5 ms·
It's still a webapp, fully served from network, without any code signing (not even SRI to match hashes against), except for the TLS layer. AFAIK they don't even
by drdaeman 9y ago
It's still a webapp, fully served from network, without any code signing (not even SRI to match hashes against), except for the TLS layer. AFAIK they don't even have a standalone variant except for the unofficial desktop Electron app, and a beta IMAP bridge for paying customers.
Basically, they still ultimately rely on trust, just like others. While they're drastically different from e.g. Gmail, trust requirement is still there.
If one's well-being really depends on security, it's best to err on side of caution. Meaning, something like MailPile on the client side, very cautious non-automated key exchange, and, optionally, self-hosted email with at-rest encryption (e.g. Postfix+Dovecot+GnuPG pipe) is probably much better option than anything Protonmail can offer in their current state. Or avoiding email (as it's not yet there and probably never will be) and using something like Wire or BitMessage or whatever (I'm not a security expert) has both client-side static and auditable source code and limits metadata leakage.
- binaryanomaly 9y agoBridge is out of beta: https://protonmail.com/bridge/ https://protonmail.com/bridge/ and yes for paying customers. Given they don't sell your data it's natural that advanced features have a price. Yes there is of course trust involved as with anything. Still, for the majority of the folks it's better to trust someone else with their mail over running their own servers with gaping security holes. Avoiding email is not really possible yet and in the very near future...
- JetSpiegel 9y ago> advanced features It's an email service. IMAP is a standard, not some feature they are charitably implementing.
- aceofduh 9y agoThere’s no competition for paid email. They can literally do whatever they want.
- xfer 9y agoNo linux client and closed source. I would love to switch my gsuite account but there is no real benefit.
- binaryanomaly 9y agoComing soon. Well the end it's only email. You decide whom to trust with. Personally, I feel better with Protonmail. It's not better nor cheaper than gsuite it just has a totally different proposition as a product.