6 ms·

It hurts my soul to see a well-reasoned and well-intentioned post like this start off with good advice then immediately recommend ProtonMail. ProtonMail is abo

It hurts my soul to see a well-reasoned and well-intentioned post like this start off with good advice then immediately recommend ProtonMail. ProtonMail is about the single worst experience I’ve ever had with Big Email. I really do wonder how many people they’ve harmed but get away with it because the happy path works for most people most of the time. The worry I have with something like Gmail or Outlook is that they can just take away your access to your inbox without reason or recourse, but it’s never actually happened to anyone I know. It happened with ProtonMail though - I set up an account for a family member, updated some of their online registrations to point to it, then a couple of days later it was locked out permanently. Thankfully they hadn’t got to the point of using the account for anything they cared about yet, just a couple of big retailer mailing lists (they’re not the most tech literate so move very slowly with things like this). Literally it was receiving mailing list emails from two well known, non-shady retailers and that’s it. Password not forgotten, No way to have the account unlocked, no way to find out why it was locked, no way to have the account deleted, no way to get access to repoint the accounts using that address because now ProtonMail owned those other website accounts (not your email not your account). Pretty much just [you can’t have your account back, you can’t find out why, you can’t appeal, and every email that ever lands here in the future belongs to us now so go fish]. They are by a long way the worst experience I ever had with a provider of any online service, so much so that I’ve since moved my own e-mail that was there back to outlook before some arbitrary spam caused the same thing to happen to me. Never again.

