4 ms·

ProtonMail shines when you just want a disposable address (that isn't dropped after a few months of inactivity) without having to provide a phone number or othe

ProtonMail shines when you just want a disposable address (that isn't dropped after a few months of inactivity) without having to provide a phone number or other sensitive info for registration. I wouldn't depend on it however for E2EE of communication data. Or any third-party service where I'm not the one managing myself the key pair and locally en/decrypting data. EDIT: as pointed out below, it seems that they do recycle your account under certain conditions (never happened with me) and they do require identification when registering via Tor (never done it through Tor). I don't think there are many scenarios left where choosing ProtonMail is the best option.

vmception 5y ago
When connecting to proton over tor they require a phone number and credit card payment
- dane-pgp 5y ago
  I don't understand why they couldn't accept a crypto-currency payment in lieu of personal details. Even accepting a "proof of burn" transaction (if they are worried about money laundering regulations) would be enough to rate-limit / disincentivise the spammers.
vbezhenar 5y ago
Proton mail Twitter: “ We have a 3 months inactivity policy, so if the account is not a paid account, and if another user requests it, and if the account doesn't have any activity, sometimes the username will be released.”
- jjcon 5y ago
  That seems like a massive privacy issue, no? I don't think any major email provider lets usernames recycle under any circumstances.
  - jcims 5y ago
    It does afford some repudiability, which could conceivably be good for privacy.
  - temp_praneshp 5y ago
    One counter example is yahoo, back in 2013[0], unless we want to be pedantic/snarky about "major" [0]https://yahoo.tumblr.com/post/52805929240/yournameyahoocom-can-be-yours https://yahoo.tumblr.com/post/52805929240/yournameyahoocom-c...
  - vbezhenar 5y ago
    I think it’s a terrible policy. What’s worse is that most free email services are similar. IMO inactive email should be disabled and its stored data should be purged, but user data, including password should be kept forever, it does not take much space. And everything should be reactivated after successful login.
StillBored 5y ago
I banged my head about this 10+ years ago. In theory it is possible to to E2EE webmail, the trick is creating and encrypting/decrypting the mail private keys in javascript on the client side. It actually shouldn't be that hard to verify once, but the problem is that you really have to verify the code every single time it gets served to the end user, which is just about impossible. That said, I use proton mail with their bridge https://protonmail.com/blog/bridge-security-model/ https://protonmail.com/blog/bridge-security-model/ which in theory is a lot easier to audit, and the end user is in charge of when it gets upgraded, so a warrant in theory doesn't just allow them to flip a flag somewhere and have the client forward the encryption keys. Whether or not that functionality is buried in the bridge is something that could be audited, although i've not done it and frankly probably no one else really serious has done it either since the effort to audit it is more than just setting up a custom GPG configuration. Edit: And just as a note, frankly it hard to justify not having an encrypted email/dropbox/whatever these days. I use it fairly regularly to communicate with my bank/attorney/etc. Its easy for them to use, and throws up another barrier to the bad guys on the internet that don't need to know my social security number/bank account numbers/etc.
- smsm42 5y ago
  You probably can do it with a browser extension with a set of pre-registered hashes for all (or at least vital) components, and segregating verified and non-verified scripts to different domains, so non-verified parts aren't allowed to ever touch sensitive data, and not allowing any wrong hashes from verified domains. Maintaining this and ensuring it actually works, let alone upgrading it, would be a nightmare though.

vmception 5y ago

When connecting to proton over tor they require a phone number and credit card payment

dane-pgp 5y ago
I don't understand why they couldn't accept a crypto-currency payment in lieu of personal details. Even accepting a "proof of burn" transaction (if they are worried about money laundering regulations) would be enough to rate-limit / disincentivise the spammers.

vbezhenar 5y ago

Proton mail Twitter: “ We have a 3 months inactivity policy, so if the account is not a paid account, and if another user requests it, and if the account doesn't have any activity, sometimes the username will be released.”

jjcon 5y ago
That seems like a massive privacy issue, no? I don't think any major email provider lets usernames recycle under any circumstances.
- jcims 5y ago
  It does afford some repudiability, which could conceivably be good for privacy.
- temp_praneshp 5y ago
  One counter example is yahoo, back in 2013[0], unless we want to be pedantic/snarky about "major" [0]https://yahoo.tumblr.com/post/52805929240/yournameyahoocom-can-be-yours https://yahoo.tumblr.com/post/52805929240/yournameyahoocom-c...
- vbezhenar 5y ago
  I think it’s a terrible policy. What’s worse is that most free email services are similar. IMO inactive email should be disabled and its stored data should be purged, but user data, including password should be kept forever, it does not take much space. And everything should be reactivated after successful login.

StillBored 5y ago

I banged my head about this 10+ years ago. In theory it is possible to to E2EE webmail, the trick is creating and encrypting/decrypting the mail private keys in javascript on the client side. It actually shouldn't be that hard to verify once, but the problem is that you really have to verify the code every single time it gets served to the end user, which is just about impossible. That said, I use proton mail with their bridge https://protonmail.com/blog/bridge-security-model/ https://protonmail.com/blog/bridge-security-model/ which in theory is a lot easier to audit, and the end user is in charge of when it gets upgraded, so a warrant in theory doesn't just allow them to flip a flag somewhere and have the client forward the encryption keys. Whether or not that functionality is buried in the bridge is something that could be audited, although i've not done it and frankly probably no one else really serious has done it either since the effort to audit it is more than just setting up a custom GPG configuration. Edit: And just as a note, frankly it hard to justify not having an encrypted email/dropbox/whatever these days. I use it fairly regularly to communicate with my bank/attorney/etc. Its easy for them to use, and throws up another barrier to the bad guys on the internet that don't need to know my social security number/bank account numbers/etc.

smsm42 5y ago
You probably can do it with a browser extension with a set of pre-registered hashes for all (or at least vital) components, and segregating verified and non-verified scripts to different domains, so non-verified parts aren't allowed to ever touch sensitive data, and not allowing any wrong hashes from verified domains. Maintaining this and ensuring it actually works, let alone upgrading it, would be a nightmare though.