to setup (nothing different to the usual) and it all works seamlessly! Just that, it's one inbox in the Free tier. Since I'm using on my own domain, I prefer having one inbox for all addresses!
      - ginsbergjason 3y ago
        you can transfer a custom domain on the free tier. we also let you register custom domains directly inside the product.
      - amilich 3y ago
        Yes, we have custom domain support with DKIM/DMARC/SPF all enabled.
        JadoJodo 3y ago
        I use FastMail but would consider moving. Can I have unlimited aliases when using my own domain? I use their MaskedEmail function to generate aliases for each service and have > 150 at this point.
ifeja 3y ago
How long is it free for?
- tikkun 3y ago
  As another perspective, I personally prefer products that are paid because it makes me less concerned that my data is the product, and less concerned that the product will disappear or stop improving.
  - ginsbergjason 3y ago
    we offer 3 paid tiers in addition to the free tier. you can also purchase custom domains directly inside skiff.
redeux 3y ago
The pricing page is confusing to me. It doesn’t mention anything about email in the free tier. It just says: > Unlimited pages > Desktop, tablet, and mobile access > IPFS support > Full text search Which seems to be all about the document service, but it also doesn’t mention how much storage I get. I assume it’s not unlimited despite saying “Unlimited pages.” Also, I can see that Skiff has raised over $14M in VC funds[1], so as a privacy-focused product with a free-tier I think it’s fair to ask what they see as their path to profitability is without compromising either their privacy or their free offering. 1. https://www.crunchbase.com/organization/skiff-402f/company_financials https://www.crunchbase.com/organization/skiff-402f/company_f...
- amilich 3y ago
  Are you possibly on a different or old page (or article)? Check out https://skiff.com/pricing https://skiff.com/pricing and scroll down, it has 20+ features. We have thousands of paid users!
  - redeux 3y ago
    Interesting. No, I went to that page but on mobile. I didn’t scroll all the way down past the tiers. You have to scroll way down to see that info. It’s probably fine on desktop but less than ideal on mobile. My 2-cents anyway.
    - amilich 3y ago
      Ah, ok. Updating it now! Thanks for the feedback, you're totally right. It's probably 18 months old.
- ginsbergjason 3y ago
  you're right it is confusing. we're updating it now.
- ignoramous 3y ago
  > Skiff has raised over $14M in VC funds, so as a privacy-focused product... They seemed to have pivoted from web3? https://news.ycombinator.com/item?id=29797691 https://news.ycombinator.com/item?id=29797691
ssddanbrown 3y ago
Their website describes this as open source but their linked repo is under CC BY-NC-SA 4.0 [1] so not commonly regarded as open source, but instead source available. They have been made aware of this [2]. Additionally, I think it may only be the front-end parts of their apps that are source available, I'm not sure the server-side parts of their app have sources published. [1] https://creativecommons.org/licenses/by-nc-sa/4.0/ https://creativecommons.org/licenses/by-nc-sa/4.0/ [2] https://github.com/skiff-org/skiff-apps/issues/94 https://github.com/skiff-org/skiff-apps/issues/94
- amilich 3y ago
  Hello! Yes, we're working on this. Note that our UI, cryptography, and editor libraries are MIT licensed.
  - mrd3v0 3y ago
    Good luck working on it! Global preference for open source aside, whichever license you pick, I'd recommend visiting https://joinup.ec.europa.eu/collection/eupl/solution/joinup-licensing-assistant/jla-find-and-compare-software-licenses https://joinup.ec.europa.eu/collection/eupl/solution/joinup-... for example, a great tool to find the appropriate license for your software. https://reuse.software/tutorial/ https://reuse.software/tutorial/ is a great read and a wonderful initiative to help with licensing and compliance. P.S: CC is not made for software.
    - bjoli 3y ago
      I always end up with MPL whenever I do these kinds of selection guides and always wonder why it isn't more widely used. Is it because the lgpl covers a lot of the need for it, or because once you allow static linking you might as well go BSD?
  - YousefED 3y ago
    Do you have a link to the MIT license of the editor? As far as I can see its also CC NC
  - 3y ago
DreamFlasher 3y ago
Could all new and shiny e2ee mail providers please be interoperable? Ie. use PGP or if you are so unhappy with PGP at least base it on matrix.
- wunderland 3y ago
  Proton supports interoperability with PGP
tptacek 3y ago
From the white paper, it appears as if this system requires its users to trust the server. That's not end-to-end encryption. What do I have wrong here? Further, it looks like the email encryption provided by this system only works between users of Skiff. At that point, why use email at all? Why not use a real secure messenger? Instead of building an "encrypted email service", you could literally just build an email-flavored frontend to Matrix; either way, you're proxying to SMTP, not speaking it directly.
