Andy Yen, the CEO of Proton (Mail, Drive, VPN, Pass…) answered a lot of the questions you, the community, asked, in an interview that covers basically everything!
He discusses security, privacy, the origins of Proton, how they operate, Linux support, future projects, products and features, quantum computing, passkeys, and more!
Proton Mail: https://proton.me/mail/TheLinuxEXP Proton VPN: https://protonvpn.com/TheLinuxEXP
👏 SUPPORT THE CHANNEL: Get access to a weekly podcast, vote on the next topics I cover, and get your name in the credits:
YouTube: https://www.youtube.com/@thelinuxexp/join Patreon: https://www.patreon.com/thelinuxexperiment Liberapay: https://liberapay.com/TheLinuxExperiment/
Or, you can donate whatever you want: https://paypal.me/thelinuxexp
👕 GET TLE MERCH Support the channel AND get cool new gear: https://the-linux-experiment.creator-spring.com/
🎙️ LINUX AND OPEN SOURCE NEWS PODCAST: Listen to the latest Linux and open source news, with more in depth coverage, and ad-free! https://podcast.thelinuxexp.com
🏆 FOLLOW ME ELSEWHERE: Website: https://thelinuxexp.com Mastodon: https://mastodon.social/web/@thelinuxEXP Pixelfed: https://pixelfed.social/TLENick PeerTube: https://tilvids.com/c/thelinuxexperiment_channel/videos Discord: https://discord.gg/mdnHftjkja
#vpn #privacy #proton #onlinesecurity #protonmail
Timecodes:
00:00 Intro 01:16 How did Proton start? 03:24 Why start with email? 06:03 What is Proton’s business model? 08:34 Why set up in Switzerland? 11:33 What data do you have on customers? 14:39 How is encryption important? 18:20 Do you always need to use a VPN? 20:47 Why focus on building an ecosystem? 24:55 Is an Office Suite planned? 26:29 What differentiates Proton from competitors? 30:26 Is Proton a viable alternative to big tech services? 33:31 Why expand to more products instead of finishing existing ones? 37:19 Does the general public care about privacy? 38:45 What’s next for Proton services? 40:08 What are the plans for native Linux clients? 46:03 Will ProtonVPN offer dedicated IPs to everyone? 47:46 What’s the environmental impact of Proton? 49:27 Proton on F-Droid, without Google Play notifications? 52:03 Why are code repos all separated and hard to find? 53:12 Why are addresses ending in “.me” ? 54:57 When will all apps reach feature parity? 56:24 Will SMTP relay be supported? 57:47 Will Proton focus more on businesses in the future? 59:50 Why put all your eggs in one basket with just Proton services? 01:01:00 Will Proton support passkeys? 01:03:21 Does E2E matter is the recipient isn’t using it? 01:04:49 Will Proton disable port forwarding in VPN? 01:06:41 Is encryption enough to make email private? 01:09:06 What protects users from a change in Proton’s code licensing? 01:11:14 How does Proton protect its infrastructure? 01:13:14 Impacts of Quantum Computing on privacy and security? 01:14:24 What’s the future of Proton Bridge? 01:16:25 When will Proton photos be a thing? 01:17:17 Plans for Proton Notes? 01:18:20 Will VPN support the Apple TV? 01:21:12 Support the channel
I have a question for ProtonMail:
What is the purpose of your end-to-end encryption?
It seems like its only conceivable purpose is to protect against the server being malicious, since the HTTPS encryption between client and server is already protecting against all adversaries who don’t control the server. But, if the server is malicious then it can target an individual user and serve them different javascript when they login. (This special javascript for the targeted user can exfiltrate their passphrase and then the adversary can decrypt everything…)
So, is it correct to say that the only scenarios where ProtonMail e2ee is actually useful in any way (eg, it could prevent an adversary from seeing plaintext) are these two?
Also, separately from potential special behavior for targeted users, is there any way to verify the integrity of the javascript being served to everyone currently (or at any point in time)? (Just having it be open source and audited isn’t sufficient, since the javascript that people actually run while using the site is minified…)
I have seen you linking this comment in multiple conversations about Proton/Encryption, so I wanted to add my two cents and understand better your perspective.
