tonyztan

38 ms·

1. 391.▲
   by tonyztan 9y ago

   ProtonVPN (same team as ProtonMail) appears to load no external trackers.
2. 392.▲
   by tonyztan 9y ago

   I think chisleu meant that they consider Verizon to be so untrustworthy that not getting a VPN is really not a viable choice to make. So chisleu doesn't get to choose whether to use a VPN or not.
3. 393.▲
   Google Wifi: Secure at every point(blog.google)

   4 points by tonyztan 9y ago|0 comments
4. 394.▲
   by tonyztan 9y ago

   EV certificates must be submitted to CT logs, which means ProtonMail and the public will be able to detect the malicious certificate. If it's not a EV certificate, the browser user interface changes and a security-conscious user may no
5. 395.▲
   by tonyztan 9y ago

   I signed up last week and it isn't inconvenient at all. Security keys are only used when you first sign in to a device, after which devices are "remembered."
6. 396.▲
   by tonyztan 9y ago

   Uncle Sam can't root everyone's machines at once. If Uncle Sam wants mass surveillance it's going be through the provider.
7. 397.▲
   by tonyztan 9y ago

   All your emails are stored encrypted with your public key when on ProtonMail's servers. And they do support end-to-end encryption with other email providers (with a user-specified passphrase).
8. 398.▲
   by tonyztan 9y ago

   They use SRP for authentication, and yes, your private key is encrypted with a key derived from your passphrase. https://protonmail.com/blog/encrypted_email_authentication/
9. 399.▲
   by tonyztan 9y ago

   Mail client support is coming soon. They pushed out a beta to paid users a few days ago.
10. 400.▲
    by tonyztan 9y ago

    From the article: "ProtonMail can also support sending/receiving end-to-end encrypted messages with recipients who are not using ProtonMail."
11. 401.▲
    by tonyztan 9y ago

    Regarding DDOS, ProtonMail has since installed a mitigation system to prevent this. https://protonmail.com/support/knowledge-base/email-ddos-pro...
12. 402.▲
    by tonyztan 9y ago

    The key is not sent anywhere. Your recovery mail allows you to recover access to your account, but not access to your keys. So if you ever lose your password you will also lose the ability to decrypt your mail.
13. 403.▲
    by tonyztan 9y ago

    They use your public key to encrypt and you use your private key to decrypt. Your private key is stored encrypted with your passphrase.
14. 404.▲
    by tonyztan 9y ago

    I'm not sure there is a legal mechanism to force ProtonMail to add a backdoor... > "Nearly every country in the world has laws governing lawful interception of electronic communications. In Switzerland, these regulations are se
15. 405.▲
    by tonyztan 9y ago

    Hmm... Could you provide a source? I don't think they do this. At least not for paid accounts with a long history.
16. 406.▲
    by tonyztan 9y ago

    I'm not sure there is a legal mechanism to force ProtonMail to add a backdoor... > "Nearly every country in the world has laws governing lawful interception of electronic communications. In Switzerland, these regulations are se
17. 407.▲
    Iwaspoisoned.com alerts officials to outbreak at Georgia Tech(foodsafetynews.com)

    4 points by tonyztan 9y ago|0 comments
18. 408.▲
    by tonyztan 9y ago

    That's a good point. But currently there is no option to use my gmail.com address with G Suite, which I'd like to keep because of old accounts. I host my domain name email addresses with ProtonMail.
19. 409.▲
    by tonyztan 9y ago

    I have the same question. I tried to submit this same article last evening and got redirected to Perceptes' submission. I'm curious as to what happened?
20. 410.▲
    by tonyztan 9y ago

    Don't know why this is being downvoted. If humans at Google can help recover the account, then it is potentially susceptible to social engineering. There's no way around that.
21. 411.▲
    by tonyztan 9y ago

    I've always wondered why they don't offer the option for personal (gmail.com) users to pay for the service and opt out of monetization. I'd pay $5-10 per month for Google's services without me being the product.
22. 412.▲
    by tonyztan 9y ago

    Exactly. Google has always (at least since 2012) provided the option to remove any and all phone numbers from your account after enabling 2FA.
23. 413.▲
    by tonyztan 9y ago

    For user death/disability, Google has the Inactive Account Manager feature, but only if the account owner set it up before the death/disability. https://support.google.com/accounts/answer/3036546?hl=en
24. 414.▲
    by tonyztan 9y ago

    According to Yubico, the RSA vulnerability only affects the YubiKey 4 and "all YubiKey 4 products shipped by Yubico after June 6, 2017 (version 4.3.5 or higher) use" a new implementation that is secure from this. https:/&#x
25. 415.▲
    by tonyztan 9y ago

    I'm thinking of a mechanism where the router obtains a trusted cert automatically, like Plex does ( https://blog.filippo.io/how-plex-is-doing-https-for-all-its-... ), and then asks users to authenticate by password over
26. 416.▲
    Russia’s Use of Antivirus Software to Spy Shows Why We Need Strong Encryption(slate.com)

    2 points by tonyztan 9y ago|1 comments
27. 417.▲
    Texas Should Not Execute Robert Pruett Tonight(nytimes.com)

    2 points by tonyztan 9y ago|0 comments
28. 418.▲
    by tonyztan 9y ago

    Equifax (and other sites that should care about security) should use Subresource Integrity, which prevents resources from being hijacked. https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
29. 419.▲
    by tonyztan 9y ago

    This. The technology (HSTS, HPKP, Subresource Integrity, upgrade-insecure-requests) is there; sites that need it just don't seem to use it.
30. 420.▲
    by tonyztan 9y ago

    If the site supports HTTPS, they should just preload HSTS to avoid future problems with HTTP.