Yes, agreeing in general, just with some clarifications. I think clarifications are important when talking about a product focused on privacy and security.
I was responding to this part:
IDK if the other “easy encrypted” providers just use standard PGP.
All Proton Mail data at rest and in transit is encrypted. However, subject lines in Proton Mail are not end-to-end encrypted, which means if served with a valid Swiss court order, we do have the ability to turn over the subjects of your messages. Your message content and attachments are end-to-end encrypted.
Depending on your threat model, this may or may not be an issue.
At least one other provider (Tuta in my example) doesn’t use PGP internally because using SMTP internally w/ PGP for the body leaks the subject line and other metadata. Neither have released the source to their backend, and I haven’t read the client code, so I don’t know if there are any other concerns.
That I think Proton is absolutely fantastic, and I used it for a few years with absolutely no issue. I do think it’s important to be accurate, though, since others may not like the tradeoffs. Proton has a bunch of other benefits as well over alternatives, such as:
IMAP bridge - you can use whatever email client you want and back up emails yourself - this does decrypt your email though, so you’d need to account for that
automatic forwarding - seems to just work as expected
other bundled services - I’ve used their VPN, and they have a few other things other providers don’t (e.g. encrypted storage)
Proton… standard protocol
Yeah, any email provider will use standard SMTP, otherwise it’s not email. The differences are whatever happens after it reaches Proton’s servers.
Yes, agreeing in general, just with some clarifications. I think clarifications are important when talking about a product focused on privacy and security.
I was responding to this part:
Proton uses standard PGP AFAIK (and yes, PGP vs GPG is irrelevant), so your subject line and attachment names are not end-to-end encrypted:
Depending on your threat model, this may or may not be an issue.
At least one other provider (Tuta in my example) doesn’t use PGP internally because using SMTP internally w/ PGP for the body leaks the subject line and other metadata. Neither have released the source to their backend, and I haven’t read the client code, so I don’t know if there are any other concerns.
That I think Proton is absolutely fantastic, and I used it for a few years with absolutely no issue. I do think it’s important to be accurate, though, since others may not like the tradeoffs. Proton has a bunch of other benefits as well over alternatives, such as:
Yeah, any email provider will use standard SMTP, otherwise it’s not email. The differences are whatever happens after it reaches Proton’s servers.