ScryptMail

» see scryptmail.com as it lived, on the wayback machine

~ the eulogy ~

ScryptMail announced itself on 17 November 2014, in a forum thread, with a number. Five hundred brand new mailboxes were available and registrations would stay open until Tuesday. The person posting was Sergei Krutov, a data protection consultant in Spokane, Washington, writing under the account name of his own product and answering questions in the thread himself. Firefox support arrived three days later because somebody asked for it.

What it offered was a position rather than a feature list. Mail was encrypted at rest with AES-256 and the metadata was encrypted too, which was the distinguishing claim: most providers who promised encryption left the headers legible. You could send a PIN-protected message to somebody who had no account. There was two-factor authentication and a webmail mirror reachable over Tor. The free tier ran to 300 MB, and instead of a subscription you topped up a balance with PayPal or Bitcoin and spent it on individual capabilities like a custom domain or an alias.

That pitch held up for about five years. ScryptMail turned up on the secure-email roundups that privacy sites publish and republish, next to names with venture funding and legal departments, and nothing on the page told you it was one person.

~ one man, five hundred mailboxes ~

Nothing in my threat model has ever needed this. The category sells protection from a subpoena or a border search, and my mail in 2014 sat in a Gmail account under the ordinary assumption that no court would be asking for it. The distance here is circumstantial rather than geographic. I read ScryptMail the way you read a piece of equipment built for somebody else's job.

The people it was actually for had a harder problem: none of this was verifiable from outside. Reviewers who went looking found a developer who had updated the code once, in January 2015, and had not come back to it. A single pair of hands is a selling point in this category right up to the moment it is the whole risk.

The transparency report did not help. It listed eight law enforcement requests, and on at least some of them access to IP information had been granted.

~ the canary that stopped singing ~

A warrant canary is a page a provider updates on a schedule to say that nothing has been served on them. Its entire value is the updating. ScryptMail's stopped in 2016 and stayed stopped. Under the canary's own logic that silence is the signal the device exists to send; in practice it probably meant something duller, one person with a consultancy to run letting a maintenance task slide. Either reading leaves a privacy product whose central published assurance had been stale for four years while people kept signing up.

~ two dates and a deletion ~

The notice, preserved in a review page captured in September 2020, is one sentence long before it turns into a schedule. ScryptMail is going out of business. Then the dates: email service to be shut down on 31 January 2020, all databases to be deleted on 31 March. Whether the second one was honored is not something anyone outside can check, and that is the point of publishing it. Naming a destruction date is the correct thing for an encrypted provider to do, and almost nobody does it, because it commits you in public to the moment the data is gone.

The address took longer to notice. Through all of 2020 and 2021 scryptmail.com kept returning the same 2.3 KB application shell to the Internet Archive, a front end with no service behind it, right up to March 2022. By 15 May 2022 the same hostname answered with a 57 KB page from somebody else entirely. It is a content farm now, publishing listicles about residential proxies and rank-tracking APIs under the ScryptMail name, which means a search for the dead privacy service lands you on SEO copy wearing its logo.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »