The company says that by turning email into end-to-end encrypted communication, Proton Mail’s transparency will close another potential security hole: ensuring you’re emailing the right person…
background
By default, email is a plain text form of communication – and your emails go through multiple servers before reaching their recipient. This means that anyone with full access to those servers can read your mail.
PGP – or Pretty Good Privacy – is an email encryption protocol designed to ensure privacy. Emails sent to you are encrypted using your public key, which anyone can access, and then can be decrypted with your private key, which only you know.
PGP turns email into end-to-end encrypted communication, but implementing it isn’t particularly user-friendly, which Proton Mail set out to solve. Provided that you and your email contacts are both using Proton Mail, PGP is automatically implemented, with neither party needing to do anything other than send and receive emails.
What started as a niche product has grown to reach 100 million users, and the company has diversified into password managers, VPNs, storage, and more.
proton mail key transparency
While ProtonMail ensures that Material While the company says your email is safe from snooping, there’s yet another potential security hole. A bad actor could spoof one of your contacts’ emails, causing you to reply to the wrong person. Email headers are very easy to spoof.
To solve it, Luck The report says that the company is preparing to launch transparency of Proton Mail. This is a way to verify that an email address actually belongs to the person behind it.
The approach utilizes blockchain technology – although the company’s CEO, Andy Yen, was quick to point out that while this technology is best known for cryptocurrencies, the company is in no way involved in that particular minefield.
The point, Yen said, is to ensure that the public key actually belongs to the intended recipient.
“Maybe it’s the NSA that has created a fake public key associated with you, and I have somehow been tricked into encrypting data with that public key,” he explained. Luck, In the security field, this tactic is known as a “man-in-the-middle attack,” as if a postal worker opens your bank statement to get your Social Security number and then reseals the envelope. Is.
Blockchains are an immutable ledger, meaning that any data initially entered into them cannot be changed. Yen realized that putting users’ public keys on the blockchain would create a record that would ensure those keys were actually theirs – and would be cross-referenced whenever other users sent emails.
Effectively, everyone keeps their public keys visible on the blockchain, and anyone can check the public keys they hold against that public record. Because the database is decentralized, it cannot be compromised by a hacker.
Like PGP, Proton Mail users won’t need to do anything to take advantage of it. Every time you email someone, the Proton Mail app will check the public key against the blockchain database to make sure it is correct.
The company is currently running Proton Mail key transparency on its own servers as a proof of concept, while moving it to a public blockchain will be necessary to provide the necessary confidence.
Blockchain Visualization: Shubham Dhage/Unsplash
FTC: We use auto affiliate links that generate income. More.
Source: 9to5mac.com