To be clear, the risks you are eliciting are real, but I don’t think there is any effective mechanism that can mitigate them. I am curious to understand what a satisfactory solution from your PoV would more-or-less look like.
In the browser you’re effectively doing an “update” with every page load (and after you’ve identified yourself to the server!) and there is no authenticity check besides HTTPS and no possibility to confirm that you received the same thing as everyone else (or that you received something that corresponds to source code in git, if the javascript happens to be open source).
It is easy to confirm that two users are running an identical version of a piece of local software; it is nearly impossible to confirm the same in the web context. Every pageload is another opportunity to deliver malicious code to a targeted user with very little chance of being detected.
As I wrote in another comment:
… and still is today.
Partially true (usually JS blobs are cached), and I have acknowledged this fact already:
But what security does this offer? If a malicious update is pushed through other channels (say, a release in an APT repo), you can get compromised when you update the software. Where is the substantial difference with getting compromised when “the page loads”? The only difference is really time, but it doesn’t change the security model. Also, the fact that you have to authenticate yourself might make it easier for an attacker to attack specific individuals, but that is by no means a necessity to carry out the attack. A malicious update can be installed by many people and it’s trivial to understand which users have been compromised post-factum by simply accessing the emails, so that non-target can simply be ignored. On the other hand, as an update can be pushed quickly, it can also be overridden more easily forcing attackers to be more noisy and repeat the attack, while a software installed can potentially not be updated anymore for months and if you install a compromised tool it’s likely your whole machine/network can get compromised, while at least the JS code runs in the browser sandbox that has to be escaped. So there are pros and cons, but the fundamental security risk is the same.
And what security does this control offer? Who does this comparison? If doing it is the provider, it’s worthless, because that process can be compromised too. The only benefit would be if users compared to each other, but first of all, nobody does this; second of all, it’s anyway a very weak control because for each software there are N versions available (non-web), so users can totally be running different versions of the software legitimately. I really don’t understand what scenario you are imagining here.
I still do not understand what would constitute a secure setup in your view. Personally, as a security professional, I think you are pointing out legitimate risks, but these risks have no fundamental solution, whatever the software.
As I said:
I am really curious on your view, because personally I think that Proton is doing well for what it can be reasonably offered. There is nothing that they can provide (hashes/signatures for the code) that would add any security in the scenario or their total compromise, because you still only have one trust boundary (you and Proton). You would need a third party that verifies the software, signs it and gives you the possibility to verify your code against it, but such thing is not used almost anywhere AFAIK. And it’s exactly the same with software releases in other ways (e.g., package manager). The package and the signature are provided by the same entity, so it doesn’t protect against the repository compromise (but only the channel compromise and partially from local tampering).
The difference is that targeted delivery of malicious versions is far less likely to ever be noticed than backdooring binaries for everyone would be.
There are various shortcomings in the numerous software distribution mechanisms in use today, but very few that make it easier to undetectably deliver malicious code to specific targeted users than javascript on a web page does.
🔔🔔🔔
When you use credible end-to-end encryption software, that is exactly what you are doing: you are getting the encryption software from someone other (literally anyone would be better) than the entity who’s job it is to store your ciphertext.
Of course, the quality of software distribution channels varies widely, but, a few properties which are pretty common outside the browser (even for proprietary software) include:
Even if most users aren’t taking additional manual steps to verify their software authenticity, a system where it is possible for them to makes it more difficult for attackers to execute a targeted attack without risking detection.
When you use things like Proton, Tuta, or Hushmail (which, again, is the same deceptively-marketed architecture as Proton and Tuta and has been doing this for literally 25 years) you lack all three of those properties and you instead constantly refetch the encryption implementation from the only (in most cases) 3rd party which happens to have your ciphertext. This architecture is designed for them to exfiltrate keys from targeted users.
Their marketing says that they can’t read your mail, and this is a lie. Some non-zero number (maybe dozens? who knows) of employees at each of these companies have the ability to read any user’s mail by serving them slightly different javascript one day, and therefore so do any 3rd parties who can coerce or compel one of these employees through legal or extralegal means.
Think about what an attacker needs to circumvent the encryption between two proton users: they need one protonmail employee. Done.
Now think about what an attacker needs to do the same to users of some PGP implementation and a normal email host that doesn’t sell snakeoil:
Of course, they might also try to compromise the victim’s endpoint in various other ways, but I’m not trying to address all of the problems of computer security in this example: I’m just contrasting the properties provided by the Proton/Tuta/Hushmail architecture with how other email encryption works.
HTH!
I see your point, and I generally agree.
However:
This is relatively useless, unless you (the user) can actually verify the legitimacy of the code, which you can’t. You may verify provenance, but that doesn’t tell you anything.
Nobody checks this really. I cannot think of a single example where I have done this or where I would be able to do this.
This is technically feasible, but obviously not in the context of actual usage, so I agree.
That said, you are forgetting that:
I think you underestimate the whole supply chain of the software that uses your PGP key. The CLI tool, the libraries. All it takes is one malicious commit in any of that, and you are toast (provided you install that version). The only protection you have is the chance that someone will notice the malicious commit(s). There are examples of similar attacks where nobody noticed.
This might be an overstatement. We don’t know what internal security measures they have. Even basic compliance require separation of duty, which means a single person cannot carry out such a process end-to-end (replacing code). They might also have internal monitoring etc., it’s not so trivial.
I agree, but there is a problem: you will never in a million years get the average person to use PGP. The whole tooling is messed up, even for technical people. This is a fact, and while I agree that the security it offers is better, the average person who is not trying to protect themselves from nation states is much better off with Proton than with Gmail, since that’s the realistic alternative. Also, even in the legal cases where Proton did disclose the data they had (anti-“terrorism” cases), they did not disclose any email content and what they had was minimal. I think if you are a target of nation state adversaries and you are thinking to communicate via Email, you are probably doomed.
To be fair, this is much, much, much, much easier that compromising Proton or getting to one of the employees. It’s also a much more reasonable attack to compromise multiple communication channels compared to only email.
Ultimately I think that you calling these product snake-oil is a misrepresentation of the reality. For the risk model of the average person, Proton (and similar) does deliver what it promises. The fact that sophisticated attackers might be able to compromise the provider and compromise the encryption is not a reason to invalidate the product tout court, in my opinion. Especially because neither me nor you know exactly the security controls they have internally to protect the integrity of that code.
When evaluating a security product that is fundamentally based on unverifiable promises, I think it makes sense to give more consideration to the scenarios where the promises are being broken than where they are being kept.
If you’re completely confident that the promises are being kept, the end-to-end encryption is not necessary.
Your implication that our being unable to know “what internal security measures they have” makes their (implied) promise not to circumvent the encryption more, rather than less, believable… does not make sense to me.
What regulatory regime do you believe ProtonMail is complying with which makes it impossible for a single person to do something like that?
Also, to be clear: I’m mostly not talking about replacing the code for everyone all the time (which is also possible but would have a much higher chance of someone noticing). I’m talking about doing it for specific users. And besides control of the right server, there are lots of other scenarios where a lone actor can do this without control of any proton servers at all but simply with the right TLS certificate and a suitable network position (eg, on-path between the user and server, or the user and their DNS recursor, or any number of other places). I think it is reasonable to assume that there are a two-digit number of people at ProtonMail who can do the kind of attacks I’m talking about. Any adversary (not only nation states) who wants to read a Proton user’s mail simply needs to figure out how to coerce one of them into performing a small task for them.
Sorry, but this is simply not true. I know lots of people who adopted PGP many years ago while being computer novices (eg, never used a terminal in their life). PGP has plenty of problems, but if you want to encrypt email, it is the standard (outside of the corporate S/MIME world). PGP will probably never be ubiquitous but neither will snakeoil things like Proton and Tuta.
Email is also not the only encrypted communication option these days, and the incorrect perception that ProtonMail’s end-to-end encryption provides meaningful security is undoubtedly preventing some of their customers from using better tools instead.
