I keep hearing bad stuff about proton, but I don’t really get most of it. Could someone please explain all of the controversy to me. Lastly, what are the best alternatives to all of their services?
Its pretty slow and clunky for an email service. On a whim, I made an account with https://posteo.de/en. Performance and interface is much better.
Murena (Mail, Cloud, Workspace, Vault, Galery, Office suite, Tasks, Calendar, Notes, Phones (FairPhone), e/OS, e/Os for kids), OpenSource, encrypted, made in the EU (France)
Ceo is a trumper
Mail - Tuta Mail
VPN - IVPN or AirVPN (Never been independently audited but cheaper and has port forwarding)
Drive - Selfhost Nextcloud or Tuta Drive
Calendar - Selfhost Nextcloud or Tuta Calendar
Docs/Sheets - Selfhost Nextcloud or LibreOffice (offline)
Pass - Bitwarden or KeePassXC (offline)
Authenticator - 2FA or Aegis (both are offline but that’s a good thing with 2FA)
Meet - Jitsi
Lumo - Local AI or Kagi Assistant (paid, comes with privacy-focused search engine) or Duck.ai (free)
For me it’s their ransomware-like business model of: attracting new users with free accounts, incentivizing them to migrate their Gmail inbox to Proton (Easy Switch), encrypting the content (“for security”), and then letting them find out that a paid feature (Bridge) is necessary to integrate the mailbox into a third-party client like Thunderbird (as a decryption layer in between); well, unless you want to manually export the mailbox using their Mail Export Tool. I’m not opposed to paying for a service (I also donate to Disroot), but I dropped them like a hot brick when I found out: thankfully not the hard way (I tested integration before migration).
Andy Yen
Known for: Proton founder (ProtonMail, Proton VPN, etc)
Proton claims to be politically neutral, but in early 2025 Andy praised the Republican party on X, and Proton issued an “official response” on Mastodon and Reddit (later deleted as “not actually official”) re-enforcing that Proton and/or Andy threw their hat in with Trump and the Republican party.
Current best alternative if you want to stay in the cloud: Tuta
Did Drew DeVault include himself on this list? He’s definitely worse than many of the people listed there.
Thanks for the Weird Little Guys link, awesome.
I would being using tuta if they didnt delete 3 of my accounts for 6 months of activity lol
Were they free accounts? They are pretty strict with free accounts. They’re not some google that can just provide a free service to everyone and not care about the cost. You can get a paid account that shouldn’t be deleted for extremely cheap like 2-3$ a month I think, and then you get multiple email aliases and stuff too. I get not wanting to pay for email, but if it’s free you’ve just got to accept you are probably the product.
Yes. There is controversy about the CEO. But mostly for me: is security theater. And in don’t trust them. Email will never work as a secure communication layer. Stop pretending it will. There a reasons which is tied to the protocol level, that make pgp non sufficient. There are also the pgp technology it self (no forward secrecy, no deniability, key management etc). Then there is the obvious fact about an email from proton to gmail, and 99% of other email providers, simply not being secure/encrypted. So you buy a privacy tool, which neglects to tell you: we actually don’t provide privacy at all - unless you treat proton emails as proton chat - strictly proton to proton… at which point youd be better of with e g signal.
If you insist: mailfence.org allows you to upload and control you own pgp keys. That’s interoprational with proton. Simarly priced i think, also Schweiz, and a bit more honest and strict imap (no bridge). But honestly… stop treating email as secure.
What’s insufficient about PGP?
Its crypto from the 90s and email is not meant to be secure. Some examples:
Only the mail body is protected, headers and metadata arent, so an attacker still knows with who you are talking about what.
Replies contain the full thread, if one person messes up once, the entire chain is unencrypted.
No ephemeral keys, no cleanly defined rotation mechanism. If someone gets your key, all past messages are also accessible.
It depends on your threat model. The actual crypto portion of it holds up, at least until we have crypto-relevant quantum computers.
If you want anonymization and PFS for basic messaging, yeah PGP + email isn’t going to cut it. But if you’re sending documents, for example, with financial or health data tied to my identity anyway, I’d take PGP with my own email provider over TLS to some tech company servers where it sits unencrypted any day.
so an attacker still knows with who you are talking about what.
>implying i fill out the subject box with anything meaningful 🤪
TY for informing me. Is there a better alternative to PGP even with the other downsides of email you listed?
Signal is probably best, since it has volume to hide in, and it’s difficult/ impossible to screw up. Partly because it’s centralized. Which is the problem with e.g mateix protocol - each node can configure thi gs a bit differently. Also why you should use the official app imo.
This is a decent walk through: https://www.privacyguides.org/en/basics/email-security/
But simple duckduckgoing can provide much more
https://5blockchains.com/posts/pgp-vs-signal/
https://ubos.tech/news/pgp-encryption-security-crisis-why-cryptography-needs-modern-alternatives/ (feels a bit clanker like - but info is legit)
I would say Signal is the best like mainstream normie friendly option but if you want the most reliable privacy imo your better off with Briar. It’s less convenient for sure, but it requires no phone number, has no centralized servers, can route messages over TOR, Bluetooth, LAN, etc. Messages are end to end encrypted peer to peer. And even when stored on your device are encrypted. Downside is you need the other person to have an android there is no iOS app. But upside is it has a flatpak!
I like briar for sure. Mostly because it might work if the internet goes blip, and you only have p2p. But… It’s in maintenance mode, exactly because its not easy to use.
It doesn’t bother me much. I’ve actually kind of always wished more software would just stop changing things and go into maintenence mode. I do hope they continue getting funding for the security updates tho.
Lost a discord acc because my proton email got annihilated after I left it to rot. Very sad.
From what I understand, Proton’s CEO has polarizing opinions to put it lightly. There’s other controversies than that, but that seems to be the main point of contention now in days.
As for alternatives, you have 3. Tutanota, Mailbox.org, or using mainstream options and manually using OpenGPG encryption yourself.
That, and its generally ill advised to “put all your eggs in one basket”.
Yeah, you can also host your own mail server or VPS and FDE (full disk encryption) the whole thing, which i have for some stuff, but generally it’s not great because cloud hosting service ip blocks are usually marked very low reputation by general mail providers, so your legitimate emails are very likely to go to spam even if you have spf, dkim, and the like all set up.
Important to note, just like proton mail or competitors though, full disk encryption prevents anyone from getting into your mail, but it does not shield messages you send. For that you need something like openpgp to encrypt actual email content, like you said.
- Image related
*poogle
proton is purple google
This is my personal opinion and only that, my opinion. If your options are proton or Google, proton. If you have the ability, technical ability (in some cases), and mental bandwidth to diversify those services, that’s even better. And if you want to securely and properly self host your own options that match your specific threat level, that’s the best.
I personally use paid proton for my email. I occasionally use the free VPN, and I have several things in their drive as a backup to my backup of my backup. I personally would not put all my eggs in the proton basket because I did that in the past with Google and if we’re ignoring the privacy portion, they have discontinued so many things over the years that I learned not to put ALL my faith in ONE company.
Edit to add, I also didn’t even touch the CEO thing but I see several others have. If we account for that, I’d still say it’s significantly better than Google.
Removed by mod
Proton is Israel’s bitch.
Proton is Israel’s bitch.
Wait, what? They are dealing/ having contracts with Israel companies or its government?
There are internet blacklists, several dozen, purportedly for scammers, and Israel is dropping their critics on them, and proton takes it at face value, with no appeal option.
Plus the US gave them lists of accounts to deleted and they did. They are bitches.
