5 ms·

I still do not understand what is point of ProtonMail: they are same as others. Google, MS or Apple will not sent your data to gov without court order. ProtonMa

• typon 5y ago
  ProtonMail messages can be end-to-end encrypted and they aren't scanned for serving ads to you. ProtonMail might be the same with regards to metadata, but they offer an onion site to mitigate that risk to a certain extent.
• nabakin 5y ago
  I'm sure Google and MS have a lot more data to give in an information request than ProtonMail. According to what ProtonMail has posted, they only turned over an IP address. Google and MS would probably have your account name, contents of your emails, login session times, all recorded IP addresses you've logged in from, all recorded devices you've logged in from, etc. I'm not sure about Apple though.
  • beermonster 5y ago
    Google literally log every thing you do[1] [1] https://www.wired.co.uk/article/how-to-delete-google-search-history-tracking https://www.wired.co.uk/article/how-to-delete-google-search-...
• windthrown 5y ago
  The "data" in this case was the user's IP address and time they logged in. Other providers might be able to be compelled to provide much more explicit data such as email content or the user's identity.
• beermonster 5y ago
  ProtonMail to ProtonMail emails are e2ee. Emails sent outside of ProtonMail ecosystem can still be secured with a password with a link to the email hosted at ProtonMail. ProtonMail uses zero-access encryption, which means it is technically impossible for them to decrypt user messages. When you sign up with Google you have to give them a phone number and other details which ProtonMail don’t require. In relation to GMail specifically see[1] [1] https://protonmail.com/blog/protonmail-vs-gmail-security/ https://protonmail.com/blog/protonmail-vs-gmail-security/
  • dngray 5y ago
    > ProtonMail to ProtonMail emails are e2ee. Emails sent outside of ProtonMail ecosystem can still be secured with a password with a link to the email hosted at ProtonMail. You can also encrypt emails with PGP with someone's public key from within ProtonMail, in this scenario you don't need to send them a password or a link. They do however have to have you in their address book with public key attached.
  • sbuk 5y ago
    Proton to Proton might be E2EE. Proton to any other service is almost certainly not. I'd suggest that their marketing is not exactly transparent. Their 'zero-access encryption' only applies to mailboxes stored in their environment. It's nice that they offer hosted secure mail, like those on offer from enterprise tools (Proofpoint, Mimecast etc.), but it's not really E2EE email. Signing up to Protonmail may not require a mobile number, but a recovery email (PII) must added and linked the account. Here is an example of a Protonmail to Gmail message (potential PII removed): Delivered-To: xxxxx@gmail.com Received: by xxxxx with SMTP id {...}; Mon, 6 Sep 2021 00:00:00 -0000 X-Google-Smtp-Source: {...} X-Received: by xxxxx with SMTP id {xxx}.50.{xxx}; Mon, 6 Sep 2021 00:00:00 -0000 ARC-Seal: i=1; a=rsa-sha256; t={...}; cv=none; d=google.com; s=arc-20160816; b={...} ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-{...}; h=mime-version:message-id:subject:reply-to:from:to:dkim-signature :date; {...} ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@protonmail.com header.s=protonmail header.b={...}; spf=pass (google.com: domain of xxxxx@protonmail.com designates {...} as permitted sender) smtp.mailfrom=xxxxx@protonmail.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com Return-Path: <xxxxx@protonmail.com> Received: from mail-{...}.protonmail.ch (mail-{...}.protonmail.ch. [{...}]) by mx.google.com with ESMTPS id {...}.{...} for <xxxxx@gmail.com> (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 6 Sep 2021 00:00:00 -0000 Received-SPF: pass (google.com: domain of xxxxx@protonmail.com designates {...} as permitted sender) client-ip={...}; Authentication-Results: mx.google.com; dkim=pass header.i=@protonmail.com header.s=protonmail header.b=WRR3qgpc; spf=pass (google.com: domain of xxxxx@protonmail.com designates {...} as permitted sender) smtp.mailfrom=xxxxx@protonmail.com; dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com Date: Mon, 6 Sep 2021 00:00:00 -0000 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=protonmail; t={xxx}; bh={...}; h=Date:To:From:Reply-To:Subject:From; b={...} To: "xxxxx@gmail.com" <xxxxx@gmail.com> From: {...} <xxxxx@protonmail.com> Reply-To: {...} <xxxxx@protonmail.com> Subject: Testing proton mail "encryption". Message-ID: <1234567890@protonmail.com> MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="THE_BOUNDARY" X-Spam-Status: No, score=-1.2 required=10.0 tests=ALL_TRUSTED,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,HTML_MESSAGE shortcircuit=no autolearn=disabled version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on mailout.protonmail.ch --THE_BOUNDARY Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: base64 --THE_BOUNDARY Content-Type: text/html; charset=utf-8 Content-Transfer-Encoding: base64 --THE_BOUNDARY-- Nothing special, certainly no E2EE encryption (to be fair, the welcome email explains this is Protonmail <-> Protonmail only) and STARTTLS, so it may be opportunistic encryption for the transmission. Not sure what benefit the Base64 encrypted body has as it's more bytes that the unencrypted message. Of course, encrypting with PGP and sending over Tor helps with anonymity, but it still relies on the recipient keeping everything secure their end. Email, no matter what you do to try and make it secure, is an inherently insecure protocol, that has been mangled beyond what it was intended for. I'm not suggesting that we shouldn't try to make it better, but that it might just be closing the proverbial stable doors.
• deleted 5y ago
  [deleted]