3 ms·

Unless you count the promises on their front page. "All emails are secured automatically with end-to-end encryption. This means even we cannot decrypt and read

Unless you count the promises on their front page. "All emails are secured automatically with end-to-end encryption. This means even we cannot decrypt and read your emails. As a result, your encrypted emails cannot be shared with third parties." Obviously that's not possible when receiving mail via SMTP and providing access via IMAP. But that's not clear to non-technical users. I think it's fair to say that putting the above quote on the landing page is misleading. EDIT: I was wrong on IMAP, which requires users to install a bridge application that handles decryption. That doesn't change anything about SMTP, though.

freeflight 8y ago
> Obviously that's not possible when receiving mail via SMTP and providing access via IMAP. Afaik on desktop all those involve the use of the ProtonMail Bridge application [0]? At least that was my understanding when I couldn't get my Thunderbird setup to check ProtonMail accounts, it requires the Bridge application. The paper is weird in that context because the Bridge application is mentioned only once in the whole paper, as a side note: "For simplicity, we group it with smartphone applications." But from what I understand their whole Outlook client setup wouldn't even work without it, so desktop clients are just as secure as the smartphone applications when they use the Bridge? [0] https://protonmail.com/support/knowledge-base/imap-smtp-and-pop3-setup/ https://protonmail.com/support/knowledge-base/imap-smtp-and-...
- lorenzhs 8y ago
  Oh, looks like you're right on IMAP. But they still receive mail via SMTP from other servers, there's no way around it if you want to be able to receive email from people not using your service. You need to be confident that their receiving servers encrypt your email without storing an unencrypted copy elsewhere.
m000 8y ago
Yes, for not technical users this can be misleading. Protonmail could have been more up-front.

freeflight 8y ago

> Obviously that's not possible when receiving mail via SMTP and providing access via IMAP. Afaik on desktop all those involve the use of the ProtonMail Bridge application [0]? At least that was my understanding when I couldn't get my Thunderbird setup to check ProtonMail accounts, it requires the Bridge application. The paper is weird in that context because the Bridge application is mentioned only once in the whole paper, as a side note: "For simplicity, we group it with smartphone applications." But from what I understand their whole Outlook client setup wouldn't even work without it, so desktop clients are just as secure as the smartphone applications when they use the Bridge? [0] https://protonmail.com/support/knowledge-base/imap-smtp-and-pop3-setup/ https://protonmail.com/support/knowledge-base/imap-smtp-and-...

lorenzhs 8y ago
Oh, looks like you're right on IMAP. But they still receive mail via SMTP from other servers, there's no way around it if you want to be able to receive email from people not using your service. You need to be confident that their receiving servers encrypt your email without storing an unencrypted copy elsewhere.

m000 8y ago

Yes, for not technical users this can be misleading. Protonmail could have been more up-front.