4 ms·

Some interesting facts about Proton Mail. It generates OpenPGP keys on their own servers, and if you want to use your own keys their instructions show users how

Some interesting facts about Proton Mail. It generates OpenPGP keys on their own servers, and if you want to use your own keys their instructions show users how to upload upload their entire OpenPGP secret keychain to Proton Mail. Not just encryption/signing subkeys, the master key also needs to be included. I've emailed them to ask that they fix this. I also created a post on their user voice thing about it. https://protonmail.uservoice.com/forums/284483-proton-mail/suggestions/48298640-import-own-openpgp-subkeys-only https://protonmail.uservoice.com/forums/284483-proton-mail/s... TLDR; Proton Mail tells users to do this: gpg --armor --export-secret-keys "${USER_ID}" | import-into-proton-mail They should support this instead: gpg --armor --export-secret-subkeys "${PROTON_ENCR_SUBKEY_ID}!" | import-into-proton-mail gpg --armor --export-secret-subkeys "${PROTON_SIGN_SUBKEY_ID}!" | import-into-proton-mail First one leaks the user's master key to them.

ta988 3y ago
Of course they will not. If you look at everything they propose there is always that one thing that makes them control everything. Their IMAP bridge, key generation etc
- trog 3y ago
  I don't know much about Proton Mail but presumably they want that so they can actually provide you with a more complete service, other than just being a mail gateway? I would assume that any technically sophisticated users who just want an SMTP/IMAP server would never let their keys leave their control, but there might be other users for whom a "middle layer" service which has their keys is good enough. (I guess this is especially evident in cryptoassets where people seem to cheerfully let third parties manage their tokens, so it's not really surprising to me that there are a bunch of people willing to do it with their PGP keys for email purposes.) I guess there's an argument about whether or not they're being responsible in providing such an option at all, which is fair enough.
- matheusmoreira 3y ago
  It's how they make OpenPGP easy to use. Everyone who's ever tried it knows how hopelessly complicated it is. Their bridge's entire purpose is to present a standard email server to email clients so that all the OpenPGP stuff can be done automatically and transparently behind the scenes. Does that create trust issues? Absolutely. Still, OpenPGP sucks and I just can't fault them for trying to fix it. They're even participating in the standards bodies alongside other OpenPGP projects trying to modernize the whole thing. Somehow it resulted in gpg forking the standard and making everything even worse. It was hard to use before, now it's hard and fragmented. https://lwn.net/Articles/953797/ https://lwn.net/Articles/953797/ https://news.ycombinator.com/item?id=38554393 https://news.ycombinator.com/item?id=38554393 I suppose they could have gpg or OpenPGP smartcard integration in the bridge, then it could use those keys to sign and encrypt. That's more secure but creates quite a bit of hassle. Suddenly the web and mobile apps become incapable of sending OpenPGP email unless you have the smartcard connected. I've got two NFC enabled YubiKeys and I can't even begin to imagine how to connect this stuff to a smartphone. Looks like there isn't enough support for it. https://news.ycombinator.com/item?id=40177539 https://news.ycombinator.com/item?id=40177539
underlogic 3y ago
fix it? are you kidding! that they demanded the private key tells you _everything_ you need to know about protonmail.
- matheusmoreira 3y ago
  Well, they are literally in the business of making OpenPGP easy to use. I understand your worry but I can also understand where they're coming from. The fact is PGP is stupidly hard. I once ran into a gpg bug that deleted my master key. I got so frustrated I just gave up and forgot about it for years. Without services like Proton Mail, this stuff is just never going to be mainstream. The only way to retain full control over all the keys is to do it the hard way: manually encrypt the emails and send that payload via SMTP. If we refuse to give them the keys, we can't enjoy the convenience of Proton Mail doing that automatically for us. Proton Mail offers a middle ground and it's a very attractive one if you accept the inherent risks associated with giving them the keys. I'm not willing to give them the master key though. I want the ability to generate a bunch of subkeys just for them. Then I can just revoke those keys if they're ever compromised, and the emails will be encrypted and signed by my actual OpenPGP identity that I'm investing time into, not a separate master key generated for my Proton Mail account. The support guys confirmed to me in writing via email that Proton Mail only ever uses the signing and encryption subkeys. They don't need the master key. > We use the signing subkey for signing and the encryption subkey for encryption, and you will have to import the whole OpenPGP at once. So I asked them directly to add support for importing just the subkeys. I made a post on their user voice thing about this too. It's garnered a bit of support already. https://protonmail.uservoice.com/forums/284483-proton-mail/suggestions/48298640-import-own-openpgp-subkeys-only https://protonmail.uservoice.com/forums/284483-proton-mail/s... Let's see what happens.
  - underlogic 3y ago
