Hi there, We have done a lot of work to improve our services over the past few months to meet the requirements laid out to be listed on privacyguides for Email Services. We believe we have resolved the previous criticisms laid out in Github Issue #1363. However for reference, I have explicitly laid…

So looks like the major things have been fixed: I was able to export a whole folder of emails not one by one. A zip file was produced with all the .eml messages. Using recovery email only for recovery only seems to also be resolved for new accounts so that looks good. It does not appear tha…

I think you are missing the point of auditing. Auditors look at far more than just a codebase. They look at secrets management, infrastructure, software design process, employee security practices, and more. “Developed in the open” is not that. Security engineers would never advise someone to use un…

As a total outsider to this discussion, both (a) asking for claimed open-source development to be open-source and (b) asking for audits to be published seem totally fair to me.

[image] Andrew Milich: I think you are missing the point of auditing. Auditors look at far more than just a codebase. They look at secrets management, infrastructure, software design process, employee security practices, and more. It depends on the scope of the audit commissioned, this is wha…

The product is open-source, but we do not open-source in development features. We publish on major releases, which is consistent with products like Signal (recommended). Did you realize that Tuta and Proton do not publish audits? They have published some attestations, but Trail of Bits (our auditor…

It’s strange to have such common practices treated with such skepticism. Given the CTO of Signal is an advisor of our’s, and the CEO of Trail of Bits is as well, of course we would rely on the best practices set by those organizations, which are the top in their respective domains. @dngray if it is…

[image] Andrew Milich: The product is open-source, but we do not open-source in development features. We publish on major releases, which is consistent with products like Signal (recommended). Okay, so that’s going to become a regular thing now? [image] Andrew Milich: Did you realize tha…

Meant to post from my public acct: What do you mean claiming? You can see it publicly on the Trail of Bits website, multiple times. Dan also tweeted about us here - https://twitter.com/dguido/status/1498403981978124299 . We’re working on more but TOB does not do attestations. Why not link to the TO…

I understand how important this information is and am glad it’s getting covered. A lot of the frustration is that many years of work goes into preparing for even submitting to PrivacyGuides, which I would regard as having some of the highest criteria in this space.

[image] Andrew Milich: What do you mean claiming? Not anything bad. [image] Andrew Milich: You can see it publicly on the Trail of Bits website, multiple times. Dan also tweeted about us here - https://twitter.com/dguido/status/1498403981978124299 . We’re working on more but TOB does not …

I totally understand - this is a great example of a direction we should be going in. FYI, Skiff is much younger (Proton will turn 10 this year, and Skiff 3). We only started the discussion when we were confident that our products stand the test of the criteria and guide.

Privacy Guides Community

Skiff Mail (Email Provider)

Site Development Tool Suggestions

Topic		Replies	Views
Skiff Mail Tool Suggestions invalid	6	2668	May 9, 2025
Skiff Mail supports OpenPGP Site Development completed	2	389	January 15, 2024
This Week in Privacy #8 Articles	0	808	February 11, 2024
Remove Skiff Tool Suggestions completed	82	8944	February 10, 2024
Skiff adds PGP as beta feature General	37	2124	January 27, 2024