Countermail - protecting your privacy?

Due to some media coverage lately, I got curious and had to take a look at the Swedish service Countermail. It seems to go far and beyond services like hushmail in order to protect your privacy, at least that's my impression from their service description. Not that I have a habit of trusting marketing talk of course, but they do have some pretty tough claims at their site.

Now I do like to look for logical errors, mistakes etc., but I am not a pentester anymore. I'll leave Backtrack and that sort of stuff to the younger generation. :-) So here are just a few simple comments on their service offerings, after playing around for an hour or so:

1. Registration

I wanted to set up a demo account. I always try setting a or 1 (digit one) as my password, to see what kind of response I get. From a security usability perspective it amazes me why most services does NOT display the password requirements BEFORE asking me to set up a password for my account. Either I will get the requirements as soon as I fail them once, or the even more frustrating sites will only reveal the full set of requirements after multiple attempts.

With Countermail I got this response when trying the letter a as my password:

Aha. Maximum length is 128. Good! Uhhhh. But what about complexity requirements? Anything there?
NO. aaaaaaa or 1111111 is accepted as passwords. Hm. Well, moving on to entropy collection:


2. OpenPGP key generation and... centralized storage.

Countermail creates OpenPGP 2048bit keys, according to their website. You can choose your own username instead of using an e-mail address, making it easier to hide your username, reducing the risk of online bruteforce attacks to your account. The setup process of a new (demo) account is pretty quick and easy, I'll give them that.

But... where are my keys? They must be stored somewhere? How are they protected? Ah. they are stored at the Countermail servers by default. Lets back to that later on, but first: SSL security.

I tend to run all https sites I use through www.ssllabs.com, for first impressions. Here are the results for Countermail:

Not the worst I've seen, neither is it among the best I've seen. Even better reason for asking "let me have my keys please!".

3. See, distribute and download your keys

I searched their FAQ, and found this:

Excellent, lets head into the settings and do exactly that. Curious & paranoid at the same time. :-)

First, an option for showing my private key is available. Or not, unless to pay for it:

We'll see about that, since the FAQ says I can download my private key. Fear nothing, click "Delete Privkey", and lets see what happens:

Warning message. Good. Lets proceed:

Reauthenticate. Good. Very smart in order to make MitM attacks just a little bit harder. And VOILA, I got myself a nice little download. Just to "confirm" (you'll have to trust them here...):

Private key deleted from the Countermail server. Sweet. You will not display it to me when I've got a demo account, but you will let me download it and delete it from your server. Here are parts of the downloaded file:

I'm not going to be to sarcastic here, but a bit of logical testing has been forgotten at Countermail. Not that it is much of a problem anyway in this case. Another little feature that I do like about Countermail is that they have implemented RFC3207 (STARTTLS support for SMTP). Here's proof, slightly censored:

ESMTP/TLS/ADH-AES256-SHA. Good. :-)

What surprises me about Countermail is their relaxed password policy. Minimum length 7 with no complexity requirements is NOT what I would expect from a service that is all about protecting security & privacy of their users. Even though users of Countermail may just be a little bit over average in terms of paranoia, I wouldn't be surprised if there are users with aaaaaaa or 1234567 as their password. At least I did, until just before I finished this sentence. Oh; and I can't find any info on HOW they store my password.

My private key has been deleted. When I log in, go to settings and click to change my password, I must enter my old as well as my new password (good), and then I'm asked automatically where to store my private key locally.

Although way above what most mail providers has to offer, there still are a few glitches easily visible in Countermail as of may 2012. I would say that recommended - and perhaps extensive - testing, like I would hope for for such a service, should have uncovered and fixed these issues.