this post was submitted on 16 Nov 2023
196 points (93.8% liked)

Privacy

31876 readers
1 users here now

A place to discuss privacy and freedom in the digital world.

Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.

In this community everyone is welcome to post links and discuss topics related to privacy.

Some Rules

Related communities

Chat rooms

much thanks to @gary_host_laptop for the logo design :)

founded 5 years ago
MODERATORS
 

Proton Mail, the leading privacy-focused email service, is making its first foray into blockchain technology with Key Transparency, which will allow users to verify email addresses. From a report: In an interview with Fortune, CEO and founder Andy Yen made clear that although the new feature uses blockchain, the key technology behind crypto, Key Transparency isn't "some sketchy cryptocurrency" linked to an "exit scam." A student of cryptography, Yen added that the new feature is "blockchain in a very pure form," and it allows the platform to solve the thorny issue of ensuring that every email address actually belongs to the person who's claiming it.

Proton Mail uses end-to-end encryption, a secure form of communication that ensures only the intended recipient can read the information. Senders encrypt an email using their intended recipient's public key -- a long string of letters and numbers -- which the recipient can then decrypt with their own private key. The issue, Yen said, is ensuring that the public key actually belongs to the intended recipient. "Maybe it's the NSA that has created a fake public key linked to you, and I'm somehow tricked into encrypting data with that public key," he told Fortune. In the security space, the tactic is known as a "man-in-the-middle attack," like a postal worker opening your bank statement to get your social security number and then resealing the envelope.

Blockchains are an immutable ledger, meaning any data initially entered onto them can't be altered. Yen realized that putting users' public keys on a blockchain would create a record ensuring those keys actually belonged to them -- and would be cross-referenced whenever other users send emails. "In order for the verification to be trusted, it needs to be public, and it needs to be unchanging," Yen said.

Curious if anyone here would use a feature like this? It sounds neat but I don't think I'm going to be needing a feature like this on a day-to-day basis, though I could see use cases for folks handling sensitive information.

top 50 comments
sorted by: hot top controversial new old
[–] demesisx 58 points 2 years ago* (last edited 2 years ago) (16 children)

I’d absolutely use this. I’m glad to see people using this incredibly powerful concept to solve problems that would literally be impossible to solve without it. It is especially encouraging that they used Monero since it has an extra layer of untraceability built-in. Blockchain is experiencing kind of a backlash in public perception, but like tech closely related to it like NFT’s, it is a VERY viable idea that just so happens to be tainted by greed and disinformation.


Voting is another concept that would become unhackable overnight...but would also probably:

A. enable the creation of a CBDC (which would also allow the state to REVOKE ownership of your own money)

B. force a state to pick a technology/crypto of choice (and tip the scales toward that crypto)

both of which I somehow am vehemently against yet moderate a (ghosty) community on blockchain voting. 😅

!blockchainvoting@infosec.pub

[–] Atemu@lemmy.ml 41 points 2 years ago (1 children)

Voting is another concept that would become unhackable overnight

No. Voting on the blockchain is an even worse idea than money on the blockchain.

In many cases, there are good reasons why these things are done they way they are. I have yet to see a software system that is better at preventing voter fraud than humans looking at your government-issued ID at a poll site and humans overseeing other humans manually counting votes.

A single actor might be able to commit voter fraud in the order of dozes or hundreds of votes perhaps but with a digital voting system based on blockchain, they could do so on the order of thousands or even millions by compromising end-user devices used for voting or buy enough work/stake/whatever to perform a 51% attack.

Same goes for money btw. Our current system is by far not a perfect one but removing the ability for governments to i.e. freeze accounts of bad actors is not a boon.

[–] demesisx 6 points 2 years ago (10 children)

I have yet to see a software system that is better at preventing voter fraud than humans looking at your government-issued ID at a poll site and humans overseeing other humans manually counting votes.

have you seen any of the research that the US government did on it? Homomorphic encryption enables votes to be both public and obfuscated at the same time. I don't want to write an essay right now but are you truly up to date on this?

