11 ms·

Tutanota: GPLv3-licensed, end-to-end encrypted email

65 points by jokoha 12y ago

jmnicolas 12y ago
I'm waiting for someone respected in the crypto circles reviewing their crypto soundness before even considering using this. Being GPL is a good point but it doesn't mean they don't have a fatal flaw in their code. I wish I had the skills to review the crypto I use.
- jokoha 12y ago
  Yes, I love the service, someone respected looking into the crypto would be fantastic!
- icebraining 12y ago
  They say it was "subject to an extensive penetration test by the SySS GmbH", but don't point to any report or even quote the conclusions.
- tptacek 12y ago
  It's hosted web mail that does crypto in Javascript. How closely do you expect crypto engineers to look at it? Don't use web mail for secure messaging.
legulere 12y ago
I don't know what people think when they put their code under GPL (especially v3) when they want to make a better version of an already open standard. One reason why tcp ip was so successful was that everybody could copy the implementation from BSD into their product.
- icebraining 12y ago
  Probably because they want people to use their own systems and apps.
bainsfather 12y ago
I've just signed up for this. It looks like exactly what we want from 'secure' email: (0) you can send unencrypted email just like any other webmail service. PLUS (1) end-to-end encrypted if sender&receiver use tutanova. (2) if receiver does not use tutanova, you can still send them encrypted email if you want to: they get an email saying - 'you have an encrypted mail, click this link to view it' - on clicking the link, they decrypt the mail by entering a pre-agreed password. (3) it is free. they seem to be making money from the 'enhanced features' in their 'Outlook Addin' package.
- e12e 12y ago
  I don't know, it's missing (4) "Host your own (encrypted or not) email" ?
aswerty 12y ago
I'd be wary about potential lock-in. The service seems to rely on everyone using their product. I'd like to see an end goal where they can communicate with other clients that support PGP or S/MIME. I do like how their approach avoids ever having an email sent from Tutanota in plain text other than when either the sender or receiver views it. Of course the main issue is the receiver has to jump through hoops if they don't use Tutanota. I imagine most people will not enjoy the hoop jumping.
- jokoha 12y ago
  In their FAQ they say: "We are planning on making Tutanota interoperable with pgp"
  - aswerty 12y ago
    Ah yes, I missed that (the FAQ is quite long). It'll be interesting to see how that works out.
- darklajid 12y ago
  And no way to access your mail via IMAP or .. any mail client, really. That's a no-go. >Can I retrieve my Tutanota emails via IMAP to another email client? >This is not possible as we could not guarantee end-to-end encryption for your data. [1] 1: https://tutanota.de/#!faq https://tutanota.de/#!faq
  - mike-cardwell 12y ago
    Well, it is possible. They'd need to write an IMAP proxy which can run on the end users machine which sits inbetween the client and the server and handles the encryption/decryption transparently.
mike-cardwell 12y ago
Loads external images. By Default. With no option to turn off. Not a viable webmail client for anyone who expects privacy. [edit] The email that it sends to external addresses does not have a text/plain part, only html [edit] Stores your email address in session storage and then pre-fills next time you log in. Does not let you opt in or out and doesn't warn you that this will happen. Unsuitable for a "public" machine. [edit] Nice, they support DANE. When I email a Tutanota user, or a Tutanota user emails me (@grepular.com), SMTP is forced to use SSL or fail, and the certificate is forced to verify with the fingerprint published in our DNSSEC secured DNS zones. No SMTP MITM's here.
- darklajid 12y ago
  I'd say these things are fixable so far [1]. - Image loading: I'd assume that this is possible to implement, given the current implementation? - text/plain & multipart mails: I'd expect the same, really. Doesn't sound too bad to build it. - same for session storage I agree with all your points, but these are things that are conceptually quite viable, imo. I'd expect these to be valid issues on Github [1] and reasonably easy fixes, no? 1: https://github.com/tutao/tutanota https://github.com/tutao/tutanota
  - mike-cardwell 12y ago
    Yeah, they can be fixed. FWIW, I used their feedback form to mention the automatic image loading privacy leak.
    - MatthiasPfau 12y ago
      I am one of the founders. Thanks for your feedback. We will fix this early next year!
      - mike-cardwell 12y ago
