5 ms·

>you mean the address? No, I mean they own the contents of your correspondence because you can't get the emails out. >how is SMTP/IMAP access supposed to work

>you mean the address? No, I mean they own the contents of your correspondence because you can't get the emails out. >how is SMTP/IMAP access supposed to work? you send the plaintext password to their server to decrypt and hope they're not storing your password? No, you send it over TLS. You can also take some cues from Google and do IMAP-specific passwords or OAuth over IMAP/SMTP.

c2h5oh 8y ago
You can use SMTP/IMAP if you want using a local bridge https://protonmail.com/fr/bridge/ https://protonmail.com/fr/bridge/
- Sir_Cmpwn 8y ago
  I referred to this in my comment. It's proprietary, communicates with ProtonMail over their proprietary API, and is only supported for paid users. These are fundamental features of an MTA, not a paid addon, this is absolutely disgusting.
  - gruez 8y ago
    >I referred to this in my comment. It's proprietary, communicates with ProtonMail over their proprietary API, and is only supported for paid users. These are fundamental features of an MTA, not a paid addon, this is absolutely disgusting. This goes back to the my original point that protonmail is pgp for most people. You sound like the sort of person who'd use a self hosted email server + some IMAP/POP3 client + some PGP client with self managed keys. Maybe having an open stack is important to you, but people like you are definitely in the minority. Most people don't know and/or care what PGP, IMAP, or MTA is, but they want something more secure than gmail/outlook.
    - Sir_Cmpwn 8y ago
      Lying to laymen about security is morally wrong. The security guarantees protonmail claims to provide literally cannot be guaranteed. And for the record, I wrote my comments on "Hacker" News, not in my local newspaper. The readers here are not "most people" and I can expect many more of them to have similar values to me.
      - deftnerd 8y ago
        Being unable to prove a companies claims yourself != company lieing. A year ago, they posted on Reddit: "Audits have been done, about one per year usually. Cyberkov has done 3 audits since 2014 (they recommend it for their activities with Palestinian activists, so security audits are necessary)" Do you claim that the independent security firm Cyberkov is lying too? With the preponderance of evidence they've provided (security audits, open source, and transparency into how everything works), if you're saying that this is a big scam and they're lying about everything, it's really up to you now to provide some evidence.
CharlesW 8y ago
> No, I mean they own the contents of your correspondence because you can't get the emails out. It looks like you can using beta.protonmail.com.[1] [1] https://protonmail.com/support/knowledge-base/how-to-export-emails-from-your-protonmail-account/ https://protonmail.com/support/knowledge-base/how-to-export-...
gruez 8y ago
>No, I mean they own the contents of your correspondence because you can't get the emails out. Isn't this just a variant of the "can't access your mails without using their client" argument? If you're really keen on using your favorite IMAP client, pay for premium and use their bridge. >No, you send it over TLS. You can also take some cues from Google and do IMAP-specific passwords or OAuth over IMAP/SMTP. How does that solve the issue of them (protonmail) stealing your password (and thus the private key used to encrypt your emails)? They need your private key to decrypt your emails server-side. If they have your private key, they can decrypt all future and past emails. Worst of all, it's totally undetectable, unlike the backdoored javascript threat that you mentioned earlier.
- Sir_Cmpwn 8y ago
  >If you're really keen on using your favorite IMAP client, pay for premium and use their bridge No, that's absolute bullshit. Paying to export your own data from a service is nuts. Not implementing features which have been expected from every mail server for the past 20 years is nuts. This behavior is inexcusable. >They need your private key to decrypt your emails server-side No, they don't, they can just send you PGP encrypted emails over IMAP and you can decrypt them client-side. This is how it works for everyone else.
  - cube2222 8y ago
    They're not a charity. If that's what they need to build a sustainable business, I'm happy to pay them, if they deliver.
    - Sir_Cmpwn 8y ago
      If paying them for your own data is your cup of tea, then you might be interested in this bridge I have for sale.
      - cube2222 8y ago
        You do realize this is there to amortize the free actual service usage?
TotempaaltJ 8y ago
> No, you send it over TLS. I don't think you understand how zero-knowledge encryption works.
- Sir_Cmpwn 8y ago
  You have to log into Protonmail's web UI with a username and password, too. How do you think this works? I'm not saying you should transmit your PGP key's passphrase to them.
  - bartbutler 8y ago
    It doesn't work how you seem to think it does. Your password never goes to the server: https://protonmail.com/blog/encrypted_email_authentication/ https://protonmail.com/blog/encrypted_email_authentication/
    - Sir_Cmpwn 8y ago
      I see. Still, this process can be performed by a mail client using IMAP or SMTP extensions, the same way the web client does - I would be happy to implement this in my own IMAP/SMTP-related software. Google also has a feature which supports a separate IMAP/SMTP password from your account password, a similar system would be easy to implement for Protonmail.
      - gruez 8y ago
        why go through all that effort (writing a spec, getting third party email clients on board, etc.), when they can write a webapp and call it a day? i'm not sure about other people, but i don't even use a mail client; i just use whatever webapp my mailbox provides.
        Sir_Cmpwn 8y ago
        Many hundreds of thousands if not millions of users utilize IMAP to receive email on their phone apps, thunderbird, outlook, etc. Support for it is expected of any mail provider as part of the basic requirements of operating an email service. Extending this with an extra means of authentication is comparatively easy to adding it to your web app.
nasredin 8y ago
Correct. When I signed up for the free tier nowhere did it say you can't forward your mail or access ot via IMAP or POP3. A bit misleading IMHO.

