>No, I mean they own the contents of your correspondence because you can't get the emails out.

Isn't this just a variant of the "can't access your mails without using their client" argument? If you're really keen on using your favorite IMAP client, pay for premium and use their bridge.

>No, you send it over TLS. You can also take some cues from Google and do IMAP-specific passwords or OAuth over IMAP/SMTP.

How does that solve the issue of them (protonmail) stealing your password (and thus the private key used to encrypt your emails)? They need your private key to decrypt your emails server-side. If they have your private key, they can decrypt all future and past emails. Worst of all, it's totally undetectable, unlike the backdoored javascript threat that you mentioned earlier.

>If you're really keen on using your favorite IMAP client, pay for premium and use their bridge

No, that's absolute bullshit. Paying to export your own data from a service is nuts. Not implementing features which have been expected from every mail server for the past 20 years is nuts. This behavior is inexcusable.

>They need your private key to decrypt your emails server-side

No, they don't, they can just send you PGP encrypted emails over IMAP and you can decrypt them client-side. This is how it works for everyone else.

They're not a charity. If that's what they need to build a sustainable business, I'm happy to pay them, if they deliver.

If paying them for your own data is your cup of tea, then you might be interested in this bridge I have for sale.

You do realize this is there to amortize the free actual service usage?

I understand that paid users subsidize free users, and having paid-exclusive features incentivizes people to pay for their accounts. That doesn't make it acceptable to lock down something as fundamental as IMAP and SMTP access, which is freaking nuts.

You speak like IMAP is something as fundamental as water, it's not, it's just a protocol. And the bridge also isn't really useful on mobile, so for most of their users, it's not useful. (People using desktop email clients are a minority)

IMAP is fundamental to email. And you make a good point, the bridge really isn't enough.

No, it may be philosophically, but in practice it's not. It may have been some time ago. Now, the huge majority uses 1. Gmail with the corresponding webapps 2. MS exchange protocol.

The only thing really fundamental to email is SMTP.

> No, I mean they own the contents of your correspondence because you can't get the emails out.

It looks like you can using beta.protonmail.com.[1]

[1] https://protonmail.com/support/knowledge-base/how-to-export-...

You can use SMTP/IMAP if you want using a local bridge https://protonmail.com/fr/bridge/

I referred to this in my comment. It's proprietary, communicates with ProtonMail over their proprietary API, and is only supported for paid users. These are fundamental features of an MTA, not a paid addon, this is absolutely disgusting.

>I referred to this in my comment. It's proprietary, communicates with ProtonMail over their proprietary API, and is only supported for paid users. These are fundamental features of an MTA, not a paid addon, this is absolutely disgusting.

This goes back to the my original point that protonmail is pgp for most people. You sound like the sort of person who'd use a self hosted email server + some IMAP/POP3 client + some PGP client with self managed keys. Maybe having an open stack is important to you, but people like you are definitely in the minority. Most people don't know and/or care what PGP, IMAP, or MTA is, but they want something more secure than gmail/outlook.

Lying to laymen about security is morally wrong. The security guarantees protonmail claims to provide literally cannot be guaranteed.

And for the record, I wrote my comments on "Hacker" News, not in my local newspaper. The readers here are not "most people" and I can expect many more of them to have similar values to me.

Being unable to prove a companies claims yourself != company lieing.

A year ago, they posted on Reddit: "Audits have been done, about one per year usually. Cyberkov has done 3 audits since 2014 (they recommend it for their activities with Palestinian activists, so security audits are necessary)"

Do you claim that the independent security firm Cyberkov is lying too?

With the preponderance of evidence they've provided (security audits, open source, and transparency into how everything works), if you're saying that this is a big scam and they're lying about everything, it's really up to you now to provide some evidence.

> No, you send it over TLS.

I don't think you understand how zero-knowledge encryption works.

You have to log into Protonmail's web UI with a username and password, too. How do you think this works? I'm not saying you should transmit your PGP key's passphrase to them.

It doesn't work how you seem to think it does. Your password never goes to the server: https://protonmail.com/blog/encrypted_email_authentication/

I see. Still, this process can be performed by a mail client using IMAP or SMTP extensions, the same way the web client does - I would be happy to implement this in my own IMAP/SMTP-related software. Google also has a feature which supports a separate IMAP/SMTP password from your account password, a similar system would be easy to implement for Protonmail.

why go through all that effort (writing a spec, getting third party email clients on board, etc.), when they can write a webapp and call it a day? i'm not sure about other people, but i don't even use a mail client; i just use whatever webapp my mailbox provides.

Many hundreds of thousands if not millions of users utilize IMAP to receive email on their phone apps, thunderbird, outlook, etc. Support for it is expected of any mail provider as part of the basic requirements of operating an email service. Extending this with an extra means of authentication is comparatively easy to adding it to your web app.

Correct.

When I signed up for the free tier nowhere did it say you can't forward your mail or access ot via IMAP or POP3.

A bit misleading IMHO.