Is Hushmail Still Safe?

Ringo Kamens writes to ask if the use of Hushmail can still be considered a secure method of communication: "For a long time, Hushmail was considered a very secure email provider until an affidavit (PDF) from a DEA agent in 2007 showed that they had handed over 12 CDs of possibly decrypted data to law enforcement. Now, Cryptome has posted that the Hushmail encryption program is no longer the same program for which Hushmail releases their source. Is Hushmail even safe to use anymore?"

Comments

Re:no encryption that YOU didn't write is safe

[Iamthecheese]

Several kind of encryption have been inspected for years by some of the brightest minds in the field. Are you claiming that they are somehow vulnerable as well? RSA, Diffie-Hellman key exchange, 3DES, AES...

Re:The file is obfuscated

[datajack]

Agreed, it is very clear from opening the jar files that the published one has undergone obfuscation.

Re:this has been the case all along

[Mistshadow2k4]

Hushmail is really a way of making GPG easy for people who don't understand how it works.

From my own admittedly anecdotal experience, I'd say Hushmail is just a way to make money. Not only do they constantly bombard you with pleas to upgrade to their paid service, but they are supposed to delete your account if you don't check it every 3 weeks. But my account was deleted under this claim when it had been only 1 week since I checked it. Yes, I'm sure. Not only that, but when I tried to create an account with the same name, whenever I pressed okay I got an error message that I couldn't use that name without upgrading. After that I'd started using GPG with Gmail. Both are free.

I guess I'm old-fashioned, or just learned better because I was raised in a poor rural area, but it's better to learn how to do something yourself if it's easy anyway than to pay someone too much to do it for you.