16 ms·

I recently left ProtonMail and went back to Fastmail. My reason was that they will never be able to fully support IMAP and now CalDAV because of the encryption

I recently left ProtonMail and went back to Fastmail. My reason was that they will never be able to fully support IMAP and now CalDAV because of the encryption they use. I grew to accept that email is not for secure messaging and my paranoia of "I'm being watched" just went away. If you need secure messaging, use something other than email.

ravenstine 7y ago
Did you try this? https://protonmail.com/bridge/ https://protonmail.com/bridge/ Or did it not work for you?
- prophesi 7y ago
  Well, snap! Does Tutanota have something akin to this? I also have stopped using Tuta/Proton due to the IMAP incompatibility.
  - prophesi 7y ago
    Did some digging, and it seems like it's at least on the roadmap, but I'm not sure how high of a priority it is. https://github.com/tutao/tutanota/issues/544 https://github.com/tutao/tutanota/issues/544
- EduardoBautista 7y ago
  I did. It’s slow. Also, it’s not available on iOS.
  - martinbm 7y ago
    When did you last use the bridge? They released an update a month or so ago which has made it significantly faster to sync changes. I do agree that it would be great to be able to use your own mail client on iOS. Not sure that will ever happen though.
steveeq1 7y ago
> I grew to accept that email is not for secure messaging and my paranoia of "I'm being watched" just went away. Agreed. Even if you use protonmail, google still has most of your email because they have the most of everyone else's.
- ravenstine 7y ago
  True, though I still think it's preferable to use for business, purchases, and logins. If I'm using an email besides Gmail, at least it means that I have a shot in that Google won't immediately know that I signed up for X service or made X purchase. Sure, they probably can figure those things out in other ways, but I'm not going to willingly hand everything directly to them. Part of the reason I use Protonmail(and pay for it) is because I want to support the notion that the web can be made up of different services as opposed to all being calls to .google.com or .facebook.com.
- newscracker 7y ago
  I feel very frustrated when I hear this argument, as if it’s futile to switch to a different email provider. It’s actually hyperbole. Most people use chat and messaging platforms (or social media platforms) to communicate with others. Personal email, IME, has reduced drastically over the years. That leaves emails that businesses send to individuals, which are usually sent through non-free-profiling-based-Gmail methods (including GSuite, which Google cannot use to profile people). Only small businesses that don’t know any better or don’t want to spend money on email would use an @gmail address (or @yahoo, @outlook, etc.) to correspond with potential and current customers.
- CivBase 7y ago
  > Even if you use protonmail, google still has most of your email because they have the most of everyone else's. I have far more incoming emails than outgoing and most of them are automated - probably not using GMail. That includes most of the most sensitive content like invoices and account management.
mechhacker 7y ago
For me it was their app just being so far behind Fastmail. If they had a better app I'd gladly pay. I just can't stomach gmail anymore and Fastmail was next best.
- BlueTemplar 7y ago
  How do both of these compare to Thunderbird?
  - mechhacker 7y ago
    I haven't used Thunderbird enough to answer this
- Klonoar 7y ago
  Amusingly enough, Fastmail is a web app wrapped in WKWebview and Protonmail is a truly native app. Based on comments over in /r/protonmail there's some redesigns coming for the apps that should hopefully improve on the creature comforts.
  - mechhacker 7y ago
    I hope this is true because I like the privacy aspect of protonmail and would pay for it in that case.
mdp 7y ago
I came to a similar conclusion. You should write every email as if it were public, because it's entirely likely that it will be. They can be forwarded, made public through legal discovery, or exposed in a data breach (eg. Sony/North Korea). Forget security for a second, imagining every email as public record will make you more considerate and less biased writer. And from a business perspective, email should be viewed as a public legal record, because in some cases it will be used that way. That's not to say that there shouldn't be private messaging options, it's just that email isn't one of them and was never really built to be. PGP was always sort of a tacked on solution with a lot of faults (no forward secrecy, plenty of meta data leakage, usability issues) All that being said, I still left Gmail for Fastmail. Just because I consider every email I write to be public doesn't mean I want Google getting a free pass to mine and sell my data.
- decebalus1 7y ago
  > Forget security for a second, imagining every email as public record will make you more considerate and less biased writer. And from a business perspective, email should be viewed as a public legal record, because in some cases it will be used that way. > Just because I consider every email I write to be public Cool. Can I have the creds to your Fastmail account then? I'm curious what you're up to these days. If you're not comfortable doing that (I promise I won't send any emails - not that it matters, I could still spoof your address anyway), I could settle with a dump of all the emails you've sent. I get the whole 'write every email with the mindset that it could one day end up on the front page of NY Times' but that doesn't dismiss security requirements for locking down your email/calendar account.
  - tptacek 7y ago
