Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How secure is Protonmail really?

news.ycombinator.com

Post reply on HN
Print view View original

11–20 of 20 posts

Re: Ask HN: How secure is Protonmail really?

#11

Post by artemisyna »

I can't actively say too much about the security of Protonmail.

However, I do know a lot of people that know the founder (Andy Yen) socially and they all uniformly think he's a scumbag. (Doing things like going to car shows with a junker saying that his nice is in the shop, other generally sketchy/manipulative actions.)

Overall, I'd say Protonmail is good at being a hype machine and while there may be some technical correctness in what they're doing, it's not a business you'd want to rely on.

Re: Ask HN: How secure is Protonmail really?

#12

Post by Something1234 »

artemisyna wrote: post #11

I can't actively say too much about the security of Protonmail. However, I do know a lot of people that know the founder (Andy Yen) socially and they all uniformly think he's a scumbag. (Doing things like going to car shows with a junker saying that his nice is in the shop, other generally sketchy/manipulative actions.) Overall, I'd say Protonmail is good at being a hype machine and while there may be some technical…

How is showing off a junker at a car show a manipulative action?

Re: Ask HN: How secure is Protonmail really?

#13

Post by sp527 »

Something1234 wrote: post #12
artemisyna wrote: post #11

I can't actively say too much about the security of Protonmail. However, I do know a lot of people that know the founder (Andy Yen) socially and they all uniformly think he's a scumbag. (Doing things like going to car shows with a junker saying that his nice is in the shop, other generally sketchy/manipulative actions.) Overall, I'd say Protonmail is good at being a hype machine and while there may be some technical…

How is showing off a junker at a car show a manipulative action?

May not be manipulative, but it certainly speaks to Yen's state of mind.

Re: Ask HN: How secure is Protonmail really?

#14

Post by throwawaymath »

otriv wrote: post #9

Not sure what you mean by 'secure'. If you send a person an email with ProtonMail, it defeats all the security that ProtonMail has (unless it's to another PM email). You should only rely on yourself for security. Start using PGP and demand that all your friends/relatives use PGP. Only sign in through Tor, use different emails for different services, etc. You can't rely on a company to provide you security or privacy.

> Start using PGP and demand that all your friends/relatives use PGP. Only sign in through Tor, use different emails for different services, etc.

Good luck with that. Security that no one uses isn't security at all. Placing those demands on everyone else in your life is going to result in fewer emails, not more secure emails.

Re: Ask HN: How secure is Protonmail really?

#16

Post by artemisyna »

Something1234 wrote: post #12
artemisyna wrote: post #11

I can't actively say too much about the security of Protonmail. However, I do know a lot of people that know the founder (Andy Yen) socially and they all uniformly think he's a scumbag. (Doing things like going to car shows with a junker saying that his nice is in the shop, other generally sketchy/manipulative actions.) Overall, I'd say Protonmail is good at being a hype machine and while there may be some technical…

How is showing off a junker at a car show a manipulative action?

I should've included an extra clause or two there.

Showing up with a junker with the explicit purpose to pick up chicks. And doing this repeatedly/bragging loudly about it.

On one hand it doesn't necessarily speak to the guy's technical capabilities. On the other hand, I at least wouldn't trust the guy to be principled enough to not pass this stuff over to . (Especially if it was at the right price.)

Re: Ask HN: How secure is Protonmail really?

#17

Post by commoner »

Only the ProtonMail web client is open-source. Their mobile apps are still closed-source, even though ProtonMail has been advertising themselves as "open source" since 2015.

September 17, 2018: "Our apps are planned to be open source by the end of the year. Your patience is greatly appreciated."

https://protonmail.com/blog/indiegogo-anniversary-four-years...

Re: Ask HN: How secure is Protonmail really?

#18

Post by otriv »

throwawaymath wrote: post #14
otriv wrote: post #9

Not sure what you mean by 'secure'. If you send a person an email with ProtonMail, it defeats all the security that ProtonMail has (unless it's to another PM email). You should only rely on yourself for security. Start using PGP and demand that all your friends/relatives use PGP. Only sign in through Tor, use different emails for different services, etc. You can't rely on a company to provide you security or privacy.

> Start using PGP and demand that all your friends/relatives use PGP. Only sign in through Tor, use different emails for different services, etc. Good luck with that. Security that no one uses isn't security at all. Placing those demands on everyone else in your life is going to result in fewer emails, not more secure emails.

> Placing those demands on everyone else in your life is going to result in fewer emails

Sometimes this is a good thing.

Re: Ask HN: How secure is Protonmail really?

#19

Post by dnel »

I've considered using it but saying nothing of the quality of the service itself, I saw it as a bit of a surveillance goldmine for anyone with an interest in monitoring people that use secure email, and you have to trust them absolutely, which is impossible for me so their selling point is rendered moot.

Re: Ask HN: How secure is Protonmail really?

#20

Post by trash_panda »

It isn't a matter of whether it's "secure" or not. The problem is that their security model is based around JavaScript code being pushed to your browser where all the "cryptography" will happen. Yes, maybe your e-mails are actually encrypted. But let's think that for example their servers get compromised, by exploiting whatever vulnerability they have, or even one of their employees gets phished. The attacker will be able to serve you a malicious JavaScript file and get your passphrase and decrypt all your e-mails.

This risk is real even in the hypothetical world were everyone uses ProtonMail, but in the real world you have a bigger risk: most people don't use ProtonMail and the risk of your e-mail being included/forwarded whatever to a "plaintext" service is really high.

I would recommend to avoid ProtonMail and other e-mail services that claim to be secure, and stick to end-to-end solutions like Signal/Wire/WhatsApp.

Post reply on HN