Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why ProtonMail is more secure than Gmail

protonmail.com

Post reply on HN
Print view View original

271–280 of 314 posts

Re: Why ProtonMail is more secure than Gmail

#271

Post by bogomipz »

jszymborski wrote: post #167
datawarrior wrote: post #63

I gave up on ProtonMail. The lack of a calendar means you often need to go back to using Google Calendar or Outlook.com Calendar, kind of negating the privacy benefits if you're a heavy calendar user. Secondly, its been years and you still can't store more than a single email address for a contact. This is so incredibly ridiculous that I have an extremely hard time understanding how they get away with charging what t…

I'm optimistic about ProtonMail in the long run, but won't use it until it gets out of my browser and onto a native app on my desktop. If UI problems bother you, and you need a calendar, you can use mailbox.org which (1) can encrypt incoming emails w/ your GPG key, (2) offers SMTP so you can use Thunderbird, (3) comes with a calendar you can use on thunderbird/your phone via network. They're also based in Germany, wh…

>"They're also based in Germany, which is nice."

They're based in Switzerland which is no longer a safe haven, although ProtonMail seems to still trade on the idea that it is.

See:

https://www.theguardian.com/world/2016/sep/25/switzerland-vo...

Re: Why ProtonMail is more secure than Gmail

#272

Post by linkregister »

bhandziuk wrote: post #255
linkregister wrote: post #110

Earlier quoted context omitted.

Under the Stored Communications Act, law enforcement may get emails or other information under third party control with only a subpoena. Retrieving email via the POP3 protocol typically deletes the email upon retrieval, making it impossible for the third party to comply with requests for already-retrieved emails.

>POP3 protocol typically deletes the email upon retrieval What POP3 client are you using that does this? I've not seen it before. It gets marked as read but that's it.

Geez, Eudora? Outlook Express maybe? I haven’t used POP3 in a decade.

It used to delete from the server after downloading locally. This was when most email mailboxes had a capacity of 10MB.

Re: Why ProtonMail is more secure than Gmail

#273

Post by DINKDINK »

md_ wrote: post #198
DINKDINK wrote: post #176

Earlier quoted context omitted.

>100 people have root @ Google. They get a tshirt with it on. A convenient way to put a target on your back. What benefit does this have to their security? Accountability?

The t-shirts are a bit of jokey swag, not an access control mechanism. ;)

Yes, it’s a “hey everyone this person has the keys to the kingdom, target them” indicator.

Re: Why ProtonMail is more secure than Gmail

#274

Post by vacri »

> ProtonMail takes the opposite approach and by default, does not monitor or record user activity, not even IP addresses.

Hrm, where's the pricing? Oh, it's based on "Messages per day" and "Folders / Labels"...

This doesn't detract from the meat of the article, but when user activity is involved in the pricing, you clearly can't claim 'no activity monitoring'.

Re: Why ProtonMail is more secure than Gmail

#276

Post by singron »

myrandomcomment wrote: post #230
Gaelan wrote: post #216

Earlier quoted context omitted.

Google also allows ads targeting a list of emails. Could be that the cigar seller asked google to show you the ads.

Why would the cigar seller ask to show me an ad for a STOP SMOKING CIGARS product? Also as I said, this showed up in Youtube the day after I ordered and the email hit my gmail. Never seen those ads before.

The cigar seller sells its customer list to a data broker or uses a third party service that does the same (e.g. it uses your email address as a user identifier in a third party analytics product). Then advertisers buy that data.

Re: Why ProtonMail is more secure than Gmail

#277

Post by jszymborski »

bogomipz wrote: post #271
jszymborski wrote: post #167

Earlier quoted context omitted.

I'm optimistic about ProtonMail in the long run, but won't use it until it gets out of my browser and onto a native app on my desktop. If UI problems bother you, and you need a calendar, you can use mailbox.org which (1) can encrypt incoming emails w/ your GPG key, (2) offers SMTP so you can use Thunderbird, (3) comes with a calendar you can use on thunderbird/your phone via network. They're also based in Germany, wh…

>"They're also based in Germany, which is nice." They're based in Switzerland which is no longer a safe haven, although ProtonMail seems to still trade on the idea that it is. See: https://www.theguardian.com/world/2016/sep/25/switzerland-vo...

I meant mailbox.org is based in Germany :)

Re: Why ProtonMail is more secure than Gmail

#278

Post by bigiain »

bascule wrote: post #256
DavideNL wrote: post #252

Earlier quoted context omitted.

> "Google products are surprisingly secure" For one their products are not "secured" from Google seeing your private data...

Neither is ProtonMail. They see all email plaintexts unless you're using end-to-encryption like GPG/PGP. They only encrypt data at rest, and we can only take them at their word that they're even doing that.

They claim (tho I haven't confirmed myself) to do encryption at the device - automatically between Protonmail accounts (right now though, they do not support sending pgp encrypted email to a protonmail account with a keypair not generated by them... Which seems a _very_ odd design decision):

In simple terms, end-to-end encryption means that messages are encrypted on the sender’s device (before it even leaves their computer or mobile phone), and can only be decrypted by the recipient on their device. This means that no third party which transmits or intercepts the email between the sender and recipient (i.e. internet service providers, the NSA, or even ProtonMail as the mail server operator) can decrypt and view the message.

This powerful protection is possible because ProtonMail has PGP email encryption built-in. End-to-end encryption is done automatically without user interaction whenever messages are exchanged between ProtonMail users. For an enterprise using ProtonMail for their email hosting, this means all communications between employees are automatically protected with end-to-end encryption. ProtonMail can also support sending/receiving end-to-end encrypted messages with recipients who are not using ProtonMail. The use of end-to-end encryption makes ProtonMail a better choice for security conscious individuals and organizations.

Re: Why ProtonMail is more secure than Gmail

#279

Post by plcancel »

protonmail wrote: post #166
ninegunpi wrote: post #91

While I love ProtonMail as an effort to popularize security for end-users and trying to come up with smart technologies to achieve that, the whole risk model behind the writeup barely stands scrutiny. What's worrying, ProtonMail (who declare security a first-class feature) use "features" instead of systems to define security of their service. If you think of it for a second, web crypto (protection against intermediar…

PM team here, we just made an account to comment. We actually agree with some of the points made above, but we'd like to add the following commentary... Encrypting email while making it more usable than PGP is hard. There's no getting around that. Web crypto is always going to have some shortcomings, but web mail is on the rise, and at the end of the day, web crypto is better than no crypto. That said, we have been w…

Thanks, PM, for trying to tackle a hard problem. I've been a happy customer.

I've also been a happy customer of your VPN product, but I'd be happy to retire the OpenVPN app on my iPhone. Any word on an iOS app soon?

Re: Why ProtonMail is more secure than Gmail

#280

Post by bigiain »

jhasse wrote: post #269
criddell wrote: post #244

Earlier quoted context omitted.

For me, Gmail solves the spam problem. I don't even remember the last time I've had a false positive or a piece of spam that made it to my inbox. My entire family uses Gmail (our domain is hosted via Google Apps) and as far as I know, it's been very close to perfect for all of us.

Well, do you really check your spam folder all the time? There might be false positives that you miss.

There are also false positives than never make it into your spam folder - that just get dropped silently. (I have a friend who's company's GSuite email _regularly_ does this...)
Post reply on HN