5 ms·

That isn't really fair. If you read the article, protonmail essentially supplied the FBI the recovery email of the account. This is metadata that protonmail mus

by booi 3y ago

That isn't really fair. If you read the article, protonmail essentially supplied the FBI the recovery email of the account. This is metadata that protonmail must have that isn't encrypted by the user for obvious reasons. Regarding the "MITM" for every email sent, this is related to their "bridge" software which allows regular IMAP/SMTP software to use Proton Mail. This software must edit the emails to encrypt them in their scheme. This software is open source and can be inspected and/or built locally. https://github.com/ProtonMail/proton-bridge https://github.com/ProtonMail/proton-bridge

m00dy 3y ago
no one can ever know Protonmail is really encrypting mails. Opensourcing a piece of software doesn't really mean that Protonmail deployed that and also doesn't really mean that you are using their promised encryption.
- aydyn 3y ago
  Surely they could have an audit/attestation by 3rd party?
  - bayindirh 3y ago
    Yes, but did they?
    - tephra 3y ago
      Yes https://proton.me/blog/security-audit https://proton.me/blog/security-audit
      - oneTbrain23 3y ago
        Worldcom passed audit I recalled. Enron too. FTC gave Bernie approval. How about FTX? Remember once uoon a time there was big 5 with one of them as Aurther Andersen? Did anyone auditted Securitum? And oh yeah did anyone actually verified what is being auditted and what is not? When so many info about a compromised Protonmail to law enforcers that Proton didnt even actively deny, I give Securitum as much confidence as AA 2 decade ago.
        illiac786 3y ago
        In your logic it seems impossible to be considered secure, since audits do not matter. Which email service do you consider secure and why?
- booi 3y ago
  you can also build it yourself
oneTbrain23 3y ago
You can read some forums and head over to mastodon or discord. Protonmail isn't secure. Some seems to hint compromised. Use it like what you would with Gmail or Yahoo. As for paying, no thanks. Nothing secure about it. You get more security buying separate VPN and even having qqmail (yes, Xi can read your email, but wont have the authority to send law enforcers to your home in Oslo or NY). NSA and CIA can...but will have zero chance of reading your qqmail.
- illiac786 3y ago
  You're shifting the effort on the others instead of providing convincing arguments. That is not very convincing.

by booi 3y ago

m00dy 3y ago

no one can ever know Protonmail is really encrypting mails. Opensourcing a piece of software doesn't really mean that Protonmail deployed that and also doesn't really mean that you are using their promised encryption.

aydyn 3y ago
Surely they could have an audit/attestation by 3rd party?
- bayindirh 3y ago
  Yes, but did they?
  - tephra 3y ago
    Yes https://proton.me/blog/security-audit https://proton.me/blog/security-audit
    - oneTbrain23 3y ago
      Worldcom passed audit I recalled. Enron too. FTC gave Bernie approval. How about FTX? Remember once uoon a time there was big 5 with one of them as Aurther Andersen? Did anyone auditted Securitum? And oh yeah did anyone actually verified what is being auditted and what is not? When so many info about a compromised Protonmail to law enforcers that Proton didnt even actively deny, I give Securitum as much confidence as AA 2 decade ago.
      - illiac786 3y ago
        In your logic it seems impossible to be considered secure, since audits do not matter. Which email service do you consider secure and why?
booi 3y ago
you can also build it yourself

oneTbrain23 3y ago

You can read some forums and head over to mastodon or discord. Protonmail isn't secure. Some seems to hint compromised. Use it like what you would with Gmail or Yahoo. As for paying, no thanks. Nothing secure about it. You get more security buying separate VPN and even having qqmail (yes, Xi can read your email, but wont have the authority to send law enforcers to your home in Oslo or NY). NSA and CIA can...but will have zero chance of reading your qqmail.

illiac786 3y ago
You're shifting the effort on the others instead of providing convincing arguments. That is not very convincing.