Is it just me or is the theme of these answers a bit paranoid if you use privacy software the government will spy on you)?

Fuzzing directories sometimes returns a weird `/logitech-quickcam_W0QQcatrefZC5QQfbdZ1QQfclZ3QQfposZ95112QQfromZR14QQfrppZ50QQfsclZ1QQfsooZ1QQfsopZ1QQfssZ0QQfstypeZ1QQftrtZ1QQftrvZ1QQftsZ2QQnojsprZyQQpfidZ0QQsaatcZ1QQsacatZQ2d1QQsacqyopZgeQQsacurZ0QQsadisZ200QQsaslopZ1QQsofocusZbsQQsorefinesearchZ1 with different extensions, usually with 403 forbidden. Any idea what that is?

/logitech-quickcam_W0QQcatrefZC5QQfbdZ1QQfclZ3QQfposZ95112QQfromZR14QQfrppZ50QQfsclZ1QQfsooZ1QQfsopZ1QQfssZ0QQfstypeZ1QQftrtZ1QQftrvZ1QQftsZ2QQnojsprZyQQpfidZ0QQsaatcZ1QQsacatZQ2d1QQsacqyopZgeQQsacurZ0QQsadisZ200QQsaslopZ1QQsofocusZbsQQsorefinesearchZ1

@MechMK1 How different is it pentesting pentesters compared to normal targets?

@ConorMancone The fact this guy thinks ProtonMail is privacy friendly is very alarming.

@J-- ProtonMail bills themselves as a privacy friendly email service, so that's not really too much of a surprise. In fact, all I know about protonmail is that it tries to be privacy friendly :)

Goodness gracious!!! The data protection office here reached out to me today about a "researcher" that has been harassing them with bug bounty submissions. The data protection office doesn't handle these, and so (everytime) directed the user to submit the results to our bug bounty email address

Naturally, the "researcher" never did that, and instead said that "since you haven't responded to my submission I'm sending them to a legal platform in 10 days". What's a legal platform??? lol!

The vulnerabilities were P5s: SSL ciphers, clickjacking, etc... Best part: the DPO office forwarded me the entire exchange, and never once did the researcher mention the actual vulnerable domains! One submission identified the vulnerable domain as "website.com", another mentioned a domain that we don't own and isn't associated with us at all, and then the screenshot from SSL Labs was cropped so you couldn't even see what domain was scanned!

Most ridiculous bug bounty submissions ever this week...

A "legal" platform is just any platform that is not illegal. :D

Like twitter

If you demand a bug bounty with a threat of legal action after submitting a report, are you still a white hat?

@ConorMancone It is far from a privacy friendly mail service.

Firstly, they control all the keys, they can decrypt any email they like.

Secondly, they use nonsense marketing such as "hosted in switzerland" and "datacentre in a mountain" to give the illusion of better privacy.

Thirdly, they on many occasions have worked with LE then tried to cover it up.

like if it's not possible to serve a subpoena to them because who would dare climbing a mountain...

Fourth, they on multiple occasions have ignored security vulnerabilities and made up nonsense reasons why they're not valid.

They're a horrible company.

I wonder if they are actually just crypto ag

crypto ag was also swiss

Oh I forgot to mention they have a lot of shady characters invested in their business.

I should note that you can verify all of this quite easily in a few searches, these are all very well known issues which protonmail refuses to comment on or acknowledge at all.

@J-- Who wouldn't want access to the emails of a "privacy focused" email service? Especially shady characters who are in blackmailing mood! It has the potential to be all the fun of the data leak from ashleymadison.com, but you get to have all the fun to yourself. I mean, I'm sure there is plenty of innocuous stuff that goes through proton mail, but I bet there is plenty of blackmail material too!

@ConorMancone What does that have to do with them being horrible to use from a privacy perspective?

The OP was advocating the use of PM. I commented on the post as well that this is a genuinely awful idea.

The bottom line is that PM is not a privacy company. No matter how they position themselves there is a lot of telling evidence that they are just pure garbage for privacy and it is nothing more than clever marketing.

@J-- Just speculating on why shady characters might want to invest in a business like this, that's all

Ohh

Sorry, I misunderstood.

Right, of course, yes.

@J-- Scary thing is it could just be the CIA. They did it before, they probably are doing it again. Using a company that's secretly run by the CIA is not really optimal for evading the five eyes...

@FireQuacker I'm gonna go with, "not really". I've threatened people with publicly publishing vulnerability details (and followed through on the threat!), but not to get a bug bounty - just to get them to actually take action to fix severe vulnerabilities

@nobody Yeah, not unlikely at all. Even if not directly, many people have evidence of strong intelligence and government ties to the service. Which is one and the same thing, really.

Whether ran by CIA directly or not, it makes no real difference. The same result comes from it.

Yup

Funnily as well, PM tried to get research taken down into their key storing methods.

A whole paper was made on why they can decrypt your emails, they tried to refute it, the author proved them wrong for a second time and they then proceeded to apply for takedowns.

I never thought protonmail was useful for privacy, but I didn't know they were so shady. Thanks for telling me!

Yeah, they are incredibly shady.

@J-- You need a paper to prove that?

Unfortunately, you have to go through Reddit and other forums to learn this because they remove anything mainstream which shows them in a negative light.

Well, duh, you have to use ProtonVPN to access ProtonMail for true privacy.

Isn't it obvious to anybody in InfoSec

They clearly have very expensive lawyers...

