ProtonMail Is Inherently Insecure, Your Emails Are Likely Compromised (2021)
theconsciousresistance.com
theconsciousresistance.com
>...if you’ve used the Webmail client, ProtonMail has always had the ability to grab your password and private encryption key without you knowing, giving them backdated access to your emails.
If the keys are stored on the same server as your encrypted data, your data might as well be unencrypted.
Because everyone uses reproducible builds and verifies them for every automatic app update, right?
> Although they do use the same client side OpenPGP library maintained by ProtonMail (its likely the only one in the world that works in browsers), they have accounted for the concern and developed a system that allows you to compare the code in your browser with the code that they’ve published Their implementation for the checksum is actually cool, I like it.
However, I believe that most people use protonmail for convenience and that it fits the threat model of the average joe. If you're getting targeted by the NSA, you shouldn't use a browser with JIT enabled anyway.
The difference between convenient and inconvenient doesn't really matter at all.
Visibility is the difference between possible and not-possible.
That is all the difference in the world, and matters no matter how few people ever actually do something.
Of course not, but it is possible to do so. It can also be verified by trusted third parties, etc.
> However, I believe that most people use protonmail for convenience and that it fits the threat model of the average joe. If you're getting targeted by the NSA, you shouldn't use a browser with JIT enabled anyway.
This is a non-sequitur. If you're starting to talk about average Joes with an unspecified threat model, surely GMail will be fine too, for some very low bar of "crooks can't hack my facebook". But there's obviously a big span inbetween that and "specifically targeted by intelligence agencies".
More to the point, no matter your threat model, you should try not to do business with scammers. Firstly, out of moral imperative, and secondly, because your threat model might change.
For those interested, I think the checksum trick referred to above (in the context of the service offered by CTemplar) is described at [0] and there is a step-by-step how-to guide at [1].
Basically the top level index.html contains integrity hashes for the JavaScript it fetches, and you're expected to copy-paste the source of the page you're viewing into an editor, save the file, and run a local checksum on it.
That is clever, but it seems like a more convenient design would be to use a "bootstrap" page which only has the minimal set of tags on it needed to run a single <script src=bootstrap.js integrity=sha384-whatever>. Then the user can do a quick visual inspection that there's nothing suspicious in the DOM and confirm that the integrity hash matches the value in an append-only log somewhere.
Mozilla actually had a clever idea for building binary transparency using the existing certificate transparency infrastructure for domains[2], by registering something like $version_number-$hash as a sub-domain of the domain where the app is hosted, e.g. v14-abc123.ctemplar.com which the user could search for using one or more certificate transparency logs.
Anyway, this manual checking process can be avoided entirely if the site is made available as a SecureBookmark[3], although that has the disadvantage that the browser would show a Data URI as the page address rather than a standard URL/domain which users are more familiar and comfortable with.
[0] https://ctemplar.com/ctemplar-checksum-implementation/
[1] https://github.com/CTemplar/webclient/tree/gh-pages
Seems that the primary claim is that ProtonMail is potentially compromised by Intelligence agencies and can nefariously show users fake pages to steal credentials and decrypt messages?
Overall the article seems light on evidence.
Edit: Found a response from ProtonMail to the Researcher quoted in OP's article.
https://protonmail.com/blog/cryptographic-architecture-respo...
Surely, they could enforce password requirements, but for me every user is responsible of having a secure password. If your account gets compromised despite the service hashing password correctly and having brute-force prevention mechanisms in place, it's on you for not having a strong enough password (or reusing it).
> And the flaw is that it is relatively simple for ProtonMail to serve you a modified version of their web application or the underlying PGP implementation. There is no way to cryptographically verify that you are getting the official version of the web client as stored in their repository.
Yes, this is true. But for anyone requiring absolute state-of-the-art privacy, you could simply use your own pair of keys without ever sending it to ProtonMail (i.e. you would use ProtonMail to send and not to encrypt, even though you would still benefit from their encryption as an additional layer). All open-source web-based services have this kind of flaw.
> PM can once again replace the web application or PGP software to recover the original message and passcode.
(This is in reference to the "Encrypt-To-Outside feature".) Yes, this is true as well, but look at the alternative: I send an email to your Gmail account. Google can read it. Then, you reply to my email, and ProtonMail could catch it in transit while it's not encrypted. I mean, they don't need you to use that feature to be able to catch your communications. So, we're back to the fact that they could serve a different version of the source code than they advertise.
I really fail to see the point of this article. I'm sure most of the users use it to stay away from Google tracking, and even the author agrees that if you need total privacy you should use your own keys.
I'm not looking for military grade encryption in a subterrainian mountain; I just want email at my domain from a service that doesn't read all of my emails and profile me based on their contents. I've looked into hosting my own email from a VPS, but it's not a trivial project, and I'm most worried about being blacklisted before I even start, since it seems most VPS providers are.
Any recommendations?
A better headline might be: ProtonMail supports full E2EE, provided you trust them with your keys (if not, why are you paying for their service?).
The answer should be "because one day web browsers will be able to pin specific versions of specific web apps, with specific hashes, corresponding to specific releases tagged in their repo, which have been audited by a certain threshold of auditors that I trust".
What that looks like in practice is probably some mixture of the following projects:
https://github.com/kpcyrd/pacman-bintrans
https://users.rust-lang.org/t/rust-code-reviews-web-site-for...
https://paragonie.com/blog/2022/01/solving-open-source-suppl...
"And the flaw is that it is relatively simple for ProtonMail to serve you a modified version of their web application or the underlying PGP implementation. There is no way to cryptographically verify that you are getting the official version of the web client as stored in their repository.
If PM decides to act maliciously, they can do so undetected. Unlike the mobile application who’s binaries get cryptographically signed to match the official codebase, there is no method to verify a web application."
Yes, but the results of such an inspection would only apply to that particular web request at that particular time.
At another time, or to some other person, a different app could be served up by ProtonMail if they so chose.
That's not to mention that the vast majority of ProtonMail users probably don't (and wouldn't have the skills to) evaluate the code they receive from ProtonMail, so even if they were being served up something suspicious, they'd never know.
Yes, either you'd have to verify the build yourself or trust someone else to do it and independently publish something for the extension to compare to the client it's served.
It’s clear that private keys are held client-side-encrypted on servers. You need that to read your emails in new devices. It’s standard and doesn’t lower security.
It’s also obvious that any website could serve you with bad Java script code.
Waste of time.
Well the author of this has a Telegram content channel.
If there's a website where you login and you see your email, there's always a way for that website to get access to the content of their own website.
Try running Thunderbird or a similar client locally, and use PGP (ugh) or something similar to encrypt messages.
(Theoretically, you can also use PGP with webmail, and it's secure, but extremely unpleasant.)
How else are you going to do it ?
Balance between security and usability, as usual. If you want more, use pgp, but loose most users.
I mean, yes, that's true, but it's still a bad idea.
> Balance between security and usability, as usual. If you want more, use pgp, but loose most users.
They could just have a local client. Thunderbird/Outlook/whatever isn't exactly difficult to use, even for non-technical people.
They do. This is what ProtonMail Bridge is.
What happens if whatsapp decides to exfiltrate your end to end encrypted messages from the client side app?? There is nothing you can do to stop them. They can even attach it to an analytics event to be discrete.
Protonmail is unable to view your emails without your password and that claim is true regardless of whether they hold your encrypted private key server side.
Total garbage