7 ms·

Security experts declare all Proton apps secure after security audit

121 points by chmars 4y ago

vr46 4y ago
Unfortunately users declare Protonmail barely usable in terms of features and UX. After a decade of this, I’m shifting back to IMAP. My use case is better off with GPG than with Protonmail. I can’t usefully function without integration into the rest of my Mac or iOS. A secure walled garden with Apps that get worse over time? I’ll go with Apple’s version.
- deleted 4y ago
  [deleted]
- nulbyte 4y ago
  Protonmail user here, and I haven't declared any such thing. The complaints I see tend to center around the assumption that using the service is exactly the same as any other service, despite the lengths they go to tell you how it's different. The service and the app is very usable and there are more than enough features, without them getting in the way. I use the app and the bridge; both have served me well.
  - vr46 4y ago
    I was sarcastically riffing on the original title, but that aside, the differences between Protonmail are diverging year-on-year, with the new bridge providing features that don’t exist in the app. Adding Calendaring and Drive at the expense of improvements in the core Mail. There’s only so long they can go on touting supposed security benefits at the expense of interoperability and usability. Swipe to multiple actions, select multiple messages, opening calendar invites in other apps. I disagree that they go to lengths to explain how everything is different, a quick look says the opposite, and they don’t establish the trade-offs at all. If you want privacy for “everyone” you have to make hard things easy and not make easy things hard.
  - pensatoio 4y ago
    They just refactored their iOS app too, thankfully. It's not a stale product, by any means.
- mbrodersen 4y ago
  Not my experience at all. It works really well.
orlp 4y ago
Technical nitpick purely on the wording of the title: the pentesters declared that "no important security issues were found during the pentest". Unfortunately in our current world that's about as good as you're going to get for a large software system, but that does not necessarily mean that Proton is secure. There could still be undiscovered vulnerabilities.
- Macha 4y ago
  Yeah, it's a bit like when someone says their relative's doctor said their cancer was cured. This is basically an impossible statement for a doctor to make to medical standards which is why the best you're going to get from a doctor is a statement that someone is in remission or the latest scan did not find cancer cells. When someone makes a stronger claim you're left wondering if it's the original source or the messenger that's after oversimplifying the situation and it looks bad for one or the other.
sodality2 4y ago
Declaring it secure after an audit is like writing 100% coverage tests and saying it's bug-free. You can't prove absence, only presence. This title is the definition of sensationalism and only by reading the article do you find the truth: "Their tests uncovered no major issues or security vulnerabilities". This is a bad look for them and I'm wary of their company now...
- capableweb 4y ago
  I agree with you that the title is a bit sensationalist. But if independent security audits with no major issues uncovered cannot make you claim something is secure, when can you claim something as secure? Or are you of the opinion that nothing ever can be claimed to be secure as there can always be holes that could be uncovered in the future? Using openssh as an example, would you say it's secure when you're using public keys for the authentication? Their track record seems pretty good for the last years, but there might still be uncovered vulnerabilities, could it still claim to be secure?
  - jsjohnst 4y ago
    > when can you claim something as secure? here’s a maybe wild take, uh, never?
    - capableweb 4y ago
      But you'd agree with me that some things are more secure than others right?
      - jsjohnst 4y ago
        I’d be willing to say “there are things with known exploits, there are things which employ techniques that are known not to be safe making them less secure, and the rest is more akin to Schrödinger's cat as far as secureness goes.”
  - sodality2 4y ago
    > But if independent security audits with no major issues uncovered cannot make you claim something is secure, when can you claim something as secure? Nothing at all; it's a broken model. The server can at any time start serving malicious payloads [0]. The server hosts your mail but they also serve the webapp. The clientside decrypts the mail, but the server hosts the client code... It's a fundamentally flawed idea, trying to retrofit encryption into email in this way, when the server essentially has to hold all of your mail. In this case, the only thing that would make me feel secure in using it, is a third-party OSS client that downloads the mail without using the webapp, using only client-side code. And even then, of course, the mail can simply just be not encrypted when being ingested by Proton. So even then I wouldn't really trust it without external encryption like PGP. In which case, why bother? To be clear I do use private email services (protonmail, tutanota) but I am simply not going to fall for the illusion of guaranteed privacy; I just trust that they are what they say they are. They are still a better option IMO than something like Gmail, but I don't think they're a silver bullet. [0]: If you think this is unlikely, see this: https://news.ycombinator.com/item?id=25337507 https://news.ycombinator.com/item?id=25337507
webmobdev 4y ago
