One thing that frustrates me about protonmail and most other mail providers is it's limits on email aliases, even if your using your own domain. With gmail you get an unlimited number of aliases.
Why ProtonMail is more secure than Gmail
201–210 of 314 posts
Re: Why ProtonMail is more secure than Gmail
#202"Zero Knowledge Encryption" is just a marketing term... I wish marketing would not cross wires with real crypto, it makes me skeptical that they really know what they're doing. They're not the only company doing this and they should be called out for it like spideroak [1]. ZKP[2] is real branch of cryptography and they do not use it AFAIK. [1] https://spideroak.com/articles/why-we-will-no-longer-use-the... [2] https:…
[deleted]
Re: Why ProtonMail is more secure than Gmail
#203Earlier quoted context omitted.
> They're for people like you and me to reclaim a semblance of privacy, and they work even with "Uncle Sam" as the threat model in a limited, dragnet surveillance sense. They don't work, because the US government's modus operandi is compromising machines or forcing users to provide access to their encrypted data. It's unclear to me why, if you take as premise a government capable of forcing one of the most valuable o…
"Put another way, I find the concept of a government willing to force Google to give up data but unwilling to use operational vulnerabilities to achieve the same thing to be contrived - how is this not just an arbitrary line in the sand?" In the US we have a constitution the prohibits searches of our papers without a warrant signed by a judge. It might be out of fashion is some circles, but the rule of law and not ju…
Those laws are implemented by humans who don't always follow them, or only follow them for certain groups of people.
Re: Why ProtonMail is more secure than Gmail
#204Earlier quoted context omitted.
This comment seems to conflate resistance to mass surveillance with resistance to targeted surveillance. It's almost as if the fact that I'll never be able to resist a targeted attack means that I shouldn't attempt to have any privacy at all, but surely that's not right. Encrypted messaging apps and services like ProtonMail have never been primarily to help people with Snowden's threat model. They're for people like…
> They're for people like you and me to reclaim a semblance of privacy, and they work even with "Uncle Sam" as the threat model in a limited, dragnet surveillance sense. They don't work, because the US government's modus operandi is compromising machines or forcing users to provide access to their encrypted data. It's unclear to me why, if you take as premise a government capable of forcing one of the most valuable o…
Email is one backdoor less to care about, step by step you can regain total privacy with project like these
Re: Why ProtonMail is more secure than Gmail
#205Earlier quoted context omitted.
From the link: "G Suite’s Gmail is already not used as input for ads personalization, and Google has decided to follow suit later this year in our free consumer Gmail service." They are definitely still reading your gmail. How else would the spam and other filters work? They can also use it under this policy for anything but "ads personalization". Machine learning, Google product integration, other recommendation not…
Well, one might reasonably ask whether "reading your mail" (as in, running an algorithm on it to try to classify phishing vs non) is a security cost or benefit. Spearphishing is a huge source of compromise at the moment; antiphishing filters might, in that view, be considered a security feature rather than a security fault. On the other hand, I have, frankly, never understood these privacy arguments. Is it a privacy…
>Is it a privacy violation if someone checks a checksum of my incoming mail against a blacklist?
No, the privacy concern is about the potential for abuse if there is a known place in the world where a very detailed account of all my online (and some offline) activities, contacts, communication and personal interests is stored.
It obviously arouses the interest and desires of criminals, governments, employers, politicians, landlords, insurance companies, creditors, marketers, ex partners, extremists and bigots, journalists, potential mates, researchers, etc.
Some of these groups are overlapping and some of the concerns might only arise in the distant future. Governments change. Ownership of companies changes. Personal circumstances and opinions change, but you can't take anything back once its out.
Re: Why ProtonMail is more secure than Gmail
#206Earlier quoted context omitted.
Right, I was going by their knowledge base article titled ‘IMAP, SMTP, and POP3 setup’ where they say: At this time Protonmail does not support IMAP/SMTP or POP3 due to the technology ProtonMail utilizes within web browsers to encrypt and decrypt your messages. We apologize for the inconvenience and are working on creative solutions to allow IMAP/SMTP use. https://protonmail.com/support/knowledge-base/imap-smtp-and-.…
https://protonmail.com/bridge
Oh, that's awesome idea!
