3 ms·

That's not true see their zero access encryption[1] https://protonmail.com/blog/zero-access-encryption/ https://protonmail.com/blog/zero-access-encryption/ If

That's not true see their zero access encryption[1] https://protonmail.com/blog/zero-access-encryption/ https://protonmail.com/blog/zero-access-encryption/ If you're saying they could change the functionality to reverse this or backdoor it then erm.. yes.. maybe. I guess if you're not going to trust anyone (and personally I'd trust ProtonMail based on their honest blog posts, security responses and response to security blog posts criticising their work) then you'd want to self-host. But I'd argue at that point email isn't the solution you're looking for.

rascul 5y ago
This from the link you shared: > Someone using a Gmail account sends an email to a ProtonMail account. When it arrives at ProtonMail, our servers can read that email because Gmail does not support end-to-end encryption. However, after receiving the email, we encrypt it immediately using the ProtonMail account owner’s public encryption key. Afterwards, we are no longer able to decrypt the message. It's noted that they can potentially read it but they encrypt it right away. I'm not saying that they have the functionality to read it in that step, I'm saying they could add it if they chose to. It's their code, after all. > I guess if you're not going to trust anyone (and personally I'd trust ProtonMail based on their honest blog posts, security responses and response to security blog posts criticising their work) then you'd want to self-host. But I'd argue at that point email isn't the solution you're looking for. I think you're reading too much into my post. I'm saying that the potential exists for the provider to read the messages, simply because email is a plaintext protocol (outside of things like GPG and S/MIME which I insinuated but didn't actually mention). I do, however, agree with you that if you don't want to trust anyone than other solutions would be more beneficial.

rascul 5y ago

This from the link you shared: > Someone using a Gmail account sends an email to a ProtonMail account. When it arrives at ProtonMail, our servers can read that email because Gmail does not support end-to-end encryption. However, after receiving the email, we encrypt it immediately using the ProtonMail account owner’s public encryption key. Afterwards, we are no longer able to decrypt the message. It's noted that they can potentially read it but they encrypt it right away. I'm not saying that they have the functionality to read it in that step, I'm saying they could add it if they chose to. It's their code, after all. > I guess if you're not going to trust anyone (and personally I'd trust ProtonMail based on their honest blog posts, security responses and response to security blog posts criticising their work) then you'd want to self-host. But I'd argue at that point email isn't the solution you're looking for. I think you're reading too much into my post. I'm saying that the potential exists for the provider to read the messages, simply because email is a plaintext protocol (outside of things like GPG and S/MIME which I insinuated but didn't actually mention). I do, however, agree with you that if you don't want to trust anyone than other solutions would be more beneficial.