How does mass surveillance works?

I’m pretty sure that certain three letter agencies are using this kind of attack.

It wasn’t clear to me that this conclusion is warranted i.e. it depends on whether “our database” includes all public keys on the planet, all public keys in use specifically with ProtonMail, or something in between.

The overall topic is a bit beyond my level of knowledge but I think the conclusions are:

  • 2048 bits is not enough (use minimum 3072)
  • when generating secret keys (symmetric or asymmetric) do make sure that you have enough entropy - I use external hardware to supplement entropy
  • specifically for SSH (not directly relevant to that paper, I think) use ECDSA rather than older choices (which by now is the default anyway, I think) - more generally, keep software current and keep abreast of developments in crypto
1 Like

i believe protonm recommends that rsa 4096 bit keys should be generated on PC-desktop-class compute devices and not mobile phones :stuck_out_tongue_winking_eye:

one thing with protonm that people aren’t aware of is that the encryption key that the contact list is protected with is SEPARATE from the other keys and i haven’t found a way to change it from 2048 to anything more secure. i’m probably too paranoid in this case but it wouldn’t hurt for them to implement an easy way for people to change it should they wish to do so …

another point. encryption keys have EXPIRATION dates and they should be manually changed together with the password/passphrase at least once/year imo.

i’ve seen that some people working in support at Purism with keys that haven’t been changed since 2016 … perhaps they don’t need to but public keys are … well … PUBLIC, so for customers peace of mind they should not neglect this aspect …


Some good points there. Of course certificates have formal expiration dates but all crypto should be considered to have some expiration date due to ongoing developments and attempts to break. Crypto is never “set and forget”.

however it is very EASY to set and forget unless there is no automatic system in place that draws your attention when a particular secret has expired … another thing to put on your cron job i guess :wink:

1 Like

I’m not an expert, but for example: “All calls on WhatsApp are VoIP”, and this means to me that you need an App (on both sides) to establish telephone call with someone. Just in comparison, VoLTE doesn’t need an App for telephone calls and link to one of explanations is here:

Be the first on your block, order your copy today!

remind me again … how many Elephants are still around today ? :scream: :weary:

Why didn’t you ask that when your first brought up elephants?

Or were you just leading us on…?

who knows … i’m an old elephant myself …