47 ms·

I spoke on Mastodon recently about Protonmail - it's a scam and I cannot recommend it to anyone. They own your email, they don't support open protocols includin

I spoke on Mastodon recently about Protonmail - it's a scam and I cannot recommend it to anyone. They own your email, they don't support open protocols including SMTP and IMAP and the only way to export your emails is through a proprietary end-user application. They excuse this nonsense by saying that it's necessary for encryption, which is blatantly false. Their security is also based on trusting ProtonMail, since they could easily siphon off plaintext at the SMTP level or secretly modify their JavaScript to exfiltrate your private keys from the web browser. Genuinely secure systems do not require you to trust their operators. >PGP, because it is built on top of email, is therefore also a federated encryption system. Unlike other encrypted communications systems, such as Signal or Telegram, PGP doesn’t belong to anybody, there is no single central server, and you aren’t forced to use one service over another. We believe encrypted communications should be open and not a walled garden. ProtonMail is now interoperable with practically ANY other past, present, or future email system that supports the OpenPGP standard, and our implementation of this standard is also itself open source. This is rich. Why don't you start with the far more fundamental and important standards of SMTP and IMAP, Protonmail? Why don't you open source your desktop & mobile applications or your bridge? What a joke.

snowpanda 8y ago
>they don't support open protocols including SMTP >they could easily siphon off plaintext at the SMTP level This doesn't make any sense.
- Sir_Cmpwn 8y ago
  They don't support realying their user's outgoing mail through SMTP. They have to support server-to-server SMTP to receive incoming mail. The latter is where they encrypt incoming emails, but they could just as easily store the plaintext and you'd never know.
  - gruez 8y ago
    that limits it to the moment the email was received, which is still better than everyone else, where you can read the mail any time in the future.
    - Sir_Cmpwn 8y ago
      Not if they store the unencrypted email when it was received without telling you. Then they could refer to their stored, plaintext copy of the email at any time in the future.
      - bartbutler 8y ago
        We don't store copies of plaintext emails indefinitely (it's obviously exists in the mail pipeline before processing). This statement is based on trust, as it would be for literally any email provider. That said, if we did store mails long term, they would be vulnerable to subpoena, and thus would almost certainly get out at some point, which would be very bad for us. So we have every incentive to actually discard plaintext, just like we say we do. Obviously this does not apply to internal or external messages that are encrypted, so the real solution is to receive less unencrypted mail, which is exactly what today's announcement is about.
        Sir_Cmpwn 8y ago
        >We don't store copies of plaintext emails indefinitely We have to take your word for it. Genuinely secure systems don't require trust. Now, I think this feature is a genuinely good one and applaud you for it, but I've seen Protonmail reps lean on it as an excuse for why they can't support IMAP and SMTP, which is nonsense. I also think that users should be educated about the difference between security guarantees (which this isn't) and security promises (which this is). Your incentives may be aligned in a way that means you'll want to avoid storing plaintext email, but it's entirely possible you could be compelled by your government to secretly start siphoning off plaintext. This is why it's necessary to design systems which don't ask for trust at all, and to educate users on the limitations of encrypting incoming emails.
_eht 8y ago
How do you find Fastmail lines up as far as implementing complete standards?
- jolmg 8y ago
  I haven't had any issues with either SMTP or IMAP on Fastmail. I've even used their IMAP server by hand with no issues. Here is the IMAP capability list (which shows protocol extensions supported) before logging in: * CAPABILITY IMAP4 IMAP4rev1 LITERAL+ ENABLE UIDPLUS SASL-IR NAMESPACE CONDSTORE SORT LIST-EXTENDED QRESYNC MOVE SPECIAL-USE CREATE-SPECIAL-USE IDLE AUTH=PLAIN and after: * CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE ACL RIGHTS=kxten QUOTA MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY CATENATE CONDSTORE ESEARCH SEARCH=FUZZY SORT SORT=MODSEQ SORT=DISPLAY SORT=UID THREAD=ORDEREDSUBJECT THREAD=REFERENCES THREAD=REFS ANNOTATE-EXPERIMENT-1 METADATA LIST-EXTENDED LIST-STATUS LIST-MYRIGHTS LIST-METADATA WITHIN QRESYNC SCAN XLIST XMOVE MOVE SPECIAL-USE CREATE-SPECIAL-USE DIGEST=SHA1 X-REPLICATION STATUS=SIZE OBJECTID SAVEDATE X-CREATEDMODSEQ XAPPLEPUSHSERVICE LOGINDISABLED XCONVERSATIONS COMPRESS=DEFLATE X-QUOTA=STORAGE X-QUOTA=MESSAGE X-QUOTA=X-ANNOTATION-STORAGE X-QUOTA=X-NUM-FOLDERS IDLE They only have the TLS ports open; the plain text services are disabled (no need for STARTTLS since that's insecure from MITM). They allow having a password different from the account password specifically for these services.
  - brongondwana 8y ago
    That initial set of capabilities comes from the NGINX proxy and is hard-coded as the set of things which seem to be needed to make clients interoperate well. The second response (yeah, I know it's long!) is from the Cyrus IMAPd server on your backend. I see you captured that right now though, because X-CREATEDMODSEQ has only been there about a week. It's probably going to be renamed as GLOBALMODSEQ or something eventually... check out https://mailarchive.ietf.org/arch/browse/extra/ https://mailarchive.ietf.org/arch/browse/extra/ for all the gory details.
- Sir_Cmpwn 8y ago
