5 ms·

* ProtonMail advertises no IP logging and overall this is very unlikely. I prefer the more transparent privacy tools that make it clear what their legally requi

* ProtonMail advertises no IP logging and overall this is very unlikely. I prefer the more transparent privacy tools that make it clear what their legally required to log and what that are required to provide to LEOs. * ProtonMail Tor hidden service is mostly a joke. Their signup isn't available over it. This combined with no support for actually anonymous methods of payment make their advertising of "anonymous email" dubious. I understand the challenges involved, but if you can't overcome/mitigate them, then don't make those claims. * Email is not a secure protocol and most every permutation of webmail is not securely implemented. Unless you're using PGP on the client side you will be trusting the provider. * The steps required currently to run webapps and verify they haven't been altered are obtuse especially if you want to continue to get any kind of new features or updates.

blub 5y ago
Yes, and this is the best one can get in 2021. So it would be nice if everyone stopped attacking them at every step and started building that mythical private e-mail service that they’re talking about instead.
- ddtaylor 5y ago
  I'll take a provider that is transparent over one that makes claims they cannot backup. cock.li is more transparent in that regard despite being a complete meme.
  - blub 5y ago
    cock.li seems to be just your average e-mail provider with no security features, as they existed since the dawn of internet. They have access to e-mail metadata and contents, and so does law enforcement or anyone hacking their servers. How can they not be transparent? They don't have any technical reason to make any security claims.
    - reginold 5y ago
      I may not understand cock.li, what feature/aspect does this quote refer to: "Cock.li has not had a successful demand for user information since 2017, thanks in large part to better education of law enforcement that contact cock.li."
      - 0-_-0 5y ago
        It refers to the size of cock.li. It's so small that it didn't get into Protonmail's situation yet.
        dngray 5y ago
        I would also bet they may have handed out some select information but it just hasn't "hit the news". I would say cock.li is certainly big enough that someone has used it in a criminal matter eg child pornography, bomb threats etc. With email it's either that or they go after wherever you're hosting from.
        pcranaway 5y ago
        cock.li was indeed used for bomb threats - https://www.dailydot.com/debug/cock-li-email-service-vincent-canfield-interview-fake-bomb-threats-hard-drives/ https://www.dailydot.com/debug/cock-li-email-service-vincent...
- reginold 5y ago
  Agreed! Where are the replacements for us to test out :)
  - andrey_utkin 5y ago
    FreedomBox, Sovereign https://github.com/sovereign/sovereign https://github.com/sovereign/sovereign
reginold 5y ago
Is anyone working on an "email like" app that runs on Signal? I'm struggling to figure out what comes after ProtonMail. It's clearly an evolutionary dead end but what succeeds it?
- raven108 5y ago
  I have Tutanota to be quite reliable end to end encryption and no ip logging. Also provides ability to send encrypted mail with pre shared passwords. Good client apps too. Given Protonmail trust issues Sir Lee ought to have avoided. Signal mail service/client would be great too. Long time FastMail user but they too give fuzzy answers on mail privacy. Mailbox.org seems to be decent with encryption at rest.
  - dngray 5y ago
    > I have Tutanota to be quite reliable end to end encryption and no ip logging. They will do IP logging if they receive relevant court requests. > Also provides ability to send encrypted mail with pre shared passwords. Good client apps too. The only client app you can use is Tutanota's client/web browser. Last I used it you couldn't export a whole mailbox (only individual mails and directories), you couldn't have folders more than 1 level deep, and you couldn't import email. You also can't encrypt emails to Tutanota users without using a temporary mailbox on their server. They could very easily disable encryption to particular users. You can't use third party clients (thunderbird, mutt mail.app etc), and if you're used to those it's a no-go. People always question whether or not ProtonMail could give you dodgy js that exfiltrates your password/private keys, the same goes for Tutanota, but in the case of Tutanota, you have no option to use a mail client, ie code not written by them.
- dngray 5y ago
  > Is anyone working on an "email like" app that runs on Signal? That is unlikely to ever happen as Signal doesn't allow any kind of third party clients. https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... That said Matrix does lend itself to this. It's also worth noting one of the major VCs (Notion) that funded that has an interest in other email companies. So who knows maybe we will see an email message client based on Matrix protocol. It certainly would be an improvement on relying on systems such as PGP and allow universal E2EE, but also E2EE to the border (required for many government/corporate) situations where auditing is required. > I'm struggling to figure out what comes after ProtonMail. It's clearly an evolutionary dead end but what succeeds it? Likely nothing. Many people that use services like this don't require anonymity. For that the threat model is absolutely fine. People seem to forget this page has existed literally since 2014: https://protonmail.com/blog/protonmail-threat-model/ https://protonmail.com/blog/protonmail-threat-model/ I think people have blown this case out of proportion without really having any facts. Minimal details are actually known the nature of what the criminal charges are about. There hasn't been any public verified information (court documents etc) pertaining to why the request was made. The most ProtonMail has said is that it was a judicial request made in Swizterland, and there was no avenue to appeal the request. Media latched on to sensationalist phrases like "climate activist" and "squatter" and those things in itself don't actually tell us very much about the nature of the charges and evidence against the suspect. Those things may not even be the reason the request was made.
nix23 5y ago
>ProtonMail advertises no IP logging and overall this is very unlikely. Your not required to log IP's as a service provider in Switzerland, however the ISP is required to do so.