    It's a "trust me" story. Honeypot
    - matheusmoreira 3y ago
      I can't deny that possibility. Still, it should be an individual's choice to risk it or not.
emptysongglass 3y ago
Proton Mail also still doesn't detect WIKD keys on the other side despite reporting it over 5 years ago.
- twiss 3y ago
  We do fetch keys from WKD, as announced almost 5 years ago: https://proton.me/blog/security-updates-2019 https://proton.me/blog/security-updates-2019 :)
  - emptysongglass 3y ago
    Actually, you have a bug that has been unfixed for 5 years now. I know because I submitted it. Still no action. Here's my last message to Proton Mail support, request ID 822331. I was directly told no resources would be spent on fixing it: > Well, it has been multiple years now so can you guys maybe prioritize this? How long do you want me to continue waiting on this issue? I can't count on PM users to send my mailserver E2EE mail when the mobile app doesn't support it.
    - sevagh 3y ago
      So is the feature missing or is your support ticket open?
      - emptysongglass 3y ago
        It's been open for 5 years.
twiss 3y ago
Hi! Crypto team lead here. 1. We don't generate OpenPGP keys on the server, we generate them in the client, and then encrypt them with a key derived from your password (which we never send to the server), and store the encrypted key on the server. Then, when you login again, we fetch and decrypt the private key, and use it in the client. The server never has access to your private keys. 2. We do support "GNU Dummy" keys now (which is what `gpg --export-secret-subkeys` creates). The required private key material needs to be in a single OpenPGP key though (with a dummy primary key), but that's what `gpg --export-secret-subkeys` does by default. Though, as mentioned above, we don't have access to the primary key on our servers either way. 2a. Note that "GNU Dummy" keys are a gpg-specific extension to OpenPGP [1]. The upcoming new version of the OpenPGP standard [2] allows a more standardized way of doing this by combining public key packets and private key packets in a single transferable private key, but it's not widely implemented yet. 3. I would argue that the private key material of the subkeys (used to encrypt and sign your emails) is actually much more important in this case (but of course we don't have access to that either). That's the reason we don't explicitly recommend this: it doesn't meaningfully improve security. But we don't stop you from doing it (now that we support it, even though it's a nonstandard feature), either. [1]: https://github.com/gpg/gnupg/blob/master/doc/DETAILS#gnu-extensions-to-the-s2k-algorithm https://github.com/gpg/gnupg/blob/master/doc/DETAILS#gnu-ext... [2]: https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-cry...
- matheusmoreira 3y ago
  > We don't generate OpenPGP keys on the server, we generate them in the client, and then encrypt them with a key derived from your password (which we never send to the server), and store the encrypted key on the server. I see, I stand corrected then. Thanks for clarifying. The Proton Mail interface contains buttons labeled "generate" so I got the impression it was being generated in the server. Is this password-derived key the "account key" which I see in the Proton Mail settings interface? Please clarify what key derivation function is being used. The OpenPGP S2K which gpg uses is outdated and probably not secure enough. I know that Proton Mail is involved in the OpenPGP standards body in an effort to modernize it and that the new RFC contains support for the memory hard argon2 algorithm. Is that what's being used? If so then I would believe that it's even more secure than the encryption that gpg applies to the exported key output. Are there instructions for verifying that all this is happening? I think a lot of folks on HN won't be convinced otherwise. > We do support "GNU Dummy" keys now (which is what `gpg --export-secret-subkeys` creates). Wow that is GREAT and the exact information I wanted! I only believed otherwise because of the documented instructions, which contain the command I posted above. I double checked with Proton Mail support as well but everything led to believe that this was not supported when in fact it was. Please add this fact to your documentation and instruct your support staff about this!! > I would argue that the private key material of the subkeys (used to encrypt and sign your emails) is actually much more important in this case (but of course we don't have access to that either). I agree. Those are the keys which sign and encrypt the data after all. It's just that I'm going to create an OpenPGP identity for things like signing code commits on git, signing packages I publish. I'm putting quite a bit of effort into getting it right. I printed out the master key to paper in paperkey and QR code format. I even contributed code to ZBar to add binary decoding support so that the key backup is easy to restore. I'll also be making an effort to join the decentralized web of trust. So I was really hoping to be able to use Proton Mail with this identity instead of the key pair that's generated for the account. This way the emails I send can be signed by the same identity that I'll publish on the OpenPGP key servers. Looks like it's going to be possible after all. Thanks for reaching out here on HN. I've been a really happy Proton Mail customer and now I'm even happier.
romanregin402 2y ago
[dead]

