ProtonMail - Encrypted Email

Old news, funds have been released.

http://pando.com/2014/07/01/surpris...-to-access-its-account-after-public-scrutiny/

 

Hacking protonmail - with a browser.

http://vimeo.com/99599725

 

Hi Andy, it's nice to be able to communicate with the developers on security issues.

Forward secrecy:
No this one is, like said in the thread, transparent. The reason we want to do DH key exchange prior to all connections, is to prevent some active MITM attacks. Otherwise encryption depends on third party. NSA signs a certificate with stolen "Swiss sign" root certificate (huge thanks for not using US-based CA). If it's not already so, please make it possible for user to view all IP addresses from which protonmail has been logged into. This makes active MITM against DH harder.

Key length
Please let the user choose it. I wouldn't mind taking a nap while my 16k key generates, clientside generation isn't burden for Protonmail anyway.

Source code
If not already, please make the client side software _free_. Charge only for the storage space.

publishing SHA3 of public key
This does not increase security since MITM attack against service from which it is viewed from can change content. Security of key authenticity depends on CA in both cases.