  I usually recommend Fastmail to people who ask me for recommendations and aren't comfortable running their own mail server.
gruez 8y ago
>They own your email you mean the address? that's expected of every hosted email service. you're always free to use your own domain though. >they don't support open protocols including SMTP and IMAP and the only way to export your emails is through a proprietary end-user application. They excuse this nonsense by saying that it's necessary for encryption, which is blatantly false. Their security is also based on trusting ProtonMail, since they could easily siphon off plaintext at the SMTP level or secretly modify their JavaScript to exfiltrate your private keys from the web browser. Genuinely secure systems do not require you to trust their operators. fair point. although if you were serious about security, you'd be using self hosted server + your own PGP keys. but for most people who just want something that works just like gmail/outlook, it's definitely a step up. >This is rich. Why don't you start with the far more fundamental and important standards of SMTP and IMAP, Protonmail? how is SMTP/IMAP access supposed to work? you send the plaintext password to their server to decrypt and hope they're not storing your password? > Why don't you open source your desktop & mobile applications or your bridge? What a joke. they're talking about interoperability, not open source.
- Sir_Cmpwn 8y ago
  >you mean the address? No, I mean they own the contents of your correspondence because you can't get the emails out. >how is SMTP/IMAP access supposed to work? you send the plaintext password to their server to decrypt and hope they're not storing your password? No, you send it over TLS. You can also take some cues from Google and do IMAP-specific passwords or OAuth over IMAP/SMTP.
  - c2h5oh 8y ago
    You can use SMTP/IMAP if you want using a local bridge https://protonmail.com/fr/bridge/ https://protonmail.com/fr/bridge/
    - Sir_Cmpwn 8y ago
      I referred to this in my comment. It's proprietary, communicates with ProtonMail over their proprietary API, and is only supported for paid users. These are fundamental features of an MTA, not a paid addon, this is absolutely disgusting.
MrBingley 8y ago
> They excuse this nonsense by saying that it's necessary for encryption, which is blatantly false. I don't see how this is false. Protonmail encrypts all user emails on the server, which can only be unlocked by the user's password. SMTP and IMAP would require transmitting the password to the server for decryption, which makes it prey to interception a la HushMail [0]. This is why they have the bridge, which runs its own IMAP server on the client and performs all authentication and decryption locally. Of course, the bridge isn't open source yet, so we can't be sure it isn't sniffing your password anyway, but that is orthogonal to the issue of supporting SMTP. [0] https://www.wired.com/2007/11/encrypted-e-mai/ https://www.wired.com/2007/11/encrypted-e-mai/
- Sir_Cmpwn 8y ago
  No, they could just transmit PGP encrypted emails down IMAP and the user could decrypt them with any number of popular PGP implementations. Your IMAP/SMTP password doesn't necessarily have to be the same as your PGP key password, nor should you even need to give Protonmail your PGP private key (password protected or not), nor does IMAP/SMTP even have to be authenticated with a password (GMail notably pioneered an OAuth-based extension to both).
  - deftnerd 8y ago
    Protonmail's method of encryption allows them to encrypt the entire message, including headers/metadata. It also encrypts the messages received that weren't encrypted when they weren't first sent. Your suggested method basically is no different from any other provider. You rely on the sender encrypting the message and header information is entirely unencrypted on the disk.
    - Sir_Cmpwn 8y ago
      >Protonmail's method of encryption allows them to encrypt the entire message, including headers/metadata I would prefer to see them promote standards to extend PGP rather than invest that time in a new, proprietary system with no buy-in from the email-related-software development community. I can follow the logic but I can also see their eyes lighting up when they realize this is a great excuse for having a proprietary, locked-in platform. >It also encrypts the messages received that weren't encrypted when they weren't first sent This could be done with PGP
bartbutler 8y ago
1. You can export your mail directly from the web app in EML form, using the bridge, and soon, from the import/export tool which is currently in beta for Visionary users. 2. We support IMAP/SMTP via the bridge (protonmail.com/bridge). 3. You can run the web client lcoally if ProtonMail itself is part of your threat model (github.com/ProtonMail/WebClient) and the rest of the clients (mobile and bridge) are working on open sourcing soon (mostly library/API version updates and documentation).
- Sir_Cmpwn 8y ago
  1. This is a nice feature, and you should expidite it through beta ASAP, but it's no replacement for open protocols which have been standard for decades and are supported on every other email provider ever. 2. The proprietary bridge which only supports paid users and communicates with protonmail over a proprietary API. Give me a break. 3. "Open sourcing soon" isn't the same as "open source". Until you fulfill this promise it's not worth anything. Also, while I have a Protonmail rep on the line, your mail server sends invalid Message-ID headers. I sent an email about this to postmaster@protonmail.com, is that box monitored?
  - bartbutler 8y ago
