Recent searches
Search options
Given Proton Mail’s fashiness coming out of the woodwork, lots of folks are looking at switching away — but they have a reasonable concern: Aren’t Proton Mail’s privacy features special, different from a normal mail provider?
AFAICT, the answer is yes in •theory•, but you aren’t giving up that much in •practice•.
Short 
surfacing notes I put in a reply — and likely containing inaccurations about Proton Mail, so please correct me if you have better info!
1/
In practice, email is pretty much all encrypted in transit these days (almost all SMTP and IMAP happen over SSL/TLS). You don’t need to worry about random third parties on the internet scanning your emails in transit.
Email, however, is not end-to-end encrypted: your own email provider (Gmail, your ISP, whatever) can see all your messages. Many actively scan your email to profile you. (This also applies to the email providers of the •recipients• of your emails.)
This is the problem Proton Mail claims to fix.
2/
The problem is that Proton Mail can’t fully fix it. IIUC, their E2E encryption requires active participation of both the sender and the receiver: https://proton.me/support/password-protected-emails
That means:
- No communication initiated by the other party is going to use it. Your bank account password recovery link isn’t E2E encrypted.
- If you want to keep a conversation you started with a human encrypted, the recipient has to use a clunky web portal to read & reply.
3/
- If the recipient of your communication quotes what you said in a normal email without using the Proton Mail web portal, oops! no longer encrypted.
- They say Proton-to-Proton emails are E2E encrypted, but there has to be an asterisk next to that: their SMTP server •must• get plaintext from my mail client, however briefly. [CORRECTION: They do not support SMTP except via local bridging; scratch this one]
- And the whole time, you just have to trust that this apparently fash-friendly company’s opaque software is doing what they say it’s doing.
4/
I honestly see no advantage of Proton Mail over just saying “let’s take this conversation to a secure platform (e.g. Signal).” And if you do that, you’re using a protocol that was actually •designed• for E2E encryption instead of trying to bolt it on the side.
I am not a Proton customer, so I may be missing something here. Am I?
If I do understand correctly, it seems like the security benefit of Proton Mail is mostly theoretical, weak sauce in practice.
5/
@inthehands kinda hard to have a valid opinion about something if you don't use it.
@rommix0
Through the 
magic of reading
@inthehands don't get the reference