967
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
this post was submitted on 17 Aug 2024
967 points (96.4% liked)
Technology
59374 readers
3126 users here now
This is a most excellent place for technology news and articles.
Our Rules
- Follow the lemmy.world rules.
- Only tech related content.
- Be excellent to each another!
- Mod approved content bots can post up to 10 articles per day.
- Threads asking for personal tech support may be deleted.
- Politics threads may be removed.
- No memes allowed as posts, OK to post as comments.
- Only approved bots from the list below, to ask if your bot can be added please contact us.
- Check for duplicates before posting, duplicates may be removed
Approved Bots
founded 1 year ago
MODERATORS
You upload your private key to the cloud. Encrypted or not, this is a bad idea. No thanks. I can do the signing locally and then I'll do the decryption with my own private key locally without them storing it as well.
Edit: mixed public keys with private keys
An encrypted key is a useless blob. What matters is the decryption key for that key, which is your password (or a key derived from it, I assume), which is client side.
They can't sign with your public key. Signing is done using your private one, otherwise nobody can verify the signature.
Either way:
You can do it using the bridge, exactly like you would with any client-side tooling.
It's still insecure. They decryption process is still in the proton company hands and they could add some client specific code to log the password on the fly. Proton is obliged to follow the swiss law and I can imagine situation that police asks proton (+ gag order ) to log certain data for specific clients like passwords and ips. Still private keys are better to be stored separately. You can sync them easily if you with with either rsync or rclone
It's not "insecure", it's simply a supply chain risk. You have the same exact problem with any client software that you might use. There are still jurisdictions, there are still supply chain attacks. The posture is different simply by a small tradeoff: business incentive and size for proton as pluses vs quicker updates (via JS code) and slower updates vs worse security and dependency on a handful of individuals in case of other tools.
Any software that makes the crypto operations can do stuff with the keys if compromised or coerced by law enforcement to do so.
In any case, if this tradeoff doesn't suit you, the bridge allows you to use your preferred tool, so this is kinda of a moot point.
The main argument for me is that if you rely on mail and gpg not to get caught by those who can coerce proton, you are already failing.
I used bridge for many years. It was totally unusable - 1) you cannot delete emails with it ( deleted emails were coming back ), 2) synchronization issues so it made me move to another "plain and simple" email provider offering pop3 and imap and also gpg integration ( but without that e2e hype talk )
I can't comment on this, since I don't use the bridge for a while. But it's just an IMAP/SMTP server, so not sure why certain features wouldn't work. What service did you end up using which has gpg integration?
I used protonmail for 3 years - bridge issues have been being ignored by protonmail support in my opinion. "Clean cache and try again". I stopped using protonmail and switched to mailbox.org. So far so good.
From what I read though, the GPG security model for mailbox.org is the same as it is for Proton webmail (except for the browser plugin, where the difference is not really there). I like mailbox.org, to be clear, but I don't get how it is an alternative to the bridge.
I don't use mailbox gpg sevice simple as that. I use mailbox perfect imap (k-9) / pop3 (desktop) integration and use gpg natively in case if that person uses gpg. Thunderbird (desktop), k-9 with openkeychain on android. I don't say proton is bad. It's quite good if you never want to export mails outside our webmail. I do want it so protonmail is not for me. Most my protonmail issues were with their bridge they, until the moment I migrated to mailbox, have not resolved.
Oh that makes sense. Yeah, definitely simple encryption and exported (unencrypted) emails are not going to work together.
I am all in support for European tech companies, so I think that mailbox.org, tuta, proton etc. Are all good options.
Exactly. There's no justification for them storing the private key online for "convenience". And key generation happens in the browser with JS. Which means it is possible to send backdoored JS to easily copy the private key.
There is a reason: simplicity. Either you do all the key management yourself, which in practice means 98% of the people won't do it at all, or you implement a solution like they did and increase the risk of a small % (see my other comment) but you cover every customer.
That simplicity introduces security and privacy issues.