    1. The web client export been live since May IIRC, the support page just hasn't been updated yet. The main issue with that is that very few people want to export their encrypted blobs, they naturally want the plaintext. So we need a decryption layer on the client, hence the client-side tools. 2. I don't see the issue with the API. Yes, we developed a separate API, because IMAP is several decades old, ridiculously inefficient, and wasn't designed with encryption in mind. The paid restriction may be lifted once we complete certain infrastructure, one major reason it's there that we were concerned about bandwidth. 3. I agree, and we're pushing as hard as we can for this. The latest mobile releases were the first ones on our latest API, so that will help. That said, the web client IS open source and anyone can use that locally and see exactly how the client-server interaction is handled in our API. Yes, it's monitored. I was notified of this problem today and will look into it.
badrabbit 8y ago
I don't think you appreciate just how insecure email is. How can you trust imap and smtp but distrust pgp? Protonmail emails are encrypted only when you send them to other protonmail users. I am really flabbergasted with your thought process. Gmail isn't a scam but protonmail is? PKI is trustworthy but pgp (wot) isn't? If you're afraid they'll modify their javascript,use their app!! Please tell me what webmail service you use,do they not use javascript? Scam implies intentional deception,you failes to prove that. Moreover you sir are slandering them. Let me say this - I don't care if they literally cloned yahoo's codebase, they are in switzerland and I pay them for their service, that alone makes them worth paying every cent!
- Sir_Cmpwn 8y ago
  I never said I distrust PGP. Where do you think I said that?
dv7 8y ago
Out of curiosity: what is your opinion on password managers like 1Password and LastPass?
- Sir_Cmpwn 8y ago
  Similarly negative.
  - CedarMadness 8y ago
    And Bitwarden? It's fully open-source and self-hostable.
    - Sir_Cmpwn 8y ago
      +1 Personally I use pass: https://www.passwordstore.org/ https://www.passwordstore.org/
zaarn 8y ago
>They own your email Bring your own domain. I'm doing that and it works perfectly fine. >they don't support open protocols including SMTP and IMAP Use the bridge, that supports SMTP and IMAP just fine. I even managed to make it run on my server and basically abuse that for login via VPN (though I stopped because running the X server for that got annoying) >the only way to export your emails is through a proprietary end-user application. They're working on an import/export tool. In the meantime, use the IMAP bridge and any sane IMAP backup tool like I do. >it's a scam I wouldn't call it a scam, nobody is taking the money and running off with it or not giving you what they advertise. You do get encrypted mail, you do get a lot more security than most people with simple SMTP or IMAP, atleast the average user. I think your description is a bit dishonest or atleast biased.
- Sir_Cmpwn 8y ago
  The bridge is proprietary software that only supports paid users. That's a really bullshit excuse given that every other provider supports IMAP directly and for free, an open protocol which has been standardized for over 20 years. An email "provider" which doesn't support IMAP/SMTP is a scam, I didn't stutter.
  - zaarn 8y ago
    The bridge costs money, yes. This is also stated in their FAQ. If you don't like it, you're free not to use their services. Show me the international contract of email providers that says all email providers need to give you free IMAP/SMTP access or IMAP/SMTP access at all. Even google doesn't give you IMAP/SMTP out of the box, you have to dig through the settings to enable that. I don't need this other than occasional backup via their bridge. I don't want a desktop mail client, I#ve been running Rainloop for about a year until I switch to PM and it still annoyed me to no end because frankly IMAP sucks. It sucks majorly.
  - cube2222 8y ago
    Most of those providers are using your data for ads. It's not free. I am working on a fairly high scale email service. IMAP and POP are very resource intensive parts of our infrastructure.
GW150914 8y ago
None of that sounds like it fits a reasonable definition of “it’s a scam,” so much as it just doesn’t fit with your various ideological stances.
newscracker 8y ago
> They own your email, they don't support open protocols including SMTP and IMAP and the only way to export your emails is through a proprietary end-user application. They excuse this nonsense by saying that it's necessary for encryption, which is blatantly false. > This is rich. Why don't you start with the far more fundamental and important standards of SMTP and IMAP, Protonmail? Why don't you open source your desktop & mobile applications or your bridge? What a joke. These are the exact reasons I have discouraged ProtonMail in every discussion it comes up. This is not a system that boasts the best of email as a platform, the decentralized and federated nature of it. In reality, it's just a walled garden of its own, even worse than Gmail, because there's no easy "takeout" solution. The IMAP support has been in the works for more than two years, and continues to remain in beta for a long time. To make things worse, when I checked a while ago, it's available only to paying customers. That's like holding the free user base for ransom. I would not recommend any email platform that actively makes it difficult to switch out. ProtonMail is a good example of such a platform, for my considerations.
- bartbutler 8y ago
  Import/export tool is in beta now and will be available for all users on launch. Export is available now via the web interface but it's a little clunky. The reason this stuff is complex and taking a while is not nefarious, it's because most people don't want just ciphertext when they export their mail.
auslander 8y ago
People, you are feeding this troll by replying, its the goal of trolling, keep the nonsense ongoing so it loses any sense.