- wishywashy0 3y ago
  Founding engineer at Skiff here. >From the white paper, it appears as if this system requires its users to trust the server. That's not end-to-end encryption. What do I have wrong here? It doesn't. All data is encrypted client side across all apps - Skiff Mail, Drive, Pages, and Calendar. For sending external, the whitepaper is very clear how this case is handled in section 8.2 as securely as possible (without having PGP in place. Though this is something we are looking at based on community feedback). >Further, it looks like the email encryption provided by this system only works between users of Skiff. At that point, why use email at all? Why not use a real secure messenger? Instead of building an "encrypted email service", you could literally just build an email-flavored frontend to Matrix; either way, you're proxying to SMTP, not speaking it directly. Lots of folks are sick of getting sold their data sold based on their email. Even corporations are sick of largely giving more information about their customers to Google even notoriously Amazon that stopped sending purchase receipts via email. So even if not end to end encrypted, we do encrypt the emails with the recipient's keys ensuring that only the recipient can access this data. This is a strong privacy guarantee not just backed by a flimsy privacy policy but actual cryptography.
  - tptacek 3y ago
    Section 8.2 seems to talk about how you send plaintext email via SMTP to users who aren't using Skiff. But that's not what I'm talking about with respect to end-to-end encryption. The white paper refers repeatedly to "browser" users. Your server can feed arbitrary Javascript to browsers and subvert encryption in a variety of ways, can't it? I'm still not clear why you designed a new, simplistic cryptosystem at all here; can't you do everything you're trying to do here on top of Matrix? Again: the cryptography promises you're making only work between users of your system.
LWIRVoltage 3y ago
Looked into this, ...it looks interesting. ..Personally, this looks promising. I am going to say it though- Skiff needs some sort of mechanism to use PGP if for nothing else, then to communicate with Protonmail email addresses specifically. I see they are taking the stance its's time to move to something beyond PGP- but given the extremely large userbase that is Protonmail- I think their target market would feel better being able to communicate with their protonmail contacts- using PGP. Also, i'm having trouble seeing if Skiff has a way to 'send secure emails' to other external email providers, like Tutanota ,Mailbox, and Protonamil do for their users to securely contact people outside their ecosystems(like peeps with gmail). Solve those issues- and the pain/difficulty/unease of convenience will disappear for their market which likely already uses Protonmail/Tutanota, etc. And Skiff would be very attractive at that point, positioning itself as a successor to those two possibly.
- tptacek 3y ago
  This is a system that appears to have long-term identity keys, for which "forward security" or "forward secrecy" appears a total of zero times in its white paper. If this is an improvement on PGP, it's not totally clear to me how. Maybe one of its authors will clear that up.
- amilich 3y ago
  I definitely agree, we are considering what to do here. I think there is a lot to improve with PGP (https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html), but I agree with the problem. Right now, you can use Skiff Pages for this. You can share public links that have E2EE using link fragments, add passwords, and collaborate in real-time.
  - upofadown 3y ago
    Well not that much to improve: * https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp
- esdf 3y ago
  openpgp web key directory exists and should work but I don't know if many email providers support or use it
tamimio 3y ago
I’ve been using it for around a year, it’s good overall, the apps can have some improvements especially desktop one.
timmit 3y ago
What is the differences between Skiff and ProtonMail?
raggi 3y ago
The marketing site says there’s full text search. The paper doesn’t cover this. How is this being solved here?
- TillE 3y ago
  Seems trivial enough to do client-side on modern hardware, especially if you exclude attachments.
  - raggi 3y ago
    Without producing confirmation side channels and so on? Doesn’t seem that trivial- at least it needs more thought than assumption of simplicity
    - amilich 3y ago
      We do it in a fairly straightforward manner right now. Check out the blog I linked to above - generate an in-memory index, end-to-end encrypt it, and store it browser storage. It's only decrypted in memory.
