Introducing ProtonMail's Tor hidden service

Re:Introducing ProtonMail's Tor hidden service by tptacek on Thursday January 19, 2017 @02:23PM (#13438682)

If you are so threatened that you feel the need to use a Tor hidden service to reach your email provider, you should know that email --- "encrypted or not" --- provides the worst protection of all possible encryption messaging options. Don't use email for sensitive communication, and certainly don't rely on the security features of any email provider for your own safety.

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by cloakandswagger on Thursday January 19, 2017 @04:31PM (#13439673)

How so? It seems like it would be just as safe as any type of messaging that uses asymmetric cryptography.

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by tptacek on Thursday January 19, 2017 @04:37PM (#13439707)

It's not; it's not even close. Every message you send, message by message, HTTP request by HTTP request, depends entirely on the security of Protonmail's servers and relies on PGP, which leaks extensive metadata and has no forward secrecy. Not only that, but because you're using SMTP email, you're always one mistake away from accidentally sending plaintext.

The good secure messaging services --- particularly Signal --- make these things impossible to screw up.

Don't use email for secrets.

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by nanch on Thursday January 19, 2017 @04:40PM (#13439728)

What's the problem with tor + PGP?

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by tptacek on Thursday January 19, 2017 @04:42PM (#13439743)

Metadata, forward secrecy, and the fact that any usable implementation in a web page will have server-dependent security.

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by nanch on Thursday January 19, 2017 @05:01PM (#13439855)

What are good alternatives for communicating with somebody then?

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by tptacek on Thursday January 19, 2017 @05:13PM (#13439933)

A secure messenger like Signal.

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by carterehsmith on Thursday January 19, 2017 @09:54PM (#13441443)

Uhhhh.

Sure, use Signal, and Tor, and others -- if you want your communication to be preferentially screened by every single three-letter agency.

BTW this is not to disparage any four-letter agencies, eg. GCHQ. They do awesome work, which I do appreciate very much.

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by brewdad on Thursday January 19, 2017 @11:58PM (#13441820)

I hope they enjoy reading my wife and I discussing dinner plans and my reminders to my son to do his homework.

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by carterehsmith on Friday January 20, 2017 @10:15PM (#13448563)

Not sure what you are trying to achieve here. Do you want to stick it to the Man?

The software that is processing your communications will spend extra 0.01 seconds analyzing the data. Is that some kind of victory for you or something?

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by riprowan on Friday January 20, 2017 @05:35AM (#13442796)

I started to make a witty post implying that you just signalled for some sort of terrorist attack using an encoded message, then I checked the calendar and posted this instead.

[ Parent | on HN ]

Re:Introducing ProtonMail's Tor hidden service by LeoPanthera on Thursday January 19, 2017 @05:16PM (#13439963)

I've been experimenting with Matrix.

[ Parent | on HN ]