End-to-end email encryption – A case study on ProtonMail design limits and security flaws

In the wake of Edward Snowden revelations on the NSA program, focus progressively increased on various tools aiming at escaping governments and various intelligence agencies mass surveillance. It also brought to light the general matter of online privacy at stake in a GAFAM world (GAFAM = Google Apple Facebook Amazon Microsoft). These are however two different topics: in the first case people want to avoid being watched by their governments, and in the second case people want to take control back over their digital life, a control they willingly relinquished to some companies that do not have privacy protection in their genes. Still, both share a common thing: the sake of privacy for which some tools try to propose a solution to.

These tools might be new, but the actual technology has been around for a while, essentially solid encryption standards such as PGP, RSA, AES and so on. Some other applications are meant to ease self-hosting services such as email, cloud file storage, calendar, which definitely is a good way of protecting one’s privacy. And this has become something possible at an affordable price (VPS, Raspberry Pi at home, etc.). The whole point being to offer people proper tools, ie tools anyone can use, as well as lower the complexity of using such technologies, if not making it transparent to the end-user.

Lire la suite