Vid shows how to easily hack 'anti-spy' webmail (sorry, ProtonMail) A security researcher has demonstrated a classic JavaScript-injection attack against ProtonMail – the webmail system developed by boffins and CERN to withstand surveillance by the world's intelligence agencies. German security expert Thomas Roth published a video over the weekend showing how he exploited a trivial …
Actually, Roth contests what ProtonMail suggested - and said he emailed in the vulns.
https://twitter.com/StackSmashing/status/468221482150404096
C.
I'm definitely more "security researcher" than "security professional," and on several occasions have notified firms of vulnerabilities and abuse by Twitter...when emails, phone calls, and other more orthodox channels of communication have been ignored.
Sometimes, public shaming works where reasonable discourse doesn't.
You're talking X terminals or NC stations. The catch is that you have to trust the server in these operations. The idea they're trying to pull off is to have effectively secure e-mail such that not even the server can read it, even under duress. Oh, and do it with turnkey simplicity so that even the stupid can do secure e-mail.
This post has been deleted by its author
The bootnote shows that the problem is basically intractable. There's no way to secure against malicious input since it can come from areas outside its sphere of influence, such as a device driver or tampered hardware. Basically, if SSL is not an option, then JavaScript security is not an option, either. Think of SSL like a bridge over a canyon where torrential rapids run. It's basically the only way across, and if that's not an option, then..."You Can't Get There From Here." It's related to the First Contact problem of secure communication: how can Alice and Bob prove themselves to each other if they've never met before and don't trust a third party to do it?
P-R-O-T-O-N-M-A-I-L
And it should have been obvious to any IT professional why that is the case.
They claim they could not read user's encryption keys, but they provide the software that handles the keys. And can replace it without the user's knowledge. Yet, despite this obvious false claim, and having been called out on it, they *still* claim they could not obtain user's passwords.
That is either world class incompetent, or plain disingenuous.
Either way, nobody I would want to trust with my communications.
Any chance for the poor sods who were stupid enough to back these people to get back their money?
This post has been deleted by its author
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
