News for hackers. Stuff that matters.

A comment on ProtonMail: End-to-end encrypted email.

Re:ProtonMail: End-to-end encrypted email by flym4n on Wednesday June 04, 2014 @11:55AM (#7846301)
It appears they silently closed a critical vulnerability recently [0]

[0] https://twitter.com/StackSmashing/status/474214532114812928

[ Parent | on HN ]
Re:ProtonMail: End-to-end encrypted email by mike-cardwell on Thursday June 05, 2014 @05:01AM (#7850953)
My name is on https://protonmail.ch/blog/protonmail-security-contributors/ because I reported a critical XSS vulnerability to them when they were previously mentioned on here.

All you needed to do was send an email which contained a From header with script embedded in the name part:

  From: "<script>Do evil</script>" <[email protected]>
All I did to find this vulnerability was sign up for an account and then plonk the email address they gave me into https://emailprivacytester.com/ (of which I am the author)
[ Parent | on HN ]