I always think twice when a company offers me an "app" for an application that is already available as a web app or that is already inbuilt in the system or doesn't use existing standards. Like, I perfectly understand the need for a Proton Mail client as some would like offline access to their mail and a backup of their mail in their system. But I resent the need of a custom and locked-in app, instead of the service being available over existing POP3 / IMAP protocol. (Yes, I understand how email encryption creates hurdles of using it over POP3 / IMAP, usage, but it would be a lot easier to trust a company if they actually built an extension over existing protocol or create a new standard that makes it easy to access their service. E.g. https://fastmail.blog/open-technologies/jmap-new-email-open-standard/ https://fastmail.blog/open-technologies/jmap-new-email-open-... ). ProtonVPN app also seems a bit redundant when most OSes already have built in support for VPN. Though I understand that it does make configuring, changing / choosing VPN servers a lot simpler, and probably helps ProtonVPN in load balancing, it provides more avenues for data collection and data leak.
coffeeandbooks 4y ago
ProtonMail has a bad history of irresponsible sensationalism. It’s like constantly marketing yourself as the most private e-mail service “built by CERN scientists” but who will give information about you to authorities: https://www.engadget.com/protonmail-climate-activist-ip-swiss-french-authorities-233004304.html?guccounter=1 https://www.engadget.com/protonmail-climate-activist-ip-swis... I know that ProtonMail doesn’t claim to protect your IP address, but I don’t expect the average user to make that distinction. This is another dumb article. Getting your service tested for vulnerabilities is good hygiene but it shouldn’t be used as marketing material to make users think your service is Fort Knox.
- blablabla123 4y ago
  I agree with the sensationalism but it's a for-profit company after all. They definitely do more than the average email provider but it's certainly not the Tor equivalent of E-Mail.
- capableweb 4y ago
  > ProtonMail has a bad history of irresponsible sensationalism. It’s like constantly marketing yourself as the most private e-mail service “built by CERN scientists” but who will give information about you to authorities: Well, conflating "security" with "following the law" seems odd. Do anyone realistically expect a legally incorporated company to not follow laws? They have to respond to lawful requests, otherwise there will be no business at all. As long as they fight against unlawful requests, they are what they make out to be. If they're found to be spying on their users when it's not lawfully requested, then you have some bite in your argument. But otherwise, I'm not sure what you expect them to do. By the way, they seem to be pretty upfront about how they collaborate with law enforcement, at least according to https://protonmail.com/law-enforcement https://protonmail.com/law-enforcement Maybe it wasn't like that in 2021 when the article you linked was published? In the end, if you rely on any single company for both your security and privacy, you're playing a loosing game. Not hiding your IP when signing up for something when you're planning to do illegal activities? Maybe time to reconsider your opsec strategy.
  - 4y ago
etiam 4y ago
For a moment there I thought the title referred to the Valve-associated Wine enhancements... Now that would have been a feat.
justinpowers 4y ago
So many complaints about the headline, but for the purpose of getting their point across to the masses and encouraging the use of as-secure-as-can-be-known software, it’s perfectly fine. If you cover your ass in a headline, which ultimately ends as legalese, the average person will completely ignore it due to wordiness or they will become suspicious and assume the worst. The body and attachments do not mislead at all and that should be commended. All this pedantry is counterproductive unless you truly know and trust your audience. Proton should be for the masses, not just for the technically adept.
Foobar8568 4y ago
So a company called Securitum did a security assessment limited to pentest according to the pdf. More over "Tests have been carried out in September 2021 in accordance with generally accepted methodologies, including OWASP Top 10 and SANS Top Issues". It's hard to believe that one can call apps being secured after pen testing especially when the two highlights are such low hang fruits that are OWASP top 10 and SANS top issues.. It doesn't really give any confidences into Proton, but then again, I am not an expert, and have seen such useless reports at different clients.
ctime 4y ago
I have a hard time adding protonmail to my "generally regarded as safe" mail provider list when they haven't been able to implement Webauthn security key support (aka U2F security keys / FIDO security keys). Yes, they support Multi-Factor authentication, but only via phishable methods (TOTP)[1]. They have been "trying" for years[2] to implement U2F but for some reason haven't been able to figure it out yet /shrug [1] https://protonmail.com/support/knowledge-base/two-factor-authentication/ https://protonmail.com/support/knowledge-base/two-factor-aut... [2] https://twitter.com/protonmail/status/1300758061255217153?lang=en https://twitter.com/protonmail/status/1300758061255217153?la...
deleted 4y ago
[deleted]
karmakaze 4y ago
I was totally confused by the title thinking what does that mean or how can they say such a thing without proving a secure sandbox environment, which I didn't even know was possible. Then I realized it's for ProtonMail etc, not Proton from Valve.

