Comment on Proton is transitioning towards a non-profit structure | Proton
Asudox@lemmy.world 2 months agoThat simplicity introduces lots of security and privacy issues.
Comment on Proton is transitioning towards a non-profit structure | Proton
Asudox@lemmy.world 2 months agoThat simplicity introduces lots of security and privacy issues.
sudneo@lemm.ee 2 months ago
Introduces some risks in terms of security. Privacy concerns are extremely minimal, because in any case you don’t control the setup of your other interlocutor(s).
Considering that the realistic alternative is not using anything at all and the fact that you have both options with Proton, it’s a win-win scenario.
Asudox@lemmy.world 2 months ago
One of the biggest risks is when someone knows your password. Your PGP encrypted emails that you want noone to see will be available to the attacker. Whereas if no such thing happened, the attacker wouldn’t be able to decrypt the PGP encrypted emails even if the attacker gained access to your account. Manually encrypting your stuff is better than having some random do it for you. It’s really just a tradeoff. Convenience or security? It’s not even hard to manually encrypt emails.
sudneo@lemm.ee 2 months ago
Just a curiosity. How do you think every password for every online service works? The service “has” your password. It is hashed, but if this doesn’t matter (similarly for encryption) to you, then you should be panicking about basically everything.
In the case of Proton an attacker has basically these options:
In the case of a manual solution:
mutt
). Once you gain access to the repository, push a backdoored update and wait for you to install the new version. Incidentally, compromising this tool also allows the attacker to compromise your whole machine (unlike what happens with JS code, which runs at least in the browser sandbox).So the tradeoff is really that:
Yeah, and this is why 99.9% of the people have never and will never touch GPG with a 10-foot pole. The tradeoff is a complete no-brainer for the vast majority of people, because the reality is that for most, either someone else does the key discovery, management, signing, encryption, decryption, or nobody does. We can sit here and pretend that it’s easy, but it’s not. Managing keys is hard, it is painful, especially on multiple devices, etc…
Asudox@lemmy.world 2 months ago
Encrypted or not, the fact that someone else has it stored somewhere in their computers is dangerous. The fact that it can be accessed online is dangerous. The only recommended way to store private keys are offline and encrypted. Why are you so ignorant of this fact, I wonder?