Secure messaging update: Threema Web vs. Signal Desktop and ProtonMail

Hey, there are neat new toys to play with! In brief: mobile chat apps are progressing and ProtonMail looks nice for secure email. I put a TL;DR down there for you.

I write about this stuff occasionally.

Threema vs. Signal, again some more

Since my last missive, Threema has released Threema Web for the Android platform…but not yet for iOS or Windows Phone.1 Threema Web promises to offer everything I like about Threema on my phone combined with the convenience of using it on a desktop or laptop computer, where I can type with all 10 fingers. At least I hope so. They haven’t rolled it out for iOS devices yet, and I don’t have an Android device, so I’m not sure. But I’m betting Threema Web continues to allow you to be more anonymous on the internet than Signal, which requires registration with a phone number and allows anyone with Signal and knowledge of your phone number to contact you that way. Threema lets you choose whether to be contactable that way, which I highly appreciate.

Nevertheless, I have started seeing more of my contacts showing up on Signal than in the past. Some of them are undoubtedly using it because of my nagging, but apparently not all of them. For example, I see Airport Liner (our favorite shuttle service from Regensburg to Munich Airport) is using Signal now, too. Probably most people don’t care too much or simply trust WhatsApp not to sell them out to its corporate parent (Facebook), now that WhatsApp offers end-to-end encryption2 based on the same technology as Signal. But I still don’t trust them.

Another thing I liked better about Threema vs. Signal from the beginning was the ability to encrypt short audio clips and send them as messages. Threema’s had that for a long time, but Signal must have gotten it in a recent update (to iOS). That feature is extremely useful when your hands are full or you’re at a stoplight and don’t have time to type out what you could say more quickly.

And of course, Signal does secure phone calls — IIRC, the app grew out of the fusion of a secure audio app (RedPhone) and secure text messaging app (TextSecure). I don’t use it for that very much, but it does work.

Still banging on about secure email

Yeah, I still am. It’s not an easy topic to cover. There are

  • competing standards within standards3,
  • somewhat elegant desktop solutions4, but mostly only clumsy apps on mobile devices
  • inherent weaknesses baked in historically5, and of course
  • the raison d’être for the likes of Gmail, Hotmail, Yahoo! Mail: ad revenue. If their machines can’t read your email, they can’t sell you.

I followed the mailpile project for a couple years, even playing with it at home on a Raspberry Pi or my Linux desktop machines, but it appears to progress only haltingly at best, felt clunky to use, and presumes that you (eventually, when they perfect their product) want your mail to be on your local devices only — like a RasPi or a memory stick you keep on your keychain. That’s not really what I want; I want mail on a server somewhere6 that is only readable for the intended recipients.

They’re really playing up the Swissness.

Then internet pal Harvey Morrell called my attention to ProtonMail. This could be a game-changer. You get:

  • public key encryption7
  • a smooth webmail experience in the desktop
  • iOS and Android apps
  • free, paid, and paid-a-lot tiers of service


I was pretty skeptical at first. Webmail can’t be as secure as an offline private key, because the webserver has to have your private key in order to decrypt messages intended only for you, thus defeating the purpose, right?

That’s true…unless there is another layer of encryption on top of that private key preventing its misuse. Wikipedia explains it: yes, the server behind ProtonMail has the private key needed to decrypt messages encrypted for you, but that private key is symmetrically8 encrypted with your login password, and decrypted on the brower-side to display secured message content only in the browser. So: ProtonMail cannot use your private key (even though it lives on their servers) because your login password prevents that. It’s the first web-based email service with public key encrpytion that sounds promising to me, because it actively promotes its inability to decrypt your email upon demand (of anyone — not even you).

Automatic encryption for ProtonMail users, Optional for everyone else

When you send a message from ProtonMail to another ProtonMail user, it’s encrypted for the recipient automatically. Super-duper easy. But what about sending a message securely to someone who is not a ProtonMail user? You can send a conventional plain-text message if you want. But you can also symmetrically encrypt the message for the recipient by providing a password. Then ProtonMail sends the recipient only a link to retrieve the message, and the recipient enters the symmetrical password then. Keeping that symmetrical password secure is up to you! 9

Composing a message for a non-ProtonMail recipient
Pick a password, confirm it, give a hint if you like.
Here is what a non-ProtonMail recipient sees when you send an encrypted message.

