6 ms·

Show HN: Easily send encrypted email from your existing email

22 points by conorgil145 13y ago

conorgil145 13y ago
Virtru dev here! Virtru allows users to easily send encrypted email from their existing email address. It is super easy to use and currently works in your browser and on your phone. We are launching our public beta program today and would love feedback from the community. Several of the Virtru team members will be monitoring this thread to respond to feedback and questions. EDIT: Virtru team members: DHowitzer (CTO), ravenac95, znelson, jgilpin
lemonlyman87 13y ago
How can Virtru help email users who are concerned with government surveillance activities that have been revealed in the last year?
- jgilpin 13y ago
  Encryption has been used in the past to keep emails secure from surveillance(PGP), but it has always been cumbersome to setup and use on both ends. Virtru's focus has been to make powerful encryption available to everyone by making it easy to use and with the services you and those you communicated with already use. Right now we have Chrome/Firefox support as well as an iPhone app...but many other clients soon.
  - mnrasul 13y ago
    PGP - one can store the keys on one's own server. In Virturo, it appears it has to be on Virutro servers. So hypothetically, we could have a Lavabit moment.
    - jgilpin 13y ago
      See my other comment about Virtru and allowing for self-hosted keys. We also don't host the content, so different laws apply..I think znelson commented on that somewhere in the thread already.
    - ravenac95 13y ago
      I think it's been iterated before, but in the future we intend to open source our key serving software. There's still much work to be done on that front. We love PGP's crypto, but we found a few problems with it in general: 1) It's hard for the normal person. (The user experience for PGP is just horrendous) 2) Before you send an email to someone you have to know their public key. With that said, we have done some research on integrating PGP like public key encryption along with our current key serving mechanism. With public key, using Virtru will be essentially equivalent to holding the keys yourself. Look for more of this in the future :-)
- znelson 13y ago
  Hey, that's a great question. We've put a lot of time and effort into thinking about this and have been working with some key people in the industry who have a lot of experience in this area. We've comprehensively addressed this issue on our blog. Here's the direct link: https://blog.virtru.com/faq-on-government-surveillance/ https://blog.virtru.com/faq-on-government-surveillance/ Let us know what you think.
  - cschmidt 13y ago
    > Q. What would Virtru do if it received a request > from the United States government for encryption keys? > A. We will require the government to go to court, > and if we can, we will notify you. To me that seems naive. You won't be able to notify anyone if you get a National Security Letter (NSL). Lavabit had turned over encryption keys for individual users, because they had to [1]. They only shut down when the government wanted their SSL key, to give access to everyone. How are you any different? [1] http://en.wikipedia.org/wiki/Lavabit http://en.wikipedia.org/wiki/Lavabit
    - znelson 13y ago
      Unlike lavabit we're not a content provider and therefore not bound by the same laws. We're just a third-party provider that holds the keys. #7 on the blog post here goes into more details: https://blog.virtru.com/faq-on-government-surveillance/ https://blog.virtru.com/faq-on-government-surveillance/
    - DHowitzer 13y ago
      Hi, it's Will Ackerly here. We've thought a lot about the National Security Letter scenario, and so, we're going to be pushing to our website a Canary (in the coal mine) icon, linking to a statement declaring that we have never received an NSL. Our special counsel on privacy (Tim Edgar, who used to work at ACLU) came up with the idea for us, which I believe Apple is using through regular reports (not a literal canary icon on their website).
      - cschmidt 13y ago
mnrasul 13y ago
So, can I keep the keys myself instead of storing them in the cloud? Or do I have to trust Virtru instead of google or some other company that they don't buckle when someone comes knocking for the keys? Based on the feature list, I can't have the keyserver on my own server. I have to trust Virtru. This is no different than sending the text in plain IMO.
- stormbrew 13y ago
  The website does actually say advanced users can run their own keystore, but this does seem like the weak point in the service in general.
- higherpurpose 13y ago
  Nope. > However, you’re entrusting us to help you maintain your privacy; you should know how we will respond if the government asks us for access to your encryption keys. The government would need those keys if it wanted to read any encrypted files it does obtain. Without them, the files are useless. > We won’t provide your keys to anyone without your consent — unless we are ordered to divulge them by a judge with jurisdiction over us. If we are ordered to divulge them, we will fight for you to have notice and an opportunity to object. So I guess I'll keep waiting for a DarkMail client.
  - gfodor 13y ago
    so from a security standpoint, this is equivalent to the status quo, except transferring responsibility from Google to a small startup for maintaining keys? I'd be shocked if google doesn't encrypt emails at rest. Is there still plenty of inflight unencrypted SMTP traffic to worry about that this could address? I guess you have to worry about the recipient if you are sending email to a non gmail/hotmail/ymail address?
    - conorgil145 13y ago
      >> I'd be shocked if google doesn't encrypt emails at rest Virtru encrypts email content on the client side, so your email is protected before it ever leaves your computer. That gives you protection in transit and at rest
deleted 13y ago
[deleted]
DHowitzer 13y ago
Open Source Key Server - For those of you interested in hosting your own key server (ACM) or helping to make a free and open source key server a reality, we're looking for people to help us. Contact me if you're interested.

