9 ms·

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless.

by cowpig 5y ago

When I started my company we chose to use Protonmail. My advice to anyone who wants secure email: don't use protonmail. The email search is completely useless. I don't understand how it can possibly be so difficult to do a substring search on a corpus and rank them in some kind of sane way. Searching for old emails based on content is an exercise in futility. After a few years of using an email service, search becomes really important. It is exceedingly difficult to pull data out. You need dev ops skills to do it. They charge for users that are disabled, and you can only stop paying for them if all of the associated data is deleted. So they effectively hold your data hostage (yes, you can get it out but it time-consuming and requires technical skills). I finally bit the bullet and paid a dev ops person (and gave him access to all my data) and switched to fastmail (at least it's not google) a few months ago. It's been an incredible relief.

protonmail 5y ago
A few clarifications. There is an export tool that is available. The reason we must count disabled addresses towards your quota is because if we did not do that, we would be susceptible to an attack where a paid user could run through our address space by creating and disabling addresses continuously, so some limits are required. You can remove disabled addresses, but only by contacting support.
- notafraudster 5y ago
  This is a sort of weird reply. The person you're replying to isn't saying "you need to allow an attacker to create and disable millions of addresses to DOS you". They're saying "you need to allow medium to longer term clients that de-activate very small portions of their overall number of accounts to not have to pay for those". You already have a system to measure account numbers, so what makes it impossible to also measure active account %ages
  - protonmail 5y ago
    Sorry if our answer wasn't clear. You can de-activate, but it must be manually requested through support.
    - spiderice 5y ago
      You’re replies are very frustrating. It’s like you’re completely missing the point of the replies and focusing on very tiny, irrelevant details. Nobody is claiming that you can’t remove deactivated accounts. Only that you charge for them until you go through the rather annoying process of contacting customer support. And then you make some bad excuse that it’s in the name of security because somebody could potentially make and deactivate millions of accounts. Obviously there could be a middle ground of allowing someone to deactivate 5 accounts per month or something. I suggest you either stop responding, or actually respond to the issues people have, and don’t make excuses that are paper thin.
      - duckfang 5y ago
        This line of discussion from Protonmail is making me greatly reconsider closing my accounts (plural) there for VPN and mail service. This is embarrassing at minimum, and show negative interaction with customers.
        abnercoimbre 5y ago
        Their service is so useful to me. But man, I can't deny their customer interactions can be problematic (as evidenced.) Is it that the developers 100% defer to a marketing rep without in-depth knowledge? Something else?
        duckfang 5y ago
        Same here, with their email AND vpn. Its been flawless so far, tech wise. But yeah, they really need to control and focus their core message to a tech board. If you whiff that (which they did), there's a good chance in running off your core users. And that is generally considered a bad idea.
  - Aeolun 5y ago
    Why would you not pay for deactivated accounts for which they’re still storing the data? I don’t think the delivery of email is what costs most money, it’s the storage of data.
- cowpig 5y ago
  Oh I forgot to mention the customer service
bassdropvroom 5y ago
Note: due to the design of PM, the search is done client-side rather than server-side. It's not an excuse but at the very least, full-text search is harder.
- alpaca128 5y ago
  Full-text search within the average amount of a single user's emails is trivial and fast on any modern PC. Smartphones do it for autocompletion suggestions every time you type a letter. The only thing taking longer than a few milliseconds is the initial indexing.
  - texasbigdata 5y ago
    This sort of comment is frustrating. How many times has XYZ site had broken search? It seems to _not_ be a trivial problem still.
    - bellyfullofbac 5y ago
      Gotta love all the comments here and on the Github issue who just throw out casual "This problem is trivial to solve!"'s.
    - Dylan16807 5y ago
      > This sort of comment is frustrating. How many times has XYZ site had broken search? I can't even think of any? But also search isn't a core feature for the vast majority of sites. Something can be easy and still break if nobody cares very much. Edit: Actually I can think of search breaking on one site that was notoriously badly run and had 0 to 1 part-time devs. That's not a flattering comparison. Edit 2: So could the people that disagree name some notable sites with broken search? I feel like if I don't understand what "XYZ" stands for it's probably not something I should be blamed for...
      - franga2000 5y ago
        Not a website, but...Windows 10?? Highest market share OS, billions of $ worth of engineering time behind it and due to recent changes, search is pretty much a core feature of the OS. And I'm not even talking about file search here, which is indeed a hard-ish problem (although `locate ... | grep ...` seems to do well enough on Linux) - this is just a simple word search through a list of programs that's usually under 100 items long. And it's still broken most of the time. Then there's MDN - a documentation site, whose 2nd most important function should be search. Yet, despite DuckDuckGo (a general-purpose search engine!) consistently finding the exact results I want, MDN's built-in search often misses even titles that are searched for verbatim. If it weren't almost 2am and I weren't running almost entirely on caffeine, I'd probably be able to think of a few more.
deleted 5y ago
[deleted]
jjcon 5y ago
I’ll second this, I love the idea of proton mail but the product isn’t anywhere close to ready for daily driving. Great for the occasional should it arise however. Encryption should be a selling point and it seems like they use it more as an excuse.
- cyberpunk 5y ago
