Snake Oil warning


That is a very good point, if the email is encrypted how can they run
a spam filter on it? They may explain it by just reading the headers
but then that would not explain how the antivirus does it.

I will probably raise this issue with them

You do that. lol


Well here goes their LONG reply:

-----------------------------------------------
As for your second question, we virus and spam scan messages when they arrive at our server.
Our asymmetric encryption feature then encrypts the message with your public key before saving it to disk.
Once its been encrypted, it can then only be decrypted if you know the password (since the private key is
protected using the password and AES256). Naturally if someone compromises the password, they compromise the
account, but we take steps to prevent this from happening on our side (we require SSL for these accounts, we
only keep the password around in memory for a minimum amount of time, and we purge the memory before releasing
it back to the system). Its not a perfect system (were open to ideas for improving it), but it accomplishes our
goal.

Our goal with this system wasn't to provide end to end security (for example, most messages arrive at our server
unencrypted). It also wasn't intended to mask someone's identity. The system was developed in response to the
PATRIOT Act. Basically we didn't like the promiscuous way other services were sharing private information with
employees, other companies and the government. The goal was to create a system where if someone did come to us
with a court order looking for information, we'd have very little private data to surrender.

Our suggestion is that if want to disconnect yourself completely from the account, you only connect to our service
through Tor. Use of Tor should guarantee that you can't track a user account back to a specific person, and a person
back to an account (if their local computer is equally secure).
----------------------------------------------------------

I have to give to them that they really took its time writting it so at least customer care seems OK, but
it stinks to snake oil peddler, they claim on their webpage they can't access your email it does not look like it
since they have your password.

They also give away your IP when sending email that was the first question I asked and they said:

-----------------------------------------------------------------------
We've wrestled with the sender IP question many times. Currently we don't log the IP your sending from on the server.
We _only_ log it in the message itself. The logic behind this was that if your attempting to scam someone,
they should have the ability to discover the IP address you sent the message from.
--------------------------------------------------------------------------------

So now they claim they don't log your IP, they probably think we are all stupid, I find it hard to believe.
.

Relevant Pages

  • Re: How to access NTFS-protected files on a slave drive
    ... I'm not the OP, but part of the point of marking files private, assigning ... account - or another system. ... Ownership of the files. ... This can not apply for XP Home, as encryption isn't supported, and does ...
    (microsoft.public.windowsxp.help_and_support)
  • Re: X.509 and ssh
    ... encryption which may be illegal in some jurisdictions, ... supposedly hiding an account number. ... authorty industry embellishing the role of digital certificate as the ... the issue with LDAP isn't so much that real-time, ...
    (comp.security.ssh)
  • Re: What laws did PC repair co. break by hacking my laptop?
    ... Had a fault with some of the keys on my laptop keyboard, ... Profile was set with a password, it was the only Administrator account, ... photographs, videos, and only my private photos and vids, had been ... Cite the Computer Misuse Act, ...
    (uk.legal)
  • Re: How to securely store a password on a PC
    ... password - so locking the data to ONE account will not solve that problem. ... Full disk encryption can protect against EXTERNAL attackers (who ... full encryption - not only Vista's BitLocker but any 3rd party solution. ... Security is not about the secrecy of the algorithm. ...
    (microsoft.public.platformsdk.security)
  • Re: decrypt help...
    ... > i've tried re-establishing a user account with the same name as when i ... then importing the cert/key combo into that account ... You would need a backup of the user profile and machine system state as well ... >> a slippery slope that most stay as far away from encryption as possible. ...
    (microsoft.public.windowsxp.help_and_support)