Been using them for a while before switching to their paid version. Of course they are closed source and a business, so any hype and over the top praise is misplaced. That said they are indeed one of max a handful companies that never did anything to make me feel that my trust is misplaced. Their service is great, the products are well polished and reliable. Development is slow and they aren’t cheap. Their target audience is very security and privacy aware so any betrayal of trust would be punished incredibly hard. In that light, their own self interest should be a good insurance, should you be uncertain.

General rule of thumb:

1. Web: can change at any moment, can serve a highly secure mail web app… except to those it might decide to target, giving them zero notice, leaving close to zero trace.
2. Electron based “app”: if it can run random JS from the web, see first point.
3. Compiled app: to change its way of working, the user needs to update/download a different version. An explicit user action is required, people can notice malicious changes and warn others about them.
4. Compiled open source app: same as a compiled app, except people can also notice malicious changes before running the code, fork it to remove them, compile it themselves, and warn others.

ProtoMail, touts itself as a “secure web app”, which is a contradiction.

If you use an open source app to access ProtonMail’s service, the security lies in whatever app you use. At that point, might as well send E2E encrypted mail via GMail.

TL;DR: the way most people use it, is just security theatre.

Been using them for 2 years now, I’ve got nothing negative to say. Really happy with their service

Only thing would be the closed source server and no third party apps. They do have an API, but I haven’t found anything written on top of that.

I’m not entirely sure why expected a user-owned private key 🤔 How do they ensure zero knowledge if you send them the username and password?

CC BY-NC-SA 4.0

My only major complaint is their free-tier is a bit lacking compared to what Skiff had (or I guess has, but not for much longer.) I think their platform is great, and definitely worth paying for, but given I’m a broke college student that’s not much of an option. Also their support for third party clients (or lack thereof) isn’t great, though I don’t use those as much. Otherwise I like it quite a bit!

On the open/closed source issue: how do they stack up against things like Tuta and Signal? The latter I heard was not actually completely open source.

I’ve had good luck. Reliable and fast as any other service.

I’m a 3rd year subscriber of the Unlimited plan, $158 for 2 years at a time. I utilize the drive, aliases, mail and VPN.

No real complaints. I still use Google calendar because it integrated more with Android phone. I still consider going back to Gmail occasionally for simplicity. I really hate Gmail though but email is garbage. Does it really matter?

I basically priced out good vpn’s, and the two year price of proton was pretty similar to most other quality VPN plans. So why not stick with it and get the rest of the ecosystem too.

I don’t think about it too much, it’s email and it works.

I do not care about secure email because I don’t communicate with anyone else using it, but I do like how it automatically blocks trackers and cleans email links for me.

Yeah I remember that conspiracy theory. Iirc, the claim was basically that any company which had any relationship with any US institution must be a honeypot. It was pretty out there, and as far as I’m aware it was very much debunked.

I’m pretty sure that the Google libraries F-droid are things like the push notification service, which afaik almost anything with notifications uses, even signal.

I’ve never actually compiled from source, but AFAIK they are open source. Its been convenient to use for me, just make very sure you don’t lose your password!

Proton AG lost me as a customer the minute they backdoored a binding arbitration clause into their TOS last year.

The difficulty of proving damages in breach of privacy cases combined with generally weak privacy legislation globally means the threat of a class action often serves as one of the only practical deterrents to abuses of power by corporations controlling sensitive personal information. By changing its terms of service, Proton essentially immunized itself from suffering any significant penalty in the event its negligence leads to a mass breach of privacy of its users.

Tactics like the use of binding arbitration clauses are hallmarks of inherently untrustworthy corporations.

I’m on the edge of quitting protonmail. The issues:

• #CAPTCHA hell. At least for Tor users.
• no app in f-droid
• API shenanigans and/or CAPTCHA breaks hydroxide (the foss bridge)
• protonvpn: you can no longer fetch all the configs in one download. You have to click “download” >120 times now to get all the configs
• account locks if you do not login frequently enough (i think every 6 months)
• if you supply your login creds but get a CAPTCHA and say fuck this, and walk, it does not count as a full login needed to reset the expiration clock
• the CAPTCHAs are graphical which forces you to enable images in your browser; but when you do that you get images that junk up your screen and waste bandwidth
• no public keyring. Hushmail was better in this regard. An advanced user could upload their PGP public key to Hushtools and then encryption just worked for hushmail users contacting that person. After Hushmail started charging, I would tell the normies who need comms w/me to get a gratis Protonmail account. But then I have to send them my public key and they have to figure out how to attach it to my profile in their phonebook. It’s a show-stopper in many situations.

Nothing really. They did once put a scan on someone’s email after the authorities asked them to. But it was a court order. Makes sense.

I don’t use them because I think Email is beyond saving anyway. 90% of our mail goes to or from Amazon, Google or Microsoft anyway. OpenPGP is not used by anyone, even Phil Zimmermann famously refused to use it. There is so much spam and phishing that most institutions no longer send anything of value by email, it’s just a notification service for “please log in to our portal to view your message”. Email is just so broken and the workarounds so feeble that it’s beyond fixing.

Email as we knew it is just gone and done. I just use O365 because it’s cheaper and offers me a lot more (like 1TB cloud storage which I use with Cryptomator). Proton Drive is too expensive for me and I like doing that on the user-end anyway because that offers real end to end security. I applaud what proton are trying to do but it’s too little too late and I don’t want to use a special email client. If they want to promote privacy they should do it with something where that’s still possible.

Proton fell into the black hole when they pitched to replace Gmail on Huawei phones. Being eager to do business with the CCP was a dealbreaker.

That said, I have a Tuta account. I don’t use it for everything, but I have no complaints.

I like proton mail a lot. Proton drive not bad either but can be finicky when uploading dozens of larger files at once.

Protonmail is fine, I doubt they are a honeypot but they do have to comply with Swiss court orders which some people give them undeserved hate for, they logged the IP of an activist after an order by Swiss authorities¹, however this could happen regardless of where they’re based, no one can ignore a court order. Swiss privacy laws are less protected for communication providers than they are for VPNs, which causes people to mistakenly assume the email providers there are just as private.

IMO they are decent, I only use them as a mirror for my primary email address in case something happens to it, but it’s never failed me in that yet.

As for the open source side of it, the Google libraries they use are the services to allow notifications through Google’s push notification service on Android, and Firebase telemetry. The rest of the app is open source aside from having those included. They don’t offer a version of their app without those yet sadly.

¹French authorities initially requested the information, however Proton didn’t respond until it went through a Swiss court^___

it appears that they haven’t been providing the source code for the latest version of their Android client so far, the latest version available on Github is from last October, with the latest commit being pushed 5 months ago: https://floss.social/@IzzyOnDroid/112152355218556203