▲ 206 points
back
195 comments
Their website describes this as open source but their linked repo is under CC BY-NC-SA 4.0 [1] so not commonly regarded as open source, but instead source available. They have been made aware of this [2]. Additionally, I think it may only be the front-end parts of their apps that are source available, I'm not sure the server-side parts of their app have sources published.
[1] https://creativecommons.org/licenses/by-nc-sa/4.0/ [2] https://github.com/skiff-org/skiff-apps/issues/94
Hello! Yes, we're working on this. Note that our UI, cryptography, and editor libraries are MIT licensed.
Open source does not mean anything in the first place. Terms like Libre or Free Software exist for a reason.
From the white paper, it appears as if this system requires its users to trust the server. That's not end-to-end encryption. What do I have wrong here?
Further, it looks like the email encryption provided by this system only works between users of Skiff. At that point, why use email at all? Why not use a real secure messenger? Instead of building an "encrypted email service", you could literally just build an email-flavored frontend to Matrix; either way, you're proxying to SMTP, not speaking it directly.
Founding engineer at Skiff here.
>From the white paper, it appears as if this system requires its users to trust the server. That's not end-to-end encryption. What do I have wrong here?
It doesn't. All data is encrypted client side across all apps - Skiff Mail, Drive, Pages, and Calendar. For sending external, the whitepaper is very clear how this case is handled in section 8.2 as securely as possible (without having PGP in place. Though this is something we are looking at based on community feedback).
>Further, it looks like the email encryption provided by this system only works between users of Skiff. At that point, why use email at all? Why not use a real secure messenger? Instead of building an "encrypted email service", you could literally just build an email-flavored frontend to Matrix; either way, you're proxying to SMTP, not speaking it directly.
Lots of folks are sick of getting sold their data sold based on their email. Even corporations are sick of largely giving more information about their customers to Google even notoriously Amazon that stopped sending purchase receipts via email.
So even if not end to end encrypted, we do encrypt the emails with the recipient's keys ensuring that only the recipient can access this data. This is a strong privacy guarantee not just backed by a flimsy privacy policy but actual cryptography.
> That's not end-to-end encryption. What do I have wrong here?
Apparently, email may not their main e2ee usecase. The CEO at Skiff wrote this on PrivacyGuides forums:
Our solution for external sharing was not intended for email. It is much more powerful to share E2EE real-time collaborative docs/files with subpages, embedded E2EE files, and so much more.
https://discuss.privacyguides.net/t/skiff-mail-email-provide...
After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in.
ProtonMail does have import/export and the SMTP bridge (for paid users) and those things work but ProtonMail mangles emails: it removes plaintext body where there's a HTML body and it screws with headers.
Ultimately the best option I could come up with was self-hosting my email address. Incoming emails go directly to a box sitting in my office, with TLS enforced.
I put this off for years fearing deliverability issues but finally realised that incoming and outgoing email can be hosted in different places. So though the box in my office receives my email, I send email through either a Hetzner box or Mailgun (with retention disabled). Haven't encountered any issues with this so far.
> After getting fed up with ProtonMail recently I went on a quest to find an alternative. Unfortunately Skiff doesn't have SMTP or even an export feature so once you go Skiff you can't go back, you're locked in.
wow, an e-mail service without smtp nor imap?? no thanks
Do you have a write-up about this? I've been wanting to host my own almost entirely for the extra control over incoming mail and have been held back by the same worries. I'd like to see what a success story looks like.
I could recommend Fastmail with PGP (when it matters). They have good documentation on how to do this [0].
More expensive than self hosting, but still quite cheap, and no weird vendor-specific lockin for the important parts.
The pricing page is confusing to me. It doesn’t mention anything about email in the free tier. It just says:
> Unlimited pages
> Desktop, tablet, and mobile access
> IPFS support
> Full text search
Which seems to be all about the document service, but it also doesn’t mention how much storage I get. I assume it’s not unlimited despite saying “Unlimited pages.”
Also, I can see that Skiff has raised over $14M in VC funds[1], so as a privacy-focused product with a free-tier I think it’s fair to ask what they see as their path to profitability is without compromising either their privacy or their free offering.
1. https://www.crunchbase.com/organization/skiff-402f/company_f...
Are you possibly on a different or old page (or article)? Check out https://skiff.com/pricing and scroll down, it has 20+ features. We have thousands of paid users!
> Skiff has raised over $14M in VC funds, so as a privacy-focused product...
They seemed to have pivoted from web3? https://news.ycombinator.com/item?id=29797691
you're right it is confusing. we're updating it now.
Why not just make a front-end for PGP, have users keys publicly available, and an 'invite others' thing for those with undiscoverable keys.
That would then actually be email rather than not-email-over-smtp.
Another service delegated to trust a 3rd party isn't.
Looked into this, ...it looks interesting.
..Personally, this looks promising. I am going to say it though- Skiff needs some sort of mechanism to use PGP if for nothing else, then to communicate with Protonmail email addresses specifically. I see they are taking the stance its's time to move to something beyond PGP- but given the extremely large userbase that is Protonmail- I think their target market would feel better being able to communicate with their protonmail contacts- using PGP.
Also, i'm having trouble seeing if Skiff has a way to 'send secure emails' to other external email providers, like Tutanota ,Mailbox, and Protonamil do for their users to securely contact people outside their ecosystems(like peeps with gmail). Solve those issues- and the pain/difficulty/unease of convenience will disappear for their market which likely already uses Protonmail/Tutanota, etc. And Skiff would be very attractive at that point, positioning itself as a successor to those two possibly.
