3 ms·

With respect, I think it's likely that you don't understand the threat model here and are making dangerous promises of security that you can't keep. If the NSA

With respect, I think it's likely that you don't understand the threat model here and are making dangerous promises of security that you can't keep. If the NSA shows up and demands that you help them access a user's data and not tell anyone about it, they won't merely be asking for a copy of your hard disk. They could ask that you modify your javascript (since you're a webapp, presumably you're doing client-side cryptography in JS, which is a terrible idea but let's ignore that for now) to send the user's key to you, or otherwise transfer cleartext back to you. I don't mean to be harsh, but I think it would be better not to release anything at all than to release a product that can't live up to its privacy promises. If you really want to innovate in this field, please do it with open source code and peer review from expert cryptographers.

simonszki 13y ago
It think you have a great idea about peer review of the code. We already have contacts with coders in the online password management business. The only thing that might be a problem is the involvement of the government. Like with Lavabit, they force them to reveal there SSL master key so that they could intercept every communications. We are currently trying to figure out if we could host our server in switzerland or something.(it fixed the problem for several security company we know.) I think our product present a huge leap in privacy for email compared to google and the likes who allow free access to data. Keep that in mind. http://gizmodo.com/how-google-gives-your-information-to-the-nsa-512840958/all http://gizmodo.com/how-google-gives-your-information-to-the-...
- cjbprime 13y ago
  I would not trust your service more than Gmail. With Gmail, I can be fairly sure that the use of encryption is competent and that they've invested in entire teams of people dedicated to monitoring the service for hacking attempts -- I might have to worry about them handing data over to the NSA, but I don't have to worry about them handing data over to a random black hat who decides to modify the JS you deploy. I also trust that Google's legal team is capable of some level of argument with the NSA, rather than just folding to them the first time actual money would be required to pay a legal team. I don't see how hosting a server in Switzerland helps you when the NSA is at your door, telling them that you must help them and you must not tell anyone about it. The weak point is you, not your servers.
  - simonszki 13y ago
    Its a personal choice after all. We are not trying to replace Gmail. Our solution target people which focus more on privacy. Would you compare Gmail to a service like mailinator, etc. Part of our encryption is based on OpenPGP(most widely used email encryption standard in the world). "I don't have to worry about them handing data over to a random black hat who decides to modify the JS you deploy" -cjbprime I like to think that when you do business with people, there is a little of faith that is necessary. Otherwise, nobody would do business with startups. And to answer your question about Switzerland, The only way to gain access to the data hosted within a Swiss data centre is if the company receives an official court order proving guilt. I hope it answered your questions.
- sharemywin 13y ago
  2 guys show up with suits flash a badge saying a terrorist group on your network has planted a dirty bomb somewhere in NY it's going to kill millions of people, you assisted them so we now consider you terrorists. or cops show up and say they have a search warrant we believe people are sharing infant pornography on your network. still got the stomach for anonymous email?
logn 13y ago
Also, email is fundamentally insecure. The to/from fields leak who's interacting with whom. On top of this, email uses DNS which has its own problems. OP, read up on http://www.darkmail.info/ http://www.darkmail.info/ but I don't event know if DarkMail is the answer. Maybe something more drastically different like https://gnunet.org/ https://gnunet.org/ is better which is strictly P2P and replaces DNS too.

simonszki 13y ago

It think you have a great idea about peer review of the code. We already have contacts with coders in the online password management business. The only thing that might be a problem is the involvement of the government. Like with Lavabit, they force them to reveal there SSL master key so that they could intercept every communications. We are currently trying to figure out if we could host our server in switzerland or something.(it fixed the problem for several security company we know.) I think our product present a huge leap in privacy for email compared to google and the likes who allow free access to data. Keep that in mind. http://gizmodo.com/how-google-gives-your-information-to-the-nsa-512840958/all http://gizmodo.com/how-google-gives-your-information-to-the-...

cjbprime 13y ago
I would not trust your service more than Gmail. With Gmail, I can be fairly sure that the use of encryption is competent and that they've invested in entire teams of people dedicated to monitoring the service for hacking attempts -- I might have to worry about them handing data over to the NSA, but I don't have to worry about them handing data over to a random black hat who decides to modify the JS you deploy. I also trust that Google's legal team is capable of some level of argument with the NSA, rather than just folding to them the first time actual money would be required to pay a legal team. I don't see how hosting a server in Switzerland helps you when the NSA is at your door, telling them that you must help them and you must not tell anyone about it. The weak point is you, not your servers.
- simonszki 13y ago
  Its a personal choice after all. We are not trying to replace Gmail. Our solution target people which focus more on privacy. Would you compare Gmail to a service like mailinator, etc. Part of our encryption is based on OpenPGP(most widely used email encryption standard in the world). "I don't have to worry about them handing data over to a random black hat who decides to modify the JS you deploy" -cjbprime I like to think that when you do business with people, there is a little of faith that is necessary. Otherwise, nobody would do business with startups. And to answer your question about Switzerland, The only way to gain access to the data hosted within a Swiss data centre is if the company receives an official court order proving guilt. I hope it answered your questions.
sharemywin 13y ago
2 guys show up with suits flash a badge saying a terrorist group on your network has planted a dirty bomb somewhere in NY it's going to kill millions of people, you assisted them so we now consider you terrorists. or cops show up and say they have a search warrant we believe people are sharing infant pornography on your network. still got the stomach for anonymous email?

logn 13y ago

Also, email is fundamentally insecure. The to/from fields leak who's interacting with whom. On top of this, email uses DNS which has its own problems. OP, read up on http://www.darkmail.info/ http://www.darkmail.info/ but I don't event know if DarkMail is the answer. Maybe something more drastically different like https://gnunet.org/ https://gnunet.org/ is better which is strictly P2P and replaces DNS too.