11 ms·
The ProtonMail Android app is now open source
- aloisdg 6y agoFirst issue on the repository: [Asking for F-Droid support][1] [1]: https://github.com/ProtonMail/proton-mail-android/issues/1 https://github.com/ProtonMail/proton-mail-android/issues/1
- riccardobrasca 6y agoThis is very nice!
- 9wzYQbTYsAIc 6y agoGood to see that they are on a positive stream with their commitment to open sourcing their apps. Really looking forward to when Proton has near parity with the GSuite basics.
- _eigenfoo 6y agoProtonMail seems to be on a roll this month. They both released Bridge for Linux [1] and open sourced Bridge [2]. [1] https://protonmail.com/blog/proton-bridge-linux-launch/ https://protonmail.com/blog/proton-bridge-linux-launch/ [2] https://protonmail.com/blog/bridge-open-source/ https://protonmail.com/blog/bridge-open-source/
- 9wzYQbTYsAIc 6y agoApparently this marks the occasion that all of their non-beta apps are now open source.
- throwaway55554 6y agoInteresting. I run rainloop on my (local) server so I can have mail in my browser (while on my lan). I'll have to see if I can get bridge for linux working with that. Server is headless, so hopefully bridge is too...
- 9wzYQbTYsAIc 6y agoBridge is GUI by default but has command line switch for headless.
- dyingkneepad 6y agoOh, bad timing. Just a few months ago I was on the fence about Protonmail vs Fastmail (vs all others) and ended jumping to Fastmail: the privacy pro didn't seem to outweigh the cons. Now with open sourcing stuff the pros do get somewhat better... But reevaluating and switching would be troublesome.... Maybe in a few years I'll revisit it :)
- frodprefect 6y agoThe pricing is very different. Fastmail allows unlimited domains where proton is almost double the cost for two.
- stjohnswarts 6y agoDoes fastmail offer encrypted server side email though?
- dyingkneepad 6y agoWell, not just pricing or privacy or domains, there's a lot that's different. That's why I mentioned weighing pros vs cons.
- novok 6y agoYeah protonmail charging for the marginally free stuff, like domains and aliases is very disappointing. I make a new email for every account, in the form of catchall_alias@username.domain.com do I have to pay proton mail $24/month for that privilege? Also not providing 20GB space as a default paid option in this day in age of $5/month/TB is also very disappointing.
- danielskogly 6y agoI've been with ProtonMail a couple of years now, and recently made the step to buy my own domain to use for personal email. What I'm hoping is that whenever I want to switch provider in the future, it won't be any more trouble than to switch some DNS settings :)
- 6y ago
- flicker-rate 6y agoNow all they need to add is hardware 2FA key support. It's on their roadmap and supposedly development is nearly done.
- Foxboron 6y agoCool. But neither the audit nor the repository explains if it's possible to create the APK in a reproducible way. Google Play distributed APKs contain their signatures, so in theory it wouldn't be possible to 1:1 reproduce the distributed ones. However for F-droid this would allow them to sign their own APKs and provide some additional security guarantees in their supply chain. Also a bit concerning that there is no tags yet in the repository.
- McDev 6y agoYou can still upload the app with your signing key. But it's also true that Google now push developers to leave the APK signing process to them
- WrtCdEvrydy 6y agoYou could try stripping the Google Play signatures... and just doing a hash check against an existing version you build yourself.
- gruez 6y ago>Google Play distributed APKs contain their signatures https://support.google.com/googleplay/android-developer/answer/7384423?hl=en https://support.google.com/googleplay/android-developer/answ... >Note: Using app signing by Google Play is optional. You can still upload an APK and manage your own keys instead of using an app bundle
- 6y ago
- intsunny 6y agoIt's a bummer protonmail doesn't support JMAP.
- bad_user 6y agoWhy would they? AFAIK they don't support IMAP/SMTP either, not without that client-side "bridge" anyway.
- kobylisak 6y agoJMAP support by the ProtonMail Bridge would be nice though.
