No, I mean they own the contents of your correspondence because you can't get the emails out.
>how is SMTP/IMAP access supposed to work? you send the plaintext password to their server to decrypt and hope they're not storing your password?
No, you send it over TLS. You can also take some cues from Google and do IMAP-specific passwords or OAuth over IMAP/SMTP.
Isn't this just a variant of the "can't access your mails without using their client" argument? If you're really keen on using your favorite IMAP client, pay for premium and use their bridge.
>No, you send it over TLS. You can also take some cues from Google and do IMAP-specific passwords or OAuth over IMAP/SMTP.
How does that solve the issue of them (protonmail) stealing your password (and thus the private key used to encrypt your emails)? They need your private key to decrypt your emails server-side. If they have your private key, they can decrypt all future and past emails. Worst of all, it's totally undetectable, unlike the backdoored javascript threat that you mentioned earlier.
No, that's absolute bullshit. Paying to export your own data from a service is nuts. Not implementing features which have been expected from every mail server for the past 20 years is nuts. This behavior is inexcusable.
>They need your private key to decrypt your emails server-side
No, they don't, they can just send you PGP encrypted emails over IMAP and you can decrypt them client-side. This is how it works for everyone else.
The only thing really fundamental to email is SMTP.
It looks like you can using beta.protonmail.com.[1]
[1] https://protonmail.com/support/knowledge-base/how-to-export-...
This goes back to the my original point that protonmail is pgp for most people. You sound like the sort of person who'd use a self hosted email server + some IMAP/POP3 client + some PGP client with self managed keys. Maybe having an open stack is important to you, but people like you are definitely in the minority. Most people don't know and/or care what PGP, IMAP, or MTA is, but they want something more secure than gmail/outlook.
And for the record, I wrote my comments on "Hacker" News, not in my local newspaper. The readers here are not "most people" and I can expect many more of them to have similar values to me.
A year ago, they posted on Reddit: "Audits have been done, about one per year usually. Cyberkov has done 3 audits since 2014 (they recommend it for their activities with Palestinian activists, so security audits are necessary)"
Do you claim that the independent security firm Cyberkov is lying too?
With the preponderance of evidence they've provided (security audits, open source, and transparency into how everything works), if you're saying that this is a big scam and they're lying about everything, it's really up to you now to provide some evidence.
I don't think you understand how zero-knowledge encryption works.
you mean the address? that's expected of every hosted email service. you're always free to use your own domain though.
>they don't support open protocols including SMTP and IMAP and the only way to export your emails is through a proprietary end-user application. They excuse this nonsense by saying that it's necessary for encryption, which is blatantly false. Their security is also based on trusting ProtonMail, since they could easily siphon off plaintext at the SMTP level or secretly modify their JavaScript to exfiltrate your private keys from the web browser. Genuinely secure systems do not require you to trust their operators.
fair point. although if you were serious about security, you'd be using self hosted server + your own PGP keys. but for most people who just want something that works just like gmail/outlook, it's definitely a step up.
>This is rich. Why don't you start with the far more fundamental and important standards of SMTP and IMAP, Protonmail?
how is SMTP/IMAP access supposed to work? you send the plaintext password to their server to decrypt and hope they're not storing your password?
> Why don't you open source your desktop & mobile applications or your bridge? What a joke.
they're talking about interoperability, not open source.