  - throwaway1566 3y ago
    To do this you would have to download all emails on all devices all the time to index them. Kind of makes the whole point of a cloud based email moot, if everything is on my device anyway, and logging in and out resets it all - might as well use an email client app.
- amilich 3y ago
  Done completely client side. We actually have multiple blogs on this - https://skiff.com/blog/private-search https://skiff.com/blog/private-search
  - raggi 3y ago
    So if I have 15gb of email, I have to process all of that on every client bootstrap? How do you plan on scaling your service with respect to this problem? once you have a non-trivial user base with non-trivial data volumes this is likely to become a substantial problem.
onereplyac 3y ago
From the whitepaper, it seems search is done by downloading all emails on every device to index them locally. Curious how well this works with a large amount of emails?
andrewmcwatters 3y ago
So what's the state of the art with respect to end-to-end email these days? Lavabit is back, but it seems like everyone uses Protonmail these days? But didn't they get into some sort of controversy a while back that made some people drop them? And now I'm seeing Skiff, which is great, it's clear that people want this. I just no longer know who the players in the space are.
- tamimio 3y ago
  >what's the state of the art with respect to end-to-end email these days? Host your own + GPG
- throwaway1566 3y ago
  Unfortuantely they have become nothing more than snake oil. Huge bloated front-ends with 1000s of npm packages makes it very hard to trust anything like this. Add to this the lack of convenient search without having everything stored locally, and it becomes useless to go with an "encrypted" email provider over just a normal provider with emails stored locally encrypted on your device
whuiosdfh 3y ago
[flagged]
throwawaycities 3y ago
In addition to DNS support it also has ENS support…which to me is pretty cool.
throwaway154 3y ago
Why not just make a front-end for PGP, have users keys publicly available, and an 'invite others' thing for those with undiscoverable keys. That would then actually be email rather than not-email-over-smtp. Another service delegated to trust a 3rd party isn't.
ronnier 3y ago
I’ve seen this provider used by bad actors to create accounts on one of the worlds largest social media platforms. That’s how I learned about skiff. Very hard problem to solve.
Sytten 3y ago
The data is still located in the US so honestly for email I would not see the benefit since so much of it will pass through unencrypted on a cloud provider (AWS?). I personally use mailfence with IMAP on Thunderbird (so its not full E2E encryption despite the marketing) but I much prefer the Belgian privacy law. Though the mobile/destop apps looks very nice and overall kudos for what seems like a coherent ecosystem (something I miss from my patching of sync.com and mailfence). Also concerned by VC money in that space, hopefully you are profitable. Nobody wants to have to move their life (calendar, drive, emails) because they trusted a startup that ran out of money...
deleted 3y ago
[deleted]
thecodeboy 3y ago
How has Skiff's email deliverability been? I'm curious if your emails go to spam more frequently, being a smaller player in an established hegemony. You have a generous free tier which may attract spammers. How do you deal with IP reputation?
- amilich 3y ago
  Deliverability is a constant challenge for us to improve on. We have rate limits that do try to protect email deliverability. Things should be good today but it will always be something to watch.
  - naveen-kumar 3y ago
    @Amilich, what's your approach to companies wanting to use Skiff? I'm starting a company of my own and while I'd love to use Skiff, there are a bunch of blockers including email inbox warming. Without SMTP/IMAP support, no warming tool will work, and no API means no one can build scripts to do the same. This small case itself will be a blocker around adoption for companies right?
- Scottn1 3y ago
  I opened an account at Skiff a few weeks ago and have used it in limited amount since then. But sending an email to my outlook.com address and my wife's gmail they both went right to inbox on first try. That was pretty impressive considering some long established email providers still go right to my spam at times.
doodlebugging 3y ago
Looks nice. I might give this a try. I noticed on your home page near the bottom under the "Getting the Latest in Privacy" subheading your list of scrollables begins to duplicate entries if you keep clicking the right arrow after the "Brave Talk X Skiff" panel. From that point on, most of the entries are twinned until you reach the end of the list. I'm a button clicker. It's a bad habit.
- amilich 3y ago
  Darn. Will have to fix it. Thanks.
kseistrup 3y ago
It seem the servers — at least the MX'es — are all US based (less convenient for people in e.g. EU) and without IPv6 connectivity.
virtualritz 3y ago
I get "Could not create account. Contact support@skiff.org for support." after entering my password for registering. On that note: the passwort page for the registration form has terrible UX. Paste is disabled for the 'Confirm password' field (Chrome, Android) but for not the first 'password' one. Rationale? I use a decent-length generated password from KeePass. Being forced to typing this out just plain sucks. Edit: after reloading the page, paste works also on the 'Confirm password' field. Very strange. Account creation still fails with above error though.
- amilich 3y ago
  This sounds like a possible captcha error. Can you email me at andrew (at) skiff.com ? Sorry about this.
onetokeoverthe 3y ago
Not downloading a recovery key. Bye.
Youden 3y ago
After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in. ProtonMail does have import/export and the SMTP bridge (for paid users) and those things work but ProtonMail mangles emails: it removes plaintext body where there's a HTML body and it screws with headers. Ultimately the best option I could come up with was self-hosting my email address. Incoming emails go directly to a box sitting in my office, with TLS enforced. I put this off for years fearing deliverability issues but finally realised that incoming and outgoing email can be hosted in different places. So though the box in my office receives my email, I send email through either a Hetzner box or Mailgun (with retention disabled). Haven't encountered any issues with this so far.
- JeremyNT 3y ago
  I could recommend Fastmail with PGP (when it matters). They have good documentation on how to do this [0]. More expensive than self hosting, but still quite cheap, and no weird vendor-specific lockin for the important parts. [0] https://www.fastmail.com/blog/pgp-tools-with-fastmail/ https://www.fastmail.com/blog/pgp-tools-with-fastmail/
- taskforcegemini 3y ago
  > After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in. wow, an e-mail service without smtp nor imap?? no thanks
  - amilich 3y ago
    We do have export to EML and ZIP files. SMTP/IMAP are not trivial due to end-to-end encryption.
  - jacooper 3y ago
    You can't have SMTP if it's fully end-to-end encrypted. That's why proton has a bridge, it decrypts messages locally, then runs an SMTP server for your local clients.
BilalBudhani 3y ago
I have been using Skiff for a month now and so far their service has been great. I love their custom domain & alias feature. Besides, I want my backup email address to be a non-gmail service to avoid complete vendor lock in.
upofadown 3y ago
I am not sure how the identity management works for encrypted email for Skiff. The white paper[1] seems to imply that a user has to send a URL with a secret in it as with document sharing. Every time? How is the user expected to get this secret URL to their correspondents? Does it require the use of a second messaging system with identity management? PGP for instance? Generally, how does Skiff allow the user to ensure that the message is being sent to their actual correspondent and not the Skiff server? Signal messenger for instance uses "Safety Numbers" for this purpose. [1] https://skiff-org.github.io/whitepaper/Skiff_Whitepaper_2023.pdf\ https://skiff-org.github.io/whitepaper/Skiff_Whitepaper_2023...
danielovichdk 3y ago
Honest question. Is PGP not just the way to go?
willhackett 3y ago
I like this concept, it's not "open" source though. Apple peeps, it'd be lovely if you could make the Mail app more useful & prettier.
YLYvYkHeB2NRNT 3y ago
The only true email that was worth anything was lavabit pre Snowden.
mike-cardwell 3y ago
"privacy first" Yet the web UI downloads remote images by default. Granted, it hides your IP address by proxying the request. But it still leaks that the message was read. I used https://www.emailprivacytester.com https://www.emailprivacytester.com to test this. No image was fetched until I clicked the email to read it.
- amilich 3y ago
  We offer a block remote content feature. There is no foolproof way to load any remote content without possibly exposing email open information.
  - mike-cardwell 3y ago
    My point was that defaults matter, and your default is not privacy preserving. Yet you claim to be a "privacy first" service. There are many email clients which do not download remote content by default. I would argue that they preserve privacy better than Skiff does.
    - amilich 3y ago
      What mail providers block all remote content by default?
      - mike-cardwell 3y ago
        I don't have a list for you. I would have thought you'd have this data yourself given the business you're in.
        amilich 3y ago
        Yes - privacy focused mail providers offer this as an option but do not enable it by default. Mainstream mail providers do not even have it as an option.
        3y ago

