9 ms·
Been a ProtonMail customer for years, still pretty dissatisfied. They've been promising U2F (a pretty standard security feature) for years, yet there is still n
by c7DJTLrn 5y ago
Been a ProtonMail customer for years, still pretty dissatisfied. They've been promising U2F (a pretty standard security feature) for years, yet there is still no sign of it in this release. They've spent years obsessing over calendars for some reason instead of their core product. They also took a very long time to open source their IMAP bridge which caused me to further lose love for them.
PM also blatantly lie in their advertising. They cannot provide end-to-end encrypted mail because limitations in existing email protocols prevent it. All they can do is quickly wrap the contents of your mail in encryption once it has arrived.
With Apple now starting to offer unlimited email aliases to their premium users, I think ProtonMail will fall behind by only offering a handful.
- beermonster 5y agoThis [1] seems pretty clear to me in how they provide e2ee email. [1] https://protonmail.com/security-details https://protonmail.com/security-details
- nix23 5y ago>They cannot provide end-to-end encrypted mail because limitations in existing email protocols prevent it You misunderstood something, end-to-end encrypted mail just works from a proton to a proton address. >Messages between ProtonMail users are also transmitted in encrypted form within our secure server network. https://protonmail.com/security-details https://protonmail.com/security-details But yeah, the free storage is a joke and the complicated add-on pricing too. Calendar and imap on the other-hand is pretty important for me. BTW: When did Apple open-sourced their email server?
- c7DJTLrn 5y ago>You misunderstood something, end-to-end encrypted mail just works from a proton to a proton address. No, I am aware of this, but PM's advertising lies by omission. >When did Apple open-sourced their email server? I'll counter this by asking when ProtonMail open sourced theirs.
- nix23 5y ago>No, I am aware of this, but PM's advertising lies by omission. Show me that advertisement. >I'll counter this by asking when ProtonMail open sourced theirs. Yes the whole infrastructure: https://github.com/ProtonMail https://github.com/ProtonMail
- c7DJTLrn 5y ago>Show me that advertisement. Look at the landing page. It clearly advertises end-to-end encryption and claims PM cannot read your emails, which is false. It does not mention that E2EE is only available between PM users. >Yes the whole infrastructure Don't move the goalposts. You said the server. Their server is not open source.
- Avamander 5y ago> It does not mention that E2EE is only available between PM users. To the extent that PGP is E2E, it's available between anyone.
- c7DJTLrn 5y agoThen advertising it as a feature of PM is still misleading. The correct way to advertise it would be as "GPG Support", or "GPG Integration".
- Avamander 5y ago"GPG support" is "E2E support" though. Calling that false advertising is like calling "e-mail service" false advertising because it's actually "IMAP/SMTP service".
- willis936 5y ago>PM cannot read your emails, which is false How so? The storage is encrypted with a key they don't have. They can read all of the non-encrypted email traffic that passes through their servers, but that's true of any router in the path of nearly all email traffic as well. They don't have the ability to decrypt the store of emails. This is valuable because most email hosting providers are one hack or subpoena away from being a massive info dump of all of their users.
- sequoia 5y ago> end-to-end encrypted mail just works from a proton to a proton address. This is no longer email, it's a proprietary messaging platform. They offer email to other email providers, and encrypted messaging to other protonmail users, and they bundle both message types into your email inbox. Signal could bolt on an email transport to allow you to send and receive emails from Signal and that would be the same: communications within Signal would be encrypted, communications to external email servers would not be (any more "encrypted" than, say, gmail is).
- nix23 5y agoYes is use a proprietary messaging platform when i send an internal (on the same server) mail to another user... mail root subject: restart server blabla ctrl D
- sbuk 5y ago> BTW: When did Apple open-sourced their email server? Apple use Postfix as an MTA for iCloud.
- nix23 5y agoAnd the imap part? The opensourced Mail client on the iphone? iCloud has an MTA?
- sbuk 5y agoYes, why so surprised? How else do they send and receive messages? Postfix scales extremely well and is used by most of the Fortune 500 in some capacity - either as edge servers, internal relays and as common-or-garden MTAs. The IMAP part is another server, at a guess something like Apache James or Oracle Communications Messaging Server, but possibly Cyrus (as Fastmail do) or Dovecot.
- deleted 5y ago[deleted]
- protonmail 5y agoWe provide privacy to everyone, which is why we offer a free plan. However, without paid features and paid services, the free version of ProtonMail would not be able to exist. Unlike adtech companies which spy on you and can hand your data to third parties (like advertisers), ProtonMail can't access your data and doesn't make money from ads. Therefore, paid features are necessary for us to put your privacy first while still offering a free plan. With regards to IMAP, we offer Proton Bridge, which enables the integration of your ProtonMail account with email clients such as Outlook, Thunderbird and Apple Mail.
- everybodyknows 5y agoFastmail user here -- likewise somewhat dissatisfied. A few points of comparison: >U2F Supported by FM desktop browser app, works well. >unlimited email aliases Yes, but the FM GUI does not scale. There's a linear list, access to it reached by picking through layers of UI salad down from the top view. List presentation is bulky; ordering by order of creation, only.
