5 ms·

If this doesn't matter, what's important for you about being a Protonmail customer? (also a paying Protonmail customer)

neltnerb 5y ago
That your emails are supposedly stored encrypted, that if other services support it end-to-end email encryption supposedly can be enabled easily, and that supposedly you cannot be served targeted ads because they cannot read the contents of your email (not that they have ads anyway). Of course Protonmail is accessible via Tor. Not that you should need to do that to remain private.
- vntok 5y ago
  > That your emails are supposedly stored encrypted, that if other services support it end-to-end email encryption supposedly can be enabled easily, and that supposedly you cannot be served targeted ads because they cannot read the contents of your email (not that they have ads anyway). Gmail does all of this for free though, right?
  - rileyphone 5y ago
    The last point very much not so - having my email provided as a free product by the world's largest ad company isn't a relationship I want to pursue.
    - vntok 5y ago
      Is the last point "that supposedly you cannot be served targeted ads because they cannot read the contents of your email"? Gmail Pro (paid G Suite) has never done that, and Gmail Perso (Free) hasn't done that since 2017.
      - dbsmith83 5y ago
        Maybe they don't serve targeted ads, but they still read your gmail
        vntok 5y ago
        Protonmail will scan all messages sent from non-protonmail addresses (content and attachments) for viruses. So they do read your gmail as well.
        dbsmith83 5y ago
        That's an interesting point, but I'd contend there is a difference between scanning for known virus patterns vs. feeding your email into ML algorithms to do God knows what with.
        neltnerb 5y ago
        If someone comes to Google, asking for the content of someone's email, is Google technically unable to provide that information for past emails? Because I am aware of no reason to think that Google stores my gmail with zero access. I don't know for a fact that ProtonMail discards this information at the earliest opportunity nor do I know for a fact that they don't try to aggregate it to learn about you (or even people in general), but that is what I interpreted the pitch as. But, look, of course if they get a subpoena they will have to start scanning your email if they are technically able to collect it. That's just a wiretap, and little would prevent the author and operator of the server software from doing whatever they want... and they're clear that if you aren't sending email between two compatible accounts that there is no E2EE. We can talk about how they should have been clearer about the need to use Tor to avoid IP logging (even if they don't do it, someone between you and ProtonMail certainly could). That's a good idea. But they are actually very clear that E2EE with your email is not what you should expect in general. And I don't think they have much incentive to scan my email from unencrypted sources to do anything nefarious, but I don't think anyone has any ability to prove they do or don't at present.
tephra 5y ago
I never said it didn't matter. I think the data retention laws and for what crimes the police are able to get certain warrants in the EU and Switzerland can be better. But that is not a proton issue that is an issue with our current governments.
- istingray 5y ago
  Ah I see. It's an issue for my use of Protonmail, in that I may cancel and move to another vendor who is more forthright. Here's what I would expect my future vendor to say about this: "Hey, we respect your needs. However, we have to tell you that you should treat us as a bit of an adversary. We will do what we can as a private company, but ultimately we can be compelled by the government, rogue employee, or if somehow we get hacked. This is the case for any company no matter what they promise or avoid telling you. We do tell you. As our customer, here's what we recommend you do: Use Tor, fund open source, vote, etc."
  - yunohn 5y ago
    > It's an issue for my use of Protonmail, in that I may cancel and move to another vendor who is more forthright You’re telling us that you never considered that an incorporated company, bound by democratic laws, would be required to respond to criminal activity warrants? What fantasy land do HNers on this thread live in?
COGlory 5y ago
End-to-end encrypted emails, not massive collection of metadata to build advertising profiles, and, maybe this will sound strange, but I wanted to pay for these services because I want to show everyone that there is a paying market and you don't have to rely on advertising to be profitable in this space. No service is capable of completely hiding IPs and still getting you the data. If you "threat model" includes hiding from Western governments, I'd recommend not using the internet.

That your emails are supposedly stored encrypted, that if other services support it end-to-end email encryption supposedly can be enabled easily, and that supposedly you cannot be served targeted ads because they cannot read the contents of your email (not that they have ads anyway). Of course Protonmail is accessible via Tor. Not that you should need to do that to remain private.

vntok 5y ago
> That your emails are supposedly stored encrypted, that if other services support it end-to-end email encryption supposedly can be enabled easily, and that supposedly you cannot be served targeted ads because they cannot read the contents of your email (not that they have ads anyway). Gmail does all of this for free though, right?
- rileyphone 5y ago
  The last point very much not so - having my email provided as a free product by the world's largest ad company isn't a relationship I want to pursue.
  - vntok 5y ago
    Is the last point "that supposedly you cannot be served targeted ads because they cannot read the contents of your email"? Gmail Pro (paid G Suite) has never done that, and Gmail Perso (Free) hasn't done that since 2017.
    - dbsmith83 5y ago
      Maybe they don't serve targeted ads, but they still read your gmail
      - vntok 5y ago
        Protonmail will scan all messages sent from non-protonmail addresses (content and attachments) for viruses. So they do read your gmail as well.
        dbsmith83 5y ago
        That's an interesting point, but I'd contend there is a difference between scanning for known virus patterns vs. feeding your email into ML algorithms to do God knows what with.
        neltnerb 5y ago
        If someone comes to Google, asking for the content of someone's email, is Google technically unable to provide that information for past emails? Because I am aware of no reason to think that Google stores my gmail with zero access. I don't know for a fact that ProtonMail discards this information at the earliest opportunity nor do I know for a fact that they don't try to aggregate it to learn about you (or even people in general), but that is what I interpreted the pitch as. But, look, of course if they get a subpoena they will have to start scanning your email if they are technically able to collect it. That's just a wiretap, and little would prevent the author and operator of the server software from doing whatever they want... and they're clear that if you aren't sending email between two compatible accounts that there is no E2EE. We can talk about how they should have been clearer about the need to use Tor to avoid IP logging (even if they don't do it, someone between you and ProtonMail certainly could). That's a good idea. But they are actually very clear that E2EE with your email is not what you should expect in general. And I don't think they have much incentive to scan my email from unencrypted sources to do anything nefarious, but I don't think anyone has any ability to prove they do or don't at present.

tephra 5y ago

I never said it didn't matter. I think the data retention laws and for what crimes the police are able to get certain warrants in the EU and Switzerland can be better. But that is not a proton issue that is an issue with our current governments.

istingray 5y ago
Ah I see. It's an issue for my use of Protonmail, in that I may cancel and move to another vendor who is more forthright. Here's what I would expect my future vendor to say about this: "Hey, we respect your needs. However, we have to tell you that you should treat us as a bit of an adversary. We will do what we can as a private company, but ultimately we can be compelled by the government, rogue employee, or if somehow we get hacked. This is the case for any company no matter what they promise or avoid telling you. We do tell you. As our customer, here's what we recommend you do: Use Tor, fund open source, vote, etc."
- yunohn 5y ago
  > It's an issue for my use of Protonmail, in that I may cancel and move to another vendor who is more forthright You’re telling us that you never considered that an incorporated company, bound by democratic laws, would be required to respond to criminal activity warrants? What fantasy land do HNers on this thread live in?

COGlory 5y ago

End-to-end encrypted emails, not massive collection of metadata to build advertising profiles, and, maybe this will sound strange, but I wanted to pay for these services because I want to show everyone that there is a paying market and you don't have to rely on advertising to be profitable in this space. No service is capable of completely hiding IPs and still getting you the data. If you "threat model" includes hiding from Western governments, I'd recommend not using the internet.