3 ms·
As I read it, that's their point. They're responding to people who are asking them "why don't you do PGP?" (like Proton does), and their answer is a pretty well
by marcus_holmes 3y ago
As I read it, that's their point. They're responding to people who are asking them "why don't you do PGP?" (like Proton does), and their answer is a pretty well-reasoned "because that doesn't make much sense - it doesn't mitigate against any actual threats".
Which kinda begs the question about what Proton thinks they're doing by implementing PGP on behalf of their users...?
- twiss 3y agoWe implement OpenPGP client-side, on the user's devices. Their central complaint of > If it’s running in the browser with code downloaded from our servers, then if we get compromised, we can serve up a version of the PGP code which leaks keys or plaintext. is well-known but only applicable to the web app, the other clients are less susceptible to this. Even for the web app, we are proposing to solve this problem: https://github.com/twiss/source-code-transparency https://github.com/twiss/source-code-transparency
- marcus_holmes 3y agothanks for the clarification. I'm a happy Fastmail user, but I appreciate that other people have different ideas