- t0astbread 6y agoIf you just want a simple way to access your mail over HTTP (without the need for standards) you could probably also run imap-api[1] pointed at the Bridge. Although admittedly it does feel a bit hacky. Or maybe also getmail or fetchmail which will download your mail over IMAP and put it in the maildir format as files. [1] https://github.com/andris9/imapapi https://github.com/andris9/imapapi
- noarchy 6y agoGreat to see this! On another note: there was a six month gap (unless I'm mistaken) between the iOS version being open sourced, and this Android release. I am a bit surprised that iOS got open sourced first. Is this because it did not receive the same security audit that presumably held up the release of the Android source?
- ipnon 6y agoBitwarden is another example of a company that proves you can make good profit as an open source SaaS.
- complexworld 6y agoPrevious discussions about PM 2018 - Ask HN: How secure is Protonmail really? https://news.ycombinator.com/item?id=18101090 https://news.ycombinator.com/item?id=18101090 2019 - Ask HN: FastMail vs. ProtonMail? https://news.ycombinator.com/item?id=19372882 https://news.ycombinator.com/item?id=19372882 How secure would it be to use PM if the following conditions were met? - you only used one of the open-source native PM apps - you only emailed other PM users - someone you trust audited the PM source code for the native apps - you installed from F-Droid
- app4soft 6y ago- your messages always processed by proprietary/closed source server So, it just like Telegram (or any other proprietary cloud/VPN/proxy service) - you really don't know what has happen on server side.
- kelnos 6y agoTrue, but if you do audit the client software, you can verify: * Your e2e encryption key never gets sent to the server. * Data is actually strongly encrypted using that key before leaving the client. Then isn't that sufficient to prove that the server can't do anything nefarious, even if it wanted to?
- app4soft 6y ago> Data is actually strongly encrypted using that key before leaving the client. Except "strongly encrypted message" you should send some extra info for server. And I'm not sure how those two types of info separated in Proton's communication protocol, so binary diff between those "parts" could be a key to select decrypt method.
- zaarn 6y agoTheir key encryption is fairly safe, if you use one-password mode, they could intercept your password from the webinterface if they wanted, but the password exchange is solid and doesn't reveal the password while still allowing to decrypt the key. Two password mode is technically more secure since even if the authentication exchange is cracked, the decryption key doesn't touch anything the server can see, it's locally decrypted. There isn't any meaningful diff you could make.
- aaronscott 6y agoI'm happy to see ProtonMail getting exposure. I moved over from gmail about a year ago, and have been quite pleased with their service. Only downside I've seen is that there isn't a clear way to increase available data storage, independent of other billable line items (like number of users etc). Other items on my wish list would be more customizable email filtering, I'd love to be able to create filters such as 'is this from [internet provider] and does it contain the word bill? -> inbox, else spam'
- deif 6y agoBoth those things you mention as wanting exist already. For data storage independent billing, go to Settings -> Dashboard. On Professional tier and above the data storage is a dropdown where you can increase the amount required. For email filtering go to Settings -> Filters and create as many conditions as you want on a filter.
- aaronscott 6y agoInteresting, I pay for the professional tier, and do not see a separate dropdown available for storage. The professional plan lists 5gb/user (at a rate of about $5/month), and the only way to scale up storage on my dashboard page is to provision more users (up to 100, so max of 500gb). It’s a non-issue now, but yeah I’d prefer to interact with my plan the way that you describe and be able to scale storage independently (and ideally at a cheaper rate). Regarding filters, that’s great! I didn’t see that before and will likely utilize it heavily now that I know it exists.
- deif 6y agoAh I see, yeah the Plus plan lets you choose the storage. Professional works differently for some reason. I bet if you contacted their support they'd consider changing it though as it doesn't quite make sense as-is.
- fullstop 6y agoI use both protonmail and gmail, with protonmail used for things that I feel require more privacy, such as banking. One thing that I really do miss, and I understand the reasoning, is being able to effectively search for an email. Since the content is encrypted you can only search for what is in the headers.
- fbnlsr 6y agoI wonder if it's possible to migrate my Gmail-powered email address while keeping my family's inboxes there. I'm interested in joining Protonmail but I can't afford to pay for everyone, nor will they understand my wish to move away from Google. I guess it can't be done as it's at the domain level, am I right?