snowpanda 8y ago

>they don't support open protocols including SMTP >they could easily siphon off plaintext at the SMTP level This doesn't make any sense.

Sir_Cmpwn 8y ago
They don't support realying their user's outgoing mail through SMTP. They have to support server-to-server SMTP to receive incoming mail. The latter is where they encrypt incoming emails, but they could just as easily store the plaintext and you'd never know.
- gruez 8y ago
  that limits it to the moment the email was received, which is still better than everyone else, where you can read the mail any time in the future.
  - Sir_Cmpwn 8y ago
    Not if they store the unencrypted email when it was received without telling you. Then they could refer to their stored, plaintext copy of the email at any time in the future.
    - bartbutler 8y ago
      We don't store copies of plaintext emails indefinitely (it's obviously exists in the mail pipeline before processing). This statement is based on trust, as it would be for literally any email provider. That said, if we did store mails long term, they would be vulnerable to subpoena, and thus would almost certainly get out at some point, which would be very bad for us. So we have every incentive to actually discard plaintext, just like we say we do. Obviously this does not apply to internal or external messages that are encrypted, so the real solution is to receive less unencrypted mail, which is exactly what today's announcement is about.
      - Sir_Cmpwn 8y ago
        >We don't store copies of plaintext emails indefinitely We have to take your word for it. Genuinely secure systems don't require trust. Now, I think this feature is a genuinely good one and applaud you for it, but I've seen Protonmail reps lean on it as an excuse for why they can't support IMAP and SMTP, which is nonsense. I also think that users should be educated about the difference between security guarantees (which this isn't) and security promises (which this is). Your incentives may be aligned in a way that means you'll want to avoid storing plaintext email, but it's entirely possible you could be compelled by your government to secretly start siphoning off plaintext. This is why it's necessary to design systems which don't ask for trust at all, and to educate users on the limitations of encrypting incoming emails.

