4 ms·

Hmm? Trusting their client aside (a huge issue with any secure service), I do seem to remember the key being used client-side with password-protection, i.e. not

Hmm? Trusting their client aside (a huge issue with any secure service), I do seem to remember the key being used client-side with password-protection, i.e. not accessible to their server. Am I misremembering something? The part that is easier to misunderstand is encryption-at-rest, where normal emails are still readable at ingress before they are encrypted with an appropriate public key. Also, secure and private != willing and capable of hosting illegal activity. They can kick suspicious behavior without having to read your emails.

protonmail 3y ago
Yes your encryption key is stored encrypted so that we have no access to it. It is decrypted when you enter your password, which we have no access to. The article above confirms that, in fact, and all of these cases are proof that our encryption cannot be bypassed by legal means. All the data stored encrypted on our servers (email content, calendars, attachments, etc.) is inaccessible to us: https://proton.me/blog/zero-access-encryption https://proton.me/blog/zero-access-encryption. All we can provide is the unencrypted metadata which we need to have access to in order for the services to work properly.