206 points by throwoutway 3y ago

[dead]

I just wish they had bothered to integrate PGP, like Protonmail or Mailbox.org do. Right now it's yet another completely insular solution.

ifeja 3y ago

Skiff is very good so far.

aaravchen 3y ago

The website doesn't work on Firefox at all. It can't even be scrolled up or down on Firefox mobile or desktop, or any variant of Firefox.

yawnxyz 3y ago

Will you guys bring "multiplayer" mode like Front?

amilich 3y ago
We might! We actually have a collaborative, e2ee editor (skiff.com/pages)

n00bskoolbus 3y ago

Is the benefit of this over something like Protonmail or Tutanota the enterprise focus products? As an individual user seems like I may as well pocket the difference, right?

esdf 3y ago
Skiff says they encrypt email subjects while protonmail does not. I cannot determine from browsing if they encrypt the sender and receiver addresses. Skiff's free tier also has a 'generous' free tier with 4 aliases, 10GB of drive (only? combined with email?) storage, and custom domain support (? !)
- amilich 3y ago
  Hello! I'm one of the founders. We do end-to-end encrypt email subjects. Sender/receiver addresses are not to ensure email goes to the right person. 10 GB drive is used across all Skiff products.
  - rnk 3y ago
    And domain support?
    - naveen-kumar 3y ago
      I've been using my personal domain on Skiff and been loving it personally! Simple to setup (nothing different to the usual) and it all works seamlessly! Just that, it's one inbox in the Free tier. Since I'm using on my own domain, I prefer having one inbox for all addresses!
    - ginsbergjason 3y ago
      you can transfer a custom domain on the free tier. we also let you register custom domains directly inside the product.
    - amilich 3y ago
      Yes, we have custom domain support with DKIM/DMARC/SPF all enabled.
      - JadoJodo 3y ago
        I use FastMail but would consider moving. Can I have unlimited aliases when using my own domain? I use their MaskedEmail function to generate aliases for each service and have > 150 at this point.

ifeja 3y ago

How long is it free for?

tikkun 3y ago
As another perspective, I personally prefer products that are paid because it makes me less concerned that my data is the product, and less concerned that the product will disappear or stop improving.
- ginsbergjason 3y ago
  we offer 3 paid tiers in addition to the free tier. you can also purchase custom domains directly inside skiff.

redeux 3y ago

The pricing page is confusing to me. It doesn’t mention anything about email in the free tier. It just says: > Unlimited pages > Desktop, tablet, and mobile access > IPFS support > Full text search Which seems to be all about the document service, but it also doesn’t mention how much storage I get. I assume it’s not unlimited despite saying “Unlimited pages.” Also, I can see that Skiff has raised over $14M in VC funds[1], so as a privacy-focused product with a free-tier I think it’s fair to ask what they see as their path to profitability is without compromising either their privacy or their free offering. 1. https://www.crunchbase.com/organization/skiff-402f/company_financials https://www.crunchbase.com/organization/skiff-402f/company_f...

amilich 3y ago
Are you possibly on a different or old page (or article)? Check out https://skiff.com/pricing https://skiff.com/pricing and scroll down, it has 20+ features. We have thousands of paid users!
- redeux 3y ago
  Interesting. No, I went to that page but on mobile. I didn’t scroll all the way down past the tiers. You have to scroll way down to see that info. It’s probably fine on desktop but less than ideal on mobile. My 2-cents anyway.
  - amilich 3y ago
    Ah, ok. Updating it now! Thanks for the feedback, you're totally right. It's probably 18 months old.
ginsbergjason 3y ago
you're right it is confusing. we're updating it now.
ignoramous 3y ago
> Skiff has raised over $14M in VC funds, so as a privacy-focused product... They seemed to have pivoted from web3? https://news.ycombinator.com/item?id=29797691 https://news.ycombinator.com/item?id=29797691

ssddanbrown 3y ago

Their website describes this as open source but their linked repo is under CC BY-NC-SA 4.0 [1] so not commonly regarded as open source, but instead source available. They have been made aware of this [2]. Additionally, I think it may only be the front-end parts of their apps that are source available, I'm not sure the server-side parts of their app have sources published. [1] https://creativecommons.org/licenses/by-nc-sa/4.0/ https://creativecommons.org/licenses/by-nc-sa/4.0/ [2] https://github.com/skiff-org/skiff-apps/issues/94 https://github.com/skiff-org/skiff-apps/issues/94

amilich 3y ago
Hello! Yes, we're working on this. Note that our UI, cryptography, and editor libraries are MIT licensed.
- mrd3v0 3y ago
  Good luck working on it! Global preference for open source aside, whichever license you pick, I'd recommend visiting https://joinup.ec.europa.eu/collection/eupl/solution/joinup-licensing-assistant/jla-find-and-compare-software-licenses https://joinup.ec.europa.eu/collection/eupl/solution/joinup-... for example, a great tool to find the appropriate license for your software. https://reuse.software/tutorial/ https://reuse.software/tutorial/ is a great read and a wonderful initiative to help with licensing and compliance. P.S: CC is not made for software.
  - bjoli 3y ago
    I always end up with MPL whenever I do these kinds of selection guides and always wonder why it isn't more widely used. Is it because the lgpl covers a lot of the need for it, or because once you allow static linking you might as well go BSD?
- YousefED 3y ago
  Do you have a link to the MIT license of the editor? As far as I can see its also CC NC
- 3y ago