    This is not a very strong argument. Here's a specific refutation: the credentials to their primary email account are likely equivalent to the credentials of many other services that they use, because of password reset. None of those emails are encrypted, or ever will be; further, they're of little value just a day or two after they're sent. That commenter could coherently expect both that their mail spool would eventually be "public" and that it was safe to use email for password resets. More generally: it's reasonable both to expect that your mail spool could eventually be public, and still not to want people to read it. There are things I don't want people to read, and there are things I need to be as careful as I can to ensure everyone can't read. Email works for the former and not the latter, and the latter is what encrypted messaging was invented for. Comparatively: I don't know many people who trust Twitter DMs, and "let's move this off Twitter DMs" is a constant refrain. But my answer to "can I read all your Twitter DMs" is still "no".
Youden 7y ago
I agree that email shouldn't be considered secure but disagree that you should just give up as a result. It's trivial to use an email provider in a more privacy-friendly jurisdiction (e.g. Mailbox.org in Germany) and with a bit of effort you can even move to a provider the PGP-encrypts incoming email which can then be decrypted by your email client (which can connect with IMAP). Given that the first measure is near-zero effort and saves you from silent/warrantless law enforcement requests, I think it's worth it. Encryption is a bit more annoying but it does save you from later disclosure of your emails.
CivBase 7y ago
> If you need secure messaging, use something other than email. Many services I need do not give me an alternative. I only continue to use email because of those services.
ljm 7y ago
Same deal, I loved the service but I don’t love living in my browser. I wanted IMAP and eventually that meant installing an app that ran a local IMAP sever that your client needed to connect to. I suppose it’s a limitation of the protocol, and it’s good that protonmail doesn’t store your emails plaintext. However, they know the encryption keys...and so will any attacker. I went to the Office 365 email package because I get more value out of the exchange server. Any emails I want to encrypt, I will do so myself. 99.99999% of my inbox is spam and automated mailing list crap and notifications and TOS updates, with maybe one or two emails every couple of months that are actually from a human being.
- dastx 7y ago
  > However, they know the encryption keys...and so will any attacker. I might be mistaken, but my understanding is that they encrypt your encryption keys using your password within the browser. They only store the encrypted blob and thus they are unable to decrypt any emails. Having said that, since emails come in unencrypted anyway, they can, in theory, log everything there. Including the sender, receiver and what the email contains.
StanislavPetrov 7y ago
"Secure messaging" is a fantasy. Nothing is 100% secure. The question then becomes, how much security is important to you? Personally I prefer a marginal level of security with encrypted email over no security at all. Your argument is the same as saying, "well they might as well store our passwords in plain text since encrypted passwords often get leaked or hacked anyway".
smadurange 7y ago
Same here. Unless all parties use the same encrypted email service, this made no sense to me actually.
dastx 7y ago
Please note that Fastmail is an Australian service. I would not trust Fastmail with my email privacy. Not because of the company, but because of the encryption laws in Australia. Food for thought.
- deleted 7y ago
  [deleted]
- supercommand 7y ago
  Are you suggesting isp’s are more trustworthy in America? Because you’ve got to get your email over someone’s pipes eventually. Fastmail is excellent. If you want secure/private/not easily spoofable by a 5 year old and you’re using email.... then you’re doing it all wrong.
  - dastx 7y ago
    > Are you suggesting isp’s are more trustworthy in America? Certainly not. My comment is relating to their data encryption laws that was passed in 2018. If you care about your privacy in any way, shape or form, individuals should be very wary of using services that operate from, or are owned by individuals in Australia (and the rest of the 5 eyes for that matter) unless you have your encryption keys and all encryption happens on your client app.
- osn9363739 7y ago
  I don't understand. Email isn't encrypted is it? And what can the Australian government do that the US government can't these days?
  - dastx 7y ago
    Recent (2018) Australian data encryption laws are insane and archaic. It allows law enforcement to force individuals (including but not limited to developers) or companies to build a back door and requires them not to tell any one, including their employers. I'm not saying the US is better or worse, or that the UK (where I live) is better or worse. I'm raising awareness as not a lot of people know about their data encryption laws. Personally I'd wanted to move to Australia but stopped chasing that due to their data encryption laws.
throwawayquick 7y ago
for personal use, maybe? but for business use, you need email security
riddlemethat 7y ago
Fastmail doesn’t offer phone support for paid users. I have an account with them and spent months troubleshooting a carddav sync issue with my two Mac computers before giving up and switching contacts over to iCloud. Proton mail seems pretty hungry for business. I inquired for a paid plan and they follow up all the time with sales people who have unique email addresses.
- supercommand 7y ago
  Interesting maybe try a fresh contact import on your macs? I know about 20+ people who use IMacs iPhones and MacBooks with fastmail and have no syncing issues.
  - riddlemethat 7y ago
    I used it for two years without issue. Tried to export and reimport to no avail.