_eht 8y ago

How do you find Fastmail lines up as far as implementing complete standards?

jolmg 8y ago
I haven't had any issues with either SMTP or IMAP on Fastmail. I've even used their IMAP server by hand with no issues. Here is the IMAP capability list (which shows protocol extensions supported) before logging in: * CAPABILITY IMAP4 IMAP4rev1 LITERAL+ ENABLE UIDPLUS SASL-IR NAMESPACE CONDSTORE SORT LIST-EXTENDED QRESYNC MOVE SPECIAL-USE CREATE-SPECIAL-USE IDLE AUTH=PLAIN and after: * CAPABILITY IMAP4rev1 LITERAL+ ID ENABLE ACL RIGHTS=kxten QUOTA MAILBOX-REFERRALS NAMESPACE UIDPLUS NO_ATOMIC_RENAME UNSELECT CHILDREN MULTIAPPEND BINARY CATENATE CONDSTORE ESEARCH SEARCH=FUZZY SORT SORT=MODSEQ SORT=DISPLAY SORT=UID THREAD=ORDEREDSUBJECT THREAD=REFERENCES THREAD=REFS ANNOTATE-EXPERIMENT-1 METADATA LIST-EXTENDED LIST-STATUS LIST-MYRIGHTS LIST-METADATA WITHIN QRESYNC SCAN XLIST XMOVE MOVE SPECIAL-USE CREATE-SPECIAL-USE DIGEST=SHA1 X-REPLICATION STATUS=SIZE OBJECTID SAVEDATE X-CREATEDMODSEQ XAPPLEPUSHSERVICE LOGINDISABLED XCONVERSATIONS COMPRESS=DEFLATE X-QUOTA=STORAGE X-QUOTA=MESSAGE X-QUOTA=X-ANNOTATION-STORAGE X-QUOTA=X-NUM-FOLDERS IDLE They only have the TLS ports open; the plain text services are disabled (no need for STARTTLS since that's insecure from MITM). They allow having a password different from the account password specifically for these services.
- brongondwana 8y ago
  That initial set of capabilities comes from the NGINX proxy and is hard-coded as the set of things which seem to be needed to make clients interoperate well. The second response (yeah, I know it's long!) is from the Cyrus IMAPd server on your backend. I see you captured that right now though, because X-CREATEDMODSEQ has only been there about a week. It's probably going to be renamed as GLOBALMODSEQ or something eventually... check out https://mailarchive.ietf.org/arch/browse/extra/ https://mailarchive.ietf.org/arch/browse/extra/ for all the gory details.
Sir_Cmpwn 8y ago
I usually recommend Fastmail to people who ask me for recommendations and aren't comfortable running their own mail server.

gruez 8y ago

>They own your email you mean the address? that's expected of every hosted email service. you're always free to use your own domain though. >they don't support open protocols including SMTP and IMAP and the only way to export your emails is through a proprietary end-user application. They excuse this nonsense by saying that it's necessary for encryption, which is blatantly false. Their security is also based on trusting ProtonMail, since they could easily siphon off plaintext at the SMTP level or secretly modify their JavaScript to exfiltrate your private keys from the web browser. Genuinely secure systems do not require you to trust their operators. fair point. although if you were serious about security, you'd be using self hosted server + your own PGP keys. but for most people who just want something that works just like gmail/outlook, it's definitely a step up. >This is rich. Why don't you start with the far more fundamental and important standards of SMTP and IMAP, Protonmail? how is SMTP/IMAP access supposed to work? you send the plaintext password to their server to decrypt and hope they're not storing your password? > Why don't you open source your desktop & mobile applications or your bridge? What a joke. they're talking about interoperability, not open source.