Another nice feature, particularly to help wean you off of your current email provider, is that you can ask ProtonMail to send you a daily reminder at your non-ProtonMail address if there are unread messages in your ProtonMail inbox. Slick!

More to come?

ProtonMail still has a way to go. It does not yet support the full functionality of PGP the way GPGMail or Enigmail does: only in-line PGP works for incoming encrypted messages from outside ProtonMail. This means: if you want to send me “ProtonMail sounds promising!” as an encrypted message at my protonmail.com address, you have to encrypt it using my public key (ask me, I’ll give it to you) and send me an email with this text as its body:

Suggest some products to me based on that, Gmail!

That’s in-line PGP, and it’s probably fine for text messages. All the email programs that support PGP do this kind of en- and decryption for you automatically.

Recipient sees the clear text without any extra effort.

But it gets clunky when a message has more than one part to be encrypted. This is common when there is a plain-text version of the email message and a fancy HTML version of the email message wrapped up in one email, or any attachments. PGP/MIME is clearly the right way to go for that use case, but ProtonMail does not support it yet — at least not for in-bound messages.

It also does not yet support storing and using the public keys of non-ProtonMail users. This means you can’t send an encrypted email to someone who is not a ProtonMail user. At most, you can notify them that an encrypted message is waiting to be retrieved (see above). I wonder if that will ever change; it would be convenient for users already comfortable with the likes of PGP, but it could discourage their free customers from ever coughing up for a paid tier of service. I suppose that’s a feature they could include on the paid tier: paying customers are already paying and don’t need further motivation to use the service.

TL;DR

Whether you

  • need secure private messaging for political or journalistic reasons,
  • are merely trying to not to be the product big internet companies sell to their advertisers, or
  • just like the technology,

try Threema and Signal and their desktop app options for chatting, and consider ProtonMail for securing your email messaging. The techiest among us will get by just fine with PGP encryption layered on top of conventional electronic messaging, but maybe these apps are a lower barrier to entry for friends, family, and colleagues who care about the principles but can’t invest in the learning curve associated with old-school public key encryption.

  1. Haha, “who cares, right?” I fear that some day my employer will force one on me. They’re so cheap and apparently work just fine for things like email and calendaring — the things the company wants you to be doing on their devices. []
  2. of content, but not metadata! []
  3. in-line PGP or PGP/MIME? []
  4. kudos to GPGMail for Apple Mail and the venerable Enigmail for Thunderbird extensions []
  5. encrypt the body of the message however you like, but the headers will remain plain as day []
  6. My server or someone else’s? Either option is OK for me. []
  7. à la PGP []
  8. this means one password does both encryption and decryption. Public key encryption is asymmetrical, using the recipient’s public key to “lock” a message for the recipient and the recipient’s private key to “unlock” it. []
  9. Consider sending it through Signal or Threema. []

Orzo Asparagus Salad

Spargelsaison is fun, but it can be a little one-note if you don’t have a variety of preparations for the stuff. If you’re lucky enough to have grilling weather while the asparagus is as its peak, this is a fantastic way to serve it alongside burgers or sausages. I found the original here and have posted my version below.

1 tablespoon olive oil
2 shallots, minced
2 cloves garlic, minced
250 g orzo pasta
at least 500 g green asparagus, cut into bite-sized pieces
about 300 g artichoke hearts, drained and quartered
1-1/2 cups sun-dried tomatoes in olive oil, julienned
1 lemon, zested and juiced
1/4 cup sherry vinegar
1/2 teaspoon kosher salt
1/2 teaspoon fresh ground black pepper
1/3 cup olive oil

In a small skillet, heat olive oil to medium. Add shallot and garlic and cook until tender and fragrant. Set aside.