This is a system that appears to have long-term identity keys, for which "forward security" or "forward secrecy" appears a total of zero times in its white paper. If this is an improvement on PGP, it's not totally clear to me how. Maybe one of its authors will clear that up.
I definitely agree, we are considering what to do here. I think there is a lot to improve with PGP (https://latacora.micro.blog/2019/07/16/the-pgp-problem.html), but I agree with the problem.
Right now, you can use Skiff Pages for this. You can share public links that have E2EE using link fragments, add passwords, and collaborate in real-time.
openpgp web key directory exists and should work but I don't know if many email providers support or use it
Is the benefit of this over something like Protonmail or Tutanota the enterprise focus products? As an individual user seems like I may as well pocket the difference, right?
Skiff says they encrypt email subjects while protonmail does not. I cannot determine from browsing if they encrypt the sender and receiver addresses.
Skiff's free tier also has a 'generous' free tier with 4 aliases, 10GB of drive (only? combined with email?) storage, and custom domain support (? !)
How has Skiff's email deliverability been?
I'm curious if your emails go to spam more frequently, being a smaller player in an established hegemony.
You have a generous free tier which may attract spammers. How do you deal with IP reputation?
So what's the state of the art with respect to end-to-end email these days? Lavabit is back, but it seems like everyone uses Protonmail these days? But didn't they get into some sort of controversy a while back that made some people drop them?
And now I'm seeing Skiff, which is great, it's clear that people want this. I just no longer know who the players in the space are.
It seem the servers — at least the MX'es — are all US based (less convenient for people in e.g. EU) and without IPv6 connectivity.
Could all new and shiny e2ee mail providers please be interoperable? Ie. use PGP or if you are so unhappy with PGP at least base it on matrix.
The data is still located in the US so honestly for email I would not see the benefit since so much of it will pass through unencrypted on a cloud provider (AWS?).
I personally use mailfence with IMAP on Thunderbird (so its not full E2E encryption despite the marketing) but I much prefer the Belgian privacy law.
Though the mobile/destop apps looks very nice and overall kudos for what seems like a coherent ecosystem (something I miss from my patching of sync.com and mailfence). Also concerned by VC money in that space, hopefully you are profitable. Nobody wants to have to move their life (calendar, drive, emails) because they trusted a startup that ran out of money...
I get "Could not create account. Contact support@skiff.org for support." after entering my password for registering.
On that note: the passwort page for the registration form has terrible UX.
Paste is disabled for the 'Confirm password' field (Chrome, Android) but for not the first 'password' one. Rationale?
I use a decent-length generated password from KeePass.
Being forced to typing this out just plain sucks.
Edit: after reloading the page, paste works also on the 'Confirm password' field. Very strange. Account creation still fails with above error though.
What is the differences between Skiff and ProtonMail?
"privacy first"
Yet the web UI downloads remote images by default.
Granted, it hides your IP address by proxying the request. But it still leaks that the message was read. I used https://www.emailprivacytester.com to test this. No image was fetched until I clicked the email to read it.
I am not sure how the identity management works for encrypted email for Skiff. The white paper[1] seems to imply that a user has to send a URL with a secret in it as with document sharing. Every time? How is the user expected to get this secret URL to their correspondents? Does it require the use of a second messaging system with identity management? PGP for instance?
Generally, how does Skiff allow the user to ensure that the message is being sent to their actual correspondent and not the Skiff server? Signal messenger for instance uses "Safety Numbers" for this purpose.
[1] https://skiff-org.github.io/whitepaper/Skiff_Whitepaper_2023...
The marketing site says there’s full text search. The paper doesn’t cover this. How is this being solved here?
I’ve seen this provider used by bad actors to create accounts on one of the worlds largest social media platforms. That’s how I learned about skiff. Very hard problem to solve.
I like this concept, it's not "open" source though. Apple peeps, it'd be lovely if you could make the Mail app more useful & prettier.
Looks nice. I might give this a try.
I noticed on your home page near the bottom under the "Getting the Latest in Privacy" subheading your list of scrollables begins to duplicate entries if you keep clicking the right arrow after the "Brave Talk X Skiff" panel. From that point on, most of the entries are twinned until you reach the end of the list.
I'm a button clicker. It's a bad habit.
The website doesn't work on Firefox at all. It can't even be scrolled up or down on Firefox mobile or desktop, or any variant of Firefox.
I have been using Skiff for a month now and so far their service has been great. I love their custom domain & alias feature.
Besides, I want my backup email address to be a non-gmail service to avoid complete vendor lock in.
How long is it free for?
From the whitepaper, it seems search is done by downloading all emails on every device to index them locally. Curious how well this works with a large amount of emails?
I just wish they had bothered to integrate PGP, like Protonmail or Mailbox.org do. Right now it's yet another completely insular solution.
I’ve been using it for around a year, it’s good overall, the apps can have some improvements especially desktop one.
In addition to DNS support it also has ENS support…which to me is pretty cool.
The only true email that was worth anything was lavabit pre Snowden.
Will you guys bring "multiplayer" mode like Front?
Honest question. Is PGP not just the way to go?
Skiff is very good so far.
Not downloading a recovery key.
Bye.