Protonmail is propaganda, as it encourages centralization. Yes the self-host VPS provider can see it, but so can proton. This puts all eggs in one basket, which is a corrupt and easily accessed basket. Please see the following I wrote earlier:
~
First, Proton is NOT end-to-end encrypted. As per own their blog:
https://proton.me/support/proton-mail-encryption-explained
(Please note, I only changed the CAPS)
Quote:
"The email is encrypted in transit using TLS. It is THEN UNENCRYPTED and re-encrypted (by us) for storage on our servers using zero-access encryption. Once zero-access encryption has been applied, no-one except you can access emails stored on our servers (including us). It is NOT end-to-end encrypted, however, and might be accessible to the senderâs email service"
Second, they do scan it for spam and phising.
They repeat this with:
Source: https://proton.me/blog/encrypted-email-spam-filtering
"Emails that come from third party email providers obviously CANNOT be delivered with end-to-end encryption, but upon reaching our mail servers, we will encrypt them with the recipientâs public key before saving the messages(new window). All this is done in memory so that by the time anything is permanently stored to disk, the email is already un-readable to us. This gives us a very limited window to perform spam filtering on incoming messages."
Then they further elaborate,
"Secondly, the message is passed through our customized Bayesian filters which marks suspicious messages as spam.
Next, we generate checksums of incoming messages and check them against a database of known spam messages. If there is a match, we mark the message as spam. The checksums are done in such a way that it is also effective against mutating spam emails."
So they claim to have it unencrypted, then have a "limited time" to stop spam, but then also claim to encrypt it, and then after compare the hash to spam hash. If their own claims were true, then why do they only have a limited time?
Third, they hand over huge amounts of data. If it's encrypted, then what do they have to hand over?
From their own transparency report:
https://proton.me/legal/transparency
"2023
Number of legal orders: 6,378
Contested orders: 407
Orders complied with: 5,971
2022
Number of legal orders: 6,995
Contested orders: 1,038
Orders complied with: 5,957"
While as with a self-host VPS,
With a large amount of effort, the VPS provider could in theory snapshot memory to get access to emails. But this data is being sent through SSL encryption, so passive general surveillance is protected against. It would have to be work (and money wasted) for them to get the data.
