Oddbean

Watchman Privacy interviewed SimpleX, But yet If you hit the contact on his website, only Telegram and Protonmail are listed. And Google analytics, Google fonts, Google forms, Gmail, and Cloudflare are used. First of all, Telegram leaks metadata (who/when is talking), and that's why people use SimpleX. You'd know this if you listened to your own interview. Second, even if we ignore that Proton's board of directors has a World Economic Forum member, which is the organization pushing for forced digital IDs. Protonmail is not really end-to-end, if they force you to have your private key in their web app, that's cloud-to-cloud. As I've went over previously, they even ban PGP signatures from external apps. Even Mikkel Thorup, the guy who SELLS Watchman Privacy event tickets, said on his podcast "Protonmail isn't as private as people think". So surely they self-host right? No, Gabe Custodiet’s "Privacy Summit" with Expat Money used Google forms and Gmail to collect the info of those seeking to flee the US for privacy. Thorup’s ExpatMoney.com and io are both on Cloudflare with Google emails, and these coordinated all Watchman events of political asylum seekers and 2nd citizenship applications. Do you really want Cloudflare and Google knowing you're fleeing the US for financial privacy? Now, I know Thorup would respond to this by saying "well your data goes to the countries you apply to citizenship for, so it's not private anyway". But this is misleading, because many countries may only need a fixed investment or time spent in the country. While as applicants to these exclusive Privacy Summits, often feel pressure to exaggerate their assets, to get accepted as clients. Then on Watchman's site, he sells “Bitcoin privacy” through Gumroad, which is on Cloudflare, Google analytics, and Facebook analytics. But the worst part is Gumroad blocks new account sign-ups unless you enable Google. Watchman can’t even figure out how to not have Google fonts API on his WordPress. And then he only sells his book for Amazon CIA contractor fiat, only uses spyware Twitter/Youtube and no alternatives, and lists the following: "CONSULTING: Few humans have the experience and knowledge I do with private and freedom living." Few humans have your knowledge? Give me a break bro, maybe in scamming people. Here at Simplified Privacy, our message is the opposite, I am not claiming to be anything special. I'm just a regular dude without even an undergrad computer science degree. All I got is a dream to spread freedom. And if I can learn this open source technology later in life, so can you. So if you want to see Watchman come on Nostr or SimpleX, make some noise. Smash that repost. Because the only way he's going to adopt freedom tech is when its undeniable that he's being left behind.

I don't know what is true or not, but I would like to read a response from watchman privacy. nostr:nevent1qqsfca7wtjczawfmzcy3ysdf25wl35ny53y96lncg6g502ts96g0kzspzpmhxue69uhkummnw3ezumt0d5hsyg9v8a40u96e8asczpgnmty6re2yapaee6gmylfhhz8vtra64yq54gpsgqqqqqqszwy5vr

You have to strike a balance if you want to enable contact with the outside world. Sure, uncompromising data protection is possible, but then no one will write to you because most people don't make the right tech choices. It's not like every initial inquiry contains a state secret. For more sensitive content, you can always resort to other means. This all-or-nothing attitude is simply not realistic.

I agree, however it would be of no added complexity for their visitors, if Watchman self-hosts his email server, had a contact form on his website and also offered a Simplex address with the advice, that Simplex is easy to install and probably the most secure way of contacting him. As for self-hosting the website and not using Google Fonts or cloudflare that's even more of a no-brainer as his visitors would not even notice that but still benefit from them not being tracked on his websites. So I do agree with @SimplifiedPrivacy.com Podcast's points.

Why can't one legit choice be on the menu? Just as an option? It's not about it being a state secret, it's that he's not using freedom tech... like nostr. So if the freedom tech influencers won't use freedom tech, then how we gonna grow? I'll tell you how, we stop letting those individuals be the freedom influencers

"your private key in their web app, that's cloud to cloud" Not necessarily true. The fact it's a web app doesn't mean private key leaves your device. Code is open source for you to see. You don't trust they run that? You can always inspect what happens client-side. I'm not saying I did. I say strong claims need strong evidences.

First of all, Protonmail is creating their private key on their end and then giving it to you. And the purpose of this encryption is to protect you from them. So that’s a conflict of interest. And what does end-to-end encryption even mean if it’s not on your device? You can audit the code served in the browser yeah (which can change at every page refresh), but you have no real way to audit their cloud backend or database to know if they even use this key in the ways they claim. Proton’s mobile app is far better than a web browser, but if they are so secure, then what are they handing over to the 3000 government data inquiries a year that’s growing?

If you're looking for a fancy academic whitepaper, here is one example: An Analysis of the ProtonMail Cryptographic Architecture Nadim Kobeissi September 6, 2021 https://eprint.iacr.org/2018/1121.pdf and the part me & you are talking about is: Pg 7 of 14. Section 4.1.1 If you're looking for me to say it to you in raw shit, here it is: When you use Nostr you have the private key on your device, browser extension or client. When you use Protonmail, their web app is unlocking/signing/or generating for you the private key stored via encryption on their server. So there are many ways they can screw with you. Including SOME: a) serving you bogus code to phish the password b) telling you the other proton guy's public PGP key is something else c) brute forcing you, they have unlimited attempts with no time lock. And your password is weaker than a PGP Key. d) messing with you during registration to begin with

Thank you. The paper focuses on the fact that when using webmail the Proton server could serve you a malicious client-side code and steal or misuse your key. But all web apps have that problem. Since Proton has implemented their "one-password" login, the PGP key is on the server, encrypted using your password salted+hashed. That means Proton could try to bruteforce it. But it also means man in the middle attacks are avoided. I would call them tradeoffs, but I wouldn't say their implementation is fundamentally flawed or insecure.

Yes, all web apps have the problem, and so it's not end-to-end. No, It does NOT avoid middle attacks, since they can serve you phising info. Also there's some analysis of proton of your password at account creation to make sure you're not a bot. So if you have 90 random characters, its more likely to reject you as a spam bot, and not let you make an account. But if you have basic WORDS that aren't random like "carrot" it will. This means they are seeing the password, connected to the backend spam filter. That's not private at all. And the source on this is me. We may release an official paper on it, but for now I'm just making the statement. It's your subjective opinion if the trade off is good, but it's far less secure than self-hosting. And a self-host VPS costs the same as a Proton Pro subscription.