Our current system is by far not a perfect one but removing the ability for governments to i.e. freeze accounts of bad actors is not a boon.

I COMPLETELY DISAGREE. It should be exactly as hard as it is to freeze the cash of bad actors. That's the point of it. I, of course, happen to be a libertarian socialist/anarcho syndicalist. You happen to be a capitalist. You seem to want be in the camp of "you will own nothing and you will like it" but I just so happen to not trust governments and their decisions. I believe in socialism but have seen it co-opted and destroyed by corruption. Anyway, I don't think that those same clearly corrupted governments should have the unilateral right to prevent me from attemtpting to claw enough back from their corruption and greed to feed my family.

[–] Atemu@lemmy.ml 6 points 2 years ago

Homomorphic encryption enables votes to be both public and obfuscated at the same time.

That's nice but has nothing to do with voter fraud prevention.

I will not reply to the stupid ad hominem. You have made it exceptionally clear that you have no idea what my political views are.

[–] LWD@lemm.ee 3 points 2 years ago* (last edited 2 years ago) (1 children)
[–] demesisx 6 points 2 years ago (9 children)

If you dislike corruption and capitalists, then why do you like cryptocurrency?

Because properly-implemented cryptocurrencies make corruption impossible. Even the shitty, scammy FTX project had a decentralized ledger, allowing the FTC to quickly and easily forensically untangle SBF’s tangled web of lies and fraud. Even Do Kwan’s TerraLuna hack would have been possible to detect had the project been open source (like any viable crypto project) but regardless of that, it will still now be quite trivial for the regulators prosecuting him and his co-conspirators with fraud.

More learning for those listening in that haven’t already made up their mind like you have: https://youtu.be/J5xegDJphvc?si=x3tJw9s1c1WL_WNy

load more comments (9 replies)
load more comments (8 replies)
[–] cheese_greater@lemmy.world 13 points 2 years ago* (last edited 2 years ago) (1 children)

What does Monero do? Why don't they emulate whatever it is that Monero achieves its reputation and functionality with?

[–] demesisx 22 points 2 years ago* (last edited 2 years ago) (5 children)

What does Monera do?

it is a crypto currency that:

Monero uses three different privacy technologies: ring signatures, ring confidential transactions (RingCT), and stealth addresses. These hide the sender, amount, and receiver in the transaction, respectively. All transactions on the network are private by mandate; there is no way to accidentally send a transparent transaction. This feature is exclusive to Monero. You do not need to trust anyone else with your privacy.

IMO, as a software engineer, leveraging the network effect of Monero was a wise choice. In decentralized systems, the network effect (the amount of unique, separate nodes on a network) is directly correlated to the security of that network. If I were to transact with you in a public place (like a mall food court), you could correlate the presence of other parties in the food court as unique nodes in a network. The more eyes you have witnessing you transaction, the more intrinsic security that transaction has.

Another concept that actually comes into play in cryptocurrency-based systems is that the intrinsic value of that token directly relates to the security of the data in its network. That could be another reason that they chose Monero. Since it already has stable value, it offers a pre-existing and stable security solution.

load more comments (5 replies)
[–] sturlabragason@lemmy.world 6 points 2 years ago

Yeah my most downvoted comments mention Blockchain 🤣 Capitalism turns everything to shit 💩

load more comments (13 replies)
[–] mojo@lemm.ee 27 points 2 years ago (3 children)

What is wrong with doing something like pgp key servers?

[–] koper@feddit.nl 21 points 2 years ago

Key servers can be dishonest, so you need to have another way of verifying that the key you receive is correct.

[–] Catsrules@lemmy.ml 11 points 2 years ago (1 children)

Blockchains are an immutable ledger, meaning any data initially entered onto them can't be altered. Yen realized that putting users' public keys on a blockchain would create a record ensuring those keys actually belonged to them -- and would be cross-referenced whenever other users send emails. "In order for the verification to be trusted, it needs to be public, and it needs to be unchanging," Yen said.

