back to article Vid shows how to easily hack 'anti-spy' webmail (sorry, ProtonMail)

A security researcher has demonstrated a classic JavaScript-injection attack against ProtonMail – the webmail system developed by boffins and CERN to withstand surveillance by the world's intelligence agencies. German security expert Thomas Roth published a video over the weekend showing how he exploited a trivial …

  1. Gene Cash Silver badge
    Facepalm

    "Roth had notified them about the hole via Twitter"

    I guess that's why he's a security researcher and not a security professional.

    1. diodesign (Written by Reg staff) Silver badge

      Re: "Roth had notified them about the hole via Twitter"

      Actually, Roth contests what ProtonMail suggested - and said he emailed in the vulns.

      https://twitter.com/StackSmashing/status/468221482150404096

      C.

    2. Franklin

      Re: "Roth had notified them about the hole via Twitter"

      I'm definitely more "security researcher" than "security professional," and on several occasions have notified firms of vulnerabilities and abuse by Twitter...when emails, phone calls, and other more orthodox channels of communication have been ignored.

      Sometimes, public shaming works where reasonable discourse doesn't.

    3. Anonymous Coward
      Anonymous Coward

      Re: "Roth had notified them about the hole via Twitter"

      The guy does have a big ego though, he wants people to know about him.

      I mean, they didn't tell him they had patched the vulnerability did they?

      After all the work he had put in to it? Didn't he have a right to know?

      How rude.

  2. IainT

    Thomas got in touch with us to make clear he'd contacted the firm directly. Professional is the title I'd use.

  3. Christian Berger Silver badge

    Well browsers are not suitable for this

    Even if there was no cross site scripting hole in there, you could still get a fake certificate and do man in the middle.

    The whole browser thing may need to be replaced by something much more simpler and based on actual security.

    1. Not That Andrew
      Joke

      Re: Well browsers are not suitable for this

      Something like an email client perhaps?

      1. Christian Berger Silver badge

        Re: Well browsers are not suitable for this

        Yes, or a terminal. Why don't we have "GUI Terminals" to which I can send a simple form and they render it, have the user fill it out and return it. Kinda like HTML used to be before webdesigners took over.

        1. Anonymous Coward
          Anonymous Coward

          Re: Well browsers are not suitable for this

          You're talking X terminals or NC stations. The catch is that you have to trust the server in these operations. The idea they're trying to pull off is to have effectively secure e-mail such that not even the server can read it, even under duress. Oh, and do it with turnkey simplicity so that even the stupid can do secure e-mail.

  4. This post has been deleted by its author

  5. The Mole

    Being too generous

    I think El Reg is being way too generous on protonmail. How and where the email is composed and encrypted is irrelevant. The web based client shouldn't be trusting what is sent to it and should have been written from the ground up to be secure against malicious input.

    1. Anonymous Coward
      Anonymous Coward

      Re: Being too generous

      The bootnote shows that the problem is basically intractable. There's no way to secure against malicious input since it can come from areas outside its sphere of influence, such as a device driver or tampered hardware. Basically, if SSL is not an option, then JavaScript security is not an option, either. Think of SSL like a bridge over a canyon where torrential rapids run. It's basically the only way across, and if that's not an option, then..."You Can't Get There From Here." It's related to the First Contact problem of secure communication: how can Alice and Bob prove themselves to each other if they've never met before and don't trust a third party to do it?

  6. Anonymous Coward
    Anonymous Coward

    How to spell snakeoil?

    P-R-O-T-O-N-M-A-I-L

    And it should have been obvious to any IT professional why that is the case.

    They claim they could not read user's encryption keys, but they provide the software that handles the keys. And can replace it without the user's knowledge. Yet, despite this obvious false claim, and having been called out on it, they *still* claim they could not obtain user's passwords.

    That is either world class incompetent, or plain disingenuous.

    Either way, nobody I would want to trust with my communications.

    Any chance for the poor sods who were stupid enough to back these people to get back their money?

  7. Anonymous Coward
    Anonymous Coward

    Protonmail is Not Secure As it may be unencrypted

    Protonmail is Not Secure As it may be unencrypted

    https://vimeo.com/100714271

  8. warmbrother

    Hmmm ... is there anything at all out there that you know of that actually works and does not scan / dump one's email ? Thanks!

  9. This post has been deleted by its author

  10. scryptmail

    I can welcome people to try scryptmail.com now in beta,

    we do email encryption and attachments, all scripts hosted on our servers, so information you leak is minimal.

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019