Cook orzo in salted water for 1 minute less than package directs. Add asparagus to orzo for last 2 minutes of cook time but no more! You want the asparagus to be bright green and still a little crispy when you drain the pasta. After draining the orzo and asparagus, run cold water over it immediately, agitating it frequently to make sure there are no pockets of heat. After draining and cooling, pour orzo and asparagus into a large salad bowl. Add artichokes and tomatoes to orzo bowl.

Remove shallot & garlic to a small deep bowl. Add lemon zest and juice, vinegar, salt and pepper to bowl. While whisking, drizzle in olive oil. Pour dressing over salad, stir thoroughly, cover and refrigerate for at least two hours. Stir again before serving.

Buongiorno Aosta, Ça va? Alles klar?

Mid-May 2017 we bugged out for (wait for it…) Italy again. But only just barely, kinda.

We started the trip out with a visit to Berlin to spend some time with our pal Snooker; that was in the works long before work stuff started amping up for me. So when it became clear that I needed a distraction from work stuff, we lumped a 6-day trip onto our 4-day weekend in Berlin with one stop overnight in our own place on the way from Berlin down and over to Aosta, Italy.

We clocked over 2500 KMs on our car — the biggest single trip yet. Spending all that time in the car, we needed some audio distraction. The audio in it is laughably poor, due to crummy factory speakers (and not enough of them) and some wacky AUX input wiring issues, so about a year ago we bought an Anker bluetooth speaker1 for use in the car. It’s got a great battery life and connects easily to either of our phones. It’s loud and clear enough for podcasts or audiobooks over the road and wind and engine noise of our car. It’s a little less well-suited for enjoying music while driving, to be sure, but for spoken audio, we’re quite happy with it.

Regensburg to Berlin and Back

We’ve done this drive a couple times. We got a hotel room at Motel One An der Urania which was nicely-located. A little expensive to park for four days, but better than most of the other options. It was a pretty easy walk over to Nollendorfplatz for breakfast at Café Berio twice.

Liechtenstein

Instead of a 7+ hour drive from Berlin to our digs in Liechtenstein, we opted for a 5 hour drive, change of laundry, and a night in our own bed before pressing on with a 3 hour drive the next morning to a ski resort in the hills above Vaduz, Liechtenstein.

Switzerland and Austria have a good racket going down there with the border crossing into/out of Germany near Lindau. You’ll be on three countries’ roads, which could very well mean you need a Vignette for Austria and Switzerland. We knew we’d need one for Switzerland for sure (about 40 CHF, valid for all of 2017), but weren’t 100% sure about Austria, so we coughed up the 8€ for a 10-day Austrian Vignette, too.

Part of the reason for a stay in Liechtenstein was that it was kind of on the way, but we also just wanted to experience a new country. Our list of unvisited European countries is growing ever-smaller. 2

Liechtenstein was pretty. And pretty small. I got the impression the Royal Oak post office is a bigger building than the seat of the government for the whole country of Liechtenstein. We strolled around Vaduz looking for a place for dinner on a Monday night — just about everything was closed. A single-person pizza and a beer ran about 30 CHF.

Oh, speaking of Swiss Francs: as we were walking down the mountain roads and catching the bus, we realized we had Euros in usable denominations, but only one 100 CHF bill. When the bus picked us up, I asked the driver if we could pay in Euros. He was reluctant; probably tired of Eurozone tourists forgetting that Liechtenstein uses the Swiss Franc. I asked if he’d prefer to break our 100 CHF bill, and that was A-OK with him. We ended up buying two all-day adult Bus Liechtenstein passes for about 10 CHF a piece. For some of the routes on the bus system there, during certain times of the year, you officially have to call ahead a reserve your transit. When we asked the driver about that he said “yeah, normally, but now I know and I’ll watch for you downtown and make sure you get back up the mountain.” Phone numbers for that are posted on the bus schedules at the stops. I shudder to think what a taxi ride up the mountain after our dinner would have costed.

Aosta Valley

There are a lot of names for this place:

  • Valle d’Aosta (Italian)
  • Vallée d’Aoste (French)
  • Val d’Oûta (Francoprovençal)
  • Augschtalann or Ougstalland (Walser German)

Whatever you call it, it was a new part of Italy for us to discover.

