Rootshell: A new E2EE email service hosted in Iceland

Re:Rootshell: A new E2EE email service hosted in Iceland by tptacek on Wednesday June 03, 2026 @05:54PM (#48390678)

I'm not wild about this benchmark. There are well-known firms (definitely not saying that about Trail! no experience at all with the other one here) that issue public-facing audit docs that read the same no matter what the project scope was.

If you're keying off 3rd party assessment, which is sane, you should be evaluating the combination of the testing team (the best firms will publish reports with the names of the consultants on them) and the scope and depth of the results. The company shouldn't matter; the scope should matter a lot.

A meaningful security assessment for an "E2EE mail service" is nosebleed expensive.

[ Parent | on HN ]

Re:Rootshell: A new E2EE email service hosted in Iceland by sc0rt on Wednesday June 03, 2026 @06:48PM (#48391164)

Did not expect this post to get all this attention. I've done a little digging and found the operator on X. Had some DMs and he(?) said that they've had 1 black box and 3 white box audits. I'm not going to speak for anyone, so maybe you can ask them directly.

[ Parent | on HN ]

Re:Rootshell: A new E2EE email service hosted in Iceland by tptacek on Wednesday June 03, 2026 @06:58PM (#48391255)

I don't really care beyond continuingto nudge people away from this idea of "seal of approval audits", which have been an industry curse for decades. I don't think E2EE email is a good idea to begin with.

[ Parent | on HN ]