Proton Mail, the leading privacy-focused email service, is making its first foray into blockchain technology with Key Transparency, which will allow users to verify email addresses. From a report: In an interview with Fortune, CEO and founder Andy Yen made clear that although the new feature uses blockchain, the key technology behind crypto, Key Transparency isn’t “some sketchy cryptocurrency” linked to an “exit scam.” A student of cryptography, Yen added that the new feature is “blockchain in a very pure form,” and it allows the platform to solve the thorny issue of ensuring that every email address actually belongs to the person who’s claiming it.

Proton Mail uses end-to-end encryption, a secure form of communication that ensures only the intended recipient can read the information. Senders encrypt an email using their intended recipient’s public key – a long string of letters and numbers – which the recipient can then decrypt with their own private key. The issue, Yen said, is ensuring that the public key actually belongs to the intended recipient. “Maybe it’s the NSA that has created a fake public key linked to you, and I’m somehow tricked into encrypting data with that public key,” he told Fortune. In the security space, the tactic is known as a “man-in-the-middle attack,” like a postal worker opening your bank statement to get your social security number and then resealing the envelope.

Blockchains are an immutable ledger, meaning any data initially entered onto them can’t be altered. Yen realized that putting users’ public keys on a blockchain would create a record ensuring those keys actually belonged to them – and would be cross-referenced whenever other users send emails. “In order for the verification to be trusted, it needs to be public, and it needs to be unchanging,” Yen said.

Curious if anyone here would use a feature like this? It sounds neat but I don’t think I’m going to be needing a feature like this on a day-to-day basis, though I could see use cases for folks handling sensitive information.

  • 0x0F@lemmy.blahaj.zone
    link
    fedilink
    English
    arrow-up
    26
    arrow-down
    5
    ·
    edit-2
    1 year ago

    It sounds overcomplicated, is there really a need for the blockchain aspect? Could the same security be provided by a simpler method (like how keybase has their identity proofs?) but better to have it and not need it than need it and not have it ig

    • Breve@pawb.social
      link
      fedilink
      arrow-up
      23
      ·
      1 year ago

      PGP solved this a long time ago, but it is difficult to make it user friendly enough for non-technical people to understand and adopt it.

      • JackbyDev@programming.dev
        link
        fedilink
        English
        arrow-up
        14
        ·
        1 year ago

        How many people have verified how many people’s identity with PGP signatures? Also I’m willing to bet a horribly shocking amount of people would just accept a new key from someone (not necessarily sign it) and trust them regardless.

        • Breve@pawb.social
          link
          fedilink
          arrow-up
          5
          arrow-down
          1
          ·
          1 year ago

          Yeah these issues are definitely not new, but replacing “I trust the people who sign/verify my keys” versus “I trust the blockchain” is not too far off. What rules are going to be in place for peers to validate entries to the blockchain and independently reach enough concensus to achieve true decentralization?

          • JackbyDev@programming.dev
            link
            fedilink
            English
            arrow-up
            4
            ·
            1 year ago

            To be clear, I’m not saying this solution is better or worse than PGP, I just don’t believe PGP works well for creating a web of trust.