There are plenty of other email providers which have reasonable-sounding privacy policies and don’t supplement them with misleading technical claims. If you are willing to trust Proton, why not instead trust some other company that doesn’t lie to you about the usefulness of browser-based encryption?
But, you do agree that, in contrast to non-web-based end-to-end-encryption solutions, web-based e2ee can always be unilaterally undetectably circumvented at any moment for specific users by a single insider or anyone with access to the right server, or the right TLS certificate, without exploiting any software bugs, right? You just think that isn’t snakeoil? 🤷
What you describe it’s an attack, not a feature though. A broken promise would be if they intentionally did so, which is something we have no proof at all (and would also be pretty stupid for them). They have no way to prevent the attack you mention completely because that’s inherent to the fact that the same entity that serves the software handles the ciphertext. There is absolutely nothing they could do to improve their stance on this “promise”.
My stance is that you need to some extent to suspend the judgement. They have an internal security team which likely considers this scenario one of the (main) ways in which their encryption can be broken. They might have extremely tight processes around that, which makes the scenario described potentially very unlikely. It might also be they have done nothing, but I can’t know either way. This fact generates a risk which different people will estimate in different quantity. Your stance seems to be pretty binary instead, while not everyone has the same risk appetite that Snowden has.
They are HIPAA compliant (which I am not very familiar with, since I am not in the healthcare sector), but separation of duties is a basic principle really that even companies without any certification adopt. I see HIPAA does have provisions in terms of access-control, but I don’t know how they comply. Either way, this does not make it “impossible” in any case, but it’s also not granted that a single employee could completely break their product.
I understand. That would still require some level of persistence, and to compromise what I am sure is plenty of replicas for the particular service (I doubt it’s predictable which one will serve which user).
Well, if an attacker has the ability to install the certificate on the device (which requires
root), then even the PGP encryption is probably toast (I can likely phish the user password with a fake-prompt and then read the private key). Either case, they usestrict-transport-securityheaders and they are on a preload list, so DNS poisoning and the like won’t work, the browser will refuse to load the page and won’t even prompt the user to accept the risk.Absolutely true, but then again, this is true about pretty much anybody. I work in the financial sector and I can assure you the malicious employees can do a lot of damage if they wanted and that’s why the malicious insider is a threat right at the top of the list for every security department. As I said before, a malicious commit to an OSS repo for a library/tool that implements your e2ee and you have the same attack vector. Also, they might as well just coerce you if they can, rather than an employee of a company.
Apologies, but this is might be simply a bubble you are in. I know one person who does, and I live in a tech bubble. PGP is incredibly annoying and the web of trust is not scalable. This without even talking about the technical challenges (the tooling sucks). Proton has 100million users alone (sure, many duplicates) and will never be mainstream, but I would be surprised if more than a million people use PGP (I have no numbers) “vanilla”. My perception is also anecdotal, but PGP being borderline unusable is almost a meme.
Yeah, perhaps. But then again, those people are probably not those who have this kind of attack in their risk model.
Because their service is top-notch and I don’t consider the eventuality of them being compromised a lie in their statements. In my mind, the theoretical capability to do something does not mean that something is done or easy to do, especially because - again - I have no idea of what other (internal) control they have implemented to prevent and control that particular vector. As far as we know, to update the frontend code employees might need to access some specific server that requires ad-hoc approval and the supervision of 3 people, plus a manual signoff, and after that the signature of the code (say, container image) is verified before locking the system again. I just made it up of course, but I think they have plenty of people in-house that figured out this risk too.
I think that web-based e2ee can be more quickly broken if the provider is compromised/there is a malicious insider and the provider does not have an appropriate level of security mitigations/controls, as it does not require user interaction. This is really the substantial difference compared to non-web e2ee, for whatever is worth. So yeah, it’s not snake-oil in my view, it’s an inherent property of web services and the best a web service can do. Actually, if you use Proton bridge you are in the same exact situation than if you were to use your favorite PGP cli tool or plugin, so there is also this.
I wouldn’t consider snake-oil something because it can be compromised, because snake-oil selling implies the bad faith of the seller, which in case of Proton I have no reason to think is there.
Yeah, i think it is a feature, and a very beneficial one for the people this system was designed for - those who want a lot of privacy-desiring users to settle on using an encryption solution which isn’t too difficult to circumvent.
Yep! That is what I’ve been saying: that is the problem with this architecture!
Note that, throughout this discussion, I’m not really just talking about Proton but rather them and Tuta and Hushmail and anything else that shares this architecture.
Well, they could be honest and inform their users: “to have the convenience of using webmail you must sacrifice the benefit of end-to-end encryption (not needing to trust the server and its operators to refrain from reading your messages).”
Do you think telling users that would surprise many/most of them, and cause them to stop using it? Could that be why they don’t mention it?
Yep. But no matter how tight their processes are, there are still single points of failure that can be coerced to gain access to anyone’s email.
It’s funny you mention Snowden. Even he was naive enough to use a Proton/Tuta/Hushmail-like system back in 2013… it was called Lavabit. In the case of Lavabit, I think the operator was actually also naive and well-intentioned because when people investigating Snowden asked him to perform the exact attack i’ve been describing (which his architecture enabled him to) he instead opted to shut down the entire service and to notify Snowden and the world.
ProtonMail operating with the architecture they have in a post-Lavabit world (they were actually founded just after that happened, and rode the Snowden privacy-awareness wave to success) is pretty strong evidence that they would not shut down their system if the alternative was being forced to spy on some of their users.
(To be clear, Lavabit should’ve known better too, existing in a post-Hushmail world…)
🤦 that is (obviously, i thought) not what i’m talking about. i know how the PKI and HSMs and HSTS and CT and CAA (protonmail’s CAA records authorize 3 different CAs to sign for them) etc etc work, and their many failures over the years that have lead to the current set of mitigations, and how HPKP worked/works (which, btw, i just checked, and protonmail is sending a
public-key-pins-report-only:header, very nice 🤣) but I don’t have the energy to explain to you why selling something as e2ee while it reduces to (among other things) specifically the security of TLS is dishonest.I just checked their site and they still say it’s “for journalists”, and “we can never access your messages”, etc etc.
Someone hiding from a violent criminal organization might well realize that they have a life-or-death “risk model” and yet not realize that ProtonMail’s (lauded by knowledgeable people like yourself) security actually has numerous human single points of failure which their adversary can coerce to read their email.
The people who need security most are often people who lack the expertise to adequately evaluate the veracity of claims like ProtonMail’s. They look to knowledgeable people (like you and i) to help them decide what is reasonable. Also, even very knowledgeable people who badly need security will sometimes sacrifice security for convenience (eg, Snowden; he also used other things, but, he used Lavabit too, presumably assuming that this type of attack, while possible, would not actually happen).
If what you want is not privacy from adversaries who can compromise your mailserver, but rather just protection from GMail reading your mail, then you don’t need e2ee: you need a provider with a privacy policy you believe they will honor. By saying things like this:
… ProtonMail is demonstrating that they are not trustworthy. When they aren’t circumventing their encryption, are they honoring their privacy policy with regard to the things the encryption doesn’t protect (metadata like social graph, location, etc)? Why would you assume they are when they’re lying about their ability to read your emails?
From your replies here, it’s becoming clear to me that you do see this: if i understand you correctly, you are not saying that ProtonMail “cannot read or give anyone else access to your emails” as they are saying; rather you are just saying that you think it is very unlikely that they would ever abuse that capability and that you assume their procedures make it so that one rogue employee couldn’t do it alone. You do seem to understand that, contrary to what they’ve written in the screenshot above, ProtonMail as a company technically could decide to. But, do you think most of their customers understand that?
I’m growing rather tired of this discussion, but I have a few more questions for you.
Given that they have 100 million users, which of these statements do you think is the most likely to be accurate:
Personally, I think #3 is a bit more likely than #4, while #1 and #2 are extremely unlikely.
So, my last questions are:
In any case, as you said, we “can’t know either way”.
in case anyone is reading this thread on PeerTube, where this post originated: it seems that edits to comments don’t currently federate from Lemmy to PeerTube.
i added to the previous comment after I initially posted it; you can see the edited version here: https://lemmy.ml/comment/8677238