Hacker News Reader

Comment by New_California | Hacker News Reader

This article is crap: 1) Claimed redirection from .onion to .com does not deanonymize the user. 2) Protonmail does provide e2e encryption. It's just that you auto-update your client (a JavaScript app) every time you visit the website, so you have no chance to discover potential targeted backdoors.

View on HN

>1) Claimed redirection from .onion to .com does not deanonymize the user.

Is is clear why they do the redirect?

To prevent abuse:

https://old.reddit.com/r/ProtonMail/comments/62rfta/comment/...

"Preventing abuse" is generally equivalent to surveillance - identifying a session as being associated with some longer lived identities. Their explanation makes me less comfortable for why they're doing it!

Redirecting to the https site is a bit less secure than the hidden service, in that your traffic will only go over 3 hops (TOR client) rather than 6 (TOR client + hidden service circuit). But AFAIK they could also write a modified TOR client that served a hidden service without any additional hops. Those additional hops are best seen as security for the hidden service rather than the user. Also, a hidden service for a well known business is kind of a pointless marketing gimmick.

Thanks, I was looking for someone pointing out 1). I thought I miss something.

Point 2 is very problematic though, you can write a browser extension that compares the checksum of app.js, but if it changes and it is just minified obfuscated code, how will you know it's safe to execute. You don't.

Same applies of course to chat apps that offer end to end encryption.

Maybe it's safe for messages to be intercepted, but can you trust the application decrypting messages and displaying to do just that?

You can use the mobile apps for kind of migrating it. And for point 1) through. I get that it's the same infrastructure but surely they could find a way to disable ssl on onion

Reply on news.ycombinator.com