c2h5oh 8y ago

You can use SMTP/IMAP if you want using a local bridge https://protonmail.com/fr/bridge/ https://protonmail.com/fr/bridge/

Sir_Cmpwn 8y ago
I referred to this in my comment. It's proprietary, communicates with ProtonMail over their proprietary API, and is only supported for paid users. These are fundamental features of an MTA, not a paid addon, this is absolutely disgusting.
- gruez 8y ago
  >I referred to this in my comment. It's proprietary, communicates with ProtonMail over their proprietary API, and is only supported for paid users. These are fundamental features of an MTA, not a paid addon, this is absolutely disgusting. This goes back to the my original point that protonmail is pgp for most people. You sound like the sort of person who'd use a self hosted email server + some IMAP/POP3 client + some PGP client with self managed keys. Maybe having an open stack is important to you, but people like you are definitely in the minority. Most people don't know and/or care what PGP, IMAP, or MTA is, but they want something more secure than gmail/outlook.
  - Sir_Cmpwn 8y ago
    Lying to laymen about security is morally wrong. The security guarantees protonmail claims to provide literally cannot be guaranteed. And for the record, I wrote my comments on "Hacker" News, not in my local newspaper. The readers here are not "most people" and I can expect many more of them to have similar values to me.
    - deftnerd 8y ago
      Being unable to prove a companies claims yourself != company lieing. A year ago, they posted on Reddit: "Audits have been done, about one per year usually. Cyberkov has done 3 audits since 2014 (they recommend it for their activities with Palestinian activists, so security audits are necessary)" Do you claim that the independent security firm Cyberkov is lying too? With the preponderance of evidence they've provided (security audits, open source, and transparency into how everything works), if you're saying that this is a big scam and they're lying about everything, it's really up to you now to provide some evidence.

CharlesW 8y ago

> No, I mean they own the contents of your correspondence because you can't get the emails out. It looks like you can using beta.protonmail.com.[1] [1] https://protonmail.com/support/knowledge-base/how-to-export-emails-from-your-protonmail-account/ https://protonmail.com/support/knowledge-base/how-to-export-...

gruez 8y ago

>No, I mean they own the contents of your correspondence because you can't get the emails out. Isn't this just a variant of the "can't access your mails without using their client" argument? If you're really keen on using your favorite IMAP client, pay for premium and use their bridge. >No, you send it over TLS. You can also take some cues from Google and do IMAP-specific passwords or OAuth over IMAP/SMTP. How does that solve the issue of them (protonmail) stealing your password (and thus the private key used to encrypt your emails)? They need your private key to decrypt your emails server-side. If they have your private key, they can decrypt all future and past emails. Worst of all, it's totally undetectable, unlike the backdoored javascript threat that you mentioned earlier.

Sir_Cmpwn 8y ago
>If you're really keen on using your favorite IMAP client, pay for premium and use their bridge No, that's absolute bullshit. Paying to export your own data from a service is nuts. Not implementing features which have been expected from every mail server for the past 20 years is nuts. This behavior is inexcusable. >They need your private key to decrypt your emails server-side No, they don't, they can just send you PGP encrypted emails over IMAP and you can decrypt them client-side. This is how it works for everyone else.
- cube2222 8y ago
  They're not a charity. If that's what they need to build a sustainable business, I'm happy to pay them, if they deliver.
  - Sir_Cmpwn 8y ago
    If paying them for your own data is your cup of tea, then you might be interested in this bridge I have for sale.
    - cube2222 8y ago
      You do realize this is there to amortize the free actual service usage?

TotempaaltJ 8y ago

> No, you send it over TLS. I don't think you understand how zero-knowledge encryption works.

Sir_Cmpwn 8y ago
You have to log into Protonmail's web UI with a username and password, too. How do you think this works? I'm not saying you should transmit your PGP key's passphrase to them.
- bartbutler 8y ago
  It doesn't work how you seem to think it does. Your password never goes to the server: https://protonmail.com/blog/encrypted_email_authentication/ https://protonmail.com/blog/encrypted_email_authentication/
  - Sir_Cmpwn 8y ago
    I see. Still, this process can be performed by a mail client using IMAP or SMTP extensions, the same way the web client does - I would be happy to implement this in my own IMAP/SMTP-related software. Google also has a feature which supports a separate IMAP/SMTP password from your account password, a similar system would be easy to implement for Protonmail.
    - gruez 8y ago
      why go through all that effort (writing a spec, getting third party email clients on board, etc.), when they can write a webapp and call it a day? i'm not sure about other people, but i don't even use a mail client; i just use whatever webapp my mailbox provides.
      - Sir_Cmpwn 8y ago
        Many hundreds of thousands if not millions of users utilize IMAP to receive email on their phone apps, thunderbird, outlook, etc. Support for it is expected of any mail provider as part of the basic requirements of operating an email service. Extending this with an extra means of authentication is comparatively easy to adding it to your web app.

nasredin 8y ago

Correct. When I signed up for the free tier nowhere did it say you can't forward your mail or access ot via IMAP or POP3. A bit misleading IMHO.