Source
r/ctemplar•
cryptoraptor

[PSA] 2022 Updated Roadmap

Hello everyone!

Unfortunately, one of our main developers fell ill and we had to push back some roadmap goals. As we are hiring new people, we can't provide good estimates to what we are working on.

Here is an updated roadmap:

  • Under research:

    • 2FA Options (FIDO, U2F & Yubikey)
    • pretty Easy privacy (p≡p or pEp)
    • Web Key Directory (WKD)

  • In progress:

    • Additional Translations Options - Russian, Turkish, Spanish, French, German, Japanese, Chinese, Portuguese, Ukrainian, Italian, Polish, Korean, Dutch, Hindi, Greek, Arabic, Indonesian, Malaysian
    • AnonAddy support
    • API optimizations
    • Business and Multiuser Accounts
    • CalDAV and CardDAV
    • Email Backup (import/export)
    • Encoding issues with foreign languages
    • IMAP/SMTP (Sub-accounts)

To clear up any end-to-end encryption misconception:

We can only guarantee end-to-end encryption in our servers, in other words, when the messages are sent between CTemplar webmail users, as the emails never leave our servers. This is easily seen in the compose menu when entering an email address, if you see a white/grey padlock, it's end-to-end encrypted.

If you want to send an encrypted message to your friend outside CTemplar, you need to have your friend's public key OR purchase a paid plan to send a password-protected message.

When you send a PGP-secured message, the padlock beside the contact email will be green. Otherwise, CTemplar will use Autocrypt, if enabled.

If in doubt, just hover over the padlock symbol, it will clarify what it means.

The IMAP sub-accounts are linked to a main CTemplar account, but are exclusively used for IMAP. The messages sent via webmail, between CTemplar users, will only be accessible via the webmail, as they are end-to-end encrypted in the server.

IMAP is not safe by default. That is why you need to encrypt your messages before sending them with an OpenPGP solution.

IMAP Encryption & Decryption:

  • To all received IMAP messages, encryption is automatically applied.
  • To send an encrypted IMAP message, users will need to have the recipients' public key to use OpenPGP and encrypt the message on their preferred email software (for instance, Thunderbird).

Also, we have heard your opinions regarding the iOS app, so we have decided to rebuild it from scratch. We do not have an estimated date, but we will keep you updated.

Some of our users pointed out the lack of IPv6 support and issues on our Content Security Policy (CSP).

  • Regarding the IPv6, we need to wait for our hosting provider to support it.

  • Our CSP needs to be permissive to allow the Angular functions to load properly. We periodically review it to ensure your data is safe and secure.

  • We have achieved a perfect grade on both Hardenize and SSL Labs.

  • We have hit 2,1k followers on Reddit and a little over 3k on Twitter.

A huge thank you to everyone that is supporting us! Without you, this would not be possible!

Posted Jan 12, 2022, 12:43 PM UTC

2822
HattoriHansou•

Recently, Ctemplar is mentioned on Techlore. This is the first time Ctemplar got some spotlight on a mainstream privacy focused forum.

Well done!

https://youtu.be/3QjBDehTyiw

4
primipare•

And in 2nd place ! Wow. Didn't expect ctemplar to come under the spotlight this soon. Interesting that they land ahead of tutanota. I am a TN user but not a fan. Still, I don't think this is earned, yet. TN are a bunch of (very nice and friendly) techies with no sense of aestetics whatsoever (so many times I have told them this) but I believe they are a more reliable service than ctemplar, today.

An iffy ranking which really only is interesting in the that ctemplar is mentioned and so highly rated.

Thanks for the link

1
DiligentGarbage•

I would debate that CTemplar is more secure than Tutanota. Tutanota only allows encryption via E2EE from other tutanota users as well as password protected emails (which I have never gotten anyone to use.) Tutanota lacks PGP encryption and this is by design, they specifically do not plan on implementing it, basically saying that "PGP is flawed, and thus no privacy is better than some privacy." Literally their argument is PGP is flawed, and thus it's not worth implementing because E2EE and Password-Protected Emails are better. And that would be great if most people used Tutanota (I don't know anyone who does and have never seen a Tutanota email online, but have seen many ProtonMail emails and even some CTemplar ones popping up now.) or if people were willing to go through the hassle of viewing password-protected emails (which again, I've never met anyone who is.) I have on the other hand met many individuals who are fine using PGP.

So while I agree Tutanota is more reliable as far as uptime goes (for now) I would debate CTemplar is more secure. Also, Germany seems to be getting less and less privacy-friendly as a jurisdiction.

1
primipare•

I do think TN are making a mistake by prioritising perfection over ease-of-use. They even replied to a post I wrote saying that yes, they do have to re-invent the wheel. That's bonkers and one of the reasons I believe their main problem is leadership and the ability to run a business. They are in a techi bubble and feel at home there. Echo chamber. I've been using them for many many years but don't bank on them and really on the look-out for a more sensible service - one respecting privacy and secure enough towards 99% of user cases. I wish they were ok to let go of that 1%....

Of all I have seen so far, I rate ctemplar as having the biggest potential.

2
Fast_Grab•

I have 2 questions.

The easy one: What does "AnonAddy support" mean?