sierkov 4y ago
- Big claims - No details or evidence to back them - Happened to you more than once Sure. We'll just believe that ProtonMail locks accounts randomly, for no reason. Or was spam the reason? If that was true, everyone would be locked out because, well, everyone is getting spam.
- YesWeWill 4y ago
  Yes, we will, since it happened to others of us. What kind of evidence would you like? My account is inaccessible. Should I tell you the password so you can try yourself or what?
- arinlen 4y ago
  > Sure. We'll just believe that ProtonMail locks accounts randomly, for no reason. https://www.reddit.com/r/ProtonMail/comments/ic19q4/locked_out_of_account_and_disappointed_in/ https://www.reddit.com/r/ProtonMail/comments/ic19q4/locked_o... A quick Google search returns tons of results from ProtonMail's subreddit of people complaining that ProtonMail locked them out of their account for unknown random reasons. This is a curated subreddit.
  - highwaylights 4y ago
    Thanks for posting this, honestly I was unaware this had been happening as widely to others. Wild.
  - sierkov 4y ago
    The post you've linked doesn't say that it was some unknown/random reason just the fact that the person is locked out of the account, not that the account itself is locked, which may be for variety of reasons(losing 2FA, forgetting password, else?). It's more about that support is slow. The person reached out and the issue was eventually resolved.
    - arinlen 4y ago
      > The post you've linked doesn't say that it was some unknown/random reason just the fact that the person is locked out of the account, (...) Fair enough. You can google though. There's a wealth of complains of people seeing their accounts locked. If you don't have time to run a Google search, you are free to read ProtonMail's own docs, specially how they describe how they lock accounts based on heuristics and how they recognize the occurrence of false positives. https://proton.me/support/account-disabled https://proton.me/support/account-disabled
- highwaylights 4y ago
  What evidence could be provided here though? The evidence would be the e-mail account which PM now hold and aren’t going to give over. I didn’t say it happened more than once, if anything I was saying once was enough and it was a risk I didn’t want to take ever again. Also, I hadn’t realised this before, but a reply further down the thread has linked to many instances of this happening on reddit.
  - sierkov 4y ago
    Trying to contact support? Their response? Ultimately figuring out the real reason? When faced with an issue I usually try to figure it out first. After all, accounts can get flagged wrongly on outlook, gmail and other services as well. And the linked reddit thread does not relate to your case. To me, the very theory of account locked just because someone sends a spam email to said account is, honestly, ridiculous. > They are by a long way the worst experience I ever had with a provider of any online service, so much so that I’ve since moved my own e-mail that was there back to outlook before some arbitrary spam caused the same thing to happen to me. Well, I misunderstood you here. Wrongly assumed you meant it happened to you again.
    - YesWeWill 4y ago
      No, all my Gmails and Outlooks still work. It's only Protonmail that stopped. Support didn't reply.
      - sierkov 4y ago
        Yeah, I get it. ProtonMail bad. I'm glad that your Gmails and Outlooks still work. Thumbs up. I'm also glad you've created this account just to reply to me, really honored.
        highwaylights 4y ago
        You're being really dismissive here - no-one's saying PM bad/others good. I was pointing out an experience with ProtonMail and others have corroborated with their own experience. All of that said, if it says nothing else it at least suggests that larger providers seem to have a better grasp of how catastrophic being locked out of one's own e-mail can be - PM really don't seem to understand the responsibility they bear being a provider of such critical infrastructure. If this were happening in this same way at larger providers like Google and Microsoft, I'm quite certain there would be heavy regulations by now.
defanor 4y ago
I find ProtonMail odd too, especially in context of better decentralization, for them (AFAIK) not supporting regular client-to-server protocols (without the bridge software) and doing that reinvented encryption which only works between its clients, but as for account cancellation, it does seem to happen with others too: there are regularly appearing stories about Gmail/Google accounts being blocked with no way to contact the support, occasional services (like Opera mail) just shutting down, some seem to take your mailbox hostage demanding more of PI.
- colordrops 4y ago
  Isn't the purpose of the bridge to avoid storing unencrypted emails on Protonmail's servers?
  - defanor 4y ago
    AIUI it is, but that's achievable with generic setups (using OpenPGP for encryption, often GnuPG) and between any mail servers as well, in a standardized way. I think the ProtonMail's argument is that they make it the default for communication between their clients, while OpenPGP is not used commonly. But to benefit from that, all the involved users should use ProtonMail, which is contrary to decentralization.
    - colordrops 4y ago
      It solves the problem of protonmail having to turn over emails to various authorities. This isn't solved with gpg as most people you would be sending to don't use it. I don't think it's meant to solve e2e encryption.
      - defanor 4y ago
        But most of the email recipients (and senders too) don't use ProtonMail either, so those won't be encrypted, and then ProtonMail can still turn over the messages. The ideal situation with this approach is that everyone uses ProtonMail (no decentralization at all), to have everything encrypted. While the ideal situation with OpenPGP is that everyone uses that, which allows for multiple independent mail servers. Edit: or do they perhaps not store sent messages (that is, they have to queue them, and attempt resending on failure, but beyond that), and/or encrypt incoming ones with the user's public key upon arrival? Edit 2: apparently the stored messages are indeed additionally encrypted by ProtonMail [1]. That looks useful. Edit 3: now I wonder why not to do that with OpenPGP too. Edit 4: looked around, apparently some do that. [2] [1] https://proton.me/support/proton-mail-encryption-explained https://proton.me/support/proton-mail-encryption-explained [2] https://jnphilipp.org/posts/auto-encrypt-all-incoming-email-with-postfix/ https://jnphilipp.org/posts/auto-encrypt-all-incoming-email-...
hardwaresofton 4y ago
Hey thanks for taking the time to write this out. I wrote that post, and I use ProtonMail and have basically nothing but good experiences with them so far. I don't consider them "Big Email" just by literal meaning (they're very small) > The worry I have with something like Gmail or Outlook is that they can just take away your access to your inbox without reason or recourse, but it’s never actually happened to anyone I know. It happened with ProtonMail though - I set up an account for a family member, updated some of their online registrations to point to it, then a couple of days later it was locked out permanently. > > Password not forgotten, No way to have the account unlocked, no way to find out why it was locked, no way to have the account deleted, no way to get access to repoint the accounts using that address because now ProtonMail owned those other website accounts (not your email not your account). > > Password not forgotten, No way to have the account unlocked, no way to find out why it was locked, no way to have the account deleted, no way to get access to repoint the accounts using that address because now ProtonMail owned those other website accounts (not your email not your account). This is pretty terrible, but I'm coming at it from a oligopoly-break-up angle, and hadn't heard any such stories about ProtonMail. I'll try to update the post to serve as a better example, but I hesitate to do so without at least suggesting something (other than self hosting, obviously) that is a similarly easier option. What do you recommend instead? Fastmail?
- jorvi 4y ago
  > What do you recommend instead? Fastmail? FastMail and Mailbox spring to mind as the premiere ‘alternate’ e-mail hosts. I’ve heard decent things about Tutanota but have never used them so can’t speak to it.
  - hardwaresofton 4y ago
    Tutanota I did hear something negative about -- they're beholden to the German government (not to necessarily say that others aren't -- ultimately nation-states tend to get their way), but I'm willing to include it if the community generally trusts it/is OK with the tradeoff.
    - deleted 4y ago
Siyo 4y ago
Also avoid using ProtonMail Bridge if you value your emails. It's been silently corrupting/deleting your emails for years now. And Proton hasn't done a single thing to warn users about it. Instead they've been working on a complete rewrite which is far from completion. Meanwhile people are still discovering that their emails are disappearing. https://github.com/ProtonMail/proton-bridge/issues/29 https://github.com/ProtonMail/proton-bridge/issues/29 https://github.com/ProtonMail/proton-bridge/issues/220 https://github.com/ProtonMail/proton-bridge/issues/220
t_mann 4y ago
Weird, I've had the opposite experience with Proton - I was able to recover an account with insufficient recovery info after having forgotten the password (100% my fault) after a quite thororough process. I've also completely lost access to a Google account on which I hadn't provided recovery info and my only "fault" was trying to log in from a new location (even in the same browser) - I moved places in between, so I couln't just go back to the old location. I'm sorry this happened to you, but I find it weird that you make this out to be a problem specific to Proton. It happens to people on all major services, it sometimes even makes the front of HN. Do we have any evidence that this happens at a significantly higher rate at Proton than at other providers?

