Oracle being intentionally malicious is unlikely, but Java has had well publicized security issues lately. (1) I'm not sure that the JVM is actually less secur

Oracle being intentionally malicious is unlikely, but Java has had well publicized security issues lately. (1) I'm not sure that the JVM is actually less secure than JavaScript engines, but it's unnecessary enough in the modern web that many users like to turn it off entirely. Requiring it to be on is a step back. (2) The applet is trusted. So if it's backdoored or exploited, the adversary gets your entire computer rather than "just" your email. This is par for the course for native apps, Java is harder to exploit than native code, and in theory email should not really be much of an attack vector (plain text and maybe basic HTML); but this app is not well-known and is thus more likely to have simple programming errors (not that popular services are immune from those either!), the browser security model is easier to screw up, and webapps are expected to be sandboxed. Again, a step backwards. (3) The choice of Java may be an indicator of inflexibility, thus poor programming skills, thus insecurity. This is speculation, but far from improbable. Off-topic, their claim to be (effectively) protected against rogue CAs is dubious, never mind the claim that they are the only provider with such protection.