blub 5y ago

Yes, and this is the best one can get in 2021. So it would be nice if everyone stopped attacking them at every step and started building that mythical private e-mail service that they’re talking about instead.

ddtaylor 5y ago
I'll take a provider that is transparent over one that makes claims they cannot backup. cock.li is more transparent in that regard despite being a complete meme.
- blub 5y ago
  cock.li seems to be just your average e-mail provider with no security features, as they existed since the dawn of internet. They have access to e-mail metadata and contents, and so does law enforcement or anyone hacking their servers. How can they not be transparent? They don't have any technical reason to make any security claims.
  - reginold 5y ago
    I may not understand cock.li, what feature/aspect does this quote refer to: "Cock.li has not had a successful demand for user information since 2017, thanks in large part to better education of law enforcement that contact cock.li."
    - 0-_-0 5y ago
      It refers to the size of cock.li. It's so small that it didn't get into Protonmail's situation yet.
      - dngray 5y ago
        I would also bet they may have handed out some select information but it just hasn't "hit the news". I would say cock.li is certainly big enough that someone has used it in a criminal matter eg child pornography, bomb threats etc. With email it's either that or they go after wherever you're hosting from.
        pcranaway 5y ago
        cock.li was indeed used for bomb threats - https://www.dailydot.com/debug/cock-li-email-service-vincent-canfield-interview-fake-bomb-threats-hard-drives/ https://www.dailydot.com/debug/cock-li-email-service-vincent...
reginold 5y ago
Agreed! Where are the replacements for us to test out :)
- andrey_utkin 5y ago
  FreedomBox, Sovereign https://github.com/sovereign/sovereign https://github.com/sovereign/sovereign

reginold 5y ago

Is anyone working on an "email like" app that runs on Signal? I'm struggling to figure out what comes after ProtonMail. It's clearly an evolutionary dead end but what succeeds it?

raven108 5y ago
I have Tutanota to be quite reliable end to end encryption and no ip logging. Also provides ability to send encrypted mail with pre shared passwords. Good client apps too. Given Protonmail trust issues Sir Lee ought to have avoided. Signal mail service/client would be great too. Long time FastMail user but they too give fuzzy answers on mail privacy. Mailbox.org seems to be decent with encryption at rest.
- dngray 5y ago
  > I have Tutanota to be quite reliable end to end encryption and no ip logging. They will do IP logging if they receive relevant court requests. > Also provides ability to send encrypted mail with pre shared passwords. Good client apps too. The only client app you can use is Tutanota's client/web browser. Last I used it you couldn't export a whole mailbox (only individual mails and directories), you couldn't have folders more than 1 level deep, and you couldn't import email. You also can't encrypt emails to Tutanota users without using a temporary mailbox on their server. They could very easily disable encryption to particular users. You can't use third party clients (thunderbird, mutt mail.app etc), and if you're used to those it's a no-go. People always question whether or not ProtonMail could give you dodgy js that exfiltrates your password/private keys, the same goes for Tutanota, but in the case of Tutanota, you have no option to use a mail client, ie code not written by them.
dngray 5y ago
> Is anyone working on an "email like" app that runs on Signal? That is unlikely to ever happen as Signal doesn't allow any kind of third party clients. https://github.com/LibreSignal/LibreSignal/issues/37#issuecomment-217211165 https://github.com/LibreSignal/LibreSignal/issues/37#issueco... That said Matrix does lend itself to this. It's also worth noting one of the major VCs (Notion) that funded that has an interest in other email companies. So who knows maybe we will see an email message client based on Matrix protocol. It certainly would be an improvement on relying on systems such as PGP and allow universal E2EE, but also E2EE to the border (required for many government/corporate) situations where auditing is required. > I'm struggling to figure out what comes after ProtonMail. It's clearly an evolutionary dead end but what succeeds it? Likely nothing. Many people that use services like this don't require anonymity. For that the threat model is absolutely fine. People seem to forget this page has existed literally since 2014: https://protonmail.com/blog/protonmail-threat-model/ https://protonmail.com/blog/protonmail-threat-model/ I think people have blown this case out of proportion without really having any facts. Minimal details are actually known the nature of what the criminal charges are about. There hasn't been any public verified information (court documents etc) pertaining to why the request was made. The most ProtonMail has said is that it was a judicial request made in Swizterland, and there was no avenue to appeal the request. Media latched on to sensationalist phrases like "climate activist" and "squatter" and those things in itself don't actually tell us very much about the nature of the charges and evidence against the suspect. Those things may not even be the reason the request was made.

nix23 5y ago

>ProtonMail advertises no IP logging and overall this is very unlikely. Your not required to log IP's as a service provider in Switzerland, however the ISP is required to do so.