For some reason I have it in the back of my mind that they were at one point accused of being a honeypot for US intelligence because of their association with MIT. Probably complete BS, but maybe not. Are they as open source as they claim to be? Looks like they’re on github. F-Droid seems to think they have some Google libraries or whatever that they use.
API shenanigans and/or CAPTCHA breaks hydroxide (the foss bridge)
protonvpn: you can no longer fetch all the configs in one download. You have to click “download” >120 times now to get all the configs
account locks if you do not login frequently enough (i think every 6 months)
if you supply your login creds but get a CAPTCHA and say fuck this, and walk, it does not count as a full login needed to reset the expiration clock
the CAPTCHAs are graphical which forces you to enable images in your browser; but when you do that you get images that junk up your screen and waste bandwidth
no public keyring. Hushmail was better in this regard. An advanced user could upload their PGP public key to Hushtools and then encryption just worked for hushmail users contacting that person. After Hushmail started charging, I would tell the normies who need comms w/me to get a gratis Protonmail account. But then I have to send them my public key and they have to figure out how to attach it to my profile in their phonebook. It’s a show-stopper in many situations.
For what it’s worth, I think if you add the izzysoft repo to F-Droid (apt.izzysoft.de/fdroid/repo) then you’ll get the ProtonMail App; I think regular F-Droid has only the VPN.
Protonmail failed to satisfy F-Droid’s inclusion criteria because it requires gms (playstore framework) and because it uses Firebase messaging.
Since I’ve disabled gms in my device I’m not sure how Protonmail would work for me. Someone tells me I might simply lose push notifications capability. But I am confused because Snikket pushes notifications just fine on my device.
Proton AG lost me as a customer the minute they backdoored a binding arbitration clause into their TOS last year.
The difficulty of proving damages in breach of privacy cases combined with generally weak privacy legislation globally means the threat of a class action often serves as one of the only practical deterrents to abuses of power by corporations controlling sensitive personal information. By changing its terms of service, Proton essentially immunized itself from suffering any significant penalty in the event its negligence leads to a mass breach of privacy of its users.
Tactics like the use of binding arbitration clauses are hallmarks of inherently untrustworthy corporations.
My only major complaint is their free-tier is a bit lacking compared to what Skiff had (or I guess has, but not for much longer.) I think their platform is great, and definitely worth paying for, but given I’m a broke college student that’s not much of an option. Also their support for third party clients (or lack thereof) isn’t great, though I don’t use those as much. Otherwise I like it quite a bit!
They do have an API, but I haven’t found anything written on top of that.
Not 3rd party of course but most of their official clients are FOSS.
How do they ensure zero knowledge if you send them the username and password?
Because you don’t. I haven’t looked into how it works exactly but all your browsers sends is your username and a proof of you having access to the password
Web: can change at any moment, can serve a highly secure mail web app… except to those it might decide to target, giving them zero notice, leaving close to zero trace.
Electron based “app”: if it can run random JS from the web, see first point.
Compiled app: to change its way of working, the user needs to update/download a different version. An explicit user action is required, people can notice malicious changes and warn others about them.
Compiled open source app: same as a compiled app, except people can also notice malicious changes before running the code, fork it to remove them, compile it themselves, and warn others.
ProtoMail, touts itself as a “secure web app”, which is a contradiction.
If you use an open source app to access ProtonMail’s service, the security lies in whatever app you use. At that point, might as well send E2E encrypted mail via GMail.
TL;DR: the way most people use it, is just security theatre.
There’s a large difference between surrendering massive amounts of highly critical metadata aswell as some data* to a known abuser vs. an entity that prides itself in not abusing your data and which even takes specific technological measures to make it as hard for them as possible (zero access encryption at rest, automatic key discovery).
(* Partial social graph, interaction timestamps, political interests, health, hobby interests and much of that usually even in plain text data form when receiving email; stored in in plain text forever.)
Enigmail for Thunderbird supports both since 2018. The mail service, be it ProtonMail, GMail, Outlook, etc., is irrelevant regarding security or privacy.
I’ve had good luck. Reliable and fast as any other service.
I’m a 3rd year subscriber of the Unlimited plan, $158 for 2 years at a time. I utilize the drive, aliases, mail and VPN.
No real complaints. I still use Google calendar because it integrated more with Android phone. I still consider going back to Gmail occasionally for simplicity. I really hate Gmail though but email is garbage. Does it really matter?
I basically priced out good vpn’s, and the two year price of proton was pretty similar to most other quality VPN plans. So why not stick with it and get the rest of the ecosystem too.
I don’t think about it too much, it’s email and it works.
I do not care about secure email because I don’t communicate with anyone else using it, but I do like how it automatically blocks trackers and cleans email links for me.
My experience has been fine. If you go into Proton Mail with the understanding that you’re doing it to stop Google from data mining your email, and not for the sake of truly private/anonymous email, you’ll have a good time. The aliasing feature is super nice as well.
If you go into Proton Mail with the understanding that you’re doing it to stop Google from data mining your email
You’re not really stopping anything if most of the people you’re emailing are still using Google or Microsoft :) Because they’ll get a copy of your email then anyway. This is really the problem with email IMO. Well, one of the problems, a lack of sender authentication is another one.
Based on the reading I’ve done, it doesn’t really seem like one exists - it’s just not what email was designed to do. I’m not an infosec professional, but that’s the impression I’ve been given by others in the field.