Sir_Cmpwn 8y ago
>you mean the address? No, I mean they own the contents of your correspondence because you can't get the emails out. >how is SMTP/IMAP access supposed to work? you send the plaintext password to their server to decrypt and hope they're not storing your password? No, you send it over TLS. You can also take some cues from Google and do IMAP-specific passwords or OAuth over IMAP/SMTP.
- c2h5oh 8y ago
  You can use SMTP/IMAP if you want using a local bridge https://protonmail.com/fr/bridge/ https://protonmail.com/fr/bridge/
  - Sir_Cmpwn 8y ago
    I referred to this in my comment. It's proprietary, communicates with ProtonMail over their proprietary API, and is only supported for paid users. These are fundamental features of an MTA, not a paid addon, this is absolutely disgusting.

MrBingley 8y ago

> They excuse this nonsense by saying that it's necessary for encryption, which is blatantly false. I don't see how this is false. Protonmail encrypts all user emails on the server, which can only be unlocked by the user's password. SMTP and IMAP would require transmitting the password to the server for decryption, which makes it prey to interception a la HushMail [0]. This is why they have the bridge, which runs its own IMAP server on the client and performs all authentication and decryption locally. Of course, the bridge isn't open source yet, so we can't be sure it isn't sniffing your password anyway, but that is orthogonal to the issue of supporting SMTP. [0] https://www.wired.com/2007/11/encrypted-e-mai/ https://www.wired.com/2007/11/encrypted-e-mai/

Sir_Cmpwn 8y ago
No, they could just transmit PGP encrypted emails down IMAP and the user could decrypt them with any number of popular PGP implementations. Your IMAP/SMTP password doesn't necessarily have to be the same as your PGP key password, nor should you even need to give Protonmail your PGP private key (password protected or not), nor does IMAP/SMTP even have to be authenticated with a password (GMail notably pioneered an OAuth-based extension to both).
- deftnerd 8y ago
  Protonmail's method of encryption allows them to encrypt the entire message, including headers/metadata. It also encrypts the messages received that weren't encrypted when they weren't first sent. Your suggested method basically is no different from any other provider. You rely on the sender encrypting the message and header information is entirely unencrypted on the disk.
  - Sir_Cmpwn 8y ago
    >Protonmail's method of encryption allows them to encrypt the entire message, including headers/metadata I would prefer to see them promote standards to extend PGP rather than invest that time in a new, proprietary system with no buy-in from the email-related-software development community. I can follow the logic but I can also see their eyes lighting up when they realize this is a great excuse for having a proprietary, locked-in platform. >It also encrypts the messages received that weren't encrypted when they weren't first sent This could be done with PGP

bartbutler 8y ago

1. You can export your mail directly from the web app in EML form, using the bridge, and soon, from the import/export tool which is currently in beta for Visionary users. 2. We support IMAP/SMTP via the bridge (protonmail.com/bridge). 3. You can run the web client lcoally if ProtonMail itself is part of your threat model (github.com/ProtonMail/WebClient) and the rest of the clients (mobile and bridge) are working on open sourcing soon (mostly library/API version updates and documentation).

Sir_Cmpwn 8y ago
1. This is a nice feature, and you should expidite it through beta ASAP, but it's no replacement for open protocols which have been standard for decades and are supported on every other email provider ever. 2. The proprietary bridge which only supports paid users and communicates with protonmail over a proprietary API. Give me a break. 3. "Open sourcing soon" isn't the same as "open source". Until you fulfill this promise it's not worth anything. Also, while I have a Protonmail rep on the line, your mail server sends invalid Message-ID headers. I sent an email about this to postmaster@protonmail.com, is that box monitored?
- bartbutler 8y ago
  1. The web client export been live since May IIRC, the support page just hasn't been updated yet. The main issue with that is that very few people want to export their encrypted blobs, they naturally want the plaintext. So we need a decryption layer on the client, hence the client-side tools. 2. I don't see the issue with the API. Yes, we developed a separate API, because IMAP is several decades old, ridiculously inefficient, and wasn't designed with encryption in mind. The paid restriction may be lifted once we complete certain infrastructure, one major reason it's there that we were concerned about bandwidth. 3. I agree, and we're pushing as hard as we can for this. The latest mobile releases were the first ones on our latest API, so that will help. That said, the web client IS open source and anyone can use that locally and see exactly how the client-server interaction is handled in our API. Yes, it's monitored. I was notified of this problem today and will look into it.

badrabbit 8y ago

I don't think you appreciate just how insecure email is. How can you trust imap and smtp but distrust pgp? Protonmail emails are encrypted only when you send them to other protonmail users. I am really flabbergasted with your thought process. Gmail isn't a scam but protonmail is? PKI is trustworthy but pgp (wot) isn't? If you're afraid they'll modify their javascript,use their app!! Please tell me what webmail service you use,do they not use javascript? Scam implies intentional deception,you failes to prove that. Moreover you sir are slandering them. Let me say this - I don't care if they literally cloned yahoo's codebase, they are in switzerland and I pay them for their service, that alone makes them worth paying every cent!