        FWIW, I discovered the image loading problem by using https://emailprivacytester.com/ https://emailprivacytester.com/ with a test account. Might be worth testing any such changes that you make there. (I am the author of that website).
onli 12y ago
The statements about german law are wrong or at least very misleading, and that might be important here. Mail Providers of a specific size here are obliged to implement Lawful Interception interfaces. It is quite obvious that in the current climate, there is no guarantee at all that those won't be used by the german intelligence and then transported to the NSA. Note also that their source-link in that paragraph is not working. However, the situation might actually work. If they have a true zero knowledge system, it could indeed be very hard in Germany to force them to produce additional data, and what they can't have they can't deliver. That is however not as clear-cut as they make it look like. That is comparable to the Vorratsdatenspeicherung, ISPs saving the traffic metadata. While the effort to force them to do that failed, all ISPs still save those data - meaning that Germany is not the described data heaven.
- higherpurpose 12y ago
  I doubt any system designed in such a way that the provider simply can't access the information, could be forced by authorities to provide some kind of backdoor into it, if it's a somewhat lawful country, and not one such as North Korea or whatever. Whether companies can be intimidated into doing it is a whole other story, but legally, I doubt any democratic government should be able to force them to do that.
  - akerl_ 12y ago
    Except those two things are mutually exclusive: A provider that can put a backdoor in can access the data, they're just choosing not to right now. Relevant example: http://www.daemonology.net/blog/2012-01-19-playing-chicken-with-cat-jpg.html http://www.daemonology.net/blog/2012-01-19-playing-chicken-w...
  - mike-cardwell 12y ago
    Hushmail is a similar service, but uses a java applet for the client side crypto. It's my understanding that they have been legally compelled at least once to deliver a backdoored applet to the client in order to access the clear text email. I think they're Canadian. I don't have references to hand, but a Google search should turn some stuff up. Whilst yu, "doubt any democratic government should be able to force them to do that", I on the other hand suspect that most (if not all) democratic governments have ways of doing exactly this.
upofadown 12y ago
When reading these things you can save a lot of time by just skimming the front page to see what standard protocols they implement. In the case of this thing time was saved...
feld 12y ago
Even GMail could launch end-to-end encrypted email if they wanted to do so for all GMail users. They own the entire infrastructure end-to-end; that's not the hard part. The hard part is encrypting email for anyone -- even if they don't use your service.
- phaer 12y ago
  Well the hardest part is to persuade most users that end to end encryption is something they actually want. If GMail would launch an integration with PGP (or similar), call it "Secure GMail - now extra private" or something and start to refer to unencrypted Mail as "unsafe", "untrusted" or something like this much would have been won.
  - hobarrera 12y ago
    The problem with GMail launching browser-encrypted email is that you have two groups of people: (a) People that don't care about encryption. Unlikely to get any signifacant amount of adoption. (b) People who do. This group of people know that browser-based encryption can't be done in a trusted manner, hence, won't want to use such a product.
    - tokenizerrr 12y ago
      Luckily Google's thought of that. They're working on an extension: https://code.google.com/p/end-to-end/ https://code.google.com/p/end-to-end/
hobarrera 12y ago
Wow! This is new "encrypted email" service is just like good old encrypted email (eg: GPG), but with user lock-in!
tptacek 12y ago
Don't use web mail for secure messaging.
- bainsfather 12y ago
  I'd like to send email messages to people without them being routinely read, stored and indexed by my govt, other govts, the hosting company, etc. Naively, this sounds simple enough to do, and you'd imagine that everyone would want&use such a system. How to I persuade other non-technical people to use something that is moderately secure? Tutanota seems like something I might be able to persuade people to use - 'hey, sign up for this, it is free, it is just like your current webmail plus if we both use it, our mail is encrypted.' That is an improvement on what they currently use, no? Do you know of any 'good' (or just 'good enough' (or even just 'better')) options?
jarun 12y ago
A older article on Tutanota with features at a glance: http://tuxdiary.com/2014/10/21/tutanota/ http://tuxdiary.com/2014/10/21/tutanota/

