This move, hopefully, promises to avoid this headache if the algo is actually post-quantum.
You can just replace the non-pq asymmetric protection with pq asymmetric protection.
All of this is very low risk but anyone wishing to have post quantum encryption probaly wouldn't appreciate three letter agencies having all of the symmetric keys if you ever used the weaker algo versions in a post quantum world.
>You can just replace the non-pq asymmetric protection with pq asymmetric protection.
Would you really feel safe with that?
This completely defeats the purpose and guarantees of E2E encryption, but for some reason, it hasn't seemed to be a priority for them. The article passingly mentions key verification, so hopefully that's changed.
Perhaps it makes more sense if you already know how they operate technically. There's a chance I browsed too quickly and missed the explanation... The article reads a bit confusing with the mixing of (a)symmetric concepts.
https://www.reddit.com/r/tutanota/comments/i3f6j6/stupid_que...
The Revolutionary plan still only offers 3 custom domains. Furthermore, SimpleLogin provides unlimited aliases (custom domain or not) for $4/mo & unlimited custom domains. So SimpleLogin still appears to be more competitively priced overall.
I doubt anyone is blanket decrypting everyone's email just to see what people had for lunch even if it's "only" encrypted with rsa4096...
"Post quantum" or "quantum resistance" are common terms used to describe crypto that is harder to crack by quantum computers. I don't see any snake oil here.
I can't say anything about TutaCrypt's long-term effectiveness except that CRYSTALS-Kyber is touted as being at the forefront of post-quantum cryptography.
Global Risk Institute... found that the majority of cryptography experts it surveyed believe quantum computers, more broadly, will be able to break anything encrypted with RSA-2048 within 24 hours within the next 30 years.
https://www.pcmag.com/news/chinese-researchers-reportedly-cr...
So all that is needed in this case is for potential customers to have the idea in the back of their minds that there might be an issue. The hyperbolic articles about the quantum threat serve that purpose.
So Tuta can be seen to be both a victim and a cause here.
Because they used tutanova.com for their internal corporate use but they also let public users signup for emails @tutanova.com. And no shocker, MS won't let you have public users create MS accounts when a fucking AD org with that domain exists.
They are incompetent.
I get the theory but until there is actually a quantum computer that can break it it would be more helpful to talk about threat-models or operational security. because crypto is hardly what anyone with brains will try to break to steal your memes.
much more worried about terrible security of MIME parsing.
There isn't one yet (at least that the general public knows about), but that doesn't mean we don't need to do anything about it right now. See this problem, for example, which would potentially affect today's encrypted data if it were harvested and saved to storage for the long term: https://en.wikipedia.org/wiki/Harvest_now,_decrypt_later
We already know the algorithm to break RSA with a quantum computer. We just don't have the hardware yet. Nobody knows when the hardware will be available but a lot of entities are working on it.
It's common in cryptography to mitigate attacks that are known but not feasible without further advances in hardware or algorithms. Nobody wants to wait until an attack is successful. That's why NIST is already working on post-quantum cryptography standardization:
https://csrc.nist.gov/projects/post-quantum-cryptography/pos...