51–60 of 314 posts
If you trust them with all that why even encrypt the mail client side?
This post would be improved by discussing that their [threat model]( https://en.wikipedia.org/wiki/Threat_model ) is so different than Google's that it regards some of Google's business practices as threats. And that, in turn, there are threats that Google treats as much bigger threats, bringing their own world-class security team to. Calling this fundamental difference in approach "more secure" manipulates the less-…
That's a fair criticism. I don't think the Gmail glossy brochure mentions its threat model either.
That said, even though the argument is a bit flawed here, I think most attracted by it would still prefer ProtonMail for other sound arguments.
The engineer in me loves the promised End-End encryption and all the cool stuff. But, the inconvenience of "unable to search contents of emails" is a deal breaker towards encrypted email for me. My primary concern was Google/Microsoft scraping my emails to build a profile of me. My emails could give away very personal information that I do not want to be used for advertising. My money finally went to Fastmail. Excell…
Didn't Google stop scanning Gmail for ads targeting? https://www.nytimes.com/2017/06/23/technology/gmail-ads.html
US law interpretation of IMAP. Only with a POP3 service you are safe.
I don't understand this. Let's say I receive a newsletter from some website. That newsletter is not PGP-encrypted, so at some point the Proton Mail servers must be able to see a plaintext version of it. That means I have to trust that they never store that plaintext version. In addition, even if they immediately encrypt it and store the encrypted version, how can they do so such that only I can read it? Is the key ge…
From what I understand, there are two passwords; the Mailbox passwords, used for encrypting and signing emails, is in fact unrecoverable, and you'll lose your emails if you forget it: https://protonmail.com/support/knowledge-base/resetting-mail...
Threat model, threat model, threat model. There are some people for whom "The government is literally after me, personally" is a valid threat model. There are some people for whom "Google employees with privileged access to Gmail are conspiring to be after me, personally" (one assumes there's a two-person rule for access to individual inboxes or deploying code that scans inboxes) is also a valid threat model. However…
Really? You've heard just as many stories of unexpected Google account closures as I have.
I'm quite confident ProtonMail just don't do that. And if they did, you'd have a much more credible chance of talking to a human and rectifying the situation.
The end-to-end encryption is only between protonmail addresses, in practice when you email people with gmail/hotmail/yahoo etc. it doesn't matter if protonmail can't read the e-mail, the other party can. (Their solution for that is to send an e-mail that contains a password-protected link with the actual message [0], I find this procedure inconvenient.) Gmail could be as secure as Protonmail by using PGP yourself [1]…
Threat model, threat model, threat model. There are some people for whom "The government is literally after me, personally" is a valid threat model. There are some people for whom "Google employees with privileged access to Gmail are conspiring to be after me, personally" (one assumes there's a two-person rule for access to individual inboxes or deploying code that scans inboxes) is also a valid threat model. However…
https://protonmail.com/blog/protonmail-threat-model/
Which says don't use it if you are up against state actors and: "Sensitive business communications – You have sensitive business information that you want to make sure is protected from competitors and other malicious parties. For example, you fear a competitor may want to sue you under false pretenses to get access to sensitive data. In this case, ProtonMail offers a great deal of protection. ProtonMail will not release ANY data unless provided with an enforceable Swiss court order. To get such an order, the case must first work its way through the Swiss courts where stricter privacy laws might result in a different ruling. Even if an adversary went through the expensive and time consuming procedure of obtaining such an order, ProtonMail’s zero access cryptography means we would only be able to release data that is encrypted since we do NOT hold the decryption keys."
Given that they have Javascript to handle the decryption keys, couldn't they demand ProtonMail change the code delivered to your browser session to give up the keys? This would make the only extra security provided by this scheme would be the multiple court jurisdictions and the less tested legality of a court order making their product less secure, ala the FBI and Apple.
I don't understand this. Let's say I receive a newsletter from some website. That newsletter is not PGP-encrypted, so at some point the Proton Mail servers must be able to see a plaintext version of it. That means I have to trust that they never store that plaintext version. In addition, even if they immediately encrypt it and store the encrypted version, how can they do so such that only I can read it? Is the key ge…
Outgoing mail similar, but there it can be encrypted, so the TAP would be directly at the server, before it is encrypted.
In contrast to gmail TAP's are installed by a warrant ordered by a judge and per customer only. With gmail warrants are not needed, data is just handed over, and search interfaces are available to any agency which wants it.
The engineer in me loves the promised End-End encryption and all the cool stuff. But, the inconvenience of "unable to search contents of emails" is a deal breaker towards encrypted email for me. My primary concern was Google/Microsoft scraping my emails to build a profile of me. My emails could give away very personal information that I do not want to be used for advertising. My money finally went to Fastmail. Excell…
I'm a paying user, and have to say, I think I may want to give up this extra security for Google's world class spam filtering.
you might want to check yahoo mail then. I work for them (oath now). and at some point all employers were forced to dogfood it. the UI took a while to get used, but now I miss in app tabs witg several emails (in Gmail I need browser tabs). ...Long story short: after yahoo was acquired we moved to gmail. you cannot belive how much more spam shows up on my imbox that I had never seens before. not to mention yahoo took…