ta988 3y ago

Of course they will not. If you look at everything they propose there is always that one thing that makes them control everything. Their IMAP bridge, key generation etc

trog 3y ago
I don't know much about Proton Mail but presumably they want that so they can actually provide you with a more complete service, other than just being a mail gateway? I would assume that any technically sophisticated users who just want an SMTP/IMAP server would never let their keys leave their control, but there might be other users for whom a "middle layer" service which has their keys is good enough. (I guess this is especially evident in cryptoassets where people seem to cheerfully let third parties manage their tokens, so it's not really surprising to me that there are a bunch of people willing to do it with their PGP keys for email purposes.) I guess there's an argument about whether or not they're being responsible in providing such an option at all, which is fair enough.
matheusmoreira 3y ago
It's how they make OpenPGP easy to use. Everyone who's ever tried it knows how hopelessly complicated it is. Their bridge's entire purpose is to present a standard email server to email clients so that all the OpenPGP stuff can be done automatically and transparently behind the scenes. Does that create trust issues? Absolutely. Still, OpenPGP sucks and I just can't fault them for trying to fix it. They're even participating in the standards bodies alongside other OpenPGP projects trying to modernize the whole thing. Somehow it resulted in gpg forking the standard and making everything even worse. It was hard to use before, now it's hard and fragmented. https://lwn.net/Articles/953797/ https://lwn.net/Articles/953797/ https://news.ycombinator.com/item?id=38554393 https://news.ycombinator.com/item?id=38554393 I suppose they could have gpg or OpenPGP smartcard integration in the bridge, then it could use those keys to sign and encrypt. That's more secure but creates quite a bit of hassle. Suddenly the web and mobile apps become incapable of sending OpenPGP email unless you have the smartcard connected. I've got two NFC enabled YubiKeys and I can't even begin to imagine how to connect this stuff to a smartphone. Looks like there isn't enough support for it. https://news.ycombinator.com/item?id=40177539 https://news.ycombinator.com/item?id=40177539

underlogic 3y ago

fix it? are you kidding! that they demanded the private key tells you _everything_ you need to know about protonmail.

matheusmoreira 3y ago
Well, they are literally in the business of making OpenPGP easy to use. I understand your worry but I can also understand where they're coming from. The fact is PGP is stupidly hard. I once ran into a gpg bug that deleted my master key. I got so frustrated I just gave up and forgot about it for years. Without services like Proton Mail, this stuff is just never going to be mainstream. The only way to retain full control over all the keys is to do it the hard way: manually encrypt the emails and send that payload via SMTP. If we refuse to give them the keys, we can't enjoy the convenience of Proton Mail doing that automatically for us. Proton Mail offers a middle ground and it's a very attractive one if you accept the inherent risks associated with giving them the keys. I'm not willing to give them the master key though. I want the ability to generate a bunch of subkeys just for them. Then I can just revoke those keys if they're ever compromised, and the emails will be encrypted and signed by my actual OpenPGP identity that I'm investing time into, not a separate master key generated for my Proton Mail account. The support guys confirmed to me in writing via email that Proton Mail only ever uses the signing and encryption subkeys. They don't need the master key. > We use the signing subkey for signing and the encryption subkey for encryption, and you will have to import the whole OpenPGP at once. So I asked them directly to add support for importing just the subkeys. I made a post on their user voice thing about this too. It's garnered a bit of support already. https://protonmail.uservoice.com/forums/284483-proton-mail/suggestions/48298640-import-own-openpgp-subkeys-only https://protonmail.uservoice.com/forums/284483-proton-mail/s... Let's see what happens.
- underlogic 3y ago
  It's a "trust me" story. Honeypot
  - matheusmoreira 3y ago
    I can't deny that possibility. Still, it should be an individual's choice to risk it or not.

