4 ms·

Skiff: Various Privacy Failures

60 points by uselpa 3y ago

crimbles 3y ago
Interesting read. I will point out that having seen "security audits" done by top tier well known security companies, they aren't worth the paper they are written on. They are selling you a pen test script run, the output of which is farted into a document for the least amount of time they can expend on it. If you want security, you have to do it in house with competent people who understand your business domain. So when I see people with regular pen tests I know they don't really give a shit because they are doing minimal ass coverage.
- mratsim 3y ago
  Disagree, their reputation is tied to their audit quality. But I'm pretty sure in this case the scope was bad. Like they coukd have had audits on "Do I use OpenSSL well?" and then misrepresent that all their privacy claims were audited. Now it seems like Skiff conveniently didn't allow Trail of Bits to publish their reports, they are usually here: https://github.com/trailofbits/publications/tree/master/reviews https://github.com/trailofbits/publications/tree/master/revi... Disclaimer, I have used Trail of Bits service in the past (and 2 other auditors for an security campaign on a blockchain, cryptography + networking product).
- jitl 3y ago
  Really? That’s not my experience. I’m not denying companies are out there basically selling a rubber stamp like you say, but I’ve worked with sharp folks from Matasano and NCC Group who would go deep, learn from eng about system but also do blind red teaming, do physical pen tests etc. I think you’ll probably get what you pay for and get good results if you put in good effort working with them. I can’t speak to Cure53 but I feel like I’ve seen that name on a few failed cryptocurrency thingies.
  - crimbles 3y ago
    I was actually including NCC in that one...
lcof 3y ago
Great read, I have seen this myself in the last 4-5 years with services surfing on the privacy wave - I mean, not just email, but also cloud drive. My conclusion, even regarding established privacy-focused email providers, is that it’s not worth the hassle, really. I use trusted and reliable email providers (according to me), and I just don’t use email for anything sensitive. That’s just right for me. I know some people do need more privacy and/or security. But a lot of people think they need the same but really, they don’t.
cedws 3y ago
I see Skiff also advertises itself as "end-to-end" encrypted. This is the same misleading advertising as ProtonMail is guilty of. Traditional email cannot be E2E encrypted because of protocol limitations. You can technically achieve E2E encryption if using PGP, but if the private keys are not in your control then it is effectively pointless. ProtonMail can only guarantee E2E encryption without PGP if you are sending email to another ProtonMail user. I don't know if Skiff also offers this special kind of encryption. Either way, they should be more upfront about the level of privacy they can offer. I had a read of Skiff's page on E2EE. It is very carefully worded and, from a skim read, is not upfront about the fact that un-PGP'd email sent and received through Skiff can be read by Skiff. https://skiff.com/blog/end-to-end-encryption-email https://skiff.com/blog/end-to-end-encryption-email Oh, one more thing. Skiff's SMTP server (inbound-smtp.skiff.com) is running on AWS in the United States which means it will be beholden to US warrants. Skiff does not have a warrant canary. Getting big Crypto AG vibes from this.
- mweidner 3y ago
  The product page is clearer (https://skiff.com/mail https://skiff.com/mail): > All emails between Skiff users are end-to-end encrypted, including both subject and contents. External mail is encrypted with your keys on receipt, keeping it private.
  - Doxin 3y ago
    That is however, quite specifically, not end-to-end encryption. The whole entire point of end-to-end encryption is that no intermediary gets to see the unencrypted content.
- protonmail 3y ago
  Regarding Proton Mail's encryption: Proton's servers don't hold your private key directly — it is generated client-side and stored encrypted with your password. You can also import your own keys: https://proton.me/support/pgp-key-management https://proton.me/support/pgp-key-management. That way, you can stay in full control of your keys. Additionally, Proton Mail uses OpenPGP internally, so Proton-to-Proton messages are always protected by PGP. Even for external messages, contacts don't necessarily have to set up PGP encryption manually; the email client can do so, enabling the use of end-to-end encryption between different providers with minimal hassle.
forwardemail 3y ago
Forward Email team here (https://forwardemail.net https://forwardemail.net), we have a write-up and comparison @ https://forwardemail.net/en/blog/docs/best-quantum-safe-encrypted-email-service https://forwardemail.net/en/blog/docs/best-quantum-safe-encr... We've considered adding a E2EE comparison column as well (with the issues such as Proton rewriting your emails @ http://jfloren.net/b/2023/7/7/0 http://jfloren.net/b/2023/7/7/0 highlighted). Privacy Guides Discussion @ https://discuss.privacyguides.net/t/forward-email-email-provider/13370 https://discuss.privacyguides.net/t/forward-email-email-prov... Unlike Skiff, Proton, and Tuta... we're _actually_ 100% open-source. Those providers that advertise as open-source really only open-source the front-end, when the back-end is the most sensitive part of an email service.
- cedws 3y ago
  This is really nice, but the blog does not address the weakest link in the chain: what if you receive a warrant from the US government? The SMTP server would be able to collect inbound/outbound emails in plaintext.
  - forwardemail 3y ago
    That is not true. You can upload a PGP key and all your email written to SQLite (IMAP/POP3) will be stored with your PGP key. Not plain text. SMTP is for outbound, IMAP/POP3 is for inbound. https://forwardemail.net/en/faq#do-you-support-openpgpmime-end-to-end-encryption-e2ee-and-web-key-directory-wkd https://forwardemail.net/en/faq#do-you-support-openpgpmime-e...
    - forwardemail 3y ago
      [dead]
    - cedws 3y ago
      Right, but inbound emails over POP/IMAP will be TLS encrypted. You're saying emails are encrypted at rest, but they cannot be encrypted in-flight because it's forwardemail that holds the TLS private key.

