ProtonMail, a secure email service, is launching an encrypted contacts manager today for its users. The manager provides "zero access" to contacts, ProtonMail says, meaning the company can't view what users have saved. It also features a digital signature that should prevent anyone from compromising or tampering with contact details.
ProtonMail says attackers could compromise a user's communications by editing a contact's email address or phone number without that user realizing. The verified signature prevents against this by requiring a private key to make edits. This key is also integral to the company's method for securing contacts in general. Every email account has a unique private and public key pair of contacts. That private key comes from a form of each user's password, which the company doesn't know. Then, the encrypted contact fields are encrypted with each user's public key, meaning it can only be decrypted with the corresponding private key. The two keys work in tandem.
The verification looks like this:
This contact storing strategy differs from Apple and Google, which can access contacts stored in the cloud. ProtonMail says it designed the feature for journalists who want to protect their sources.
ProtonMail says attackers could compromise a user's communications by editing a contact's email address or phone number without that user realizing. The verified signature prevents against this by requiring a private key to make edits. This key is also integral to the company's method for securing contacts in general. Every email account has a unique private and public key pair of contacts. That private key comes from a form of each user's password, which the company doesn't know. Then, the encrypted contact fields are encrypted with each user's public key, meaning it can only be decrypted with the corresponding private key. The two keys work in tandem.
The verification looks like this:
This contact storing strategy differs from Apple and Google, which can access contacts stored in the cloud. ProtonMail says it designed the feature for journalists who want to protect their sources.