> Protonmail even has an SSL cert for that onion address even though it’s completely unnecessary. It is absolutely necessary, especially with the new, longer v

> Protonmail even has an SSL cert for that onion address even though it’s completely unnecessary. It is absolutely necessary, especially with the new, longer v3 onion domains[0]. Generating a v2 onion address that begins with "protonmail" takes a few hours of GPU. Given a link to one of these v2 addresses no user is ever going to authenticate it by memorizing the address: protonmailrmez3lotccipshtklggee7olb73fu1rgj7r4o4vfu7ozyd.onion The user knows and authenticates an onion because the endpoint is signed using the same certificate and CA as the .com address and the user can verify this in their browser. > When a user makes a new account with Protonmail on TOR they are re-directed from Protonmail’s “.onion” to “.com” address. This breaks your secure encrypted connection to their onion address This step won't deanonymize you or "break your secure encrypted connection". You are routed via a Tor exit node rather than via a guard node to a hidden service. As to why they do it - offering a free service to anonymous users on Tor is a constant battle with spammers and bots. You only have to look at the absurd lengths darkweb markets go to to authenticate "real" users (multiple CAPTCHA gateways with minute+ wait times) as to how difficult this challenge is with completely anonymous traffic that has absolutely nothing to session/fingerprint a user on to prevent abuse. This entire post is speculative troll-bait, which unfortunately Protonmail fell for. Their response to this type of post only reinforces the views of those who are conspiracy-minded and see links where there are none. It is very reminiscent of the FUD campaign Pando Daily ran against the Tor project itself (any second degree link to anybody even remotely US government means the software is obviously backdoored). [0] The article links to the Protonmail v2 onion - a shorter format address and protocol that has been deprecated.