I think it is important to understand that email never will be very secure because the standard wasn’t made with modern threat models in mind, if you want to communicate privately and anonymously, you need modern protocols like signal, i also use proton but only because I hate Google, i don’t expect my emails are any more private than they have ever been. I use email only when it is required, I use signal for private communication, overlap is impossible
Your emails are.more private in the same sense that if you have a letter with something on it, turning it over means someone can’t read it over your shoulder, but they could have read it before it got to you.
Google has access to the contents of your inbox, Proton mail does not. But the protocols are unchanged and unencrypted email is accessible in transit.
So moving to Proton is a definite improvement, particularly as email remains a basic means of communication. But as you say if you wand secure communication then it is very flawed.
But you can get secure email if you’re the sender (you can choose to encrypt) or it’s coming from someone else at Proton.
But yeah, there should be a secure alternative, perhaps an amendment to SMTP where only the “to” address is available. If I have the public key of the receiver (negotiation of that could be part of the protocol), I can encrypt everything else and my email could still be routed properly.
Yeah, this is one of the things that I quite like about Proton. It provides a migration path. You start sending and receiving plain-text mail (then encrypted before saving) but now you can use an open standard protocol to start communicating securely and Proton can slowly lose the ability to read much of your email.
IDK if the other “easy encrypted” providers just use standard PGP.
AFAIK, Proton’s standard is PGP, they just manage the keys for you (I’m guessing keys are AES encrypted and decrypted on the client) (source):
Proton Mail’s end-to-end encryption is based on an open-source version of PGP.
Tuta doesn’t use PGP, but it uses open encryption standards for it. So it’s a wash IMO since both are only used for internal emails (within their respective platforms).
For messages to external email addresses, they use pretty much the same thing: password-protected access through their platform (i.e. you click a link to Proton or Tuta and enter the password to decrypt).
I don’t know about other email services, but those two both seem pretty good, regardless of whether PGP or GPG is used internally. I haven’t reviewed the source code of either, but both have open clients so maybe I’ll get around to it at some point.
I think it is important to understand that email never will be very secure because the standard wasn’t made with modern threat models in mind, if you want to communicate privately and anonymously, you need modern protocols like signal, i also use proton but only because I hate Google, i don’t expect my emails are any more private than they have ever been. I use email only when it is required, I use signal for private communication, overlap is impossible
It’s useful to minimize data leaks too, since (especially when combined with simple login etc) you can avoid giving out your real address ever.
Your emails are.more private in the same sense that if you have a letter with something on it, turning it over means someone can’t read it over your shoulder, but they could have read it before it got to you.
Google has access to the contents of your inbox, Proton mail does not. But the protocols are unchanged and unencrypted email is accessible in transit.
So moving to Proton is a definite improvement, particularly as email remains a basic means of communication. But as you say if you wand secure communication then it is very flawed.
But you can get secure email if you’re the sender (you can choose to encrypt) or it’s coming from someone else at Proton.
But yeah, there should be a secure alternative, perhaps an amendment to SMTP where only the “to” address is available. If I have the public key of the receiver (negotiation of that could be part of the protocol), I can encrypt everything else and my email could still be routed properly.
Yeah, this is one of the things that I quite like about Proton. It provides a migration path. You start sending and receiving plain-text mail (then encrypted before saving) but now you can use an open standard protocol to start communicating securely and Proton can slowly lose the ability to read much of your email.
IDK if the other “easy encrypted” providers just use standard PGP.
AFAIK, Proton’s standard is PGP, they just manage the keys for you (I’m guessing keys are AES encrypted and decrypted on the client) (source):
Tuta doesn’t use PGP, but it uses open encryption standards for it. So it’s a wash IMO since both are only used for internal emails (within their respective platforms).
For messages to external email addresses, they use pretty much the same thing: password-protected access through their platform (i.e. you click a link to Proton or Tuta and enter the password to decrypt).
I don’t know about other email services, but those two both seem pretty good, regardless of whether PGP or GPG is used internally. I haven’t reviewed the source code of either, but both have open clients so maybe I’ll get around to it at some point.
I think you are agreeing with me. I like Proton because it uses a standard protocol and it provides a migration path from unencrypted to encrypted.
PGP and GPG are effectively synonyms in this context. (GPG is just an implementation of PGP)