sierkov 4y ago

- Big claims - No details or evidence to back them - Happened to you more than once Sure. We'll just believe that ProtonMail locks accounts randomly, for no reason. Or was spam the reason? If that was true, everyone would be locked out because, well, everyone is getting spam.

YesWeWill 4y ago
Yes, we will, since it happened to others of us. What kind of evidence would you like? My account is inaccessible. Should I tell you the password so you can try yourself or what?
arinlen 4y ago
> Sure. We'll just believe that ProtonMail locks accounts randomly, for no reason. https://www.reddit.com/r/ProtonMail/comments/ic19q4/locked_out_of_account_and_disappointed_in/ https://www.reddit.com/r/ProtonMail/comments/ic19q4/locked_o... A quick Google search returns tons of results from ProtonMail's subreddit of people complaining that ProtonMail locked them out of their account for unknown random reasons. This is a curated subreddit.
- highwaylights 4y ago
  Thanks for posting this, honestly I was unaware this had been happening as widely to others. Wild.
- sierkov 4y ago
  The post you've linked doesn't say that it was some unknown/random reason just the fact that the person is locked out of the account, not that the account itself is locked, which may be for variety of reasons(losing 2FA, forgetting password, else?). It's more about that support is slow. The person reached out and the issue was eventually resolved.
  - arinlen 4y ago
    > The post you've linked doesn't say that it was some unknown/random reason just the fact that the person is locked out of the account, (...) Fair enough. You can google though. There's a wealth of complains of people seeing their accounts locked. If you don't have time to run a Google search, you are free to read ProtonMail's own docs, specially how they describe how they lock accounts based on heuristics and how they recognize the occurrence of false positives. https://proton.me/support/account-disabled https://proton.me/support/account-disabled
highwaylights 4y ago
What evidence could be provided here though? The evidence would be the e-mail account which PM now hold and aren’t going to give over. I didn’t say it happened more than once, if anything I was saying once was enough and it was a risk I didn’t want to take ever again. Also, I hadn’t realised this before, but a reply further down the thread has linked to many instances of this happening on reddit.
- sierkov 4y ago
  Trying to contact support? Their response? Ultimately figuring out the real reason? When faced with an issue I usually try to figure it out first. After all, accounts can get flagged wrongly on outlook, gmail and other services as well. And the linked reddit thread does not relate to your case. To me, the very theory of account locked just because someone sends a spam email to said account is, honestly, ridiculous. > They are by a long way the worst experience I ever had with a provider of any online service, so much so that I’ve since moved my own e-mail that was there back to outlook before some arbitrary spam caused the same thing to happen to me. Well, I misunderstood you here. Wrongly assumed you meant it happened to you again.
  - YesWeWill 4y ago
    No, all my Gmails and Outlooks still work. It's only Protonmail that stopped. Support didn't reply.
    - sierkov 4y ago
      Yeah, I get it. ProtonMail bad. I'm glad that your Gmails and Outlooks still work. Thumbs up. I'm also glad you've created this account just to reply to me, really honored.
      - highwaylights 4y ago
        You're being really dismissive here - no-one's saying PM bad/others good. I was pointing out an experience with ProtonMail and others have corroborated with their own experience. All of that said, if it says nothing else it at least suggests that larger providers seem to have a better grasp of how catastrophic being locked out of one's own e-mail can be - PM really don't seem to understand the responsibility they bear being a provider of such critical infrastructure. If this were happening in this same way at larger providers like Google and Microsoft, I'm quite certain there would be heavy regulations by now.

defanor 4y ago

I find ProtonMail odd too, especially in context of better decentralization, for them (AFAIK) not supporting regular client-to-server protocols (without the bridge software) and doing that reinvented encryption which only works between its clients, but as for account cancellation, it does seem to happen with others too: there are regularly appearing stories about Gmail/Google accounts being blocked with no way to contact the support, occasional services (like Opera mail) just shutting down, some seem to take your mailbox hostage demanding more of PI.