  Hmm, I use it for everything, but I’m using the bridge with apple mail.app, maybe that’s a bit of the happy path for searching.. No real complaints besides the bridge sometimes pegging a cpu until I HUP it..
  - inamiyar 5y ago
    I also use the bridge with Thunderbird with no problems.
    - jwally 5y ago
      Was literally about to posit that as a solution. It’s way above my pay grade but I wonder if homomorphic encryption could be leveraged at scale without compromising security.
  - wyxuan 5y ago
    Apple mail app searching sucks. Might just be my personal experience but I find it easier to just search for email on gmail
    - pcdoodle 5y ago
      It's not just you. Apple mail sucks for search.
- brundolf 5y ago
  I've been using it for 2.5 years for my personal email (I don't do anything super complicated with email; mostly service notifications, the occasional correspondence with friends or recruiters or such). As far as UX, it's pretty mediocre (on both web and mobile) but it gets the job done for my purposes.
ulimn 5y ago
I think the search doesn’t include the message of the email is because it’s encrypted and it would have to decrypt every single email to do it. // Or something like that, I’m dumb for cryptography :)
fnord77 5y ago
aren't all messages encrypted on the server? that would make search difficult because no server process could read them. all your emails would have to be pulled into the client for decryption first.
- navanchauhan 5y ago
  Not really, it depends on each service provider. You can imagine each user as a folder in the /var/mail directory, it depends on your implementation to encrypt the folder or not. Gmail encrypts all in-transit e-mails but I cannot find a reference for encrypting on their servers
  - brundolf 5y ago
    Their point is that ProtonMail specifically does encrypt emails on the server. That's their headlining feature. Only clients are supposed to be able to decrypt them.
    - navanchauhan 5y ago
      Oh, my bad. I thought when they were referring to the server, it was email servers in general.
buu700 5y ago
They charge for users that are disabled Took me a second to figure out that you weren't claiming accessibility was only supported at an extra cost.
- inamiyar 5y ago
  I didn't get it till reading this.
amelius 5y ago
It used to be the case that both ProtonMail and FastMail were frequently recommended on HN. So, how is FastMail doing in comparison?
- vbezhenar 5y ago
  I'm not entirely happy with fastmail. Too much of legitimate mail ends up in Spam. They even put aliexpress mails to spam, that kind of domain surely must be whitelisted. I'd prefer more spam in inbox, because right now I have to check spam every the time to ensure that nothing is lost.
  - trulyme 5y ago
    A bit off-topic, but I'm constantly surprised that e-mail companies are so bad at this. If I, as a user, keep corresponding with someone, what kind of brain-dead system keeps putting their mails to spam? (answer: gmail) I am communicating with them, do you really think they are spamming me? It's so frustrating. And yes, their SPF & similar headers are correct (or at least they seem to be, as G of course doesn't tell me why it went to spam). I know I can setup filters, but I thought they had that "smart" machine learning thingy? Or at least some simple "if" statements? /rant
  - hedora 5y ago
    Settings -> Filters and Rules -> Spam Protection -> Advanced settings -> Custom Ikea mass marketing emails are ~5.5 for me, and essentially all of the “false positives” in my spambox. The real spam is all 20+. It looks like fastmail defaults the threshold to 5. Try increasing it to slightly above the score your legitimate emails get.
  - neurostimulant 5y ago
    To be fair, aliexpress is pretty spammy. If they use simple bayesian filter for their spam filter it's pretty understandable that aliexpress emails ended up being marked as spam.
  - franga2000 5y ago
    To be fair, 70% of what I get from AliExpress is actually spam, despite having disabled all the email switches I could find. For each order, I get 3-5 near-useless emails and every visit to the site results in a week or two of "abandoned cart recovery" emails.
dna_polymerase 5y ago
That's what you get for making stupid decisions based on ideology instead of facts. Protonmail says it very clearly that all mail is encrypted on their servers. If you expect search functionality from them you don't get encryption. You bought into some random surveillance state propaganda. Google isn't interested in the mail of your random startup, they are happy expanding their cloud footprint. In return you get good search and top notch mail servers. Make sane decisions instead of ideological ones. Product-wise there is not a thing wrong in the world with GMail.
- kmaasrud 5y ago
  Choosing something you ideologically do not support is not sane
  - franga2000 5y ago
    I don't ideologically support exploitation of workers, using unclean energy sources and the "proof of work" model of education. Yet, I need many modern gadgets, have no carbon-neutral way of crossing the country other than biking for 2 weeks and need a university degree to get a job that allows me to live well. Blindly choosing ideology over self-preservation is what isn't sane here.
- andrepd 5y ago
  "There's nothing wrong with people reading your correspondence (and archiving it forever and running algorithms on it)! If you say othetwise you're blinded by ideology!" Conform, citizen!
- minitech 5y ago
  > If you expect search functionality from them you don't get encryption. It’s not as if the client can’t maintain an encrypted index, they just haven’t implemented it. Also, apart from all of the important advantages of encryption, there’s always the privacy angle compared to Gmail: Google uses mail to target ads and scrape purchases, which a lot of people don’t want.
  - 5y ago
snotrockets 5y ago
My own advice re secure email is that there isn't such a beast – you just can't apply what is expected from modern secure messaging, like having no insecure fallbacks, forward secrecy, encrypted metadata, etc.
essentialoils 5y ago
https://theconsciousresistance.com/protonmail-is-insecure/ https://theconsciousresistance.com/protonmail-is-insecure/ https://privacy-watchdog.io/protonmails-creation-with-cia-nsa/ https://privacy-watchdog.io/protonmails-creation-with-cia-ns... https://eprint.iacr.org/2018/1121.pdf https://eprint.iacr.org/2018/1121.pdf
marmaduke 5y ago
> exceedingly difficult to pull data out Their “bridge” lets you use a regular imap client, which makes it trivial.