@nobody The paper was a lot more technical than just that. It was a general look into their entire security IIRC.

The key storage was just a pressing issue, of course.

eprint.iacr.org/2018/1121.pdf

this is the paper.

> This is in stark contrast to ProtonMail’s response to Kobeissi’s analysis that tries to frame the vulnerability as ‘his opinion’ and not a real problem with their infrastructure.

^ they really made that public statement.

they genuinely tried to tell the author and the infosec community that it was nothing more than opinion that they could decrypt all emails.

Oh nice, they're partially funded by the swiss government. I'm definitely gonna assume this is just CryptoAG 2.0 now

This site seems to have written a lot about ProtonMail: privacy-watchdog.io/truth-about-protonmail

Oh yeah!

I almost forgot.

They have a .onion link, nice, right? But!

You cannot access your emails via the onion.

You cannot sign up via the onion.

You cannot do anything via the onion but go to the main page which anywhere you click redirects you to the clearnet page.

WTF?

To make this all worse... You require a phone number to sign up OR another email address. Except the only domains accepted for the email address is: outlook, gmail, yahoo, etc, etc, etc.

Further reading... privacy-watchdog.io/protonmails-creation-with-cia-nsa

I actually forgot about these things until @FireQuacker article reminded me.

Are there any real privacy focused email providers though?

What I listed earlier was nothing compared to these points.

@nobody Eh, personally, I think that there are probably some.

But I would argue that any of them hosted via the clearnet are not.

Or if they are, it is only a matter of time until they are not.

I think there was one that snowden used.

Yeah... L something.

It got shut down.

As they refused to hand over emails or keys when they were investigating Snowden.

lavabit

That's it!

Lavabit, yes.

its back I think

They have relaunched, I believe.

But I am not sure if the original owner is in control of it.

I suspect he is not. I suspect this is now a honeypot.

eh that is quite probable

Very...

Why would they not hijack the good name of Lavabit for their own gain?

It makes perfect sense. Everyone knows the owner refused to help.

So taking control of the service, relaunching it and pretending he still owns it is a great idea.

Pretending he still owns it, how would they do that?

Lots of ways.

Blackmailing him that he will go to prison if he does x or x.

Remember, he withheld evidence.

That is a federal offense.

They pretty much can do what they want with him at this point.

They're hardly going to tell everyone that they're now in control of the service.

People will just assume that the owner relaunched it.

Hmmm... we pretty much can't trust anyone at this point

You're not wrong.

If you must use email, use PGP. Control your own keys.

Don't use email for anything confidential, that's way easier

Depends how paranoid you are, I guess.

Some would say using email at all is a terrible idea.

Others would say only use it when you must. It is relative.

But the key takeaway is that email is fucking garbage.

If your threat model is a "5 eyes agency" then your best remediation step is to not do anything to get on their radar.

And I don't mean that from the perspective of "if you have nothing to hide you have nothing to fear"

If your threat model is 5 eyes, aren't you already doing everything to get on their radar?

I mean that from the perspective of: very few people would be able to keep themselves hidden from 5 eyes if being actively targeted, for any reasonable amount of time

Wow, I just saw a person advocating for the minimum wage (globally) to be set at 0.

How do people like this even believe themselves that is a good system? No, really. I'd some wisdom from someone who can explain this level of greed.

I am pro minimal wage to be a livable one. The argument against the minimal wage is that it puts a limit on the skills you are willing to employ. If the minimal wage is 5 dollars, you as an employer would only hire someone that can make you $5 or more. without mandated minimal wage, you could employ anyone that can make you 10 cents and pay them 5 cents.

Well, exactly.

How can someone not understand how morally wrong that is?

morality and profit usually aren't on the same subset

if you look from the eyes of the employer, a 0 minimal wage is optimal

To enforce. Sure, if someone wants to work for 10 cents an hour then let them (nobody would). But to actually go as far to say that it should be an enforced "feature" of society (or whatever the fuck you want to call it) people must be able to see how unethical such a practice truly is.

from the eyes of "the people", $100/h is better

Optimal, yes. But how can you as a person believe that level of extreme capitalism it is okay?

It baffles me.

usually is someone that lives on the good part of the planet

I genuinely can't fathom how people believe that we should go to such extremes...

It makes me sick that people really believe this is acceptable.

Really. It isn't acceptable. not at all.

It is morally wrong. Ethically wrong and quite frankly sick.

These are the same sorts of people that probably enjoy watching the poor suffer.

The same people who want to bring back slavery, I imagine.

perhaps... and same people don't remember that without people receiving money, they cannot buy things, and there goes the market

I saw a study from a century ago (so society changed a little bit since that) from Alaska IIRC, and the government increased minimal wage to bar unskilled people from getting jobs, so even the most basic entry jobs were to be paid a high wage. the result was that immigrants couldn't get any jobs

so if you are on the absolute low end of the workforce (no skills, bad at language, no contacts, no experience), a high minimal wage forces you out of the workforce because nobody wants to hire you

on the other hand, without a decent minimal wage, even those who are more skilled will earn the bare minimum and slip into poverty

if you ask me, if a person cannot provide for his family with a minimal wage, the minimal wage is sub-minimal

@ThoriumBR Agreed.

Long email sent to developers, explaining the vulnerability for the second time and begging them to change it for goodness sake. Let's see if this one works...

My company sets up this application for customers, and it turns out that the database password is both hardcoded and simple. So if the TCP port is left open, game over. The developer is like, "Well, we can just have the installer turn on the firewall..."