emptysongglass 3y ago

Proton Mail also still doesn't detect WIKD keys on the other side despite reporting it over 5 years ago.

twiss 3y ago
We do fetch keys from WKD, as announced almost 5 years ago: https://proton.me/blog/security-updates-2019 https://proton.me/blog/security-updates-2019 :)
- emptysongglass 3y ago
  Actually, you have a bug that has been unfixed for 5 years now. I know because I submitted it. Still no action. Here's my last message to Proton Mail support, request ID 822331. I was directly told no resources would be spent on fixing it: > Well, it has been multiple years now so can you guys maybe prioritize this? How long do you want me to continue waiting on this issue? I can't count on PM users to send my mailserver E2EE mail when the mobile app doesn't support it.
  - sevagh 3y ago
    So is the feature missing or is your support ticket open?
    - emptysongglass 3y ago
      It's been open for 5 years.

twiss 3y ago

Hi! Crypto team lead here. 1. We don't generate OpenPGP keys on the server, we generate them in the client, and then encrypt them with a key derived from your password (which we never send to the server), and store the encrypted key on the server. Then, when you login again, we fetch and decrypt the private key, and use it in the client. The server never has access to your private keys. 2. We do support "GNU Dummy" keys now (which is what `gpg --export-secret-subkeys` creates). The required private key material needs to be in a single OpenPGP key though (with a dummy primary key), but that's what `gpg --export-secret-subkeys` does by default. Though, as mentioned above, we don't have access to the primary key on our servers either way. 2a. Note that "GNU Dummy" keys are a gpg-specific extension to OpenPGP [1]. The upcoming new version of the OpenPGP standard [2] allows a more standardized way of doing this by combining public key packets and private key packets in a single transferable private key, but it's not widely implemented yet. 3. I would argue that the private key material of the subkeys (used to encrypt and sign your emails) is actually much more important in this case (but of course we don't have access to that either). That's the reason we don't explicitly recommend this: it doesn't meaningfully improve security. But we don't stop you from doing it (now that we support it, even though it's a nonstandard feature), either. [1]: https://github.com/gpg/gnupg/blob/master/doc/DETAILS#gnu-extensions-to-the-s2k-algorithm https://github.com/gpg/gnupg/blob/master/doc/DETAILS#gnu-ext... [2]: https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-crypto-refresh https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-cry...

matheusmoreira 3y ago
> We don't generate OpenPGP keys on the server, we generate them in the client, and then encrypt them with a key derived from your password (which we never send to the server), and store the encrypted key on the server. I see, I stand corrected then. Thanks for clarifying. The Proton Mail interface contains buttons labeled "generate" so I got the impression it was being generated in the server. Is this password-derived key the "account key" which I see in the Proton Mail settings interface? Please clarify what key derivation function is being used. The OpenPGP S2K which gpg uses is outdated and probably not secure enough. I know that Proton Mail is involved in the OpenPGP standards body in an effort to modernize it and that the new RFC contains support for the memory hard argon2 algorithm. Is that what's being used? If so then I would believe that it's even more secure than the encryption that gpg applies to the exported key output. Are there instructions for verifying that all this is happening? I think a lot of folks on HN won't be convinced otherwise. > We do support "GNU Dummy" keys now (which is what `gpg --export-secret-subkeys` creates). Wow that is GREAT and the exact information I wanted! I only believed otherwise because of the documented instructions, which contain the command I posted above. I double checked with Proton Mail support as well but everything led to believe that this was not supported when in fact it was. Please add this fact to your documentation and instruct your support staff about this!! > I would argue that the private key material of the subkeys (used to encrypt and sign your emails) is actually much more important in this case (but of course we don't have access to that either). I agree. Those are the keys which sign and encrypt the data after all. It's just that I'm going to create an OpenPGP identity for things like signing code commits on git, signing packages I publish. I'm putting quite a bit of effort into getting it right. I printed out the master key to paper in paperkey and QR code format. I even contributed code to ZBar to add binary decoding support so that the key backup is easy to restore. I'll also be making an effort to join the decentralized web of trust. So I was really hoping to be able to use Proton Mail with this identity instead of the key pair that's generated for the account. This way the emails I send can be signed by the same identity that I'll publish on the OpenPGP key servers. Looks like it's going to be possible after all. Thanks for reaching out here on HN. I've been a really happy Proton Mail customer and now I'm even happier.

romanregin402 2y ago

[dead]