121 points by chmars 4y ago

vr46 4y ago

Unfortunately users declare Protonmail barely usable in terms of features and UX. After a decade of this, I’m shifting back to IMAP. My use case is better off with GPG than with Protonmail. I can’t usefully function without integration into the rest of my Mac or iOS. A secure walled garden with Apps that get worse over time? I’ll go with Apple’s version.

deleted 4y ago
[deleted]
nulbyte 4y ago
Protonmail user here, and I haven't declared any such thing. The complaints I see tend to center around the assumption that using the service is exactly the same as any other service, despite the lengths they go to tell you how it's different. The service and the app is very usable and there are more than enough features, without them getting in the way. I use the app and the bridge; both have served me well.
- vr46 4y ago
  I was sarcastically riffing on the original title, but that aside, the differences between Protonmail are diverging year-on-year, with the new bridge providing features that don’t exist in the app. Adding Calendaring and Drive at the expense of improvements in the core Mail. There’s only so long they can go on touting supposed security benefits at the expense of interoperability and usability. Swipe to multiple actions, select multiple messages, opening calendar invites in other apps. I disagree that they go to lengths to explain how everything is different, a quick look says the opposite, and they don’t establish the trade-offs at all. If you want privacy for “everyone” you have to make hard things easy and not make easy things hard.
- pensatoio 4y ago
  They just refactored their iOS app too, thankfully. It's not a stale product, by any means.
mbrodersen 4y ago
Not my experience at all. It works really well.

orlp 4y ago

Technical nitpick purely on the wording of the title: the pentesters declared that "no important security issues were found during the pentest". Unfortunately in our current world that's about as good as you're going to get for a large software system, but that does not necessarily mean that Proton is secure. There could still be undiscovered vulnerabilities.

Macha 4y ago
Yeah, it's a bit like when someone says their relative's doctor said their cancer was cured. This is basically an impossible statement for a doctor to make to medical standards which is why the best you're going to get from a doctor is a statement that someone is in remission or the latest scan did not find cancer cells. When someone makes a stronger claim you're left wondering if it's the original source or the messenger that's after oversimplifying the situation and it looks bad for one or the other.

sodality2 4y ago

Declaring it secure after an audit is like writing 100% coverage tests and saying it's bug-free. You can't prove absence, only presence. This title is the definition of sensationalism and only by reading the article do you find the truth: "Their tests uncovered no major issues or security vulnerabilities". This is a bad look for them and I'm wary of their company now...

capableweb 4y ago
I agree with you that the title is a bit sensationalist. But if independent security audits with no major issues uncovered cannot make you claim something is secure, when can you claim something as secure? Or are you of the opinion that nothing ever can be claimed to be secure as there can always be holes that could be uncovered in the future? Using openssh as an example, would you say it's secure when you're using public keys for the authentication? Their track record seems pretty good for the last years, but there might still be uncovered vulnerabilities, could it still claim to be secure?
- jsjohnst 4y ago
  > when can you claim something as secure? here’s a maybe wild take, uh, never?
  - capableweb 4y ago
    But you'd agree with me that some things are more secure than others right?
    - jsjohnst 4y ago
      I’d be willing to say “there are things with known exploits, there are things which employ techniques that are known not to be safe making them less secure, and the rest is more akin to Schrödinger's cat as far as secureness goes.”
- sodality2 4y ago
  > But if independent security audits with no major issues uncovered cannot make you claim something is secure, when can you claim something as secure? Nothing at all; it's a broken model. The server can at any time start serving malicious payloads [0]. The server hosts your mail but they also serve the webapp. The clientside decrypts the mail, but the server hosts the client code... It's a fundamentally flawed idea, trying to retrofit encryption into email in this way, when the server essentially has to hold all of your mail. In this case, the only thing that would make me feel secure in using it, is a third-party OSS client that downloads the mail without using the webapp, using only client-side code. And even then, of course, the mail can simply just be not encrypted when being ingested by Proton. So even then I wouldn't really trust it without external encryption like PGP. In which case, why bother? To be clear I do use private email services (protonmail, tutanota) but I am simply not going to fall for the illusion of guaranteed privacy; I just trust that they are what they say they are. They are still a better option IMO than something like Gmail, but I don't think they're a silver bullet. [0]: If you think this is unlikely, see this: https://news.ycombinator.com/item?id=25337507 https://news.ycombinator.com/item?id=25337507