22 points by conorgil145 13y ago

Virtru dev here! Virtru allows users to easily send encrypted email from their existing email address. It is super easy to use and currently works in your browser and on your phone. We are launching our public beta program today and would love feedback from the community. Several of the Virtru team members will be monitoring this thread to respond to feedback and questions. EDIT: Virtru team members: DHowitzer (CTO), ravenac95, znelson, jgilpin

lemonlyman87 13y ago

How can Virtru help email users who are concerned with government surveillance activities that have been revealed in the last year?

jgilpin 13y ago
Encryption has been used in the past to keep emails secure from surveillance(PGP), but it has always been cumbersome to setup and use on both ends. Virtru's focus has been to make powerful encryption available to everyone by making it easy to use and with the services you and those you communicated with already use. Right now we have Chrome/Firefox support as well as an iPhone app...but many other clients soon.
- mnrasul 13y ago
  PGP - one can store the keys on one's own server. In Virturo, it appears it has to be on Virutro servers. So hypothetically, we could have a Lavabit moment.
  - jgilpin 13y ago
    See my other comment about Virtru and allowing for self-hosted keys. We also don't host the content, so different laws apply..I think znelson commented on that somewhere in the thread already.
  - ravenac95 13y ago
    I think it's been iterated before, but in the future we intend to open source our key serving software. There's still much work to be done on that front. We love PGP's crypto, but we found a few problems with it in general: 1) It's hard for the normal person. (The user experience for PGP is just horrendous) 2) Before you send an email to someone you have to know their public key. With that said, we have done some research on integrating PGP like public key encryption along with our current key serving mechanism. With public key, using Virtru will be essentially equivalent to holding the keys yourself. Look for more of this in the future :-)
znelson 13y ago
Hey, that's a great question. We've put a lot of time and effort into thinking about this and have been working with some key people in the industry who have a lot of experience in this area. We've comprehensively addressed this issue on our blog. Here's the direct link: https://blog.virtru.com/faq-on-government-surveillance/ https://blog.virtru.com/faq-on-government-surveillance/ Let us know what you think.
- cschmidt 13y ago
  > Q. What would Virtru do if it received a request > from the United States government for encryption keys? > A. We will require the government to go to court, > and if we can, we will notify you. To me that seems naive. You won't be able to notify anyone if you get a National Security Letter (NSL). Lavabit had turned over encryption keys for individual users, because they had to [1]. They only shut down when the government wanted their SSL key, to give access to everyone. How are you any different? [1] http://en.wikipedia.org/wiki/Lavabit http://en.wikipedia.org/wiki/Lavabit
  - znelson 13y ago
    Unlike lavabit we're not a content provider and therefore not bound by the same laws. We're just a third-party provider that holds the keys. #7 on the blog post here goes into more details: https://blog.virtru.com/faq-on-government-surveillance/ https://blog.virtru.com/faq-on-government-surveillance/
  - DHowitzer 13y ago
    Hi, it's Will Ackerly here. We've thought a lot about the National Security Letter scenario, and so, we're going to be pushing to our website a Canary (in the coal mine) icon, linking to a statement declaring that we have never received an NSL. Our special counsel on privacy (Tim Edgar, who used to work at ACLU) came up with the idea for us, which I believe Apple is using through regular reports (not a literal canary icon on their website).
    - cschmidt 13y ago

mnrasul 13y ago

So, can I keep the keys myself instead of storing them in the cloud? Or do I have to trust Virtru instead of google or some other company that they don't buckle when someone comes knocking for the keys? Based on the feature list, I can't have the keyserver on my own server. I have to trust Virtru. This is no different than sending the text in plain IMO.

stormbrew 13y ago
The website does actually say advanced users can run their own keystore, but this does seem like the weak point in the service in general.
higherpurpose 13y ago
Nope. > However, you’re entrusting us to help you maintain your privacy; you should know how we will respond if the government asks us for access to your encryption keys. The government would need those keys if it wanted to read any encrypted files it does obtain. Without them, the files are useless. > We won’t provide your keys to anyone without your consent — unless we are ordered to divulge them by a judge with jurisdiction over us. If we are ordered to divulge them, we will fight for you to have notice and an opportunity to object. So I guess I'll keep waiting for a DarkMail client.
- gfodor 13y ago
  so from a security standpoint, this is equivalent to the status quo, except transferring responsibility from Google to a small startup for maintaining keys? I'd be shocked if google doesn't encrypt emails at rest. Is there still plenty of inflight unencrypted SMTP traffic to worry about that this could address? I guess you have to worry about the recipient if you are sending email to a non gmail/hotmail/ymail address?
  - conorgil145 13y ago
    >> I'd be shocked if google doesn't encrypt emails at rest Virtru encrypts email content on the client side, so your email is protected before it ever leaves your computer. That gives you protection in transit and at rest

deleted 13y ago

[deleted]

DHowitzer 13y ago

Open Source Key Server - For those of you interested in hosting your own key server (ACM) or helping to make a free and open source key server a reality, we're looking for people to help us. Contact me if you're interested.