Oddbean

Before you start sharing clickbait headlines like "Proton is compromised", "privacy is dead", etc, just read the whole fucking news article first. Proton always said they would provide whatever they have (metadata) to Law Enforcement if subpoenaed. That was never a secret or in question. They are an actual registered company... They still don't nhave access to email body content. E2E encryption still works. What they can provide is IP addresses, recovery email, recovery phone, browser fingerprints and email metadata (timestamp, recipient, sender, subject, size). If you are worried about this (you should), use a VPN (not proton VPN) or Tor, avoid disclosing sensitive information in the email subject. Despite the FUD, people are still 99% safer and more private using ProtonMail relative to Gmail or similar. https://restoreprivacy.com/protonmail-discloses-user-data-leading-to-arrest-in-spain/

I use protonmail and I love it but what do you mean by e2e encrypted email? A mail from proton to Gmail or vice versa can't be e2e encrypted. Do they (claim to) have encryption at rest for all emails?

Proton claims to have encryption at rest for non e2e encryted emails. Of course you need to take their word of it, since they can just make a copy during unencrypted transport. But so far, there's no evidence that they actually do this.

E2EE works only Proton to Proton. That's why I onboarded my family. For external encryption offers Proton something different. The sender can encrypt the mail with a (strong) password. https://m.primal.net/IEHN.png But I am sure you know that already.... 🙂

It is E2E between proton users. If you want to encrypt it to other users, you can. Although you have to set a password for your email. Then the receiver will only get a proton website link, which if they click, they have to put in your password and then they can view it. I think that is the only way to encrypt to any arbitrary mailbox.

I do have a password to my Proton email but didn’t realize I needed to give that password to whomever (with a different email account) received my transmission. Thanks so much for weighing in on this important topic.

When you create an email, and you want to send to a non-proton user, if you click the lock icon, you have to set a specific password for that email. Then it will be password protected/encrypted, and only openable with that password. NOT your account password. You shall not share that with anyone!

Many “influencers“ might lead to believe that using any VPN (specifically the one they advertise) turns people into a cipherpunk. Many are centralized services vulnerable to attacks and even more are just a honeypot. And of course almost all of them have to comply with the law as companies.

There was a case where Proton disclosed data not to the authorities but to the press. There was a case where they helped the CIA with money. They don't do anonymous payment with Bitcoin, they don't have logs disabled by default in client settings, etc. As a result, Proton just sucks. It's basically just a paid Google.

Only after creating an account, what does that mean in practice? For example, Proton may ask you for your Visa/MasterCard details and only then allow you to pay with Bitcoin. That's exactly what they do to me because they think I'm unreliable.

I wouldn't know about that but: * You should not rely on the law to protect your privacy * you definitely should not put all your eggs in the same basket: if you use proton mail, don't use any other service from them. Look for alternatives for vpn, cloud, password manager, notes, calendar, etc and spread your risk as much as possible. Ideally most of the above can and should be selfhostable.

Reading one of their Mastodon posts they say that as VPN is not considered a communications tool in Swiss law they therefore don't have to log IP-addresses, and that there are no Swiss laws that can compel them to do so. https://mastodon.social/@protonprivacy/112401509092025344

Proton is as transparent as they could be on this and they openly talk about what they do / could see on their web site all the time. It comes across like a lot of people use Proton Mail but don't actually read what they say and then get in trouble. A lot of the data they received are opt-in by users (IP history logs, recovery emails) and what is left is impossible for them to stop them knowing. If a company following the law is 'compromised' then by their logic everything is. Arguably using a service that endorses breaking it makes you even more compromised by putting a target on your back. EncroChat, SkyECC, Phantom Secure, ANOM had hundreds of thousands of combined users and countless arrests... the price is paid on all of their users. Fortunately they were almost all involved in serious crime, but that doesn't mean the next time it wouldn't be normal people who could be misled by a false promise of security and privacy. Proton is a good provider by telling the truth and following good practice. Email is not like SimpleX or Signal, they can't move hosted infrastructure away to their users so they cannot get legal requests or design their product in a way where they can't provide any valuable information. Even if you host your own email, it wouldn't stop them going after the person above the pyramid (your host / network provider) to disrupt the operation...

I was a paying a Proton customer for over 6 years. They about 4 months ago they suspended my account for unknown reason. Their primary support method is email. Anyway, suspend my account and have shitting support no thanks. I long for the day when centralized services are a thing of the past.

All that and: You can't expect anyone to take the fall for you, especially not for free. The only one responsible for your action is you and you are the only one who should be held accountable. nostr:nevent1qqsfhm74zz3yme54rg5qwwmju6996tym4xnypqwpug0yhlzmm29shfsppamhxue69uhkummnw3ezumt0d5pzp5x7h70mzt00s86r6lrfg2dm0pyp9tq7f5k48gszmd42cl4yk3nvqvzqqqqqqyask03c

Absolutely, it's essential to look beyond the headlines. ProtonMail has been upfront about complying with legal requirements, which only extend to metadata and not the content of your emails thanks to end-to-end encryption. While concerns about metadata collection are valid, using ProtonMail still offers a higher degree of privacy compared to many mainstream alternatives. It’s about choosing the best available option while staying aware of its limitations.