DreamFlasher 3y ago

Could all new and shiny e2ee mail providers please be interoperable? Ie. use PGP or if you are so unhappy with PGP at least base it on matrix.

wunderland 3y ago
Proton supports interoperability with PGP

tptacek 3y ago

From the white paper, it appears as if this system requires its users to trust the server. That's not end-to-end encryption. What do I have wrong here? Further, it looks like the email encryption provided by this system only works between users of Skiff. At that point, why use email at all? Why not use a real secure messenger? Instead of building an "encrypted email service", you could literally just build an email-flavored frontend to Matrix; either way, you're proxying to SMTP, not speaking it directly.

wishywashy0 3y ago
Founding engineer at Skiff here. >From the white paper, it appears as if this system requires its users to trust the server. That's not end-to-end encryption. What do I have wrong here? It doesn't. All data is encrypted client side across all apps - Skiff Mail, Drive, Pages, and Calendar. For sending external, the whitepaper is very clear how this case is handled in section 8.2 as securely as possible (without having PGP in place. Though this is something we are looking at based on community feedback). >Further, it looks like the email encryption provided by this system only works between users of Skiff. At that point, why use email at all? Why not use a real secure messenger? Instead of building an "encrypted email service", you could literally just build an email-flavored frontend to Matrix; either way, you're proxying to SMTP, not speaking it directly. Lots of folks are sick of getting sold their data sold based on their email. Even corporations are sick of largely giving more information about their customers to Google even notoriously Amazon that stopped sending purchase receipts via email. So even if not end to end encrypted, we do encrypt the emails with the recipient's keys ensuring that only the recipient can access this data. This is a strong privacy guarantee not just backed by a flimsy privacy policy but actual cryptography.
- tptacek 3y ago
  Section 8.2 seems to talk about how you send plaintext email via SMTP to users who aren't using Skiff. But that's not what I'm talking about with respect to end-to-end encryption. The white paper refers repeatedly to "browser" users. Your server can feed arbitrary Javascript to browsers and subvert encryption in a variety of ways, can't it? I'm still not clear why you designed a new, simplistic cryptosystem at all here; can't you do everything you're trying to do here on top of Matrix? Again: the cryptography promises you're making only work between users of your system.

LWIRVoltage 3y ago

Looked into this, ...it looks interesting. ..Personally, this looks promising. I am going to say it though- Skiff needs some sort of mechanism to use PGP if for nothing else, then to communicate with Protonmail email addresses specifically. I see they are taking the stance its's time to move to something beyond PGP- but given the extremely large userbase that is Protonmail- I think their target market would feel better being able to communicate with their protonmail contacts- using PGP. Also, i'm having trouble seeing if Skiff has a way to 'send secure emails' to other external email providers, like Tutanota ,Mailbox, and Protonamil do for their users to securely contact people outside their ecosystems(like peeps with gmail). Solve those issues- and the pain/difficulty/unease of convenience will disappear for their market which likely already uses Protonmail/Tutanota, etc. And Skiff would be very attractive at that point, positioning itself as a successor to those two possibly.

tptacek 3y ago
This is a system that appears to have long-term identity keys, for which "forward security" or "forward secrecy" appears a total of zero times in its white paper. If this is an improvement on PGP, it's not totally clear to me how. Maybe one of its authors will clear that up.
amilich 3y ago
I definitely agree, we are considering what to do here. I think there is a lot to improve with PGP (https://latacora.micro.blog/2019/07/16/the-pgp-problem.html https://latacora.micro.blog/2019/07/16/the-pgp-problem.html), but I agree with the problem. Right now, you can use Skiff Pages for this. You can share public links that have E2EE using link fragments, add passwords, and collaborate in real-time.
- upofadown 3y ago
  Well not that much to improve: * https://articles.59.ca/doku.php?id=pgpfan:tpp https://articles.59.ca/doku.php?id=pgpfan:tpp
esdf 3y ago
openpgp web key directory exists and should work but I don't know if many email providers support or use it

tamimio 3y ago

I’ve been using it for around a year, it’s good overall, the apps can have some improvements especially desktop one.

timmit 3y ago

What is the differences between Skiff and ProtonMail?

raggi 3y ago

The marketing site says there’s full text search. The paper doesn’t cover this. How is this being solved here?