Altstadt

We stayed just outside the Altstadt at B&B Mu — and our hosts were delightful. We highly recommend them. We enjoyed walking around the city. Like Regensburg, it’s a couple thousand years old, with a Roman fortress at its core, and plenty of architecture left over from that era.

We also took a few trips around the region in our car and via train.

Gaby and Gressoney-Saint-Jean

B&B Mu left us a pamphlet of castles you can visit in the region. We headed up to Gressoney-Saint-Jean to see Castel Savoia. On the way, we drove through a gorgeous little town called Gaby. We would have eaten lunch there, but it was Wednesday, and apparently the town shuts down on Wednesdays. A little bit further up the road, a small sandwich board at a hillside hotel caught my eye, and we pulled in for a fantastic, very generous prix fixe lunch at Hotel Fiordiroccia.

That was all just drive-by chance on our way to Savoy Castle, a summer residence of Queen Margherita. Upon arrival, we took a tour of the interior of the castle. It would have been a great value, but it was only in Italian, and ours is not up to snuff for architecture, dynastic heraldry, or late nineteenth century royal family politics.

Turin’s Museum dell’Automobile

On one of the predicted-to-be-rainier days, we took a two-hour train ride to Turin3 to visit the automobile museum there. We didn’t have any expectations going in really, but I was quite impressed with the layout and interactivity of the museum exhibits — despite the PREGO NON TOCARE everywhere (it is a museum and they were priceless antiques after all). There was a good selection of early European and Golden Age North American car models there. But the clear focus was on FIAT-affiliated designs and designers.

It was more like a Pininfarina museum than anything.

Arrivederci

Some closing thoughts:

  • Good weather for nice views made all the difference on the way there and around the region
  • We didn’t seek anything else out in Turin but the car museum — and what we saw of that part of the city was not impressive
  • Really gotta get one of those VHS Italian or French for tourists classes in — we had no language problems, but it felt like we were causing so much extra effort on everyone else
  • We generally ate well, but the food situation in Aosta felt a little weird: there were elements of Tuscan or Neapolitan cuisine in there, but plenty of local alpine touches, making it regionally distinct
  1. I bought it from amazon.de, but I can’t recommend that in good conscience anymore until they stop funding breitbart.com with ad revenue. []
  2. Look out, Andorra and San Marino and Scandinavia — you could be next! []
  3. changing trains in Ivrea []

Bridge Work Still in Progress

For the first time in a while, we took a stroll back to the old neighborhood for the Maidult festival running there for a few days yet. You can count on the Dult, in May or in the Fall, to provide plenty of good people watching. It’s like an American amusement park in that regard — it takes all kinds and all kinds do show up for the beer tents, rickety rides, carnival games, and odd specialty goods for sale.

We were there with some of my work peeps whom I don’t see much anymore.

You can see that the middle of the bridge is still covered up in a tenty, shed-like thing. We haven’t heard any news about progress, or the lack thereof. Have you?

Then again, maybe it doesn’t matter much, especially if you’re one of the people enjoying a warm evening with friends on the bank.

A Long Weekend in Liège and Maastricht

We needed to get the heck outta Dodge. Well, I did. With no travel from Mallorca until last weekend, it felt like we hadn’t been anywhere in ages. Don’t get us wrong, we’re enjoying the new place. But a whole lot of work intensity and no change of scenery to break it up made for a very real need to escape for a bit.

So here’s what we did: Continue reading A Long Weekend in Liège and Maastricht

Recap: November to Yesterday

Time is flying.

Dang. Not yet a quarter into it, and this year is flying by already. After our inconvenient-but-still-lovely Mallorcan long weekend last year, we returned to Regensburg to get to work on our new digs. We’ve learned a lot about wiring and installing ceiling lamps, and options for furniture, and some life lessons about paint contractors.1

Let’s see, what’s been going on? Continue reading Recap: November to Yesterday

  1. Hint: when they tell you to buy paint, get their estimate IN WRITING. Anyone need some teal or lavender paint? []