Comment by hiddenforest | Hacker News Reader

Comment by hiddenforest | Hacker News Reader

There are people who think that Protonmail is a government front. I don't think so, but who am I? What's a little bothersome is the new administration is more likely to push for the impossible backdoor into encryption. Swiss companies are under an MLAT, so yes, they will cooperate with American government agencies if they request information. CTemplar looks promising, but in a way, all of these "secure" email hosting companies are really pushing security theater. It's difficult to trust third parties with your data, even if you are not a dissident, journalist, or someone who actually needs to protect their life.

I'm not looking forward to this upcoming administration's tactics as regards big tech. I didn't like Trump's administration much (what there was of it). Biden is looking to put Eric Schmidt somewhere up high as relates tech. He's buried into the American military industrial complex already and just purchased Cypriot citizenship. Conflict of interest? I'd be lying if I said I wasn't at least more concerned over the Democrats and their view of encryption/back doors and company compliance. Why can't we have a transparent government like Finland?

> There are people who think that Protonmail is a government front. I don't think so, but who am I?

It seems that many people have a wrong (read: unrealistically high) expectation of security on Protonmail to begin with. If you are just using Protonmail as a plain mail service, it's nearly as vulnerable as any other emails providers: all incoming mails can be monitored at the originator's mail provider, or at Protonmail, all outgoing mails can be monitored at Protonmail or at the receiver's mail provider. These security properties are natural conclusions from the architecture of SMTP. No backdoor is needed. If the government wants to subpoena your mail, they can simply require Protonmail to intercept all incoming traffic at the SMTP server before it's encrypted locally. Also, the fact that Protonmail is subjected to subpoenas is publicly announced on their website, and they state that they'll cooperate as far as the degree allowed by cryptography.

No backdoor conspiracy is even needed to begin with. End-of-end encryption is only used in-browser when you're sending mails to another Protonmail user.

Don't get me wrong. I use Protonmail and I'm a paying user. The only major advantage of Protonmail is data-at-rest encryption, once the plainmail arrives to your inbox, it's not possible to be leaked retroactively without your passphrase. And this advantage alone is enough for me to use it, since it's as insecure as any other mails at worst, and a bit more secure at best, I have nothing to lose. If a higher degree of security is desirable, it's still your own responsibility to use end-to-end encryption, preferable, one should also use Protonmail's official client (with source code) to access Protonmail locally, which ensures that malicious JavaScript can't be injected from the server side to reveal the passphrase to your inbox.

Finally, if you must find a credible conspiracy from it (I'm not a fan of doing it, 90% of the time the arguments are all vague "backdoor" or geopolitics rather than a technical security analysis), Protonmail can be considered a PR hack supported by the NSA that misleads non-technical users to think it as a silver bullet, thus actually impeding the progress of developing better end-to-end encryption for email communication.

> Why can't we have a transparent government like Finland?

In case this is a genuine question, I think it is because U.S. government has the largest power in the world and this is a benefit to many people who want that power protected and available to them. In a transparent government, this control by would bother regular citizens more and would destabilize things.

Reply on news.ycombinator.com