- cross-posted to:
- tech@links.roobre.es
- cross-posted to:
- tech@links.roobre.es
Email is an open system, right? Anyone can send a message to anyone… unless they are on Gmail! School Interviews uses two email servers t…
Email is an open system, right? Anyone can send a message to anyone… unless they are on Gmail! School Interviews uses two email servers t…
I switched to ProtonMail and have really enjoyed it. I was using my own domain with Gmail so my email address didn’t even change.
For those considering Proton Mail: There is one great benefit or disadvantage, depending on how you see it. As all traffic is encrypted, Proton Mail does not support standard IMAP or POP3. It’s therefore best used with the official Proton Mail app rather than third party apps. On desktop, you can use your favourite email client (Thunderbird et al) only if you install a “bridge” which decrypts incoming emails before forwarding them to the client: this bridge is, in turn, only available to paying subscribers.
That said, it’s a great service, and the fact that they have a viable business model which doesn’t depend on selling out their users might be a good thing.
IMAP supports TLS, what’s Proton’s excuse for enforcing their own delivery protocol?
Proton is end-to-end encrypted - they don’t have the keys themselves. With TLS, encryption is between you and the server, but the information can be decrypted on the server side.
At least that’s my understanding of it. If you want Proton’s own words, they wrote an explanation on their website. :)
I fail to see how the mails being encrypted stops them from using IMAP(s) like everyone else. IMAP doesn’t care what the contents of the email it’s sending/fetching are, and is perfectly compatible with other E2EE solutions like PGP/GPG which they say their solution is based on.
If IMAP is enabled on a provider, that provider can access your emails, unless you’ve encrypted the content of the email itself (with something like pgp or gpg). Proton only has access to emails in transit and after that, it can no longer access your email as it’s entirely encrypted. Since Proton doesn’t save the emails in transit, it has zero ability to provide those emails even if given an enforceable subpoena. Other providers that use IMAP can and do have access to your emails and can give them to a government authority if given an enforceable request.
The difference is the data at rest protocols on different providers. Proton has zero access encryption for data at rest. It only has access for data in transit and its ephemeral in that once it’s done with that transaction, it no longer has that data.
I presume ProtonMail markets this as a security feature? It guarantees your provider cannot sniff your email content and can’t be compelled to disclose user emails to law enforcement.
They’re not using a different protocol for delivery, they still use IMAP and SMTP, but other mail clients can’t decrypt the message content from Proton because they don’t have the keys (and nor do Proton). Proton do supply a “bridge” app if you want to use your Proton mail with a desktop email client, which handles the decryption between your computer and Proton by accessing the Proton encryption keys on your computer.
TLS is like a padlock on a box, and you have the key. Encrypted content is if the letter in the box is also written in code, needing another key to translate into plain language.
Proton doesn’t use IMAP. Your inbox isn’t quite like other internet mailboxes. You can’t access it with TLS. You access it via normal TCP/IP traffic. The contents are encrypted and can only be decrypted on your device. This is why IMAP doesn’t work. The Bridge acts as a Proton client, decrypts the data and then acts as a local IMAP server so you can connect to it via another IMAP client. Proton cannot read your email at any other time other than ephemerally at the moment it receives the email, which it then encrypts one way into your inbox. It cannot decrypt it. Only your devices can. Your devices get the private key from Proton’s servers, but they’re encrypted with your account password. So you grab the encrypted key and decrypt it locally on your device. It’s not the most secure, but it’s the most secure you can do without having to manage your own keys. It should be noted that you can possibly lose access to your email. This would require losing access to your physical devices and losing your password at the same time. As long as you have a device that has your key, you can restore access to your account which allows it to update the encryption on the key, etc. If you lose your physical devices and lose your password, you can only restore access to your account, but not any of your email up until that point.
Any advice or hints on how to switch over? I wanted to do it years ago but I dread having to change my main mail address on everything, from apps, tools and games to bills or RL document-related stuff, it sounds like a horrible mess and ton of work
My recommendation (assuming you have a normal @gmail addy and not a custom domain like I had) would be to use email forwarding. So you can leave your Gmail as is, but set it up (in the settings) to automatically forward all your email to your new protonmail address. Then you can gradually change the important contacts/sites to your new email at your leisure.
I do highly recommend buying a domain and setting up your own email address though, it gives you a lot more portability going forward. You can actually do a lot with your own domain, and it helps you maintain trust better.
Anyway, enough preaching lol, protonmail also maintains a guide to help people switch: https://proton.me/easyswitch
If you’re recommending setting up a forward/IMAP collection from a Gmail account, don’t forget to mention deleting the messages from the server as well! Emails left on a server for more than 30 days are considered “abandoned property” for the purposes of warrantless search.
What an insane fact, I had no idea thanks for sharing 😱
Do you have a source for this?
The most I could find is that the Electronic Communications Privacy Act allows for warrants to be issued for emails less than 180 days old. I’ve found vague references and snippets from articles no longer available that seem to claim some acts that have passed since then allow for simple subpoenas instead of full on warrants for said emails, but 180 days is the only threshold I’ve found and again, it’s for less than 180 days that’s at danger.
Does protonmail support custom domain email addresses?
They do, I have used them myself for years and have no complaints!
If you are setting up a forward/IMAP collection from Gmail though, be sure to set it to delete messages from Gmail after forwarding/collection. Any email you leave on a server longer than 30 days is classified “abandoned property” for the purposes of warrantless searches in the US (and if you’re European using Gmail, this applies to you too), even if you’re still actively accessing the email inbox.
Thanks for mentioning this provider. I’ve actually switched over now. You should ask for a referral fee :) After reading about it, I’m quite impressed with their implementation. It’s very thorough.
Buying a domain you mean going to a registrar like I did for my lemmy instance?
Or do I need to buy it from an email provider?
If you already have a registered domain there is no need to get a new one.