“ProtonMail Contacts” world’s first encrypted contacts manager is here

By Waqas
The world-renowned encrypted email service provider ProtonMail is back in the
This is a post from HackRead.com Read the original post: “ProtonMail Contacts” world’s first encrypted contacts manager is here
Continue reading “ProtonMail Contacts” world’s first encrypted contacts manager is here

Encrypted Email Service Tutanota Celebrates 2 Million Users

By Waqas

Tutanota, an email encryption service is gaining popularity all across the globe and has seen a rapid growth since the start of 2017. In the past month, the company has gained over half a million users and is now celebrating 2 million users in total. After the Snowden leak, it became abundantly clear that different […]

This is a post from HackRead.com Read the original post: Encrypted Email Service Tutanota Celebrates 2 Million Users

Continue reading Encrypted Email Service Tutanota Celebrates 2 Million Users

Does pre-shared "secret" part of salt stored in ProtonMail client make SRP auth sequence any safer?

Looking for an encrypted mail provider I checked ProtonMail and asked them why do they use “semi-random password salts (one random part, one non-random part)” compared to SRP 6a fully random salt. Got this answer:

The advantage is that in the event another service’s password database is compromised, and the user used the same password on ProtonMail and this compromised third-party service (don’t do this!), and that service uses the same hash algorithm we do, the attacker would not be able to impersonate the ProtonMail server in the SRP auth sequence, because ProtonMail clients know that the salt begins with a non-random sequence and check this, whereas the salt stolen from 3rd party service would not.

Now given that the client is Open Source, what is the point of this? They didn’t answer this one. I haven’t read the source, so I don’t know how it’s implemented, but does anybody know how it could enhance auth security?

Continue reading Does pre-shared "secret" part of salt stored in ProtonMail client make SRP auth sequence any safer?