ravenstine 7y ago

Did you try this? https://protonmail.com/bridge/ https://protonmail.com/bridge/ Or did it not work for you?

prophesi 7y ago
Well, snap! Does Tutanota have something akin to this? I also have stopped using Tuta/Proton due to the IMAP incompatibility.
- prophesi 7y ago
  Did some digging, and it seems like it's at least on the roadmap, but I'm not sure how high of a priority it is. https://github.com/tutao/tutanota/issues/544 https://github.com/tutao/tutanota/issues/544
EduardoBautista 7y ago
I did. It’s slow. Also, it’s not available on iOS.
- martinbm 7y ago
  When did you last use the bridge? They released an update a month or so ago which has made it significantly faster to sync changes. I do agree that it would be great to be able to use your own mail client on iOS. Not sure that will ever happen though.

steveeq1 7y ago

> I grew to accept that email is not for secure messaging and my paranoia of "I'm being watched" just went away. Agreed. Even if you use protonmail, google still has most of your email because they have the most of everyone else's.

ravenstine 7y ago
True, though I still think it's preferable to use for business, purchases, and logins. If I'm using an email besides Gmail, at least it means that I have a shot in that Google won't immediately know that I signed up for X service or made X purchase. Sure, they probably can figure those things out in other ways, but I'm not going to willingly hand everything directly to them. Part of the reason I use Protonmail(and pay for it) is because I want to support the notion that the web can be made up of different services as opposed to all being calls to .google.com or .facebook.com.
newscracker 7y ago
I feel very frustrated when I hear this argument, as if it’s futile to switch to a different email provider. It’s actually hyperbole. Most people use chat and messaging platforms (or social media platforms) to communicate with others. Personal email, IME, has reduced drastically over the years. That leaves emails that businesses send to individuals, which are usually sent through non-free-profiling-based-Gmail methods (including GSuite, which Google cannot use to profile people). Only small businesses that don’t know any better or don’t want to spend money on email would use an @gmail address (or @yahoo, @outlook, etc.) to correspond with potential and current customers.
CivBase 7y ago
> Even if you use protonmail, google still has most of your email because they have the most of everyone else's. I have far more incoming emails than outgoing and most of them are automated - probably not using GMail. That includes most of the most sensitive content like invoices and account management.

mechhacker 7y ago

For me it was their app just being so far behind Fastmail. If they had a better app I'd gladly pay. I just can't stomach gmail anymore and Fastmail was next best.

BlueTemplar 7y ago
How do both of these compare to Thunderbird?
- mechhacker 7y ago
  I haven't used Thunderbird enough to answer this
Klonoar 7y ago
Amusingly enough, Fastmail is a web app wrapped in WKWebview and Protonmail is a truly native app. Based on comments over in /r/protonmail there's some redesigns coming for the apps that should hopefully improve on the creature comforts.
- mechhacker 7y ago
  I hope this is true because I like the privacy aspect of protonmail and would pay for it in that case.

mdp 7y ago

I came to a similar conclusion. You should write every email as if it were public, because it's entirely likely that it will be. They can be forwarded, made public through legal discovery, or exposed in a data breach (eg. Sony/North Korea). Forget security for a second, imagining every email as public record will make you more considerate and less biased writer. And from a business perspective, email should be viewed as a public legal record, because in some cases it will be used that way. That's not to say that there shouldn't be private messaging options, it's just that email isn't one of them and was never really built to be. PGP was always sort of a tacked on solution with a lot of faults (no forward secrecy, plenty of meta data leakage, usability issues) All that being said, I still left Gmail for Fastmail. Just because I consider every email I write to be public doesn't mean I want Google getting a free pass to mine and sell my data.

decebalus1 7y ago
> Forget security for a second, imagining every email as public record will make you more considerate and less biased writer. And from a business perspective, email should be viewed as a public legal record, because in some cases it will be used that way. > Just because I consider every email I write to be public Cool. Can I have the creds to your Fastmail account then? I'm curious what you're up to these days. If you're not comfortable doing that (I promise I won't send any emails - not that it matters, I could still spoof your address anyway), I could settle with a dump of all the emails you've sent. I get the whole 'write every email with the mindset that it could one day end up on the front page of NY Times' but that doesn't dismiss security requirements for locking down your email/calendar account.
- tptacek 7y ago
  This is not a very strong argument. Here's a specific refutation: the credentials to their primary email account are likely equivalent to the credentials of many other services that they use, because of password reset. None of those emails are encrypted, or ever will be; further, they're of little value just a day or two after they're sent. That commenter could coherently expect both that their mail spool would eventually be "public" and that it was safe to use email for password resets. More generally: it's reasonable both to expect that your mail spool could eventually be public, and still not to want people to read it. There are things I don't want people to read, and there are things I need to be as careful as I can to ensure everyone can't read. Email works for the former and not the latter, and the latter is what encrypted messaging was invented for. Comparatively: I don't know many people who trust Twitter DMs, and "let's move this off Twitter DMs" is a constant refrain. But my answer to "can I read all your Twitter DMs" is still "no".