by cowpig 5y ago

protonmail 5y ago

A few clarifications. There is an export tool that is available. The reason we must count disabled addresses towards your quota is because if we did not do that, we would be susceptible to an attack where a paid user could run through our address space by creating and disabling addresses continuously, so some limits are required. You can remove disabled addresses, but only by contacting support.

notafraudster 5y ago
This is a sort of weird reply. The person you're replying to isn't saying "you need to allow an attacker to create and disable millions of addresses to DOS you". They're saying "you need to allow medium to longer term clients that de-activate very small portions of their overall number of accounts to not have to pay for those". You already have a system to measure account numbers, so what makes it impossible to also measure active account %ages
- protonmail 5y ago
  Sorry if our answer wasn't clear. You can de-activate, but it must be manually requested through support.
  - spiderice 5y ago
    You’re replies are very frustrating. It’s like you’re completely missing the point of the replies and focusing on very tiny, irrelevant details. Nobody is claiming that you can’t remove deactivated accounts. Only that you charge for them until you go through the rather annoying process of contacting customer support. And then you make some bad excuse that it’s in the name of security because somebody could potentially make and deactivate millions of accounts. Obviously there could be a middle ground of allowing someone to deactivate 5 accounts per month or something. I suggest you either stop responding, or actually respond to the issues people have, and don’t make excuses that are paper thin.
    - duckfang 5y ago
      This line of discussion from Protonmail is making me greatly reconsider closing my accounts (plural) there for VPN and mail service. This is embarrassing at minimum, and show negative interaction with customers.
      - abnercoimbre 5y ago
        Their service is so useful to me. But man, I can't deny their customer interactions can be problematic (as evidenced.) Is it that the developers 100% defer to a marketing rep without in-depth knowledge? Something else?
        duckfang 5y ago
        Same here, with their email AND vpn. Its been flawless so far, tech wise. But yeah, they really need to control and focus their core message to a tech board. If you whiff that (which they did), there's a good chance in running off your core users. And that is generally considered a bad idea.
- Aeolun 5y ago
  Why would you not pay for deactivated accounts for which they’re still storing the data? I don’t think the delivery of email is what costs most money, it’s the storage of data.
cowpig 5y ago
Oh I forgot to mention the customer service