If it uses IMAP4 variant under the hood and not completely different/proprietary API - are there any plans of possibly releasing this as a standalone tool someday?
I don't use Protonmail, because I already have self-hosted own-premises mail system for a long while, but I don't have encryption at rest. Given that you use OpenPGP, this bridge app looks very interesting. If it only could talk to a local gpg-agent as an option (rather than an PM account), it would be probably just perfect.
Re: Why ProtonMail is more secure than Gmail
#207Earlier quoted context omitted.
Gmail isn't floating around any brochures on security though - it's pitch to the majority of its users is "It's Google and Mail and where most people have their emails. You don't want to be that one weirdo at @yahoo.com do you?" and that just about does it. ProtonMail is trying to recruit users with the brochure. That said, even though the argument is a bit flawed here, I think most attracted by it would still prefer…
Do you really believe people use gmail because of its brand? I don't know about any security brochure, but I know I can setup 2FA to use push notifications (not an insecure SMS number), and can check where all of my logins are from, and have "suspicious" logins blocked automatically, etc, etc. I can also create single-use passwords for insecure devices (such as a youtube password just for my apple TV). Not to mention…
There are absolutely people (many of them) who use GMail because of its brand. They most commonly will say "GSuite" though.
Re: Why ProtonMail is more secure than Gmail
#208Threat model, threat model, threat model. There are some people for whom "The government is literally after me, personally" is a valid threat model. There are some people for whom "Google employees with privileged access to Gmail are conspiring to be after me, personally" (one assumes there's a two-person rule for access to individual inboxes or deploying code that scans inboxes) is also a valid threat model. However…
> "I don't want to lose access to my email" (remember that availability is a part of security!). Arent there many (difficult to judge how many) cases of people losing access to their Google account, and therefore about everything they had online (photos, email, videos, etc...). That is also scary enough, especially when it happens randomly with no clear reason why and the support of Google seems to be limited to send…
I definitely wouldn't say many. I can count the number of cases it has happened in the past few years on one hand, and as far as I remember, almost all of them got their accounts back.
Yes, you could argue that only the loud ones making noise get their accounts back, which my be true, but considering that billions of people use GMail, the fact that so few stories even show up means that it's probably safer than even air travel.
Re: Why ProtonMail is more secure than Gmail
#209Earlier quoted context omitted.
Except this is no longer true. Google does not read your gmail anymore. https://blog.google/products/gmail/g-suite-gains-traction-in...
From the link: "G Suite’s Gmail is already not used as input for ads personalization, and Google has decided to follow suit later this year in our free consumer Gmail service." They are definitely still reading your gmail. How else would the spam and other filters work? They can also use it under this policy for anything but "ads personalization". Machine learning, Google product integration, other recommendation not…
So I ordered some cigars online the other day. I did this on a device not logged into google, in privacy mode.
An email with the order went to my @gmail. The next day in my Youtube videos the ads where for stop smoking patches.
They read email.
Re: Why ProtonMail is more secure than Gmail
#210Earlier quoted context omitted.
Off the top of my head I think the number 1 "threat" that Google doesn't protect you from is privacy. They are actively watching your email with algorithms to use for advertising purposes. On the other hand, they have more resources than anyone else to protect against things like DDOS, nation-state hacking/phishing, and physical disasters. They also have a legion of lawyers to protect against improper legal requests,…
Protonmail says they have no access to user data and so I guess that means they offer zero protection from spam and emailed threats. One could argue that Google's filtering of spam and potentially harmful mail is a point in favor of Google.
SMTP has headers that are visible to the email provider while the email is in transit. The absence of logs, etc., goes far to mitigate this threat. As an added benefit, there is a lot of anti-spam functionality that can be used with only this metadata available, and only ephemerally. I don't think it's true that zero-knowledge at rest means inability to provide common email provider value adds like anti-spam.