Email was designed decades ago, before the concept of data-mining even existed. It probably didn’t occur to the creators how universally accepted it would be. Much less rampant.
That being said, its’ privacy is entirely dependent on who stores your data and whether they give a shit.
I can’t get contact photos to display on PM. Tuta doesn’t have this feature at all, but the fact that PM appears to, but doesn’t work; well, it shouldn’t, but little things like that drive me crazy.
Nothing really. They did once put a scan on someone’s IP after the authorities asked them to. But it was a court order. Makes sense.
I don’t use them because I think Email is beyond saving anyway. 90% of our mail goes to or from Amazon, Google or Microsoft anyway. OpenPGP is not used by anyone, even Phil Zimmermann famously refused to use it. There is so much spam and phishing that most institutions no longer send anything of value by email, it’s just a notification service for “please log in to our portal to view your message”. Email is just so broken and the workarounds so feeble that it’s beyond fixing.
Email as we knew it is just gone and done. I just use O365 because it’s cheaper and offers me a lot more (like 1TB cloud storage which I use with Cryptomator). Proton Drive is too expensive for me and I like doing the encryption on the user-end anyway because that offers real end to end security. I applaud what proton are trying to do but it’s too little too late and I don’t want to use a special email client. If they want to promote privacy they should do it with something where that’s still possible.
And for VPN I prefer mullvad anyway because I like the way they sell scratch cards on Amazon. And my password manager I self-host.
But really it’s not a bad service if you can afford it and don’t want to go for Microsoft and Google.
If you want open source encrypted messaging, try delta chat. It’s an email client that’s styled like a messaging app, and it works with most email providers.
AFAIK Signal are pretty much FLOSS, they’re just keeping their cards extremely close, to the point of turning into a data silo.
Moxie Marlinspike famously nixed the LibreSignal app and demanded they stop using Signal servers.
And last I heard Signal can but refuses to federate with other servers, so their available server code might as well be closed source. That is, you can setup your own Signal server but you can’t connect to the network that others use…
Federation no longer works, no. They did have it at first but Moxie hated it because it was harder to push new features.
But you can use other clients. It’s not expressly allowed and LibreSignal stopped their development, but they’ve never actually banned anyone for doing it. I use the Matrix bridge to Signal and I’ve never seen issues with it.
Also, Moxie doesn’t work there anymore so their attitude might be changing. I hope so, as having an official option to use third-party clients and bots (for the latter see Telegram where they add a LOT of value to group chats like live transcription or translation) would really make the platform a lot more viable for me. As it is now I hardly use it and I never recommend it because I don’t see the point of replacing one walled garden with a slightly nicer looking one that is still nonetheless a walled garden.
I realy like Matrix but normies tend not to grok it because they need a username and password. Weird, because Discord and other services do too and they manage to use them fine. But whatever. I’ll just bridge all their shit.
It’s been a while since I looked at Signal but I was aware that Marlinspike stepped down. that can only be an improvement after he effectively shut down LibreSignal. I guess projects like the Matrix bridge have somehow been more acceptable?
it appears that they haven’t been providing the source code for the latest version of their Android client so far, the latest version available on Github is from last October, with the latest commit being pushed 5 months ago: floss.social/
I don’t like that their open-source repositories, like the android mail app, disabled public issues. Normally lots of good information can be found in issues, like known bugs or reasons why a tracker still exists in the app.
As far as I can tell, the Linux desktop client doesn’t have it yet, but has been promised.
EDIT: Ok, duh, on Linux Mint under System Settings>Themes>Settings>Miscellaneous Options, Dark Mode I selected “Prefer Dark” and voila: Dark. Proton’s the only app I have that that setting seems to have any effect on . . .
It seems to be missing from the official app. But I believe it is an account-wide setting. So log into your web interface and change it from there and it should reflect on the app.
the “ads” aren’t shoved up your ass. It’s not bad.
their customer service helped me a couple of times. (And a couple of times they didn’t)
they have a dedicated site for feature requests. Yet, they still choose what they implement and don’t comunicate it perfectly. They’re still a company. They do it better thab most others.
they don’t artificially limit the features on ine os, because it’s not yet implemented on all. That’s actually a good thing, not a bad one.
on linux it’s incredibly easy to add a vpn. No idea why we scream for an app.
Been using them for a while before switching to their paid version. Of course they are closed source and a business, so any hype and over the top praise is misplaced. That said they are indeed one of max a handful companies that never did anything to make me feel that my trust is misplaced. Their service is great, the products are well polished and reliable. Development is slow and they aren’t cheap. Their target audience is very security and privacy aware so any betrayal of trust would be punished incredibly hard. In that light, their own self interest should be a good insurance, should you be uncertain.
I wouldn’t really call the BE service “core” to what they provide. All the truly interesting code is in the clients. The server just an email service that stores the email in an encrypted format and talks their custom API.
An open source ProtonMail back-end won’t help you in any way unless you’re trying to host PM yourself I guess?
“The source code for the back-end remains closed source.[26][27] However, Proton Mail released the source code for the web interface under an open-source license.[28] Proton Mail also open sourced their mobile clients for iOS and Android,[29][30] as well the Proton Mail Bridge app.[31]”
Some of the tech they developed and use is open source. But the core tech is closed. For me, that’s good enough as long as they keep up acting with integrity they do.
Add comment