webmobdev 4y ago

I always think twice when a company offers me an "app" for an application that is already available as a web app or that is already inbuilt in the system or doesn't use existing standards. Like, I perfectly understand the need for a Proton Mail client as some would like offline access to their mail and a backup of their mail in their system. But I resent the need of a custom and locked-in app, instead of the service being available over existing POP3 / IMAP protocol. (Yes, I understand how email encryption creates hurdles of using it over POP3 / IMAP, usage, but it would be a lot easier to trust a company if they actually built an extension over existing protocol or create a new standard that makes it easy to access their service. E.g. https://fastmail.blog/open-technologies/jmap-new-email-open-standard/ https://fastmail.blog/open-technologies/jmap-new-email-open-... ). ProtonVPN app also seems a bit redundant when most OSes already have built in support for VPN. Though I understand that it does make configuring, changing / choosing VPN servers a lot simpler, and probably helps ProtonVPN in load balancing, it provides more avenues for data collection and data leak.

coffeeandbooks 4y ago

ProtonMail has a bad history of irresponsible sensationalism. It’s like constantly marketing yourself as the most private e-mail service “built by CERN scientists” but who will give information about you to authorities: https://www.engadget.com/protonmail-climate-activist-ip-swiss-french-authorities-233004304.html?guccounter=1 https://www.engadget.com/protonmail-climate-activist-ip-swis... I know that ProtonMail doesn’t claim to protect your IP address, but I don’t expect the average user to make that distinction. This is another dumb article. Getting your service tested for vulnerabilities is good hygiene but it shouldn’t be used as marketing material to make users think your service is Fort Knox.

blablabla123 4y ago
I agree with the sensationalism but it's a for-profit company after all. They definitely do more than the average email provider but it's certainly not the Tor equivalent of E-Mail.
capableweb 4y ago
> ProtonMail has a bad history of irresponsible sensationalism. It’s like constantly marketing yourself as the most private e-mail service “built by CERN scientists” but who will give information about you to authorities: Well, conflating "security" with "following the law" seems odd. Do anyone realistically expect a legally incorporated company to not follow laws? They have to respond to lawful requests, otherwise there will be no business at all. As long as they fight against unlawful requests, they are what they make out to be. If they're found to be spying on their users when it's not lawfully requested, then you have some bite in your argument. But otherwise, I'm not sure what you expect them to do. By the way, they seem to be pretty upfront about how they collaborate with law enforcement, at least according to https://protonmail.com/law-enforcement https://protonmail.com/law-enforcement Maybe it wasn't like that in 2021 when the article you linked was published? In the end, if you rely on any single company for both your security and privacy, you're playing a loosing game. Not hiding your IP when signing up for something when you're planning to do illegal activities? Maybe time to reconsider your opsec strategy.
- 4y ago

etiam 4y ago

For a moment there I thought the title referred to the Valve-associated Wine enhancements... Now that would have been a feat.

justinpowers 4y ago

So many complaints about the headline, but for the purpose of getting their point across to the masses and encouraging the use of as-secure-as-can-be-known software, it’s perfectly fine. If you cover your ass in a headline, which ultimately ends as legalese, the average person will completely ignore it due to wordiness or they will become suspicious and assume the worst. The body and attachments do not mislead at all and that should be commended. All this pedantry is counterproductive unless you truly know and trust your audience. Proton should be for the masses, not just for the technically adept.

Foobar8568 4y ago

So a company called Securitum did a security assessment limited to pentest according to the pdf. More over "Tests have been carried out in September 2021 in accordance with generally accepted methodologies, including OWASP Top 10 and SANS Top Issues". It's hard to believe that one can call apps being secured after pen testing especially when the two highlights are such low hang fruits that are OWASP top 10 and SANS top issues.. It doesn't really give any confidences into Proton, but then again, I am not an expert, and have seen such useless reports at different clients.

ctime 4y ago

I have a hard time adding protonmail to my "generally regarded as safe" mail provider list when they haven't been able to implement Webauthn security key support (aka U2F security keys / FIDO security keys). Yes, they support Multi-Factor authentication, but only via phishable methods (TOTP)[1]. They have been "trying" for years[2] to implement U2F but for some reason haven't been able to figure it out yet /shrug [1] https://protonmail.com/support/knowledge-base/two-factor-authentication/ https://protonmail.com/support/knowledge-base/two-factor-aut... [2] https://twitter.com/protonmail/status/1300758061255217153?lang=en https://twitter.com/protonmail/status/1300758061255217153?la...

deleted 4y ago

[deleted]

karmakaze 4y ago

I was totally confused by the title thinking what does that mean or how can they say such a thing without proving a secure sandbox environment, which I didn't even know was possible. Then I realized it's for ProtonMail etc, not Proton from Valve.