bassdropvroom 5y ago

Note: due to the design of PM, the search is done client-side rather than server-side. It's not an excuse but at the very least, full-text search is harder.

alpaca128 5y ago
Full-text search within the average amount of a single user's emails is trivial and fast on any modern PC. Smartphones do it for autocompletion suggestions every time you type a letter. The only thing taking longer than a few milliseconds is the initial indexing.
- texasbigdata 5y ago
  This sort of comment is frustrating. How many times has XYZ site had broken search? It seems to _not_ be a trivial problem still.
  - bellyfullofbac 5y ago
    Gotta love all the comments here and on the Github issue who just throw out casual "This problem is trivial to solve!"'s.
  - Dylan16807 5y ago
    > This sort of comment is frustrating. How many times has XYZ site had broken search? I can't even think of any? But also search isn't a core feature for the vast majority of sites. Something can be easy and still break if nobody cares very much. Edit: Actually I can think of search breaking on one site that was notoriously badly run and had 0 to 1 part-time devs. That's not a flattering comparison. Edit 2: So could the people that disagree name some notable sites with broken search? I feel like if I don't understand what "XYZ" stands for it's probably not something I should be blamed for...
    - franga2000 5y ago
      Not a website, but...Windows 10?? Highest market share OS, billions of $ worth of engineering time behind it and due to recent changes, search is pretty much a core feature of the OS. And I'm not even talking about file search here, which is indeed a hard-ish problem (although `locate ... | grep ...` seems to do well enough on Linux) - this is just a simple word search through a list of programs that's usually under 100 items long. And it's still broken most of the time. Then there's MDN - a documentation site, whose 2nd most important function should be search. Yet, despite DuckDuckGo (a general-purpose search engine!) consistently finding the exact results I want, MDN's built-in search often misses even titles that are searched for verbatim. If it weren't almost 2am and I weren't running almost entirely on caffeine, I'd probably be able to think of a few more.

deleted 5y ago

[deleted]

jjcon 5y ago

I’ll second this, I love the idea of proton mail but the product isn’t anywhere close to ready for daily driving. Great for the occasional should it arise however. Encryption should be a selling point and it seems like they use it more as an excuse.

cyberpunk 5y ago
Hmm, I use it for everything, but I’m using the bridge with apple mail.app, maybe that’s a bit of the happy path for searching.. No real complaints besides the bridge sometimes pegging a cpu until I HUP it..
- inamiyar 5y ago
  I also use the bridge with Thunderbird with no problems.
  - jwally 5y ago
    Was literally about to posit that as a solution. It’s way above my pay grade but I wonder if homomorphic encryption could be leveraged at scale without compromising security.
- wyxuan 5y ago
  Apple mail app searching sucks. Might just be my personal experience but I find it easier to just search for email on gmail
  - pcdoodle 5y ago
    It's not just you. Apple mail sucks for search.
brundolf 5y ago
I've been using it for 2.5 years for my personal email (I don't do anything super complicated with email; mostly service notifications, the occasional correspondence with friends or recruiters or such). As far as UX, it's pretty mediocre (on both web and mobile) but it gets the job done for my purposes.

ulimn 5y ago

I think the search doesn’t include the message of the email is because it’s encrypted and it would have to decrypt every single email to do it. // Or something like that, I’m dumb for cryptography :)

fnord77 5y ago

aren't all messages encrypted on the server? that would make search difficult because no server process could read them. all your emails would have to be pulled into the client for decryption first.

navanchauhan 5y ago
Not really, it depends on each service provider. You can imagine each user as a folder in the /var/mail directory, it depends on your implementation to encrypt the folder or not. Gmail encrypts all in-transit e-mails but I cannot find a reference for encrypting on their servers
- brundolf 5y ago
  Their point is that ProtonMail specifically does encrypt emails on the server. That's their headlining feature. Only clients are supposed to be able to decrypt them.
  - navanchauhan 5y ago
    Oh, my bad. I thought when they were referring to the server, it was email servers in general.