The hard one: Can you clarify what "autocrypt" is? I'm under the impression that it means if we send an email to a non-CTemplar user, you'll automatically scan known key databases to see if they have a public key and use it if available. Is that correct, or am I misunderstanding this?

1
Brilliant-March-9234•

In regards to Anonaddy, here is the problem as explained on their GitHub page:

“Expected behavior

CTemplar properly selects correct alias to reply to AnonAddy email. CTemplar properly threads AnonAddy Emails.

Actual behavior

CTemplar does not properly select correct alias to reply to AnonAddy email. CTemplar does not properly thread AnonAddy Emails.”

As to autocrypt, your understanding appears to be correct.

1
Fast_Grab•

So for the AnonAddy one, it basically doesn't respond to the alias correctly?

1
cryptoraptorOP•

The easy one: What does "AnonAddy support" mean?

Some of our users wish to use the https://anonaddy.com/ services. However, they are receiving illegible emails or are unable to properly reply to them.

The hard one: Can you clarify what "autocrypt" is? I'm under the impression that it means if we send an email to a non-CTemplar user, you'll automatically scan known key databases to see if they have a public key and use it if available.

Autocrypt works differently from WKD, which is what you mention by ("(...) automatically scan known key databases to see if they have a public key and use it if available") We have a blog post about it.

Wikipedia also explains this: Autocrypt-capable email clients transparently negotiate encryption capabilities and preferences and exchange keys between users alongside sending regular emails. (...) When a message is encrypted to a group of receivers, keys are also automatically sent to all receivers in this group. This ensures that a reply to a message can be encrypted without any further complications or work by the user.

1
Fast_Grab•

So regarding the autocrypt one: the end result is the same, just a different method of getting there? Am I understanding that right?

1
cryptoraptorOP•

This blog post explains it quite well:

https://lefherz.net/2019/08/23/autocrypt-how-to-allow-automated-encryption-in-thunderbird-enigmail/

If you use Autocrypt, every mail carries an extra header, an invisible part in your mail. It contains your public key, so the recipients can encrypt to you; and it also can contain a setting called “prefer-encrypt: mutual”, which tells others whether you even want encrypted mails.

If they also use Autocrypt, their mail program automatically extracts your public key from your mail header. And if you have switched on “prefer-encrypt: mutual”, or “allow automated encryption”, as I call it, they will encrypt to you from now on.

If it’s turned off, the keys still get exchanged. But most Autocrypt-capable mail programs will write unencrypted mails to you, because the “prefer-encrypt: mutual” is missing in the header. This is by design; Valodim wrote a great blogpost about why Autocrypt made this design decision.

TLDR: In essence, Autocrypt is just transparent way of parties sharing PGP keys, if they have one. Your first message will always be unencrypted until the keys of the other party are known. Autocrypt won't query any online database for those keys, as they are shared through the message header.

1
Fast_Grab•

Gotcha. Thanks for taking the time to explain. I appreciate it.

1
Brilliant-March-9234•

What is the progress on issue “PGP/MIME: Encrypt, Decrypt, Sign, Share Keys #1206,” being able to send and receive messages following multiple standards? Also, great job on recognizing the need to rebuild the iOS app - it is much needed! When you get to the point of beta testing the new app, I would be more than happy to help. Thanks for your work and a great product.

1
cryptoraptorOP•

What is the progress on issue “PGP/MIME: Encrypt, Decrypt, Sign, Share Keys #1206,” being able to send and receive messages following multiple standards?

It is a complex issue and it will take us a few weeks (at best) to fix and test before publishing.

When you get to the point of beta testing the new app, I would be more than happy to help.

Certainly! Kindly PM me or send an email to [email protected] with your email address, so we can add you to the TestFlight wait-list!

1
Brilliant-March-9234•

PM’D

1
PolGZ•

Is there a way to contribute with those translations?

1
cryptoraptorOP•

Hello! Certainly!

We have our translations stored here: https://github.com/CTemplar/webclient/tree/dev/src/assets/i18n

If you intend to add a language that is not there yet, please copy the contents of an existing language and send us the new file, either through here or make an issue with it attached on GitHub.

Language name format: https://src.chromium.org/viewvc/chrome/trunk/src/third_party/cld/languages/internal/languages.cc

Example: Let's say you want to translate from English to Japanese, you'd copy the contents of en.json and you'd create the file ja.json in your computer. After translating the strings, you'd upload the ja.json file to a GitHub Issue or contact us through social media.

Let us know if you have any doubts!

Thanks for wanting to contribute!

1
[deleted]•

hey, I'd like to contribute languages that are not on the roadmap. I haven't done this before so it'll take time. I'm hoping to contribute 1 - 4 (or more) languages if that is okay.

1
cryptoraptorOPCTemplar Dev Team•

Certainly! What languages are you planning to bring?

1
[deleted]•

Malayalam. It's an Indian Language; that's the first one that I'm trying to contribute. As i said i haven't done this before so it's gonna take a lot of time and i'm just doing this as a time-pass activity. So no promises.

1
blzart•

Please do something with filtering spam... My email became unusable with ton of junk came to my inbox.

1
cryptoraptorOPMODCTemplar Dev Team•

Kindly send us a message to [email protected] and someone will take a look at your issue.

Thank you!

1