I'm presently using mailfence.com
They claim all encryption happen in the browser and that they are zero knowledge.
My question is this: Where do they store my key. If my private key is stored on their servers, can't they decrypt all my mails?
Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this communityI'm presently using mailfence.com
They claim all encryption happen in the browser and that they are zero knowledge.
My question is this: Where do they store my key. If my private key is stored on their servers, can't they decrypt all my mails?
I work at Mailfence as an Information security analyst.
Where do they store my key.
When you generate your keypair, we first encrypt it with your passphrase in the browser and then store it on our servers. This way, server never sees the key in plain-text, and a zero-knowledge framework gets established.
If my private key is stored on their servers, can't they decrypt all my mails?
No, we can't. As your private key is encrypted with your passphrase, which only you knows.
The blog-post Mailfence end-to-end encryption and digital signatures will give you more insights in this regard (including the open-source libraries that we use to perform crypto-based operations).
We are always open to external (legitimate) audits, and to further strengthen our transparency - we have also planned to go open-source. It's now only a matter of time and priorities.
I'm not sure how exactly mailfence works, so the following paragraph is a theory on how it could work: Mailfence seems to work with asymmetric cryptography. So it would't be necessary to enter a password when sending mail. But in order to read encrypted mail adressed to you, you'd need to enter a password that locally decrypts your private key. This may all happen the moment you sign in to the service, e.g. some javascript uses the info you enter to sign in to fetch and decrypt your key, and then authenticates you to the mail service, possibly using the decrypted key to sign a challenge. So yes, its possible to build a zero knowledge mail service.
However:
The browser is a notoriously insecure environment. It isn't possible to secure javascript. So if your browser is hacked by maware/malicious javascript, you lose.
Mailfence could turn evil and send the decrypted private key back to their servers in the background, once it got locally decrypted. Nothing you can do to avoid that.
Its likely that mailfence can read most of your mail, since most of your communication partners probably don't use encryption, so mailfence could read incoming unencrypted mail to you before they encrypted it, or read outgoing mail from you to someone that doesn't use encryption.
The people behind mailfence seem like they are trying, but there are multiple underlying flaws with there design ... many of which they simply cant fix as they are inherent to the underlying architecture that they are using. While there are many problems, the biggest of these is:
Ok, so they need to encrypt your content in the client side ... and a reasonable way to do that is with a Private-Key ... the problem is that since this is a web app and you will need the Private-Key on multiple different devices ... they have to send it to the server. This is a problem for many reasons:
super-secure.js
from untouchable-cdn.com
... if mailfence.com has a single line of javascript code coming from anywhere else it has the potential of overwriting the functions of the super-secure.js
library ... there is no way to prevent this.... There are still further problems some of which can be found here though it was written in 2011 and some of the issues are no-longer true for current browsers.
further issues that could be elaborated on later if I find the time: