Skiff: Various Privacy Failures

• publications

  51 1,318 8.7 Python

  Publications from Trail of Bits

  

Disagree, their reputation is tied to their audit quality.

But I'm pretty sure in this case the scope was bad. Like they coukd have had audits on "Do I use OpenSSL well?" and then misrepresent that all their privacy claims were audited.

Now it seems like Skiff conveniently didn't allow Trail of Bits to publish their reports, they are usually here: https://github.com/trailofbits/publications/tree/master/revi...

Disclaimer, I have used Trail of Bits service in the past (and 2 other auditors for an security campaign on a blockchain, cryptography + networking product).

• free-email-forwarding

  63 2,398 0.0 JavaScript

  The best free email forwarding for custom domains. Visit our website to get started (SMTP server)

  

Forward Email team here (https://forwardemail.net), we have a write-up and comparison @ https://forwardemail.net/en/blog/docs/best-quantum-safe-encr...

We've considered adding a E2EE comparison column as well (with the issues such @ http://jfloren.net/b/2023/7/7/0 highlighted).

Privacy Guides Discussion @ https://discuss.privacyguides.net/t/forward-email-email-prov...

Unlike Skiff, Proton, and Tuta... we're _actually_ 100% open-source. Those providers that advertise as open-source really only open-source the front-end, when the back-end is the most sensitive part of an email service.

• SurveyJS

  surveyjs.io sponsored

  Open-Source JSON Form Builder to Create Dynamic Forms Right in Your App. With SurveyJS form UI libraries, you can build and style forms in a fully-integrated drag & drop form builder, render them in your JS app, and store form submission data in any backend, inc. PHP, ASP.NET Core, and Node.js.

  

• forwardemail.net

  4 756 9.8 JavaScript

  Privacy-focused encrypted email for everyone.

  

Here is the actual code in the back-end where we use your PGP public key:

Source code for PGP encryption for storage when you're connected (we only use your password in-memory, and never write it to disk on our side) @ https://github.com/forwardemail/forwardemail.net/blob/562a52...

Outbound email automatically checks for PGP key in case you didn't include the recipients (we use WKD): https://github.com/forwardemail/forwardemail.net/blob/562a52...

Your individual mailbox is a SQLite database file and is encrypted using ChaCha20-Poly1305 as well.

• mta-sts.forwardemail.net

  1 1 3.8 HTML
  

We use MTA-STS (for inbound AND outbound) with our mode set to enforce[1], to require senders to communicate with us only using TLS encrypted sockets. There is no legal precedence currently requiring software services to implement backdoors.

[1]: https://github.com/forwardemail/mta-sts.forwardemail.net/blo...

Suggest a related project