buu700 5y ago

They charge for users that are disabled Took me a second to figure out that you weren't claiming accessibility was only supported at an extra cost.

inamiyar 5y ago
I didn't get it till reading this.

amelius 5y ago

It used to be the case that both ProtonMail and FastMail were frequently recommended on HN. So, how is FastMail doing in comparison?

vbezhenar 5y ago
I'm not entirely happy with fastmail. Too much of legitimate mail ends up in Spam. They even put aliexpress mails to spam, that kind of domain surely must be whitelisted. I'd prefer more spam in inbox, because right now I have to check spam every the time to ensure that nothing is lost.
- trulyme 5y ago
  A bit off-topic, but I'm constantly surprised that e-mail companies are so bad at this. If I, as a user, keep corresponding with someone, what kind of brain-dead system keeps putting their mails to spam? (answer: gmail) I am communicating with them, do you really think they are spamming me? It's so frustrating. And yes, their SPF & similar headers are correct (or at least they seem to be, as G of course doesn't tell me why it went to spam). I know I can setup filters, but I thought they had that "smart" machine learning thingy? Or at least some simple "if" statements? /rant
- hedora 5y ago
  Settings -> Filters and Rules -> Spam Protection -> Advanced settings -> Custom Ikea mass marketing emails are ~5.5 for me, and essentially all of the “false positives” in my spambox. The real spam is all 20+. It looks like fastmail defaults the threshold to 5. Try increasing it to slightly above the score your legitimate emails get.
- neurostimulant 5y ago
  To be fair, aliexpress is pretty spammy. If they use simple bayesian filter for their spam filter it's pretty understandable that aliexpress emails ended up being marked as spam.
- franga2000 5y ago
  To be fair, 70% of what I get from AliExpress is actually spam, despite having disabled all the email switches I could find. For each order, I get 3-5 near-useless emails and every visit to the site results in a week or two of "abandoned cart recovery" emails.

dna_polymerase 5y ago

That's what you get for making stupid decisions based on ideology instead of facts. Protonmail says it very clearly that all mail is encrypted on their servers. If you expect search functionality from them you don't get encryption. You bought into some random surveillance state propaganda. Google isn't interested in the mail of your random startup, they are happy expanding their cloud footprint. In return you get good search and top notch mail servers. Make sane decisions instead of ideological ones. Product-wise there is not a thing wrong in the world with GMail.

kmaasrud 5y ago
Choosing something you ideologically do not support is not sane
- franga2000 5y ago
  I don't ideologically support exploitation of workers, using unclean energy sources and the "proof of work" model of education. Yet, I need many modern gadgets, have no carbon-neutral way of crossing the country other than biking for 2 weeks and need a university degree to get a job that allows me to live well. Blindly choosing ideology over self-preservation is what isn't sane here.
andrepd 5y ago
"There's nothing wrong with people reading your correspondence (and archiving it forever and running algorithms on it)! If you say othetwise you're blinded by ideology!" Conform, citizen!
minitech 5y ago
> If you expect search functionality from them you don't get encryption. It’s not as if the client can’t maintain an encrypted index, they just haven’t implemented it. Also, apart from all of the important advantages of encryption, there’s always the privacy angle compared to Gmail: Google uses mail to target ads and scrape purchases, which a lot of people don’t want.
- 5y ago

snotrockets 5y ago

My own advice re secure email is that there isn't such a beast – you just can't apply what is expected from modern secure messaging, like having no insecure fallbacks, forward secrecy, encrypted metadata, etc.

essentialoils 5y ago

https://theconsciousresistance.com/protonmail-is-insecure/ https://theconsciousresistance.com/protonmail-is-insecure/ https://privacy-watchdog.io/protonmails-creation-with-cia-nsa/ https://privacy-watchdog.io/protonmails-creation-with-cia-ns... https://eprint.iacr.org/2018/1121.pdf https://eprint.iacr.org/2018/1121.pdf

marmaduke 5y ago

> exceedingly difficult to pull data out Their “bridge” lets you use a regular imap client, which makes it trivial.