Proton Mail, the leading privacy-focused email service, is making its first foray into blockchain technology with Key Transparency, which will allow users to verify email addresses. From a report: In an interview with Fortune, CEO and founder Andy Yen made clear that although the new feature uses blockchain, the key technology behind crypto, Key Transparency isn’t “some sketchy cryptocurrency” linked to an “exit scam.” A student of cryptography, Yen added that the new feature is “blockchain in a very pure form,” and it allows the platform to solve the thorny issue of ensuring that every email address actually belongs to the person who’s claiming it.
Proton Mail uses end-to-end encryption, a secure form of communication that ensures only the intended recipient can read the information. Senders encrypt an email using their intended recipient’s public key – a long string of letters and numbers – which the recipient can then decrypt with their own private key. The issue, Yen said, is ensuring that the public key actually belongs to the intended recipient. “Maybe it’s the NSA that has created a fake public key linked to you, and I’m somehow tricked into encrypting data with that public key,” he told Fortune. In the security space, the tactic is known as a “man-in-the-middle attack,” like a postal worker opening your bank statement to get your social security number and then resealing the envelope.
Blockchains are an immutable ledger, meaning any data initially entered onto them can’t be altered. Yen realized that putting users’ public keys on a blockchain would create a record ensuring those keys actually belonged to them – and would be cross-referenced whenever other users send emails. “In order for the verification to be trusted, it needs to be public, and it needs to be unchanging,” Yen said.
Curious if anyone here would use a feature like this? It sounds neat but I don’t think I’m going to be needing a feature like this on a day-to-day basis, though I could see use cases for folks handling sensitive information.
The only place where end-to-end encryption is used on ProtonMail is between ProtonMail users. It is a closed, essentially private, system.
Signal already dealt with a similar issue by having keys stored on users’ devices and not in a database that is made to be both publicly accessible and irrevocable. Sounds like a big step backwards to me.
Update: Proton’s blockchain is currently not public. So scratch that one off the list of supposed benefits.
This is false. Protonmail has supported Web Key Discovery for external domains since 2019: https://proton.me/blog/security-updates-2019
Unfortunately pretty much no one uses openPGP.
Yeah, and I don’t think Proton is helping anybody by introducing a new, competing method of encrypting and verifying email…
As far as I know they use openPGP and that works automatically between proton users but can be set up to work from and to anyone. The other partner just needs to use a client that supports it (like the objectively best client, Thunderbird ;) ) unfortunately pretty much no one uses openPGP so emails will very seldom be E2E encrypted.
Apparently the Proton clients support web key exchanges so you wouldn’t have to import the key of users that use OpenPGP (if they have imported the key to the exchange) so in theory that would make it better. I have yet to use that functionality in Thunderbird though, since again, pretty much no one uses openPGP.
I have sent one legit openPGP email and that was to my country’s financial inspection asking for an internship. Unfortunately they replied unencrypted and included my email in the reply, lol. It’s fair enough though, since I used a feature that’s probably intended to report fraud and crime.
And this is not at all what’s happening here.
deleted by creator
They’re the maintainers of the most popular JS PGP library and they’re pushing for some major upgrades to the PGP standard. There’s no competing standard. Proton is pretty much the only popular encrypted mail provider that actually does interop well enough.
I’m reading the linked article. It says “However, key discovery has long been a challenge in the OpenPGP ecosystem… A new approach, called Web Key Directory (WKD), leverages the web to allow a domain to serve its own keys”
Are you speaking for Proton when you say this being added to PGP??
deleted by creator