That isn't really fair. If you read the article, protonmail essentially supplied the FBI the recovery email of the account. This is metadata that protonmail must have that isn't encrypted by the user for obvious reasons.

Regarding the "MITM" for every email sent, this is related to their "bridge" software which allows regular IMAP/SMTP software to use Proton Mail. This software must edit the emails to encrypt them in their scheme.

This software is open source and can be inspected and/or built locally. https://github.com/ProtonMail/proton-bridge

no one can ever know Protonmail is really encrypting mails. Opensourcing a piece of software doesn't really mean that Protonmail deployed that and also doesn't really mean that you are using their promised encryption.

Surely they could have an audit/attestation by 3rd party?

Yes, but did they?

Yes https://proton.me/blog/security-audit

Worldcom passed audit I recalled. Enron too. FTC gave Bernie approval. How about FTX? Remember once uoon a time there was big 5 with one of them as Aurther Andersen? Did anyone auditted Securitum? And oh yeah did anyone actually verified what is being auditted and what is not? When so many info about a compromised Protonmail to law enforcers that Proton didnt even actively deny, I give Securitum as much confidence as AA 2 decade ago.

In your logic it seems impossible to be considered secure, since audits do not matter. Which email service do you consider secure and why?

you can also build it yourself

You can read some forums and head over to mastodon or discord. Protonmail isn't secure. Some seems to hint compromised. Use it like what you would with Gmail or Yahoo. As for paying, no thanks. Nothing secure about it. You get more security buying separate VPN and even having qqmail (yes, Xi can read your email, but wont have the authority to send law enforcers to your home in Oslo or NY). NSA and CIA can...but will have zero chance of reading your qqmail.

You're shifting the effort on the others instead of providing convincing arguments. That is not very convincing.

Do you have any proof that they store all the keys to emails? Because in none of the cited cases did they provide email contents to law enforcement, only data that you know is not encrypted, like recovery email.

Your encryption key is stored encrypted so that we have no access to it. It is decrypted when you enter your password, which we have no access to. The article above confirms that, in fact, and all of these cases are proof that our encryption cannot be bypassed by legal means. All the data stored encrypted on our servers (email content, calendars, attachments, etc.) is inaccessible to us: https://proton.me/blog/zero-access-encryption. All we can provide is the unencrypted metadata which we need to have access to in order for the services to work properly.

> However, after receiving the email, we encrypt it immediately using the Proton Mail account owner’s public encryption key.

Email contents could still be siphoned, copied and shipped before the encryption process starts.

How can you clarify theres not a siphon between then and that?

Well they double pinky promise, of course

For emails between Proton Mail users, it's end-to-end encrypted, meaning the encryption happens client side before the message even reaches the Proton server. If a message is coming from Gmail, then of course that cannot be encrypted until it reaches the server, unless of course the Gmail user is using PGP, which Proton Mail is interoperable with.

How do you suggest they technically not read the email at all? It is delivered unencrypted by Gmail, what do you want protonmail to do with it?

It's a shame because it would seem to be easy to make protonmail but low hanging fruit fixed.

Similarly it seems relatively easy for signal to move away from needing a phone number.

I don't know how good Session and Simplex are.

Ah, I tried to boot up my old account but it looks like it's been deleted from being in the free tier too long. I cancelled my subscription after they had a nearly week long downtime.

Mine has been in the free tier forever, never use it, and it is still fine.

Hmm? Trusting their client aside (a huge issue with any secure service), I do seem to remember the key being used client-side with password-protection, i.e. not accessible to their server. Am I misremembering something?

The part that is easier to misunderstand is encryption-at-rest, where normal emails are still readable at ingress before they are encrypted with an appropriate public key.

Also, secure and private != willing and capable of hosting illegal activity. They can kick suspicious behavior without having to read your emails.

Yes your encryption key is stored encrypted so that we have no access to it. It is decrypted when you enter your password, which we have no access to. The article above confirms that, in fact, and all of these cases are proof that our encryption cannot be bypassed by legal means. All the data stored encrypted on our servers (email content, calendars, attachments, etc.) is inaccessible to us: https://proton.me/blog/zero-access-encryption. All we can provide is the unencrypted metadata which we need to have access to in order for the services to work properly.

I think Tutanota [0] is also worth mentioning with their transparent reports and warrant canary in place

0: https://tutanota.com/blog/transparency-report/

I mean, what are people's expectations here? If you're sensible, you don't sign up for Proton Mail believing that the FBI will never be able to read your email. You sign up with the expectation that Proton Mail will follow the laws of Switzerland and only disclose information when they must do so under Swiss law.

What more do you want from them?

I use it expecting they will not sell my data to third parties or use it for things like AI training. I'd expect Google, Microsoft, etc to do this.

Do you know how Proton Mail actually works? Encryption keys are encrypted client side so Proton never has access to your private key, just an encrypted copy that cannot be decrypted server side.

I might be missing something, but how are the keys decrypted? Isn't it using the password? I assume the passwords are hashed on the server, but how would we know if you are storing the nonhashed password when we log in?

Proton Mail is open source, anybody can review the code to see that that clearly is not the case.

I haven't reviewed all the code, but my question would be related to the back end which I can't find the source for. Even if the back end is open source we wouldn't know if that is the same code on the servers.

You're asking for a negative proof. How do you want an email provider to demonstrate they are not storing your nonhashed password? I don't see how that's feasible. Audits are a step in that direction, but it's not like mathematical proof.

That is my point. The protonmail person said they never have access to the decrypted key. As far as I can tell they can't prove it.

So we agree you are asking for something impossible to prove? Not sure you got my point.

I agree it is impossible. I don't like their claims that they don't have access to the decrypted keys and we can prove it by looking at the code. They could have access to the keys and looking at the code wouldn't prove they don't.

I understand but I read the statement differently. It's a description of their security model simply. Sure they could be lying like any other company, so a certain amount of trust is required.

Unless you read and compiled the code yourself and run it locally, some level of trust is always required.