Youden 7y ago

I agree that email shouldn't be considered secure but disagree that you should just give up as a result. It's trivial to use an email provider in a more privacy-friendly jurisdiction (e.g. Mailbox.org in Germany) and with a bit of effort you can even move to a provider the PGP-encrypts incoming email which can then be decrypted by your email client (which can connect with IMAP). Given that the first measure is near-zero effort and saves you from silent/warrantless law enforcement requests, I think it's worth it. Encryption is a bit more annoying but it does save you from later disclosure of your emails.

CivBase 7y ago

> If you need secure messaging, use something other than email. Many services I need do not give me an alternative. I only continue to use email because of those services.

ljm 7y ago

Same deal, I loved the service but I don’t love living in my browser. I wanted IMAP and eventually that meant installing an app that ran a local IMAP sever that your client needed to connect to. I suppose it’s a limitation of the protocol, and it’s good that protonmail doesn’t store your emails plaintext. However, they know the encryption keys...and so will any attacker. I went to the Office 365 email package because I get more value out of the exchange server. Any emails I want to encrypt, I will do so myself. 99.99999% of my inbox is spam and automated mailing list crap and notifications and TOS updates, with maybe one or two emails every couple of months that are actually from a human being.

dastx 7y ago
> However, they know the encryption keys...and so will any attacker. I might be mistaken, but my understanding is that they encrypt your encryption keys using your password within the browser. They only store the encrypted blob and thus they are unable to decrypt any emails. Having said that, since emails come in unencrypted anyway, they can, in theory, log everything there. Including the sender, receiver and what the email contains.

StanislavPetrov 7y ago

"Secure messaging" is a fantasy. Nothing is 100% secure. The question then becomes, how much security is important to you? Personally I prefer a marginal level of security with encrypted email over no security at all. Your argument is the same as saying, "well they might as well store our passwords in plain text since encrypted passwords often get leaked or hacked anyway".

smadurange 7y ago

Same here. Unless all parties use the same encrypted email service, this made no sense to me actually.

dastx 7y ago

Please note that Fastmail is an Australian service. I would not trust Fastmail with my email privacy. Not because of the company, but because of the encryption laws in Australia. Food for thought.

deleted 7y ago
[deleted]
supercommand 7y ago
Are you suggesting isp’s are more trustworthy in America? Because you’ve got to get your email over someone’s pipes eventually. Fastmail is excellent. If you want secure/private/not easily spoofable by a 5 year old and you’re using email.... then you’re doing it all wrong.
- dastx 7y ago
  > Are you suggesting isp’s are more trustworthy in America? Certainly not. My comment is relating to their data encryption laws that was passed in 2018. If you care about your privacy in any way, shape or form, individuals should be very wary of using services that operate from, or are owned by individuals in Australia (and the rest of the 5 eyes for that matter) unless you have your encryption keys and all encryption happens on your client app.
osn9363739 7y ago
I don't understand. Email isn't encrypted is it? And what can the Australian government do that the US government can't these days?
- dastx 7y ago
  Recent (2018) Australian data encryption laws are insane and archaic. It allows law enforcement to force individuals (including but not limited to developers) or companies to build a back door and requires them not to tell any one, including their employers. I'm not saying the US is better or worse, or that the UK (where I live) is better or worse. I'm raising awareness as not a lot of people know about their data encryption laws. Personally I'd wanted to move to Australia but stopped chasing that due to their data encryption laws.

throwawayquick 7y ago

for personal use, maybe? but for business use, you need email security

riddlemethat 7y ago

Fastmail doesn’t offer phone support for paid users. I have an account with them and spent months troubleshooting a carddav sync issue with my two Mac computers before giving up and switching contacts over to iCloud. Proton mail seems pretty hungry for business. I inquired for a paid plan and they follow up all the time with sales people who have unique email addresses.

supercommand 7y ago
Interesting maybe try a fresh contact import on your macs? I know about 20+ people who use IMacs iPhones and MacBooks with fastmail and have no syncing issues.
- riddlemethat 7y ago
  I used it for two years without issue. Tried to export and reimport to no avail.