3 ms·

People are surprised by this because Proton does the best it can to hide what information they actually have that isn't E2EE. Especially if you want to use it a

People are surprised by this because Proton does the best it can to hide what information they actually have that isn't E2EE. Especially if you want to use it as a regular email service as a form of "privacy" (just read https://proton.me/mail/security https://proton.me/mail/security if you want to see how misleading they're trying to be. "Strong encryption at all times" *except when there isn't). They need a page like this to explain what exactly is E2EE and what isn't: https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651

lolinder 3y ago
Sorry, but what exactly is misleading on that page? Over and over again it says that the content of your email is encrypted. It's very specific about that, and it's hard to see how someone would misinterpret that to include the account recovery email address. Is that claim itself not accurate?
- overstay8930 3y ago
  "We cannot read or give anyone else access to your emails." is completely false, Proton can read emails sent or received from non-proton infrastructure. They have to. I mean just look at the end-to-end encryption block, it's such an obvious dark pattern to make people believe they're getting end to end encryption, but when you actually read it they don't claim it at all, but how is someone who doesn't understand technobabble supposed to know that? They're just trying to pretend it's the same thing. If Proton was an American company they would have been fined into the ground for this stunt. Google wasn't even safe from the Incognito mode lawsuit.
  - lolinder 3y ago
    Here's that block for reference: > With Proton Mail, emails are encrypted at all times, so we can never access your messages. The content of your emails is encrypted on your device before being sent to our servers, meaning only you and your intended recipient can decrypt it. > You can also use our Password-protected Emails feature to quickly send end-to-end encrypted emails to any email address, not just Proton Mail accounts. That first sentence, if left alone, could be interpreted to include incoming email from non-Proton Mail accounts. But as soon as you keep reading it clears that right up: * It clearly says that the security comes from encrypting outbound email on your device. * It clearly says that there is a way to encrypt outgoing email even to non-Proton Mail accounts. This isn't technobabble either, it's using terminology that is as accessible to laypeople as possible while still being precise in its language.
    - overstay8930 3y ago
      > But as soon as you keep reading it clears that right up C'mon man, even you should know how much BS that is. They are misleading people and they know it, just hoping nobody reads the fine print. I have 0 trust in Proton because of this shit. It doesn't matter what they say in the fine print, telling people there's strong encryption at all times right next to "end-to-end encryption" would fool anyone into thinking Proton can't read email in transit to non-Proton emails (in fact they even claim this, and it's false). They wouldn't be able to gain any users if they told the truth that they are the same as any other email provider except when they email their own users. They even have the gall to say they offer a more secure business email but don't offer SAML or log integration, very basic things any actual business is required to have if they want to even meet baseline security measures.
      - lolinder 3y ago
        It's not fine print, it's the second sentence of the main body text! If someone can't be bothered to even read beyond the first sentence of the marketing page, then privacy and encryption aren't actually important to them, it's just an aesthetic.
protonmail 3y ago
We already do have such a page: https://proton.me/support/proton-mail-encryption-explained https://proton.me/support/proton-mail-encryption-explained. Additionally, our Threat model has been publicly available since the service came into being in 2014: https://proton.me/blog/protonmail-threat-model https://proton.me/blog/protonmail-threat-model
- overstay8930 3y ago
  A blog post from 2014 is a hilariously bad way to claim you aren’t blatantly lying in your marketing.

lolinder 3y ago

Sorry, but what exactly is misleading on that page? Over and over again it says that the content of your email is encrypted. It's very specific about that, and it's hard to see how someone would misinterpret that to include the account recovery email address. Is that claim itself not accurate?

overstay8930 3y ago
"We cannot read or give anyone else access to your emails." is completely false, Proton can read emails sent or received from non-proton infrastructure. They have to. I mean just look at the end-to-end encryption block, it's such an obvious dark pattern to make people believe they're getting end to end encryption, but when you actually read it they don't claim it at all, but how is someone who doesn't understand technobabble supposed to know that? They're just trying to pretend it's the same thing. If Proton was an American company they would have been fined into the ground for this stunt. Google wasn't even safe from the Incognito mode lawsuit.
- lolinder 3y ago
  Here's that block for reference: > With Proton Mail, emails are encrypted at all times, so we can never access your messages. The content of your emails is encrypted on your device before being sent to our servers, meaning only you and your intended recipient can decrypt it. > You can also use our Password-protected Emails feature to quickly send end-to-end encrypted emails to any email address, not just Proton Mail accounts. That first sentence, if left alone, could be interpreted to include incoming email from non-Proton Mail accounts. But as soon as you keep reading it clears that right up: * It clearly says that the security comes from encrypting outbound email on your device. * It clearly says that there is a way to encrypt outgoing email even to non-Proton Mail accounts. This isn't technobabble either, it's using terminology that is as accessible to laypeople as possible while still being precise in its language.
  - overstay8930 3y ago
    > But as soon as you keep reading it clears that right up C'mon man, even you should know how much BS that is. They are misleading people and they know it, just hoping nobody reads the fine print. I have 0 trust in Proton because of this shit. It doesn't matter what they say in the fine print, telling people there's strong encryption at all times right next to "end-to-end encryption" would fool anyone into thinking Proton can't read email in transit to non-Proton emails (in fact they even claim this, and it's false). They wouldn't be able to gain any users if they told the truth that they are the same as any other email provider except when they email their own users. They even have the gall to say they offer a more secure business email but don't offer SAML or log integration, very basic things any actual business is required to have if they want to even meet baseline security measures.
    - lolinder 3y ago
      It's not fine print, it's the second sentence of the main body text! If someone can't be bothered to even read beyond the first sentence of the marketing page, then privacy and encryption aren't actually important to them, it's just an aesthetic.

protonmail 3y ago

We already do have such a page: https://proton.me/support/proton-mail-encryption-explained https://proton.me/support/proton-mail-encryption-explained. Additionally, our Threat model has been publicly available since the service came into being in 2014: https://proton.me/blog/protonmail-threat-model https://proton.me/blog/protonmail-threat-model

overstay8930 3y ago
A blog post from 2014 is a hilariously bad way to claim you aren’t blatantly lying in your marketing.