Vid shows how to easily hack 'anti-spy' webmail (sorry, ProtonMail)

A security researcher has demonstrated a classic JavaScript-injection attack against ProtonMail – the webmail system developed by boffins and CERN to withstand surveillance by the world's intelligence agencies. German security expert Thomas Roth published a video over the weekend showing how he exploited a trivial …

[Gene Cash]

"Roth had notified them about the hole via Twitter"

I guess that's why he's a security researcher and not a security professional.

[diodesign]

Re: "Roth had notified them about the hole via Twitter"

Actually, Roth contests what ProtonMail suggested - and said he emailed in the vulns.

https://twitter.com/StackSmashing/status/468221482150404096

C.

[Franklin]

Re: "Roth had notified them about the hole via Twitter"

I'm definitely more "security researcher" than "security professional," and on several occasions have notified firms of vulnerabilities and abuse by Twitter...when emails, phone calls, and other more orthodox channels of communication have been ignored.

Sometimes, public shaming works where reasonable discourse doesn't.

[Anonymous Coward]

Re: "Roth had notified them about the hole via Twitter"

The guy does have a big ego though, he wants people to know about him.

I mean, they didn't tell him they had patched the vulnerability did they?

After all the work he had put in to it? Didn't he have a right to know?

How rude.

[IainT]

Thomas got in touch with us to make clear he'd contacted the firm directly. Professional is the title I'd use.

[Christian Berger]

Well browsers are not suitable for this

Even if there was no cross site scripting hole in there, you could still get a fake certificate and do man in the middle.

The whole browser thing may need to be replaced by something much more simpler and based on actual security.

[Not That Andrew]

Re: Well browsers are not suitable for this

Something like an email client perhaps?

[Christian Berger]

Re: Well browsers are not suitable for this

Yes, or a terminal. Why don't we have "GUI Terminals" to which I can send a simple form and they render it, have the user fill it out and return it. Kinda like HTML used to be before webdesigners took over.

[Anonymous Coward]

Re: Well browsers are not suitable for this

You're talking X terminals or NC stations. The catch is that you have to trust the server in these operations. The idea they're trying to pull off is to have effectively secure e-mail such that not even the server can read it, even under duress. Oh, and do it with turnkey simplicity so that even the stupid can do secure e-mail.

[The Mole]

Being too generous

I think El Reg is being way too generous on protonmail. How and where the email is composed and encrypted is irrelevant. The web based client shouldn't be trusting what is sent to it and should have been written from the ground up to be secure against malicious input.

[Anonymous Coward]

Re: Being too generous

The bootnote shows that the problem is basically intractable. There's no way to secure against malicious input since it can come from areas outside its sphere of influence, such as a device driver or tampered hardware. Basically, if SSL is not an option, then JavaScript security is not an option, either. Think of SSL like a bridge over a canyon where torrential rapids run. It's basically the only way across, and if that's not an option, then..."You Can't Get There From Here." It's related to the First Contact problem of secure communication: how can Alice and Bob prove themselves to each other if they've never met before and don't trust a third party to do it?

[Anonymous Coward]

How to spell snakeoil?

P-R-O-T-O-N-M-A-I-L

And it should have been obvious to any IT professional why that is the case.

They claim they could not read user's encryption keys, but they provide the software that handles the keys. And can replace it without the user's knowledge. Yet, despite this obvious false claim, and having been called out on it, they *still* claim they could not obtain user's passwords.

That is either world class incompetent, or plain disingenuous.

Either way, nobody I would want to trust with my communications.

Any chance for the poor sods who were stupid enough to back these people to get back their money?

[Anonymous Coward]

Protonmail is Not Secure As it may be unencrypted

Protonmail is Not Secure As it may be unencrypted

https://vimeo.com/100714271

[warmbrother]

Hmmm ... is there anything at all out there that you know of that actually works and does not scan / dump one's email ? Thanks!

[scryptmail]

I can welcome people to try scryptmail.com now in beta,

we do email encryption and attachments, all scripts hosted on our servers, so information you leak is minimal.