TillE 3y ago
Seems trivial enough to do client-side on modern hardware, especially if you exclude attachments.
- raggi 3y ago
  Without producing confirmation side channels and so on? Doesn’t seem that trivial- at least it needs more thought than assumption of simplicity
  - amilich 3y ago
    We do it in a fairly straightforward manner right now. Check out the blog I linked to above - generate an in-memory index, end-to-end encrypt it, and store it browser storage. It's only decrypted in memory.
- throwaway1566 3y ago
  To do this you would have to download all emails on all devices all the time to index them. Kind of makes the whole point of a cloud based email moot, if everything is on my device anyway, and logging in and out resets it all - might as well use an email client app.
amilich 3y ago
Done completely client side. We actually have multiple blogs on this - https://skiff.com/blog/private-search https://skiff.com/blog/private-search
- raggi 3y ago
  So if I have 15gb of email, I have to process all of that on every client bootstrap? How do you plan on scaling your service with respect to this problem? once you have a non-trivial user base with non-trivial data volumes this is likely to become a substantial problem.

onereplyac 3y ago

From the whitepaper, it seems search is done by downloading all emails on every device to index them locally. Curious how well this works with a large amount of emails?

andrewmcwatters 3y ago

So what's the state of the art with respect to end-to-end email these days? Lavabit is back, but it seems like everyone uses Protonmail these days? But didn't they get into some sort of controversy a while back that made some people drop them? And now I'm seeing Skiff, which is great, it's clear that people want this. I just no longer know who the players in the space are.

tamimio 3y ago
>what's the state of the art with respect to end-to-end email these days? Host your own + GPG
throwaway1566 3y ago
Unfortuantely they have become nothing more than snake oil. Huge bloated front-ends with 1000s of npm packages makes it very hard to trust anything like this. Add to this the lack of convenient search without having everything stored locally, and it becomes useless to go with an "encrypted" email provider over just a normal provider with emails stored locally encrypted on your device

whuiosdfh 3y ago

[flagged]

throwawaycities 3y ago

In addition to DNS support it also has ENS support…which to me is pretty cool.

throwaway154 3y ago

Why not just make a front-end for PGP, have users keys publicly available, and an 'invite others' thing for those with undiscoverable keys. That would then actually be email rather than not-email-over-smtp. Another service delegated to trust a 3rd party isn't.

ronnier 3y ago

I’ve seen this provider used by bad actors to create accounts on one of the worlds largest social media platforms. That’s how I learned about skiff. Very hard problem to solve.

Sytten 3y ago

The data is still located in the US so honestly for email I would not see the benefit since so much of it will pass through unencrypted on a cloud provider (AWS?). I personally use mailfence with IMAP on Thunderbird (so its not full E2E encryption despite the marketing) but I much prefer the Belgian privacy law. Though the mobile/destop apps looks very nice and overall kudos for what seems like a coherent ecosystem (something I miss from my patching of sync.com and mailfence). Also concerned by VC money in that space, hopefully you are profitable. Nobody wants to have to move their life (calendar, drive, emails) because they trusted a startup that ran out of money...

deleted 3y ago

[deleted]

thecodeboy 3y ago

How has Skiff's email deliverability been? I'm curious if your emails go to spam more frequently, being a smaller player in an established hegemony. You have a generous free tier which may attract spammers. How do you deal with IP reputation?

amilich 3y ago
Deliverability is a constant challenge for us to improve on. We have rate limits that do try to protect email deliverability. Things should be good today but it will always be something to watch.
- naveen-kumar 3y ago
  @Amilich, what's your approach to companies wanting to use Skiff? I'm starting a company of my own and while I'd love to use Skiff, there are a bunch of blockers including email inbox warming. Without SMTP/IMAP support, no warming tool will work, and no API means no one can build scripts to do the same. This small case itself will be a blocker around adoption for companies right?
Scottn1 3y ago
I opened an account at Skiff a few weeks ago and have used it in limited amount since then. But sending an email to my outlook.com address and my wife's gmail they both went right to inbox on first try. That was pretty impressive considering some long established email providers still go right to my spam at times.

doodlebugging 3y ago

Looks nice. I might give this a try. I noticed on your home page near the bottom under the "Getting the Latest in Privacy" subheading your list of scrollables begins to duplicate entries if you keep clicking the right arrow after the "Brave Talk X Skiff" panel. From that point on, most of the entries are twinned until you reach the end of the list. I'm a button clicker. It's a bad habit.

