amilich

Hey - really sorry to hear this - could you email me [email protected]? Here are 3 suggestions to try- 1. Reset your settings.json - if shared with vscode, sometimes settings can cause perf regressions 2. Could you try cmd-shift-p -> "capture and send debugging data"? Will send us some profiling data to debug 3. Clear your user data (will delete chats) as a last resort - cmd-shift-p, "reveal user data," close the app, then delete this folder and restart the app

Thanks for sharing! PGP support has been a huge request and enables end-to-end encryption automatically between large email providers for one of the first times we know of.

It's enough of other companies making money on our data. That's why I started Skiff (end-to-end encrypted email/docs/drive/calendar)! It's harder to build products E2EE but you get long-term trust from users.

Hello :)

Skiff cannot access email content, subject, and header info. To/from/cc/bcc fields are not stored end-to-end encrypted, though.

Few notes - iOS issue stems from a recent upgrade from an iframe to a webview. It's fixed on all mobile apps and versions. - All DMARC-failing mail does go to spam. - Caching images on receipt was examined but deemed impractical. It balloons email size from generally 50-150 KB to possibly multiple MB. Even for a personal mailbox, this could lead to 100s of GB being stored. Some version of this could be done on device or in the browser and temporarily stored. I actually think iOS either does this or will do this in the future.

Thanks for the report. This is actually helpful. I am investigating this now.

I just compared Skiff and Tutanota on your tool. The results were the same. Thank you for confirming this.

It's very simple. One of them had access to user's private keys (Lavabit).

One never has access to user private keys (Skiff).

That's why Skiff has had 4 security audits, not just 1 3 years ago. And, with multiple of the best auditors.

No, I'm not joking. We do have this option, and it's consistent with the defaults across private mail providers. Still waiting for your list of the ones that don't load images by default.

It does not load the images. That's just patently false disinfo.

Any security engineer would have a heart attack if any employee, friend, or colleague said "security audit stuff [doesn't] matter." I wouldn't use software that doesn't undergo security audits.

Also, pentest ≠ audit. Completely different!

Actually, that's completely false. Security audits are a standard, reputable process for software. Trail of Bits is probably the best (or one of very few top) firms in this category. Check out: https://github.com/trailofbits

That's just false. Downloading crypto libraries over the web plagued Javascript crypto for years. We use tweetnacl, stablelib, and webcrypto - and tweetnacl also uses webcrypto!

Yes - privacy focused mail providers offer this as an option but do not enable it by default. Mainstream mail providers do not even have it as an option.

We use an open-source mailserver (Haraka), but security audits are the most trustworthy way to do this. We've had 4: skiff.com/transparency. Audits cover infrastructure.

What mail providers block all remote content by default?

Skiff encrypts all received emails with user public keys immediately on receipt. This is quite clear in our security model page and whitepaper. Skiff does not have access to any user emails, including external received ones.

No: Skiff does not have access to a single email stored on our platform, including ones received externally. All are public-key encrypted, including subjects and content.

We also don't do this. In a near future implementation you can just synchronize the end-to-end encrypted search index.

This sounds like a possible captcha error. Can you email me at andrew (at) skiff.com ? Sorry about this.

We offer a block remote content feature. There is no foolproof way to load any remote content without possibly exposing email open information.

See https://skiff.com/transparency, Trail of Bits has performed 2 audits, Cure53 1 audit, and we had an additional audit 2.5 years ago.

No, this is done with public-key encryption which does not require the client.

Those ads are still targeted to you, maybe not off of your email content (now vs 2017)

Before this basic cryptography was downloaded via JS files which yields no security and gave web cryptography a bad reputation. That is not true now.

We do have export to EML and ZIP files. SMTP/IMAP are not trivial due to end-to-end encryption.

Also, not really true of Gmail. Try turning your WiFi off, then deleting your Gmail account. You might have mail stored offline on your phone (let alone any other device), as well as any IMAP or other clients. It's the same or worse.

Emails are downloaded when you receive them. Isn't that how email works?

Darn. Will have to fix it. Thanks.

This isn't how it works at all? We don't pay for storage on users devices... buying the device = buying the storage. It's actually much more efficient than doing search through some massive database.