[–] Pipoca@lemmy.world 7 points 2 years ago (2 children)

How do you ensure the accuracy of the data going into the block chain in the first place?

[–] Catsrules@lemmy.ml 2 points 2 years ago

That I don't know the answer too. And i would like more information about how it works. I am mostly familiar with Crypto in block chains work and I still wouldn't say i fully understand that either.

I am also a little confused when they say unchanging. Sure block chain are unchanging but I am assuming you can add new data that would take priority of old data. I don't think you would want a system that you could never change your key once you add it. Because that is stupid keys can and will get compromised eventually.

load more comments (1 replies)
load more comments (1 replies)
[–] voracitude@lemmy.world 24 points 2 years ago

This is basically like Domain Keys-Identified Mail (DKIM) but for a specific email address, without needing to own a domain to set it up. I'm gonna call it "P(ersonal)KIM" for short.

If this is implemented correctly it'll be a few clicks to set up and then just work in the background to make it harder to impersonate you via email, even if you have a free email address.

[–] herr@lemmy.world 16 points 2 years ago* (last edited 2 years ago)

I would strongly assume Protonmail will be doing this automatically soon, there's no manual day-to-day verification necessary.

Writing to the Blockchain is difficult and takes processing power, reading from it is absolutely trivial though.

[–] RecallMadness@lemmy.nz 12 points 2 years ago (1 children)

I’ll use it once they’ve sorted out CalDAV and CardDAV… it’s only been an open issue for eight fucking years.

[–] synergy041@lemmy.ml 4 points 2 years ago (1 children)
[–] RecallMadness@lemmy.nz 5 points 2 years ago

There’s no way to sync contacts and calendars between an iPhone (and other mail clients) and protonmail. The app does one way sync from the phone to protonmail, but not the other way round.

8 years ago a feature request was made to add support for CardDAV and CalDAV, but even with the release of bridge it’s not there.

So iOS users have to resort to using other calendar services, or 3rd party bridges to enable it.

[–] LWD@lemm.ee 6 points 2 years ago* (last edited 2 years ago) (1 children)
[–] Atemu@lemmy.ml 23 points 2 years ago (5 children)

This is false. Protonmail has supported Web Key Discovery for external domains since 2019: https://proton.me/blog/security-updates-2019

[–] lud@lemm.ee 6 points 2 years ago (1 children)

Unfortunately pretty much no one uses openPGP.

[–] LWD@lemm.ee 3 points 2 years ago* (last edited 2 years ago) (2 children)
[–] lud@lemm.ee 2 points 2 years ago* (last edited 2 years ago)

As far as I know they use openPGP and that works automatically between proton users but can be set up to work from and to anyone. The other partner just needs to use a client that supports it (like the objectively best client, Thunderbird ;) ) unfortunately pretty much no one uses openPGP so emails will very seldom be E2E encrypted.

Apparently the Proton clients support web key exchanges so you wouldn't have to import the key of users that use OpenPGP (if they have imported the key to the exchange) so in theory that would make it better. I have yet to use that functionality in Thunderbird though, since again, pretty much no one uses openPGP.

I have sent one legit openPGP email and that was to my country's financial inspection asking for an internship. Unfortunately they replied unencrypted and included my email in the reply, lol. It's fair enough though, since I used a feature that's probably intended to report fraud and crime.

load more comments (1 replies)
load more comments (4 replies)
[–] dustyData@lemmy.world 3 points 2 years ago (1 children)

Look, another solution without problem.

[–] hersh@literature.cafe 13 points 2 years ago (1 children)

Key verification has been a real problem for decades, and AFAIK nobody's made a solution that is simple and effective.

[–] Atemu@lemmy.ml 2 points 2 years ago

nobody’s made a solution that is simple and effective

This one isn't that either by the looks of it but it's certainly a problem where something like blockchain could provide a solution.

load more comments
view more: next ›