65 points by jokoha 12y ago

I'm waiting for someone respected in the crypto circles reviewing their crypto soundness before even considering using this. Being GPL is a good point but it doesn't mean they don't have a fatal flaw in their code. I wish I had the skills to review the crypto I use.

jokoha 12y ago
Yes, I love the service, someone respected looking into the crypto would be fantastic!
icebraining 12y ago
They say it was "subject to an extensive penetration test by the SySS GmbH", but don't point to any report or even quote the conclusions.
tptacek 12y ago
It's hosted web mail that does crypto in Javascript. How closely do you expect crypto engineers to look at it? Don't use web mail for secure messaging.

legulere 12y ago

I don't know what people think when they put their code under GPL (especially v3) when they want to make a better version of an already open standard. One reason why tcp ip was so successful was that everybody could copy the implementation from BSD into their product.

icebraining 12y ago
Probably because they want people to use their own systems and apps.

bainsfather 12y ago

I've just signed up for this. It looks like exactly what we want from 'secure' email: (0) you can send unencrypted email just like any other webmail service. PLUS (1) end-to-end encrypted if sender&receiver use tutanova. (2) if receiver does not use tutanova, you can still send them encrypted email if you want to: they get an email saying - 'you have an encrypted mail, click this link to view it' - on clicking the link, they decrypt the mail by entering a pre-agreed password. (3) it is free. they seem to be making money from the 'enhanced features' in their 'Outlook Addin' package.

e12e 12y ago
I don't know, it's missing (4) "Host your own (encrypted or not) email" ?

aswerty 12y ago

I'd be wary about potential lock-in. The service seems to rely on everyone using their product. I'd like to see an end goal where they can communicate with other clients that support PGP or S/MIME. I do like how their approach avoids ever having an email sent from Tutanota in plain text other than when either the sender or receiver views it. Of course the main issue is the receiver has to jump through hoops if they don't use Tutanota. I imagine most people will not enjoy the hoop jumping.

jokoha 12y ago
In their FAQ they say: "We are planning on making Tutanota interoperable with pgp"
- aswerty 12y ago
  Ah yes, I missed that (the FAQ is quite long). It'll be interesting to see how that works out.
darklajid 12y ago
And no way to access your mail via IMAP or .. any mail client, really. That's a no-go. >Can I retrieve my Tutanota emails via IMAP to another email client? >This is not possible as we could not guarantee end-to-end encryption for your data. [1] 1: https://tutanota.de/#!faq https://tutanota.de/#!faq
- mike-cardwell 12y ago
  Well, it is possible. They'd need to write an IMAP proxy which can run on the end users machine which sits inbetween the client and the server and handles the encryption/decryption transparently.

mike-cardwell 12y ago

Loads external images. By Default. With no option to turn off. Not a viable webmail client for anyone who expects privacy. [edit] The email that it sends to external addresses does not have a text/plain part, only html [edit] Stores your email address in session storage and then pre-fills next time you log in. Does not let you opt in or out and doesn't warn you that this will happen. Unsuitable for a "public" machine. [edit] Nice, they support DANE. When I email a Tutanota user, or a Tutanota user emails me (@grepular.com), SMTP is forced to use SSL or fail, and the certificate is forced to verify with the fingerprint published in our DNSSEC secured DNS zones. No SMTP MITM's here.

darklajid 12y ago
I'd say these things are fixable so far [1]. - Image loading: I'd assume that this is possible to implement, given the current implementation? - text/plain & multipart mails: I'd expect the same, really. Doesn't sound too bad to build it. - same for session storage I agree with all your points, but these are things that are conceptually quite viable, imo. I'd expect these to be valid issues on Github [1] and reasonably easy fixes, no? 1: https://github.com/tutao/tutanota https://github.com/tutao/tutanota
- mike-cardwell 12y ago
  Yeah, they can be fixed. FWIW, I used their feedback form to mention the automatic image loading privacy leak.
  - MatthiasPfau 12y ago
    I am one of the founders. Thanks for your feedback. We will fix this early next year!
    - mike-cardwell 12y ago
      FWIW, I discovered the image loading problem by using https://emailprivacytester.com/ https://emailprivacytester.com/ with a test account. Might be worth testing any such changes that you make there. (I am the author of that website).

