I really don't like this about proton, they're always going on about their encryption but most emails they've seen in plain text on their SMTP servers. Because that's just how SMTP works. And so has the provider of the other party.

Once they've put them in your mailbox they can't decrypt them again but I always consider a single exposure a loss of confidentiality. The only emails this doesn't apply to are those from people using PGP (yeah all three of them) and those on proton themselves.

In my view this Achilles heel makes most of their protections irrelevant. But they still market it as if it's the email equivalent of signal, which actually can't see what you say at any point of transit. And non technical people have no idea about the difference.

Ps I'm not blaming proton for not having a technical solution for this because interoperability makes it an unsolvable problem. But I do blame them for their marketing around it.

Kagi is to google as proton is to gmail.

You get web mail, custom domains, decent security, decent spam detection, solid features, and no PII being sold. Nice, clean, simple - I like paying them money. I feel good about doing business with them, and I don't run into that often these days.

* OK "every" is an exaggeration but enough that the impression has been formed.

Even proton only provides webmail free - pop3/imap/smtp require payment. But that's still better than 99.99% of other webmail - everyone verifies via some method that ties to your personal info.

Is that really what happened here?

https://en.wikipedia.org/wiki/Stop_Cop_City

Protestors: Police should have better training.

Police: Build big training center

Protestors: No, not like thaaaat!!

So yea, “not like that” indeed.

If you are so hard-pressed to do something, then maybe setup your own smtp server

If the person or politics / group,they don't support then they have no problem just straight up making stuff up.

Like the hit piece of Elons Grok where it was "doxing" pornstars names,but in reality all it did was just search web online and got the info from the first website it could find.

But they made it seem like it was some hidden info that only Grok and Elon would know...

Doxing for the most part is simply aggregating publicly available information on an individual and broadcasting it to a wider audience. Rarely does it require more serious sleuthing or even “hacking”, although those are the more notorious instances because it involves someone who may have been trying to hide their identity for various reasons.

No, it's that people keep misusing that word for a broader and broader class of things. Pushing back on dilution of meaning isn't a lack of understanding.

I think we’re pretty far away from “falsely accused of doxing”. What’s it going to be? “I was just writing a research paper!”

In theory you could open up your protonmail account over tor and with bitcoin (or does that not work anymore?).

Its been a good while since I tried them out. Why I don't recommend them anymore is because when I didn't extend my subscription in time (expecting an account downgrade), my mail was locked and emails hold on to as random. Allowed to login only for payment.

That was one red flag from me, the second was when they shared IP address logs of a French protestor. E̶v̶e̶n̶ ̶t̶h̶o̶u̶g̶h̶ ̶a̶t̶ ̶t̶h̶e̶ ̶t̶i̶m̶e̶ ̶t̶h̶e̶y̶ ̶h̶a̶d̶ ̶a̶ ̶n̶o̶ ̶l̶o̶g̶s̶ ̶p̶o̶l̶i̶c̶y̶,̶ ̶i̶f̶ ̶I̶ ̶r̶e̶m̶e̶b̶e̶r̶ ̶c̶o̶r̶r̶e̶c̶t̶l̶y̶.̶ ̶O̶r̶ ̶i̶f̶ ̶I̶ ̶d̶o̶n̶'̶t̶.̶

You probably aren't remembering correctly given that specifically have a "login logs" option that can be toggled on/off.

I think at the time there was confusion around their policies

"ProtonMail logged IP address of French activist after order by Swiss authorities"

https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...

I like Proton. I use Proton.

However, the problem with proton is that if you access your email via a web browser, there's nothing stopping protonmail (to my knowledge) from reading your email from within their webapp via JS. This type of attack could be targeted at the behest of authorities.

So, actually, Proton COULD read your email (IFF you use webmail).

The authorities can also read your self-hosted email if they had a warrant to search your house. Even if you enable FDE they can do a cold boot attack.

I'd count that up as a hypothetical win of the self-hosted main in your own location.

If you are Dr. Evil, OTOH, other calculi apply.

tl;dr they pull the decryption keys from your computer while it's still running, which of course it is because your mail server has to be up 24/7.

How would one access it if one needed to do config changes or, really, anything the server for legitimate purposes?

Mail transfer can tolerate multi-hour interruptions. Imagine the drama if it couldn't!

They can just send things without e2ee from any of their clients (not just web).

> This type of attack could be targeted at the behest of authorities.

No? How can authorities tell them how to do their business?

Or any similar service from another vendor? Or hosts their own email. If someone using Protonmail emails me, their data is also not getting sold for example, it's just stored on my laptop

Proton does have interoperability with PGP/GPG but very few people use that because of its UX.

Yes, correspondence between you and Build-A-Bear, and between you and your local terrorist cell, are unencrypted individually. But Build-A-Bear presumably doesn't know about your correspondence with the cell, and the latter presumably has some interest in not sharing organizational data access with the former.

I suppose you do have to trust that Proton isn't served a directive to snoop on your correspondence in transit with other providers. But that's still a much better position than leaving all of your historical data unencrypted at rest.