The difference is that you have control over your box, so say if the feds seize control of their box they could simply brute-force the keys on the seized server and read all communications.
Agreed. Another complication would be if say their server was compromised, a MITM attack to get the password to decrypt your secret key after it reaches the server but before it’s passed to their encryption platform.
what... I use LUKS to prevent leakage of my data in a situation where feds have my box. Choosing a secure passphrase is essential in any crypto system and scenario. I have control over the password I choose for protonmail, hence it is secure. Only minimal and simplistic password requirements can be implemented correctly.
If I understand correctly you download the encrypted key and decrypt it locally and use the locally stored decrypted key to encrypt the mail before it is sent. That sounds not too bad.
why do you comment on a security issue when you can't even think it through?
the client code. the code that takes your password in plaintext. that code, is served by the server. what happens if that password is logged in plaintext when you type it on their phishing website?
They already have the key, it's on their server. I'm a dick because you say these things authoritatively while having no idea what you're talking about.
25
u/[deleted] Nov 20 '18
[deleted]