On Tue, Jul 1, 2014 at 2:15 PM, Gregory Foster <gfoster@entersection.org> wrote:

protonmail.ch

From what I can tell, you are loading the code they provide on the fly into your browser to execute crypto ops on your behalf. That is just

This appears to be just one of many startups offering non-solutions. plain bad. Remember hushmail? When you give up your environment to the same parties providing your service, you give up the game. And it's centralized, few will choose different passphrases, etc. https://protonmail.ch/blog/protonmail-threat-model/ "There are more difficult to use, but more secure solutions out there, which are more appropriate for Snowden’s use case." For one, you're better off learning and using some underlying tools like these instead... https://www.gnupg.org/ https://www.enigmail.net/ https://protonmail.ch/sign_up.php -> https://protonmail.ch/invite "Notification Email (Required) - Used only to contact you about our public beta. This should be your current email (Gmail, Hotmail, Yahoo!, etc) - not your new protonmail email. ... Your notification email will not be linked to your ProtonMail account - it is only used for communicating with you during our beta and will be removed from our system after the beta." This is a failure of implied and stated privacy ethics. Invites are linked. And it should not be asked for in the first place. Thus never on the system and no trust needed. "response to our open beta has maxed our server capacity. We're working hard to add more servers While open and honest if true, this does not inspire systems confidence. "I think it is safe to say if we were NSA funded, we wouldn’t need to be going around competing for 100k startup awards" Actually, that is precisely what you'd want to do. There's no architecture whitepaper. And so on, etc... It's a useful service and a step in the game. Just be exactly sure of what it is and what it is not. And you should not rely on service providers to be the sole source of your answer to that question either.

ProtonMail's public Bitcoin address: https://blockchain.info/address/1Q1nhq1NbxPYAbw1BppwKbCqg58ZqMb9A8?filter=2

I'd rather fund something like... "The next gen P2P secure email solution"

Dnia wtorek, 1 lipca 2014 22:20:44 grarpamp pisze:

I'd rather fund something like... "The next gen P2P secure email solution"

You mean like RetroShare? -- Pozdr rysiek

Gregory Foster wrote: reflexive acceptance of open source projects

Not so much, ie: one must still evaluate them too.

I think it's beautiful to see and support the proliferation of work occurring to address ... privacy ... [with open source]

Yes.

[with closed source].

Pretty products, onesheets, and test vectors. Yes, they're nice and do help in overall movement towards an all encrypted world. They're worth recommending. However, caveat trust and whatever other issues to the recommendee. This applies equally to opensource. Seeing mail providers basically advertise 'you can trust us' to their end users (with whatever backing reasons they have (which btw are typically as full of holes as your typical privacy policy))... that's what should give people pause to think carefully. This, re: proton... which would you rather hear, and which do you hear? - Warning: We detected a breach that injected snake oil into your browser. - Warning: We can inject snake oil into into your browser at will. Any provider who tells you they offer an email service in which they can make your email trustably secure for you, regardless of how they claim to do it, is a liar. Period. You are the trust root, only you can secure your email. So those who want better will need to use provider independant encryption tools. And the best you'll ever get with them under [1] is encrypting everything but the 'envelope to' (which you must expose for delivery), and the authenticated 'envelope from' (which they, being the centralized rulers they are, will require). More self help tools... https://www.mailvelope.com/ https://whiteout.io/

the new normal of no privacy

Any fixes on centralized clearnet 'email', beyond everyone using self help tools, will always have these trust issues now. As with Banks/Paypal vs Bitcoin, remove the delegation of trust to the central provider... by removing the central provider from the equation. [1] http://en.wikipedia.org/wiki/Email

The slumbering cypherpunk spirit has awakened. @gregoryfoster <> http://entersection.com/

http://entersection.com/posts/1238-charlie-chaplin-on-the-patrimony-of-greed... ?