Mailfence threat model
We believe that every user has the right to know exactly what threats Mailfence – a secure and private email suite is designed to PROTECT or NOT PROTECT you from. That’s why we’ve composed this generic Mailfence threat model.
‘Mailfence’ will PROTECT YOU against:
- Eavesdropping on your internet connection – When you are using Mailfence, the connection between your computer and the Mailfence server is protected by (SSL/TLS) encryption. That means if someone is eavesdropping on your Internet connection, they will not be able to read the traffic that you send to our website. This is especially important if you are using your computer from a public or office network, or if you are using a wireless connection that is not encrypted.
- Mass surveillance – Perfect for an individual (or corporation) that does NOT want the government (or other non-state actors) to have access to all of their emails at any time. Mailfence does not operate like the gigantic American players (Google, Microsoft, Yahoo…) who continuously scan and archive all of your conversations. Our end-to-end encryption technology (E2EE) is designed to guard you against anyone who is trying to snoop your email privacy by giving absolute confidentiality and integrity to all of your messages – where only a designated recipient can read the content of a message via decrypting it through his/her private key.
- Message Forgery / Tempering Attacks – With digital signatures, ‘Mailfence’ gives you the possibility of having absolute authenticity and non-repudiation – thereby making it the only solution which provides the complete CIA triad to its users and makes it an ideal platform for not only privacy enthusiasts but also for professionals (doctors, engineers, lawyers, journalist, teachers, students…) to exercise their online liberty to the fullest.
- Compromised Account – If your account password gets compromised – the protective layer of passphrase over your private key will restrict an attacker to perform any crypto-activity (send any encrypted and/or digitally signed emails, performing operations on your key store…) and to read any of the encrypted emails that have been sent to you by other people. Thereby preserving the confidentiality and integrity of your encrypted content to the max.
- Data Theft – Let’s say if a strong adversary (state or even a non-state actor) somehow breaches our servers to get hold of our data (which is highly unlikely to happen) – all of your encrypted content will remain intact and no adversary will be able to decrypt it, as it will require your private key that has been protected by your passphrase (which you and only you knows). Also, to reduce the odds of cracking-down a private-key by using heavy-state machinery & resources, the default length of every generated Key-Pair has been set to 4096 bits (being generated with strong entropy) – some folks will say it only provide a bit of extra security comparing to 2048 bits – well, we say that we don’t mind grabbing that extra).
‘Mailfence’ will NOT PROTECT YOU against:
- A compromised device – If your device has been compromised by a malware, keylogger etc (which is not very difficult to perform these days, especially if your adversary is a state actor) then E2EE and other security measures are useless. In fact your adversary can use your account to further spoof your identity and damage your online presence on a large scale. (keep an eye on ‘tips’ in our blog to follow better practices)
- Compromised or forgotten passphrase – This is yet another and unfortunately a common case. If your passphrase has been compromised (let’s say via a malware, keylogger or through the use of bad practices – writing it somewhere, sending it in clear text, ……) or you simply have forgotten it – then you’ll be in serious trouble and we will not be able to help you in anyway, except to urge you to change your passphrase or simply revoke that keypair and use a new one. (see ‘How to‘ for more details)
- A high level Man-in-the-Middle (MITM) attack – High level Man-in-the-Middle attack is a kind of attack where an adversary (typically a state actor) can create a clone of Mailfence in an extremely sophisticated manner (forging our certificate – which is very hard but not impossible, authenticating user’s on false grounds, etc.) and somehow also faking all the services that Mailfence provides in order to fool you into confusing us with them for compromising your data at large. Provided the complexity and difficulty of such an attack – it is often considered as a threat only from high-level adversaries (state actors…). Due to our efforts into getting a CA certificate (having no American company in the chain etc) and providing you with the possibility of verifying our SSL/TLS certificate, we have guarded our defenses to a maximum possible extent.
Now, Mailfence is a state-of-the-art solution which provides (pretty) good privacy and security. We do realize there are users who may have specific adversaries that are focusing enormous resources towards their targets – and that’s where even crypto might not do much as this comic will possibly illustrate.
– Mailfence Team
Arnaud is the co-founder and CEO of Mailfence. He’s been a serial entrepreneur and startup investor since 1994 and launched several pioneering internet companies such as Rendez-vous, IP Netvertising or NetMonitor. He is regarded as the internet advertising pioneer of Belgium. You can follow Arnaud on this blog.