In context of 5/9/14+ eyes, the nomenclature of solid advertising might differ from your interpretation, where perceptions matter ─ ranging from honeypots, compromised Tor exit nodes to dubious VPN providers, absence of warrant canaries to flawed encryption products etc. It is probably best to exercise caution and remain sceptical, rather than start endorsing products, based solely on a single random event.
Of course there are flawed VPNs and honeypot Tor nodes out there. The fight to track people and censor information is ongoing 24/7 around the globe.
Random event or not, if a government feels that it has to plug a leak as opposed to pwning/backdooring it then to me this means they chose the lesser evil and they really cannot crack ProtonMail. If that's indeed the case then this sends the message to me that I'd like my email to be better protected and I might switch away from GMail.
Whether there is a bigger game involved though, I can't know. Can you?
The government does not need to tell you anything and when it says it can't 'break' something, try and remember ─ you can dance like nobody is watching, but make sure you encrypt like everybody is watching.
write something!
... if you live in Russia.
Remember Lavabit.
You don't have to believe him.
Google engineers have admitted in print that their inter-DC links were not encrypted.
Marissa Mayer admitted in print that she allowed the government to install a linux kernel module to sniff email traffic for keywords, among other things.
Didn't Google qua Google, not mere engineers, do that by publicly announcing that they were upgrading security by encrypting them in the wake of the Snowden leaks?
I don't know whether their mobile apps also trust the server in the same way--by loading content or js from the server. If not, then those could potentially offer a more secure alternative since the same attack would now require an update for all users, which would leave evidence behind. Of course, you still have to trust that any users you're sending email to also never submit their passwords to the web app.
There is no such issue if you use https://github.com/vladimiry/ElectronMail desktop app as it comes with static resources built on the CI server from the official source code repositories and embedded in then installation packages, see https://github.com/vladimiry/ElectronMail/issues/79 for details. See here https://github.com/vladimiry/ElectronMail/blob/d974b43908e10... the "ProtonMail Version 4.0-beta Web UI" versions embedded in the most recent v4.2.1 release.
The way of verifying that the installation packages attached to the releases have been assembled from the source code is being provided, see https://github.com/vladimiry/ElectronMail/issues/183.
And finally, the app is fully open-source creature, so anyone could assembly own package.
Unless your emails are encrypted for you on someone else's client before they're sent to your protonmail, in which case protonmail still has all of the metadata (time sent, where it was sent from, length of the message, etc.)
Do you believe proton mail can keep state level actors like Russia, China, and the United States out of their prod infra?
They may be "mostly" subpoena proof as in they can't disclose old emails, but do you trust them to not hand over your data before it's encrypted?
> Do you believe proton mail can keep state level actors like Russia, China, and the United States out of their prod infra?
No, I don't believe they'll be able to keep state actors out of their servers indefinitely. But it's more a matter of what the state actors find once they've gained access. As I understand it, the architecture of the service is what prevents protonmail themselves, as well as any intruder, from reading the encrypted mail files[0].
I don't think this is true. A hash of the password could be part of the key, but Protonmail already has that hash stored on its server (otherwise they would not be able to log you in when you send the password hash). If Protonmail would like to access your emails (or be asked to do so), I'm confident that they technically can. The only benefit is when a hacker get access to the email database, but not the password hash database, then in this case the hacker cannot read the emails.
Except when it's not (and the full password is used instead).
However, when you send an unencrypted email with Protonmail, they claim that they encrypt the email at rest, but the claim is not verifiable.
Also, mailboxes are encrypted client side.
Mobile version only. You have to use proxy or VPN for desktop or web app.
Telegram was just the right size — not so tiny that only a few nerds use it, but not so big that the majority of normies have adopted it. And there was sort of a personal conflict, government people don't like Pavel Durov..
And it's not like Russians, Chinese and generally people in countries whose governments are in the habit of censoring the internet aren't used to using Tor and/or VPNs to dodge censorship.