colordrops 4y ago
Isn't the purpose of the bridge to avoid storing unencrypted emails on Protonmail's servers?
- defanor 4y ago
  AIUI it is, but that's achievable with generic setups (using OpenPGP for encryption, often GnuPG) and between any mail servers as well, in a standardized way. I think the ProtonMail's argument is that they make it the default for communication between their clients, while OpenPGP is not used commonly. But to benefit from that, all the involved users should use ProtonMail, which is contrary to decentralization.
  - colordrops 4y ago
    It solves the problem of protonmail having to turn over emails to various authorities. This isn't solved with gpg as most people you would be sending to don't use it. I don't think it's meant to solve e2e encryption.
    - defanor 4y ago
      But most of the email recipients (and senders too) don't use ProtonMail either, so those won't be encrypted, and then ProtonMail can still turn over the messages. The ideal situation with this approach is that everyone uses ProtonMail (no decentralization at all), to have everything encrypted. While the ideal situation with OpenPGP is that everyone uses that, which allows for multiple independent mail servers. Edit: or do they perhaps not store sent messages (that is, they have to queue them, and attempt resending on failure, but beyond that), and/or encrypt incoming ones with the user's public key upon arrival? Edit 2: apparently the stored messages are indeed additionally encrypted by ProtonMail [1]. That looks useful. Edit 3: now I wonder why not to do that with OpenPGP too. Edit 4: looked around, apparently some do that. [2] [1] https://proton.me/support/proton-mail-encryption-explained https://proton.me/support/proton-mail-encryption-explained [2] https://jnphilipp.org/posts/auto-encrypt-all-incoming-email-with-postfix/ https://jnphilipp.org/posts/auto-encrypt-all-incoming-email-...

hardwaresofton 4y ago

Hey thanks for taking the time to write this out. I wrote that post, and I use ProtonMail and have basically nothing but good experiences with them so far. I don't consider them "Big Email" just by literal meaning (they're very small) > The worry I have with something like Gmail or Outlook is that they can just take away your access to your inbox without reason or recourse, but it’s never actually happened to anyone I know. It happened with ProtonMail though - I set up an account for a family member, updated some of their online registrations to point to it, then a couple of days later it was locked out permanently. > > Password not forgotten, No way to have the account unlocked, no way to find out why it was locked, no way to have the account deleted, no way to get access to repoint the accounts using that address because now ProtonMail owned those other website accounts (not your email not your account). > > Password not forgotten, No way to have the account unlocked, no way to find out why it was locked, no way to have the account deleted, no way to get access to repoint the accounts using that address because now ProtonMail owned those other website accounts (not your email not your account). This is pretty terrible, but I'm coming at it from a oligopoly-break-up angle, and hadn't heard any such stories about ProtonMail. I'll try to update the post to serve as a better example, but I hesitate to do so without at least suggesting something (other than self hosting, obviously) that is a similarly easier option. What do you recommend instead? Fastmail?

jorvi 4y ago
> What do you recommend instead? Fastmail? FastMail and Mailbox spring to mind as the premiere ‘alternate’ e-mail hosts. I’ve heard decent things about Tutanota but have never used them so can’t speak to it.
- hardwaresofton 4y ago
  Tutanota I did hear something negative about -- they're beholden to the German government (not to necessarily say that others aren't -- ultimately nation-states tend to get their way), but I'm willing to include it if the community generally trusts it/is OK with the tradeoff.
  - deleted 4y ago

Siyo 4y ago

Also avoid using ProtonMail Bridge if you value your emails. It's been silently corrupting/deleting your emails for years now. And Proton hasn't done a single thing to warn users about it. Instead they've been working on a complete rewrite which is far from completion. Meanwhile people are still discovering that their emails are disappearing. https://github.com/ProtonMail/proton-bridge/issues/29 https://github.com/ProtonMail/proton-bridge/issues/29 https://github.com/ProtonMail/proton-bridge/issues/220 https://github.com/ProtonMail/proton-bridge/issues/220

t_mann 4y ago

Weird, I've had the opposite experience with Proton - I was able to recover an account with insufficient recovery info after having forgotten the password (100% my fault) after a quite thororough process. I've also completely lost access to a Google account on which I hadn't provided recovery info and my only "fault" was trying to log in from a new location (even in the same browser) - I moved places in between, so I couln't just go back to the old location. I'm sorry this happened to you, but I find it weird that you make this out to be a problem specific to Proton. It happens to people on all major services, it sometimes even makes the front of HN. Do we have any evidence that this happens at a significantly higher rate at Proton than at other providers?