The UK’s Investigatory Powers Act has way too much power. By forcing Apple to remove its encryption for UK users, it threatens the #privacy of everyone.
We at Tuta would never build a backdoor - and our #opensource code is proof of that.
👉 https://tuta.com/blog/uk-demands-apple-backdoor-encryption
@Tutanota@mastodon.social Just like Linus (LTT) said, Apple could have just stopped working in UK territory, people would fight back against UK’s government, pushing them to revert back the law and get Apple back. But Apple has no backbone and cares only about money, unlike Tuta.
#Apple #Tuta #Privacy
@Tutanota@mastodon.social But only your client is open source? You actually haven’t (to my knowledge) shared how your server side works, which could aswell have a backdoor, lol.
And also how do we know the actual server side is the same as what is published?
I’m not particularly moaning about tuta. I’m just saying publishing code is not the same as asserting it is what is running.
@rzeta0 @Tutanota Tuta is great, I use Tuta, but they constantly make the claim about being part of the #opensource community, but the only part of Tuta that is actually open source is their client-side. What people actually need, server-side is not open source. Self-host capability is one of the most important parts of open source and Tuta didn’t get that right.
@sirobsidian @rzeta0 @Tutanota Isn’t that the status quo? Are Proton’s, Threema’s or Signal’s server code open-source?
@tizmic @sirobsidian @Tutanota
Indeed.
And as I said above, it is not easy to verify that what is published as server side code is actually what is running.
@rzeta0 @tizmic @sirobsidian That is exactly the point. No one could proof that the open sourced code would actually be running when you access Tuta… Nevertheless, we plan to enable you to self-host Tuta Mail, and for this, open sourcing the server code will make sense. This will be a small server, which can run locally.
Note, all the encryption takes place locally on your device (end-to-end encryption) so our servers don’t see your encrypted emails and can’t read your data.
@Tutanota@mastodon.social @rzeta0@mastodon.social @tizmic@mastodon.social @sirobsidian@fosstodon.org what way do clients have to validate the client code does not differ from what is published? This is even more important for web based clients, since your servers can serve whatever they want to whatever client/ip/user makes the request.
@Tutanota@mastodon.social I don’t know what to expect from a mentality which has made eugenics Liberal in order to choose the genes according to fashion after having fought the Nazis, signed the death warrant of physical money to hide poverty and take advantage of the commission on the slightest micro-transaction, authorized the marketing of printable synthetic meat to feed the beggars while a capricious crown head are presented every morning with a 100 eggs to draw two whose cooking would be suitable?!
@Tutanota@mastodon.social Will we see the #Tuta server-side open source anytime soon?
@Seldon@fosstodon.org This is not planned right now. No one could proof that the open sourced code would actually be running when you access Tuta… Nevertheless, we plan to enable you to self-host Tuta Mail, and for this, open sourcing the server code will make sense. This will be a small server, which can run locally.
Note, all the encryption takes place locally on your device (end-to-end encryption) so our servers don’t see your encrypted emails and can’t read your data.
@Tutanota@mastodon.social
This! Please release a self hostable version of your server code. This would be a massive win for the #selfhosted community.
@Seldon@fosstodon.org
@Tutanota@mastodon.social what would you do if the UK made the same backdoor request of you? I presume you’d geoblock the UK?
@otfrom@functional.cafe We haven’t seen the order so it’s hard to say. However, what we can say is that German data protection legislation is pretty strict and could very well be in conflict with the UK order, which would have helped us. In any case, we will never undermine the end-to-end encryption offered in Tuta, and this is proven by our open source code.
@Tutanota@mastodon.social that sounds like the preference would be to cut off UK customers (which is fine, but I’d need to factor that into my threat model)
@Tutanota@mastodon.social Where do you publish your warrant canary? This seems crucial in your position. https://en.m.wikipedia.org/wiki/Warrant_canary
@levigroker@mastodon.social Hi there! you can find it at the end of this:
 of everyone.](https://fedia.io/media/a8/14/a81405135ec7c98d886f350290b975c83e2a84f66df3ec104e81804e6b31560c.png){kind=link}