60 points by uselpa 3y ago

Interesting read. I will point out that having seen "security audits" done by top tier well known security companies, they aren't worth the paper they are written on. They are selling you a pen test script run, the output of which is farted into a document for the least amount of time they can expend on it. If you want security, you have to do it in house with competent people who understand your business domain. So when I see people with regular pen tests I know they don't really give a shit because they are doing minimal ass coverage.

mratsim 3y ago
Disagree, their reputation is tied to their audit quality. But I'm pretty sure in this case the scope was bad. Like they coukd have had audits on "Do I use OpenSSL well?" and then misrepresent that all their privacy claims were audited. Now it seems like Skiff conveniently didn't allow Trail of Bits to publish their reports, they are usually here: https://github.com/trailofbits/publications/tree/master/reviews https://github.com/trailofbits/publications/tree/master/revi... Disclaimer, I have used Trail of Bits service in the past (and 2 other auditors for an security campaign on a blockchain, cryptography + networking product).
jitl 3y ago
Really? That’s not my experience. I’m not denying companies are out there basically selling a rubber stamp like you say, but I’ve worked with sharp folks from Matasano and NCC Group who would go deep, learn from eng about system but also do blind red teaming, do physical pen tests etc. I think you’ll probably get what you pay for and get good results if you put in good effort working with them. I can’t speak to Cure53 but I feel like I’ve seen that name on a few failed cryptocurrency thingies.
- crimbles 3y ago
  I was actually including NCC in that one...

lcof 3y ago

Great read, I have seen this myself in the last 4-5 years with services surfing on the privacy wave - I mean, not just email, but also cloud drive. My conclusion, even regarding established privacy-focused email providers, is that it’s not worth the hassle, really. I use trusted and reliable email providers (according to me), and I just don’t use email for anything sensitive. That’s just right for me. I know some people do need more privacy and/or security. But a lot of people think they need the same but really, they don’t.

cedws 3y ago

I see Skiff also advertises itself as "end-to-end" encrypted. This is the same misleading advertising as ProtonMail is guilty of. Traditional email cannot be E2E encrypted because of protocol limitations. You can technically achieve E2E encryption if using PGP, but if the private keys are not in your control then it is effectively pointless. ProtonMail can only guarantee E2E encryption without PGP if you are sending email to another ProtonMail user. I don't know if Skiff also offers this special kind of encryption. Either way, they should be more upfront about the level of privacy they can offer. I had a read of Skiff's page on E2EE. It is very carefully worded and, from a skim read, is not upfront about the fact that un-PGP'd email sent and received through Skiff can be read by Skiff. https://skiff.com/blog/end-to-end-encryption-email https://skiff.com/blog/end-to-end-encryption-email Oh, one more thing. Skiff's SMTP server (inbound-smtp.skiff.com) is running on AWS in the United States which means it will be beholden to US warrants. Skiff does not have a warrant canary. Getting big Crypto AG vibes from this.

mweidner 3y ago
The product page is clearer (https://skiff.com/mail https://skiff.com/mail): > All emails between Skiff users are end-to-end encrypted, including both subject and contents. External mail is encrypted with your keys on receipt, keeping it private.
- Doxin 3y ago
  That is however, quite specifically, not end-to-end encryption. The whole entire point of end-to-end encryption is that no intermediary gets to see the unencrypted content.
protonmail 3y ago
Regarding Proton Mail's encryption: Proton's servers don't hold your private key directly — it is generated client-side and stored encrypted with your password. You can also import your own keys: https://proton.me/support/pgp-key-management https://proton.me/support/pgp-key-management. That way, you can stay in full control of your keys. Additionally, Proton Mail uses OpenPGP internally, so Proton-to-Proton messages are always protected by PGP. Even for external messages, contacts don't necessarily have to set up PGP encryption manually; the email client can do so, enabling the use of end-to-end encryption between different providers with minimal hassle.

forwardemail 3y ago

Forward Email team here (https://forwardemail.net https://forwardemail.net), we have a write-up and comparison @ https://forwardemail.net/en/blog/docs/best-quantum-safe-encrypted-email-service https://forwardemail.net/en/blog/docs/best-quantum-safe-encr... We've considered adding a E2EE comparison column as well (with the issues such as Proton rewriting your emails @ http://jfloren.net/b/2023/7/7/0 http://jfloren.net/b/2023/7/7/0 highlighted). Privacy Guides Discussion @ https://discuss.privacyguides.net/t/forward-email-email-provider/13370 https://discuss.privacyguides.net/t/forward-email-email-prov... Unlike Skiff, Proton, and Tuta... we're _actually_ 100% open-source. Those providers that advertise as open-source really only open-source the front-end, when the back-end is the most sensitive part of an email service.

cedws 3y ago
This is really nice, but the blog does not address the weakest link in the chain: what if you receive a warrant from the US government? The SMTP server would be able to collect inbound/outbound emails in plaintext.
- forwardemail 3y ago
  That is not true. You can upload a PGP key and all your email written to SQLite (IMAP/POP3) will be stored with your PGP key. Not plain text. SMTP is for outbound, IMAP/POP3 is for inbound. https://forwardemail.net/en/faq#do-you-support-openpgpmime-end-to-end-encryption-e2ee-and-web-key-directory-wkd https://forwardemail.net/en/faq#do-you-support-openpgpmime-e...
  - forwardemail 3y ago
    [dead]
  - cedws 3y ago
    Right, but inbound emails over POP/IMAP will be TLS encrypted. You're saying emails are encrypted at rest, but they cannot be encrypted in-flight because it's forwardemail that holds the TLS private key.