Sir_Cmpwn 8y ago
I never said I distrust PGP. Where do you think I said that?

dv7 8y ago

Out of curiosity: what is your opinion on password managers like 1Password and LastPass?

Sir_Cmpwn 8y ago
Similarly negative.
- CedarMadness 8y ago
  And Bitwarden? It's fully open-source and self-hostable.
  - Sir_Cmpwn 8y ago
    +1 Personally I use pass: https://www.passwordstore.org/ https://www.passwordstore.org/

zaarn 8y ago

>They own your email Bring your own domain. I'm doing that and it works perfectly fine. >they don't support open protocols including SMTP and IMAP Use the bridge, that supports SMTP and IMAP just fine. I even managed to make it run on my server and basically abuse that for login via VPN (though I stopped because running the X server for that got annoying) >the only way to export your emails is through a proprietary end-user application. They're working on an import/export tool. In the meantime, use the IMAP bridge and any sane IMAP backup tool like I do. >it's a scam I wouldn't call it a scam, nobody is taking the money and running off with it or not giving you what they advertise. You do get encrypted mail, you do get a lot more security than most people with simple SMTP or IMAP, atleast the average user. I think your description is a bit dishonest or atleast biased.

Sir_Cmpwn 8y ago
The bridge is proprietary software that only supports paid users. That's a really bullshit excuse given that every other provider supports IMAP directly and for free, an open protocol which has been standardized for over 20 years. An email "provider" which doesn't support IMAP/SMTP is a scam, I didn't stutter.
- zaarn 8y ago
  The bridge costs money, yes. This is also stated in their FAQ. If you don't like it, you're free not to use their services. Show me the international contract of email providers that says all email providers need to give you free IMAP/SMTP access or IMAP/SMTP access at all. Even google doesn't give you IMAP/SMTP out of the box, you have to dig through the settings to enable that. I don't need this other than occasional backup via their bridge. I don't want a desktop mail client, I#ve been running Rainloop for about a year until I switch to PM and it still annoyed me to no end because frankly IMAP sucks. It sucks majorly.
- cube2222 8y ago
  Most of those providers are using your data for ads. It's not free. I am working on a fairly high scale email service. IMAP and POP are very resource intensive parts of our infrastructure.

GW150914 8y ago

None of that sounds like it fits a reasonable definition of “it’s a scam,” so much as it just doesn’t fit with your various ideological stances.

newscracker 8y ago

> They own your email, they don't support open protocols including SMTP and IMAP and the only way to export your emails is through a proprietary end-user application. They excuse this nonsense by saying that it's necessary for encryption, which is blatantly false. > This is rich. Why don't you start with the far more fundamental and important standards of SMTP and IMAP, Protonmail? Why don't you open source your desktop & mobile applications or your bridge? What a joke. These are the exact reasons I have discouraged ProtonMail in every discussion it comes up. This is not a system that boasts the best of email as a platform, the decentralized and federated nature of it. In reality, it's just a walled garden of its own, even worse than Gmail, because there's no easy "takeout" solution. The IMAP support has been in the works for more than two years, and continues to remain in beta for a long time. To make things worse, when I checked a while ago, it's available only to paying customers. That's like holding the free user base for ransom. I would not recommend any email platform that actively makes it difficult to switch out. ProtonMail is a good example of such a platform, for my considerations.

bartbutler 8y ago
Import/export tool is in beta now and will be available for all users on launch. Export is available now via the web interface but it's a little clunky. The reason this stuff is complex and taking a while is not nefarious, it's because most people don't want just ciphertext when they export their mail.

auslander 8y ago

People, you are feeding this troll by replying, its the goal of trolling, keep the nonsense ongoing so it loses any sense.