News for hackers. Stuff that matters.

A comment on ProtonMail Rewrites Your Emails. Parent comment

Re:ProtonMail Rewrites Your Emails by e12e on Saturday July 08, 2023 @10:28AM (#36644753)
But you distribute the js that accepts the passphrase - so you could trivially exfiltrate the password - and so access the private key.

"Don't have access" is a little too strongly worded IMNHO.

(I understand the reasoning - and I don't necessarily think it's bad - I just think it overpromises a bit)

[ Parent | on HN ]
Re:ProtonMail Rewrites Your Emails by twiss on Saturday July 08, 2023 @10:33AM (#36644787)
Sure, fair enough. I've edited it to "the server doesn't have access". Also, see https://news.ycombinator.com/item?id=36643922.
[ Parent | on HN ]
Re:ProtonMail Rewrites Your Emails by cuteboy19 on Monday July 10, 2023 @07:44AM (#36665002)
The app ultimately shows you your decrypted email. If client side code is compromised then I don't think this is the thing you worry about
[ Parent | on HN ]
Re:ProtonMail Rewrites Your Emails by e12e on Monday July 10, 2023 @11:19AM (#36667702)
Sending signed and encrypted emails is worse than just reading.
[ Parent | on HN ]