• Allero@lemmy.today
        link
        fedilink
        arrow-up
        1
        ·
        6 months ago

        Because we only know what the client does, and have no clue on the server side of things, allowing Proton to do any manipulations with the data. Not ideal when you consider it for password storage.

          • Allero@lemmy.today
            link
            fedilink
            arrow-up
            1
            ·
            edit-2
            6 months ago

            Because non-obvious backdoors can be added to the client that break or circumvent encryption (looking at you, xz), stealing all of your passwords, and no one will be able to raise the alarm just by looking at the server code.

            Open-source backend allows to generally avoid this situation, while also potentially rendering you able to self-host if you’re paranoid.

            • refalo@programming.dev
              link
              fedilink
              arrow-up
              1
              ·
              6 months ago

              and you can control that

              Sorry, I meant “assuming one has complete control over the client source” where the remote cannot just change it on you.

              • Allero@lemmy.today
                link
                fedilink
                arrow-up
                2
                ·
                edit-2
                6 months ago

                I mean they can make a sneaky update to the client that introduces such changes.

                Sure, if you won’t update your client, this won’t affect you, but would potentially open you up to security vulnerabilities.

                • refalo@programming.dev
                  link
                  fedilink
                  arrow-up
                  2
                  ·
                  edit-2
                  6 months ago

                  This was a real concern with MEGA back in the day (after Kim said you should no longer trust them) and a big reason why I prefer to use standalone client apps that I can control the source of.