ProtonMail DDoS wipeout: Day 6. Yes, we're still under attack

Re: It's time to update SMTP to make end to end encryption default

You can use pgp with enigmail. It takes all of five minutes to set up. However, people at heart don't really care. You're telling me that the same people that smoke (with a 50% chance of dying horribly a decade or two early) care about e-mail security? It's an abstract issue until it's too late for them.

IT security is like the toilets, a ridiculous topic of conversation unless it breaks and you're standing knee deep in sewage.

Re: It's time to update SMTP to make end to end encryption default

That way there would be no point in NSA or the like hitting anybody.

Sure there would. This attack in particular is an example of something which would continue to be effective even with end-to-end encrypted SMTP everywhere.

This is a Distributed Denial-of-Service attack. The direct purpose of a DDoS is to make a service unavailable. While they are sometimes used to distract from other attacks, they are designed specifically to disrupt communications.

There is often benefit to state intelligence agencies simply to disrupt others' communications, and end-to-end e-mail encryption doesn't prevent DDoS attacks.

Re: It's time to update SMTP to make end to end encryption default

Where is the robust key management infrastructure to support it going to come from? The magic spaghetti tree?

Re: In all fairness to Protonmail.....

Haven't I just read on ElReg a recent article on CryptoLocker4 which appears to be even more malicious than the original? The part that caused the sack to pucker was CL's ability to wait in hiding for months, slowly encrypting files so that even the ones on backups may be useless. Clever!

In that article there were quite a few really decent comments about how to put critical resources (files/folders) on ZFS or other external file systems and establish very strong control of Read/Write access. If you MUST use Windows, just let the user's Desktop be held hostage.

Don't be so fast on pinning this on the Brits... or the US... It could be really be any country if it is a state actor. Pinning the blame without the forensics is opinion not fact. It could be one state or it could be several working together. Or maybe not a state at all.... although for 6 days, non-stop, I'd think it's state as script-kiddies would be bored by now and moving on to someone else.

They were being pragmatic. They were pressured because their ISP went down, taking some Swiss banks with them - the Swiss do love their banks. It was a small price to pay to avoid being deported. And of course it was a huge mistake that they won't make again. Not just because it encourages future script-kiddies, but because it distracts media attention, and your attention, from the nature of the secondary attack.

We don't need ProtonMail, we are all smart-arses who can properly use Open-PGP to chat among ourselves. But we can't convince anyone else to learn how to do that, so our doctors, our judiciary, our journalists and politicians need a simple 'tick box to encrypt' solution from a trusted provider. And we do need that, more than ever. Our state is increasingly psychotic, paranoid, irrational and violent. We can't all emigrate to Switzerland or Iceland, someone has to stick around to feed the cats.