amilich 3y ago
Darn. Will have to fix it. Thanks.

kseistrup 3y ago

It seem the servers — at least the MX'es — are all US based (less convenient for people in e.g. EU) and without IPv6 connectivity.

virtualritz 3y ago

I get "Could not create account. Contact support@skiff.org for support." after entering my password for registering. On that note: the passwort page for the registration form has terrible UX. Paste is disabled for the 'Confirm password' field (Chrome, Android) but for not the first 'password' one. Rationale? I use a decent-length generated password from KeePass. Being forced to typing this out just plain sucks. Edit: after reloading the page, paste works also on the 'Confirm password' field. Very strange. Account creation still fails with above error though.

amilich 3y ago
This sounds like a possible captcha error. Can you email me at andrew (at) skiff.com ? Sorry about this.

onetokeoverthe 3y ago

Not downloading a recovery key. Bye.

Youden 3y ago

After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in. ProtonMail does have import/export and the SMTP bridge (for paid users) and those things work but ProtonMail mangles emails: it removes plaintext body where there's a HTML body and it screws with headers. Ultimately the best option I could come up with was self-hosting my email address. Incoming emails go directly to a box sitting in my office, with TLS enforced. I put this off for years fearing deliverability issues but finally realised that incoming and outgoing email can be hosted in different places. So though the box in my office receives my email, I send email through either a Hetzner box or Mailgun (with retention disabled). Haven't encountered any issues with this so far.

JeremyNT 3y ago
I could recommend Fastmail with PGP (when it matters). They have good documentation on how to do this [0]. More expensive than self hosting, but still quite cheap, and no weird vendor-specific lockin for the important parts. [0] https://www.fastmail.com/blog/pgp-tools-with-fastmail/ https://www.fastmail.com/blog/pgp-tools-with-fastmail/
taskforcegemini 3y ago
> After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in. wow, an e-mail service without smtp nor imap?? no thanks
- amilich 3y ago
  We do have export to EML and ZIP files. SMTP/IMAP are not trivial due to end-to-end encryption.
- jacooper 3y ago
  You can't have SMTP if it's fully end-to-end encrypted. That's why proton has a bridge, it decrypts messages locally, then runs an SMTP server for your local clients.

BilalBudhani 3y ago

I have been using Skiff for a month now and so far their service has been great. I love their custom domain & alias feature. Besides, I want my backup email address to be a non-gmail service to avoid complete vendor lock in.

upofadown 3y ago

I am not sure how the identity management works for encrypted email for Skiff. The white paper[1] seems to imply that a user has to send a URL with a secret in it as with document sharing. Every time? How is the user expected to get this secret URL to their correspondents? Does it require the use of a second messaging system with identity management? PGP for instance? Generally, how does Skiff allow the user to ensure that the message is being sent to their actual correspondent and not the Skiff server? Signal messenger for instance uses "Safety Numbers" for this purpose. [1] https://skiff-org.github.io/whitepaper/Skiff_Whitepaper_2023.pdf\ https://skiff-org.github.io/whitepaper/Skiff_Whitepaper_2023...

danielovichdk 3y ago

Honest question. Is PGP not just the way to go?

willhackett 3y ago

I like this concept, it's not "open" source though. Apple peeps, it'd be lovely if you could make the Mail app more useful & prettier.

YLYvYkHeB2NRNT 3y ago

The only true email that was worth anything was lavabit pre Snowden.

mike-cardwell 3y ago

"privacy first" Yet the web UI downloads remote images by default. Granted, it hides your IP address by proxying the request. But it still leaks that the message was read. I used https://www.emailprivacytester.com https://www.emailprivacytester.com to test this. No image was fetched until I clicked the email to read it.

amilich 3y ago
We offer a block remote content feature. There is no foolproof way to load any remote content without possibly exposing email open information.
- mike-cardwell 3y ago
  My point was that defaults matter, and your default is not privacy preserving. Yet you claim to be a "privacy first" service. There are many email clients which do not download remote content by default. I would argue that they preserve privacy better than Skiff does.
  - amilich 3y ago
    What mail providers block all remote content by default?
    - mike-cardwell 3y ago
      I don't have a list for you. I would have thought you'd have this data yourself given the business you're in.
      - amilich 3y ago
        Yes - privacy focused mail providers offer this as an option but do not enable it by default. Mainstream mail providers do not even have it as an option.
        3y ago