4 ms·

I'm not a fan of Tuta, mainly because of their disingenuous advertising where they keep calling themselves "open source" when they in fact only open source thei

by hnarn 3y ago

I'm not a fan of Tuta, mainly because of their disingenuous advertising where they keep calling themselves "open source" when they in fact only open source their clients but keep anything server-side under wraps -- but for this reason this also makes me skeptical; if their clients are indeed open source (which I assume is true, I haven't verified), and all encryption happens client-side before being sent to the server (also an assumption), how would it even be possible for this to be true? In my understanding, anything that Tuta potentially did to compromise e-mails would necessarily have to shine through in their open source client code -- unless they willingly serve binaries that are not actually built from that code, which of course would be a scandal. So even if I don't like them, I'm going to need something more concrete than someone simply saying they have "intelligence ties" to be willing to believe that they are somehow duping their users.

linhns 3y ago
Privacy-wise, all your emails are stored in Germany, and govt can just flip the switch at any time and just confiscate the servers.
- byyll 3y ago
  And privacy-wise, the data can be encrypted.
- hnarn 3y ago
  So what? The assumption is that the data is encrypted at rest. If your threat model is "physical seizure by a nation state" then obviously you shouldn't be storing your encrypted data at a SaaS provider in a location out of your control anyway, but I don't see why it would be a reasonable assumption by default that Tuta willingly uses weak (or no) encryption.
  - byyll 3y ago
    > I don't see why it would be a reasonable assumption by default that Tuta willingly uses weak (or no) encryption. Quite the opposite even, according to them at least. They are one of the first pioneering post-quantum encryption in email.
- nicce 3y ago
  It does not matter where the emails are stored if you have zero trust policy and use proper encryption protocols.
amanzi 3y ago
I always ask this when it comes up - how would open-sourcing the server-side components help you trust them? They could be running any code on the server-side and you wouldn't know. So even if they open-sourced their server-side code, how would you know for sure that is actually the code they are running in production? I always ask this because ultimately if you are consuming a web-based application, you have to have some level of trust in the provider. And if you didn't trust them, your only option would be to completely self-host in an environment that only you have full control over.
- hackideiomat 3y ago
  I guess, if the crypto is real, the only things feds could do is tell tuta to load different JS for certain IPs. Which would not be easy to verify as anyone but a targeted person. The point here is, if they have nothing to hide, they can easily open source. If they already have a weird system to serve some people insecure code, they have to extract that from their code base, maintain 2 versions and make sure both sides are up to date at all times. So not going open source is easier if you wanna be malicious. Not a huge task for feds tbh, but still. Also, there's still benefits for my privacy and security as in I'm sure some people would find vulns in the code and report them.
  - amanzi 3y ago
    But my point is that even if they did open-source their backend code, and even if it was 100% secure and showed that full end-to-end encryption was implemented, you still wouldn't know for sure that this was the code they were running in production. They might have a modified code base running in production and you would be none the wiser.
    - hnarn 3y ago
      You’re straw-manning. Nobody said that open sourcing the server component would increase trust in the SaaS service. The whole point of open sourcing a server side component is so that you can self-host, so you don’t have to trust the provider. Also, regardless of whether someone is actually interested in self-hosting or not, one can still call Tuta disingenuous for repeatedly marketing themselves as “open source” when they are clearly not.

by hnarn 3y ago

linhns 3y ago

Privacy-wise, all your emails are stored in Germany, and govt can just flip the switch at any time and just confiscate the servers.

byyll 3y ago
And privacy-wise, the data can be encrypted.
hnarn 3y ago
So what? The assumption is that the data is encrypted at rest. If your threat model is "physical seizure by a nation state" then obviously you shouldn't be storing your encrypted data at a SaaS provider in a location out of your control anyway, but I don't see why it would be a reasonable assumption by default that Tuta willingly uses weak (or no) encryption.
- byyll 3y ago
  > I don't see why it would be a reasonable assumption by default that Tuta willingly uses weak (or no) encryption. Quite the opposite even, according to them at least. They are one of the first pioneering post-quantum encryption in email.
nicce 3y ago
It does not matter where the emails are stored if you have zero trust policy and use proper encryption protocols.

amanzi 3y ago

I always ask this when it comes up - how would open-sourcing the server-side components help you trust them? They could be running any code on the server-side and you wouldn't know. So even if they open-sourced their server-side code, how would you know for sure that is actually the code they are running in production? I always ask this because ultimately if you are consuming a web-based application, you have to have some level of trust in the provider. And if you didn't trust them, your only option would be to completely self-host in an environment that only you have full control over.

hackideiomat 3y ago
I guess, if the crypto is real, the only things feds could do is tell tuta to load different JS for certain IPs. Which would not be easy to verify as anyone but a targeted person. The point here is, if they have nothing to hide, they can easily open source. If they already have a weird system to serve some people insecure code, they have to extract that from their code base, maintain 2 versions and make sure both sides are up to date at all times. So not going open source is easier if you wanna be malicious. Not a huge task for feds tbh, but still. Also, there's still benefits for my privacy and security as in I'm sure some people would find vulns in the code and report them.
- amanzi 3y ago
  But my point is that even if they did open-source their backend code, and even if it was 100% secure and showed that full end-to-end encryption was implemented, you still wouldn't know for sure that this was the code they were running in production. They might have a modified code base running in production and you would be none the wiser.
  - hnarn 3y ago
    You’re straw-manning. Nobody said that open sourcing the server component would increase trust in the SaaS service. The whole point of open sourcing a server side component is so that you can self-host, so you don’t have to trust the provider. Also, regardless of whether someone is actually interested in self-hosting or not, one can still call Tuta disingenuous for repeatedly marketing themselves as “open source” when they are clearly not.