3 ms·
Slightly OT, but I didn't see an important question being asked: What is the motivating threat model of ProtonMail? If I just want to access my email securely
by doomrobo 7y ago
Slightly OT, but I didn't see an important question being asked:
What is the motivating threat model of ProtonMail?
If I just want to access my email securely, that's done by HTTPS. If I want an end-to-end encrypted solution, ProtonMail can provide that, though only for emails between ProtonMail users. For e2e outside of ProtonMail, I can use PGP.
From what I understand, ProtonMail makes all the PGP stuff easier by baking it into their UI. Is there anything else it offers other than this convenience? Are they encrypting incoming mail with recipient keys and throwing away the original? If so, who is that protecting, and against whom? Presumably the plaintext was stored by the sender and possibly seen by intermediary servers. Can I get similar security properties by periodically downloading my email and deleting it off the server (assuming the deletion is actually happening)?
These are honest questions. I admit I'm skeptical of PM's utility, but I'd this fits someone's usecase and threat model, I can't argue with that.
- scotch_drinker 7y agoI'm using ProtonMail because I'm trying to de-Google-Amazon-Facebook my life somewhat as another user mentions. I'm tired of being the product and am willing to pay for certain things.
- doomrobo 7y agoSo why ProtonMail over any other email provider, besides GMail? Would you be willing to pay for email?
- arosier 7y agoProtonMail employee here: Are they encrypting incoming mail with recipient keys and throwing away the original? Yes we do. This mainly protects against service level requests for data in the future. Can I get similar security properties by periodically downloading my email and deleting it off the server (assuming the deletion is actually happening)? Yup, assuming you want to deal with that. ProtonMail is designed to give you a privacy focused option for email.