- thr0w3345 6y agoThe “visionary” plan which should be enough for a family is only like €20/month
- mackrevinack 6y agodoes everyone in your family currently have the email name they want or did they have to compromise by putting numbers at the end or use similar tricks? ...because theres probably a better chance of getting the name they want with ProtonMail. the shorter name@pm.me email address is a nice feature to have as well
- fbnlsr 6y agoThe problem resides in the fact that I'm currently using G-Suite, so yeah everyone has the email they want and I'm using my own domain.
- deleted 6y ago[deleted]
- waynesonfire 6y agobeen a user for a couple years. open source everything, maybe the community can help fix their basic bugs like not being able to import their VCF exported contacts into thunderbird.
- hotgeart 6y agoIs there a way to centralize all my emails in protonmail? Can't see an option to enter my pop3/smtp server. Or I'm blind?
- kube-system 6y agoProtonMail doesn't really try to be general-purpose email client. You can either use the bridge with an email client of your choice, or you can forward your mail.
- Natales 6y agoNot really the email client of your choice. In Mac OS, you can do Apple Mail and Thunderbird well, but if you try something like Airmail, it crashes the app (or other unexpected behavior). Not exactly 100% IMAP compliant for what I can tell.
- bflesch 6y agoProtonMail/VPN are great products, but after the Crypto AG fiasco I suspect it is another CIA front. We'll find out in 50 years.
- Aissen 6y agoExactly what a CIA shill would say. We'll find out in 50 years.
- aldoushuxley001 6y agoWhat was the Crypto AG fiasco, and why does it make you suspect ProtonMail is a CIA front?
- pixxel 6y agoI missed this. What’s the fiasco?
- bflesch 6y ago"Crypto AG was a Swiss company specialising in communications and information security. It was secretly jointly owned by the American Central Intelligence Agency (CIA) and West German Federal Intelligence Service (BND) from 1970 until about 1993, with the CIA continuing as sole owner until about 2018.[1] With headquarters in Steinhausen, the company was a long-established manufacturer of encryption machines and a wide variety of cipher devices." see https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG Basically they were world's leading manufacturer of encrypted phones & fax machines for military use and it was revealed that they were controlled by German and US intelligence all along. My suspicion for ProtonMail is only that it's too good to be true: A small amount per month to solve all my privacy/confidentiality needs w/o really inconveniencing me? I'm in!
- markosaric 6y agoNice! So when can I install this and the ProtonVPN app on F-Droid? :-)
- ta1771 6y agoAfter they submit their code to the F-Droid.org team that audits and readies it for their build server queue.
- kevincox 6y ago> Their audit found that our app has no outstanding vulnerabilities. Either I'm misunderstanding what they mean by "outstanding" or this is a very bold claim. Shouldn't they be saying something like "Their audit found no vulnerabilities in our app."
- singlow 6y agoI think it means that they resolved any found vulnerabilities before the audit was published. Therefore none of the found vulnerabilities were _outstanding_ when they published it. In this case _outstanding_ means that the auditors have not yet verified a fix.
- h91wka 6y agoThis was a showstopper for me back when I decided to go with posteo.net instead. Well, better late than never, hopefully their service will become useful for more people.
- akullpp 6y agoI switched this month from Google services to alternatives and therefore to PMs paid plan. I'm very happy so far with the Android and web app.
- ver_ture 6y agoWhat is the android app? Is it an apk from outside the play store?
- deleted 6y ago[deleted]
- zenlot 6y agoMarketing move. They've been on a downfall due to relations to Tesonet. Now started open sourcing their apps to restore reputation.
- aledthemathguy 6y agoProtonMail will become an extremely important company in the next decade. Their one risk is being bought.
- emoticoji 6y agoUnexpected. I'll try my paid subscription with them simply because they deserve it. I'm curious about your opinions though: will the platform be riskier now for a while, since bugs will be more likely to be found?
- AnonC 6y agoI hope the open sourcing helps accelerate the pace of development. Tangentially, my needs are very minimal and I have a couple of ProtonMail accounts on the free tier that don't get much mail (the size of the mailboxes put together would be 5MB or so). I also aggressively delete unnecessary emails quickly and empty the trash. I'm waiting for multiple account support in the official mobile client for users on the free tier (this was promised quite sometime ago).
- da_n 6y agoThis is great to see, well done ProtonMail. I asked Fastmail if they would open source their email app on Android but was told no. > the probability of the app to be opensourced is very unlikely