onli 12y ago

The statements about german law are wrong or at least very misleading, and that might be important here. Mail Providers of a specific size here are obliged to implement Lawful Interception interfaces. It is quite obvious that in the current climate, there is no guarantee at all that those won't be used by the german intelligence and then transported to the NSA. Note also that their source-link in that paragraph is not working. However, the situation might actually work. If they have a true zero knowledge system, it could indeed be very hard in Germany to force them to produce additional data, and what they can't have they can't deliver. That is however not as clear-cut as they make it look like. That is comparable to the Vorratsdatenspeicherung, ISPs saving the traffic metadata. While the effort to force them to do that failed, all ISPs still save those data - meaning that Germany is not the described data heaven.

higherpurpose 12y ago
I doubt any system designed in such a way that the provider simply can't access the information, could be forced by authorities to provide some kind of backdoor into it, if it's a somewhat lawful country, and not one such as North Korea or whatever. Whether companies can be intimidated into doing it is a whole other story, but legally, I doubt any democratic government should be able to force them to do that.
- akerl_ 12y ago
  Except those two things are mutually exclusive: A provider that can put a backdoor in can access the data, they're just choosing not to right now. Relevant example: http://www.daemonology.net/blog/2012-01-19-playing-chicken-with-cat-jpg.html http://www.daemonology.net/blog/2012-01-19-playing-chicken-w...
- mike-cardwell 12y ago
  Hushmail is a similar service, but uses a java applet for the client side crypto. It's my understanding that they have been legally compelled at least once to deliver a backdoored applet to the client in order to access the clear text email. I think they're Canadian. I don't have references to hand, but a Google search should turn some stuff up. Whilst yu, "doubt any democratic government should be able to force them to do that", I on the other hand suspect that most (if not all) democratic governments have ways of doing exactly this.

upofadown 12y ago

When reading these things you can save a lot of time by just skimming the front page to see what standard protocols they implement. In the case of this thing time was saved...

feld 12y ago

Even GMail could launch end-to-end encrypted email if they wanted to do so for all GMail users. They own the entire infrastructure end-to-end; that's not the hard part. The hard part is encrypting email for anyone -- even if they don't use your service.

phaer 12y ago
Well the hardest part is to persuade most users that end to end encryption is something they actually want. If GMail would launch an integration with PGP (or similar), call it "Secure GMail - now extra private" or something and start to refer to unencrypted Mail as "unsafe", "untrusted" or something like this much would have been won.
- hobarrera 12y ago
  The problem with GMail launching browser-encrypted email is that you have two groups of people: (a) People that don't care about encryption. Unlikely to get any signifacant amount of adoption. (b) People who do. This group of people know that browser-based encryption can't be done in a trusted manner, hence, won't want to use such a product.
  - tokenizerrr 12y ago
    Luckily Google's thought of that. They're working on an extension: https://code.google.com/p/end-to-end/ https://code.google.com/p/end-to-end/

hobarrera 12y ago

Wow! This is new "encrypted email" service is just like good old encrypted email (eg: GPG), but with user lock-in!

tptacek 12y ago

Don't use web mail for secure messaging.

bainsfather 12y ago
I'd like to send email messages to people without them being routinely read, stored and indexed by my govt, other govts, the hosting company, etc. Naively, this sounds simple enough to do, and you'd imagine that everyone would want&use such a system. How to I persuade other non-technical people to use something that is moderately secure? Tutanota seems like something I might be able to persuade people to use - 'hey, sign up for this, it is free, it is just like your current webmail plus if we both use it, our mail is encrypted.' That is an improvement on what they currently use, no? Do you know of any 'good' (or just 'good enough' (or even just 'better')) options?

jarun 12y ago

A older article on Tutanota with features at a glance: http://tuxdiary.com/2014/10/21/tutanota/ http://tuxdiary.com/2014/10/21/tutanota/