Email encryption on Android and iOS becomes easy with the open source app Tutanota

https://tutanota.de/blog/posts/get-the-tutanota-app-for-ios-android

by bruce487 • 11 years ago

33 26 11 years ago

tutanota.de

klaustopher• 11 years ago

So, one can only send encrypted mails to other users of the platform?

http://tutanota.uservoice.com/knowledgebase/articles/470724-...

johnd03• 11 years ago

No, it works with anybody: http://tutanota.uservoice.com/knowledgebase/articles/470795-...

hobarrera• 11 years ago

Yeah, it emails a link to the third party to use their website to read the email.

And you have to pre-share a password.

It basically takes a dump on every standard we already have.

darklajid• 11 years ago

That link only talks about pgp/gpg, but yeah - their solution (haven't figured out the whole thing yet) seems to be "Send everything to our servers, others can get it from there using our app (or a web application)".

No gpg/pgp relation. No IMAP support¹. They do support SMTP if

a) the recipient is not on the same platform

b) you're sending an unencrypted mail (only possible to external users anyway)

If you send an encrypted mail to an external user, they basically just get a link or something. "View the real mail here"?

I believe the intentions are good, but that's trying to solve the problem by killing off most things I require for my mails, unfortunately.

①: http://tutanota.uservoice.com/knowledgebase/articles/470761-...

eloy• 11 years ago

This will never work. I'm more enthusiastic about DIME.[1]

I think SMTP will not (and cannot) ever be replaced. But if there will be DIME support in Postfix and Thunderbird, I can give it a chance.

[1] https://darkmail.info/

alfiedotwtf4• 11 years ago

For submission, there's RFC 4468.

alfiedotwtf4• 11 years ago

The NSA Planned to Hijack Google App Store to Hack Smartphones [1]

Given that software updates are automatic (unless you manually turn them off etc), how can you trust an app if you can't trust the platform?

1. https://firstlook.org/theintercept/2015/05/21/nsa-five-eyes-...

mike_hearn• 11 years ago

Two things.

Firstly, Android checks app signatures and as far as I know the market app doesn't have any ability to override that. It can do a few privileged things like skip showing the permissions screen, but I think the OS still wants to see correct signatures. So even if the app store was hacked the phone itself might reject a bogus upgrade.

Secondly, that slide is more like some junior GCHQ guy noodling around, I think. It is old and dates from a time before Google used SSL for everything. I doubt it's possible to do via purely technical attacks now.

Thirdly, it'd almost certainly be easier to attack the developer laptop/workstation to steal the signing keys directly than attack Android head on. I plan to do some research this summer into splitting the RSA signing keys used by Android apps to allow for threshold signed online updates for Android and maybe iOS.

alfiedotwtf4• 11 years ago

It is old and dates from a time before Google used SSL for everything

Their budget is $52.6 billion and (as you say, the slides are old) they have lead time too. Let that sit for a moment.

zyx3212• 11 years ago

The only way to change the signing key for an app (on an unrooted phone at least) is by completely uninstalling it (which deletes the main data directory) and then installing a new version. In fact, Google lost the key for their OTP authenticator app at one point, requiring all users to install the new app manually before they would receive updates again.

coffeecheque• 11 years ago

Slightly OT, but what's the likelihood of Apple/Google integrating PGP natively into the OS? I know iPhone has S/MINE - but is PGP too much to ask?

higherpurpose• 11 years ago

For PGP you can try:

https://whiteout.io/

https://lavaboom.com/

JustSomeNobody3• 11 years ago

I don't know about Apple, but I doubt Google will because of the features they've been putting out lately (i.e.: Now cards for flights, etc based on emails).

hiamnew2• 11 years ago

I have to be honest, I have given up on pgp. From what I know there is no way to have encrypted communications between more than two people. So why even bother pursuing the dream of everyone using it if there is such a roadblock in the way of common communication habits.

agd• 11 years ago

I believe PGP does support multiple recipients. The symmetric key is encrypted and included for every recipient.

hiamnew2• 11 years ago

Ouch, I did not expect that. Nice!

rockdoe• 11 years ago

PGP absolutely supports multiple recipients. As the other reply says, the (small) symmetric key is encrypted separately with the public key of every recipient.

snksnk• 11 years ago

A good alternative is Countermail [https://countermail.com/] (probably more secure than Tutanova, to the extent possible for these services) and an app such as K-9 Mail.

JustSomeNobody3• 11 years ago

I thought it was already easy on Android with K-9 and APG.

mike-cardwell• 11 years ago

APG is discontinued. You should use OpenKeychain now instead - http://www.openkeychain.org - OpenKeychain does everything APG did, more, and has a much nicer interface. It even lets you use a Yubikey as a PGP smartcard over NFC so you don't have to store your PGP keys on your phone - https://grepular.com/An_NFC_PGP_SmartCard_For_Android

The one thing that K-9 misses, which is pretty major IMO, is PGP/MIME support. It only works with inline PGP.

JustSomeNobody3• 11 years ago

Thanks for the information, I'll look into those.

Yeah, I don't like that PGP/MIME isn't supported, but I manage.

owly• 11 years ago

Don't forget https://protonmail.ch They are working on iOS and Android apps, and from what I've seen they have the most promise of making encryption simple for ALL.

dkyc• 11 years ago

"Swiss Data Security

Our email service safeguards user data with strict privacy protections and our secure datacenter facility hidden inside a Swiss granite mountain."

Now that is comforting.

dzlobin• 11 years ago

I might be missing something but the source of the actual iOS app doesn't appear to be on their Github.

Email encryption on Android and iOS becomes easy with the open source app Tutanota

Related Stories