Technology

69913 readers

2164 users here now

This is a most excellent place for technology news and articles.

Our Rules

Follow the lemmy.world rules.
Only tech related news or articles.
Be excellent to each other!
Mod approved content bots can post up to 10 articles per day.
Threads asking for personal tech support may be deleted.
Politics threads may be removed.
No memes allowed as posts, OK to post as comments.
Only approved bots from the list below, this includes using AI responses and summaries. To ask if your bot can be added please contact a mod.
Check for duplicates before posting, duplicates may be removed
Accounts 7 days and younger will have their posts automatically removed.

Approved Bots

founded 2 years ago

MODERATORS

[email protected]

Seeking Input on Proton AG: Trustworthiness and Security (lemmy.eco.br)

submitted 2 years ago by [email protected] to c/[email protected]

10 comments fedilink hide all child comments

Hey everyone, how do you evaluate the company Proton AG, the owner of Proton Mail and Proton Pass? I'm in the process of migrating some accounts to their platform, but I've always been wary of using a password solution, especially after the LastPass incident. I used to use Keepass stand alone, but it's quite cumbersome. So, how do you assess their credibility and security? Just saying that it's Swiss and has scientists doesn't really help, lol. Thanks!

all 13 comments

sorted by: hot top controversial new old

[–] [email protected] 18 points 2 years ago (2 children)

I would suggest looking into other options for PW managers like bitwarden. Having email, calendar, drive, VPN, and PW manager all from one provider just means there is a single point of failure.

[–] [email protected] 7 points 2 years ago (1 children)

All Proton services are e2e encrypted, so even if they are breached, there is little data available without having to crack each user keys.

Still, the password manager is still new, and there is still a lot to iron out. So I would advise against using it as main password manager. But it is promissing.

[+] [email protected] 2 points 2 years ago (2 children)

[removed by mod]

[–] [email protected] 3 points 2 years ago

That's why you need to install the proton mail bridge if you want to use it with apps like thunderbird. Of course, Emails not send from or too another proton account are not encrypted, but that's something proton can't change... Although you can put a password on your emails, so only people who know that password can access the mail, but that's more of a workaround than a fix.

[–] [email protected] 2 points 2 years ago (1 children)

I'm not a proton employee, so I can't give you the exact process used, but basically Protonmail probably uses asymmetrical encryption to encrypt incoming emails as soon as they receive it.

Asymmetrical encryption uses two keys. A public one, and a private one, both linked together by two one-way mathematical function. The public one can be used by anyone to encrypt a message using said one-way function, but cannot be decrypted without using the private key, which is itself encrypted by your password (which is both unknown to Proton, that why you cannot recover your data if you forget your password), and probably other parameters like your main Protonmail email address.

Now, on the client side, your password (and any other parameters) are used to locally decrypt the private key, which in return is used to locally decrypt the data send by Protonmail servers.

Sure, it isn't true E2E encryption, but it is the closest to it you can get while talking with another server that do not support E2E encryption.

But there is more. If you send an email to another Protonmail client, said email will be truly E2E encrypted as both client will have access to each other public key, allowing them to encrypt the message on the client side, which will prevent Protonmail from ever read it. If I'm not mistaken, sames goes with any PGP enabled client (like Thunderbird with the Enigmail addon).

[–] [email protected] 4 points 2 years ago

I agree, keep your password manager, 2FA, and email all on separate services so at least there is some protection from getting your accounts stolen if they get access to one of them.

[–] [email protected] 15 points 2 years ago (1 children)

especially after the LastPass incident.

Which one?

Serously, I think LastPass has the worst security record for any password manager. Ever. And I think they're the only who sold to some management company.

Proton is solid. So is Bitwarden.

[–] [email protected] 8 points 2 years ago

I uses Proton services for a long time, and am a paid user for more than 6 years (and more if you count when I was on the free version). I never had any problem with them, and had at worst a day of downtime when they got ddos some years ago.

Services are solid and well designed, feedback are listened to, only downside is a closed-source backend (but the frontend is open-source, if I recall well).

Only thing to take into account. If you loose your password somehow, you loose all your data. So keep the recovery keys very preciously.

[–] [email protected] 3 points 2 years ago

I used to use Keepass stand alone, but it's quite cumbersome.

How is it cumbersome, also, have you checked out KeePassXC? It's, IMO, much better than the official KeePass app.

[–] [email protected] 3 points 2 years ago

Unless you’re a big company, they won’t give two craps about you. If you’re a large company you can ask to audit them and reveal some of their security practices. Chances are if they don’t just talk the talk but also walk the walk they’ve been already audited by a third party, which if you choose to trust can be enough in your case. The reality is you cannot know what goes on in their backend, you can only know what’s going on in your backend.