3 ms·

This, from a company that happily put Google's reCAPTCHA on their login form, further telling people on GitHub not to worry about it, without having ever heard

by junon 3y ago

This, from a company that happily put Google's reCAPTCHA on their login form, further telling people on GitHub not to worry about it, without having ever heard of hCaptcha. I have long since left Proton as I don't believe their actions match their supposed mission.

sickofparadox 3y ago
What do you use for an alternative as a free-to-open privacy focused email provider?
- dev213 3y ago
  tutanota is great. I've been a happy, paying customer for about a year now.
  - AlotOfReading 3y ago
    The service is solid, but there are a lot of caveats and compromises they make to achieve their differentiating features. For one thing, the encryption means you can only use their frontend/app to access your email. Unfortunately the app doesn't get notifications reliably, search is utterly broken, and the app can't show the subject line in toasts for security reasons, so I never know if an email needs to be read now or whenever's convenient. You also need to be on the paying tier for a usable product. I evaluated a number of options when I was trying to decide where to park my domain long term. Cue an incident at a border crossing where immigration wanted to see a hotel booking that search insisted didn't exist. Turns out the booking email was a few days outside the free tier search window, and that limitation wasn't obvious in the pressure of an immigration queue. Felt like I had been gaslit once I realized.
    - hellojesus 3y ago
      Last I checked, Proton also didn't allow third party tools to access mail. Has that changed?
      - benabbottnz 3y ago
        Proton Mail Bridge lets you use a third party email client. https://proton.me/mail/bridge https://proton.me/mail/bridge https://proton.me/blog/thunderbird-outlook-encrypted-email https://proton.me/blog/thunderbird-outlook-encrypted-email
        hellojesus 3y ago
        Awesome, thanks. Was looking to pay for a provider, and this puts Proton back in the running.
      - tredre3 3y ago
        Proton offers an IMAP/SMTP bridge so that generic tools can do whatever they want. This makes backing up emails trivial. Tutanota still doesn't have an easy way to export all emails.
    - dev213 3y ago
      I don't understand your point about it being unusable as a free user. I only upgraded to a paid tier about a year ago, before that I was using for about one and a half years for free with 0 issues. Notifications never arrive late (at least on the IOS app) Maybe it's because I'm not a heavy E-mail "Power user", but I see most of these as non-issues (this depends on your use case, of course) Another huge pro for me, as a resident of Germany, the data stays in Germany and is protected under our strong data security laws. I do have to agree, the search was kind of sucky for a while. But imo it's improved a lot is also pretty useable now.
- junon 3y ago
  There isn't one unless you run it yourself. It simply doesn't exist. Email is never private unless you put your own encryption layer on it, which both sides must support, at which point you're probably better off using an E2E solution.
kaplun 3y ago
This is not true. We moved longtime ago to use hCaptcha precisely to cut ties with Google reCAPTCHA. And we switched today from hCaptcha to our own solution precisely for the reason described in the blog post.
protonmail 3y ago
This comment is absolutely the wrong take on this. For context, Proton Mail was first launched in 2014, and back then, hCaptcha didn't even exist and there were no other non-broken captcha solutions that worked at scale besides reCaptcha. It wasn't until 2020 that hCaptcha became better known, and until then it was really quite untested at scale. In any case, Proton switched over to hCaptcha soon after but even then, it was not without issues, and did not work for many prospective Proton users. Whether it's reCaptcha or hCaptcha, Proton's implementation always sandboxed it within an iframe which mitigated the privacy concerns and it honestly could have been left like this. But instead, Proton went out of the way, investing substantial resources to build, launch, and operate it's own captcha service. That's actually pretty extreme commitment to the mission, and putting money and resources to prove it.

by junon 3y ago

sickofparadox 3y ago

What do you use for an alternative as a free-to-open privacy focused email provider?

dev213 3y ago
tutanota is great. I've been a happy, paying customer for about a year now.
- AlotOfReading 3y ago
  The service is solid, but there are a lot of caveats and compromises they make to achieve their differentiating features. For one thing, the encryption means you can only use their frontend/app to access your email. Unfortunately the app doesn't get notifications reliably, search is utterly broken, and the app can't show the subject line in toasts for security reasons, so I never know if an email needs to be read now or whenever's convenient. You also need to be on the paying tier for a usable product. I evaluated a number of options when I was trying to decide where to park my domain long term. Cue an incident at a border crossing where immigration wanted to see a hotel booking that search insisted didn't exist. Turns out the booking email was a few days outside the free tier search window, and that limitation wasn't obvious in the pressure of an immigration queue. Felt like I had been gaslit once I realized.
  - hellojesus 3y ago
    Last I checked, Proton also didn't allow third party tools to access mail. Has that changed?
    - benabbottnz 3y ago
      Proton Mail Bridge lets you use a third party email client. https://proton.me/mail/bridge https://proton.me/mail/bridge https://proton.me/blog/thunderbird-outlook-encrypted-email https://proton.me/blog/thunderbird-outlook-encrypted-email
      - hellojesus 3y ago
        Awesome, thanks. Was looking to pay for a provider, and this puts Proton back in the running.
    - tredre3 3y ago
      Proton offers an IMAP/SMTP bridge so that generic tools can do whatever they want. This makes backing up emails trivial. Tutanota still doesn't have an easy way to export all emails.
  - dev213 3y ago
    I don't understand your point about it being unusable as a free user. I only upgraded to a paid tier about a year ago, before that I was using for about one and a half years for free with 0 issues. Notifications never arrive late (at least on the IOS app) Maybe it's because I'm not a heavy E-mail "Power user", but I see most of these as non-issues (this depends on your use case, of course) Another huge pro for me, as a resident of Germany, the data stays in Germany and is protected under our strong data security laws. I do have to agree, the search was kind of sucky for a while. But imo it's improved a lot is also pretty useable now.
junon 3y ago
There isn't one unless you run it yourself. It simply doesn't exist. Email is never private unless you put your own encryption layer on it, which both sides must support, at which point you're probably better off using an E2E solution.

kaplun 3y ago

This is not true. We moved longtime ago to use hCaptcha precisely to cut ties with Google reCAPTCHA. And we switched today from hCaptcha to our own solution precisely for the reason described in the blog post.

protonmail 3y ago

This comment is absolutely the wrong take on this. For context, Proton Mail was first launched in 2014, and back then, hCaptcha didn't even exist and there were no other non-broken captcha solutions that worked at scale besides reCaptcha. It wasn't until 2020 that hCaptcha became better known, and until then it was really quite untested at scale. In any case, Proton switched over to hCaptcha soon after but even then, it was not without issues, and did not work for many prospective Proton users. Whether it's reCaptcha or hCaptcha, Proton's implementation always sandboxed it within an iframe which mitigated the privacy concerns and it honestly could have been left like this. But instead, Proton went out of the way, investing substantial resources to build, launch, and operate it's own captcha service. That's actually pretty extreme commitment to the mission, and putting money and resources to prove it.