- nirvdrum 5y agoIn case you haven't seen it, Fastmail supports subdomain addressing [0]. I use that to create ad hoc aliases for most services I sign up for and they don't clutter up the UI. [0] -- https://www.fastmail.com/help/receive/addressing.html https://www.fastmail.com/help/receive/addressing.html
- joshka 5y ago+1 FM - I use subdomain + wildcard alias + denylist any leaked alias instead of single aliases + allow list. This seems to works well enough for my use case (single user domain)
- 9wzYQbTYsAIc 5y ago> They've spent years obsessing over calendars for some reason instead of their core product. They are considering their core product to be an alternative to the full Google Suite.
- c7DJTLrn 5y agoThat would be the dream but man, they are a hell of a long way off.
- 9wzYQbTYsAIc 5y agoIt’s getting really close
- dmos62 5y agoWhy do you say that?
- 9wzYQbTYsAIc 5y agoBecause the beta experience is looking pretty good and the feature gaps are shrinking. It’s almost to the point where I would switch away from a DIY alternative for calendar, file sharing, etc.
- 9wzYQbTYsAIc 5y ago> They cannot provide end-to-end encrypted mail because limitations in existing email protocols prevent it. All they can do is quickly wrap the contents of your mail in encryption once it has arrived. Based on my understanding, that claim is for people who use ProtonMail to email other ProtonMail users. In that situation, emails are indeed end-to-end encrypted, without you having to encrypt the email content yourself, first.
- beermonster 5y agoThey say [1] between ProtonMail users, so yeah. [1] https://protonmail.com/security-details https://protonmail.com/security-details
- dheera 5y ago> end-to-end encrypted mail because limitations in existing email protocols prevent it You can E2E encrypt the body of the message with GPG, I don't think the protocol prevents it.
- c7DJTLrn 5y agoYes, but advertising this as a feature of PM is misleading. This is more of a "GPG Integration" or "Support for GPG".
- beermonster 5y agoThis is what they advertise https://protonmail.com/support/knowledge-base/what-is-encrypted/ https://protonmail.com/support/knowledge-base/what-is-encryp...
- KingMachiavelli 5y agoWhile there are certainly some areas in which ProtonMail can improve, how is E2E encryption via GPG 'incorrect'? Sure there is plain text metadata but other E2E encryption protocols have the same issue.
- c7DJTLrn 5y agoPM does not state that the E2EE they provide requires use of GPG. Like I said to others in the thread, it's lying by omission. It's made to sound like a 'it just works' feature when in reality 99% of your emails will never be E2EE secured because nobody uses GPG.
- deleted 5y ago[deleted]
- Avamander 5y agoThe lack of U2F or YubiKey PGP support is sad and something they could allow. But the lack of wide deployment of PGP is not their fault, surely they can't be blamed for that. It offers you the functionality and makes it quite trivial to use, assuming the recipient actually has a key. That's your contacts' job really. True universal E2EE e-mail between people was something that Estonia tried by giving everyone access to S/MIME. Clients sucked and still suck in that aspect, it was rarely used because of that reason. The functionality no longer exists. Way ahead of its time I guess.
- Youden 5y agoI was briefly a customer but after the first year I got very fed up with their billing model. Most services offer either pre-paid subscriptions where you buy say a year upfront and it doesn't auto-renew and/or some auto-renewal where they charge your credit card at the end of the previous billing period. If you decide you don't want the service, you can, in the first case, simply not renew and in the second, you have to cancel but you're made quite aware that your credit card will be charged. This is not the case however, with Protonmail. With Protonmail, you can go through the whole checkout process without saving a credit card, which one would assume means the plan is prepaid, as it would be basically anywhere else on the internet. But it's not possible to have a non-recurring payment on Protonmail. If they don't have a credit card on file, they'll put an "invoice" (what I not-so-fondly prefer to call a ransom) for the next billing period on your account, which they expect you to pay. If you don't pay, they block your _entire_ account. If, for example, you buy a year of ProtonVPN to try it for a while and end up not liking it much but also don't think it necessary to explicitly cancel, at the end of the year you'll get an "invoice" for an entire year of ProtonVPN. If you try to ignore it, your Protonmail inbox will no longer be accessible. If you leave it for several months, you'll be forced to pay for them, even if your entire account was locked and services inaccessible for that time. I've talked to support but they show zero sympathy. The whole billing model feels like a malicious scam to me.
- protonmail 5y agoAll emails from ProtonMail to ProtonMail are end-to-end encrypted. For ProtonMail users who want to send end-to-end encrypted emails to non-ProtonMail users, we offer an Encrypt for Outside option. We also use zero-access encryption for data at rest that renders digital files inaccessible to the service provider. ProtonMail relies on a subscription model, which means that users upgrade to get additional storage, more custom domains, priority support, etc. Because our users pay us to protect their privacy, our financial interests are perfectly aligned with theirs, and unlike adtech companies, we have no incentive to collect data on our users.