Introduces some risks in terms of security. Privacy concerns are extremely minimal, because in any case you don't control the setup of your other interlocutor(s).
Considering that the realistic alternative is not using anything at all and the fact that you have both options with Proton, it's a win-win scenario.
One of the biggest risks is when someone knows your password. Your PGP encrypted emails that you want noone to see will be available to the attacker. Whereas if no such thing happened, the attacker wouldn't be able to decrypt the PGP encrypted emails even if the attacker gained access to your account. Manually encrypting your stuff is better than having some random on the internet do it for you. It's really just a tradeoff. Convenience or security? It's not even hard to manually encrypt emails.
Just a curiosity. How do you think every password for every online service works? The service "has" your password. It is hashed, but if this doesn't matter (similarly for encryption) to you, then you should be panicking about basically everything.
In the case of Proton an attacker has basically these options:
In the case of a manual solution:
mutt). Once you gain access to the repository, push a backdoored update and wait for you to install the new version. Incidentally, compromising this tool also allows the attacker to compromise your whole machine (unlike what happens with JS code, which runs at least in the browser sandbox).So the tradeoff is really that:
Yeah, and this is why 99.9% of the people have never and will never touch GPG with a 10-foot pole. The tradeoff is a complete no-brainer for the vast majority of people, because the reality is that for most, either someone else does the key discovery, management, signing, encryption, decryption, or nobody does. We can sit here and pretend that it's easy, but it's not. Managing keys is hard, it is painful, especially on multiple devices, etc..
EDIT:
The entire threat model for proton is also documented BTW: https://proton.me/blog/protonmail-threat-model
Encrypted or not, the fact that someone else has it stored somewhere in their computers is dangerous. The fact that it can be accessed online is dangerous. The only recommended way to store private keys are offline and encrypted. Why are you so ignorant of this fact, I wonder? I think you trust Proton a bit too much.
Of course. You are simply over-representing this risk, though. Besides, regular people realistically don't need to worry about Proton being backdoored, because their device is 10-100x more likely to be breached instead. Security is not a binary, it's a shade. Performing a software update is also "dangerous". Do you check every time you update the software its code, to verify no malicious backdoor is there? No, exactly, you trust the maintainers and the package infrastructure.
So you don't store them on your device(s) (encrypted)? I store my GPG keys that I use to sign software on my yubikeys. That said, email is something I check from my phone and multiple computers (as most people). Do you really use a hardware key to do on-the-fly decryption, every time someone sends you a message, from each device?
As a security engineer, I also generally discourage such absolute "recommendations". My threat model is different from a regular Joe threat model, and both are different from Snowden's. There is no such thing as "only recommended way", because this is not a religion, it's a risk decision. Most people use Gmail, where the content of their email is literally available server side. Those same people can gain privacy and security using GPG via Proton, and in their threat model "provider gets compromised and software backdoored" is completely irrelevant. Is it relevant in your threat model? Good, then yes, you should only store keys offline and encrypted. Actually, you shouldn't use email at all, and you should use dedicated tools and protocols that are meant for security, where metadata is not transmitted in clear text, for example. You should also have virtually no session duration and perform a full login with 2FA every time, you should probably access the software that you use to communicate only from a secure machine dedicated for the purpose etc..
I simply have clear in my mind what my threat model is and what risks are acceptable. I perfectly fit in the "Anyone with privacy concerns" category in the threat model they built. What about you?
Indeed. Email is not ideal for such things but it exists and is needed because everyone refuses to make a switch. If XMPP were to replace emails, that would've been great.
Anyway, I still don't trust Proton. Have a great day.
Who knows :) But XMPP also needed all kind of extensions to support even relatively old security measures.
That's fine, you can trust who you want, of course. The important thing is to have clear the risk model.
Especially with the fact that: 1) deminificafion of the javascript code is not simple 2) you cannot "freeze" the code version you use. Still your computer does allow it ( minus the windows which follows the Microsoft thinking way, kidding about windows updates )
Yeah mb. Mixed private keys with public keys. Edited original comment.