Oddbean new post about | logout
▲ ▼
sommerfeld | 10 months ago (raw) | root | parent | reply | flag +1 
 The difference is protonmail encrypts it at rest with private keys under your exclusive control.

They can only scan unencrypted emails while they are in-transit (same as any other provider) which they obviously use for spam detection.

The value of protonmail is precisely encryption-at-rest combined with automatic open pgp encryption.
▲ ▼
edb2639e | 10 months ago (raw) | root | parent | reply | flag 
 What's the difference? They scan all encrypted e-mails before they "encrypt" them with private keys without password which they keep.
▲ ▼
sommerfeld | 10 months ago (raw) | root | parent | reply | flag +1 
 The private key you import/generate is encrypted clientside with your password (which is also only known clientside, since serverside only sees the salted hash).

Email is inherently insecure and non-private. I don't know exactly what your point is. Protonmail takes steps to improve the situation as much as possible but you still claim that it's better to just use gmail.
▲ ▼
edb2639e | 10 months ago (raw) | root | parent | reply | flag 
 First of all what is the purpose of importing the key?

I can generate my key and export it to Protonmail.
▲ ▼
sommerfeld | 10 months ago (raw) | root | parent | reply | flag +3 
 That's what I meant by "importing". You can import your local gpg key into PM, or if you change your reference frame, you are exporting it from your OS to PM.
▲ ▼
edb2639e | 10 months ago (raw) | root | parent | reply | flag 
 I agree with you. E-mail is a history.

The point is that Protonmail and Tutanota have nothing in common with privacy and security. They use those words to fool people. It's marketing.

If you are capable to use pgp, it's better to use it in yahoo, gmail or other email provider with pop3 imap access.
▲ ▼
sommerfeld | 10 months ago (raw) | root | parent | reply | flag +2 
 Disagree. At least with those providers you have encryption at rest and with PM you can also use pgp.

You can claim that is "privacy theatre" since they can clone and archive unencrypted emails in-transit. True.

But doing that severely goes against their business model, specially when you are a paying customer. It is a trusted relationship in that respect, but at least the incentives are on your side.

Using gmail or other mainstream providers is strictly worse in every way. And you know that they are actively scanning your unencrypted emails not just for spam prevention, but to sell your data and to give your up to Law Enforcement.