Review of #SkiffMail, #SkiffDrive, #SkiffPages, and #SkiffCalender
( #Skiff #Email #Mail #Storage #drive #pages #notes #secure #calendar #EndToEndEncryption #E2EE #Privacy #security)

A new email service has come along that is trying to take a piece of privacy conscious email services/suits like #ProtonMail and #Tutanota. They make the claim of being open source, security audited, complete end to end encryption even if mailed to an outside email address. How they do this, they say, they use extra security over TLS encryption from the MTA. They will not go into specifics on how anything works, and the sources for the server are completely closed source. There is no way to really audit how the server functions.

I have downloaded all the apps from them, and the apps alone were far from enjoyable. They were completely buggy and mostly had to force stop and clear cache in order to use. Many times, freezing with loading of spinning logo. On the mail app, there is NOWHERE to change your password. Under the delete account, it will always say that it is the wrong password, but the Drive app will accept the password fine. The drive app will also allow you to change your password where the mail app won't. The Drive app leaves so much ambiguity on how much storage is used or if something is actually saved. There is no way to tell, and I lost test files that were randomly generated files uploaded and when shown on drive, after deleting on device also removed from drive app. All apps have so few of functionality that if you are looking for features, they seem to be very lacking. The Calendar app is just a calendar app. There is nothing really special about this at all. Pages is ok for notes but is not anything spectacular. Nothing of the apps have anything that gives any reason to choose Skiff based on the apps alone as they are all lack luster when compared to its competition, Proton and Tutanota.

Let's get to the real reason you would want to use Skiff, it's privacy claims of complete end to end encryption, including mail to outside email services. They say it's automatically done but will not explain how or anything regarding how this is done. They just use a lot of jargon and seem to make it seem completely automagically done. In the composition of email, there is nothing in regards to symmetrical encryption that both Proton and Tutanota provides. There is nothing in setup or sending email on anything asymmetrical encryption related at all. Proton at least provides #GPG / #PGP private keys that you can even download. There is no check for encryption what so ever for sending, so my assumption is that it would be autonomic. I have my main email set to autocrypt mutual mode through imap client so I would be expecting that it would use that if there was any encryption. Once sent, I checked MTA logs and ONLY way email was encrypted was through TLS. Everything else in email was not end to end encrypted. Looking at headers, there is nothing there to indicate any encryption either. I figured that maybe if I send a reply with signature maybe it will then encrypt from then on. Nope, there is no end to end encryption. So the last part is the server, there is no source code for the server, no way to download your messages from imap or pop3 or any way to just manually download your mail. You have no ability to possess your own emails. Proton provides a gateway to use a client with, Tutanota allows you to individually download. Both also let you view headers, which Skiff does not.

Final results: this is just another company that is rifting on privacy and open source community. There is nothing I find secure about them, the apps are not in good working condition, and just looks to me like general email. I find that the only E2EE solution is any email that allows imap or pop3 then use an email client that allows GPG with autocrypt mutual mode or some sort of OTP.

Skiff is NOT recommended and I give a 1/10 score.