There is also this.
"The plan, he said, was to have criminals use the storefront — an online end-to-end encryption service called Tutanota — to allow authorities to collect intelligence about them."
"So if targets begin to use that service, the agency that's collecting that information would be able to feed it back, that information, into the Five Eyes system, and then back into the RCMP,"
https://www.cbc.ca/news/politics/ortis-testimony-transcripts-1.7026011
I'm always dismissive of honeypot claims and prefer to look at a product for what it actually is.
My biggest gripe with it is actually the lack of open pgp support, something proton supports.
Emails are only e2ee between tuta users which is kind of useless tbh.
True. The last part will be the same with Proton as well. Only e2ee on the same service. I need to learn pgp. Would the person receiving the pgp email need to know how to decrypt to read the email or is it just a click?
That's not true, proton supports openpgp with any client/provider and even automatically fetches public keys using WKD or popular key servers.
You can easily send e2ee email to different providers and I have done so and it works automatically.
If the interface is good, they don't even need to know anything, the client app handles encryption and decryption for them.
Damn thats all new to me. So how do i send an encrypted email to gmail from my proton?
You need to use an email client with pgp support such as thunderbird (with the enigma extension) or if you're comfortable with a terminal app you can use aerc, mutt or neomutt.
There are probably more but I don't know them.
Interesting. I thought proton didnt allow sign in to other clients. Must be new?
You asked from gmail.
With proton all that is done automatically no matter which client you use (app, web or thirdparty using Proton Bridge).
I said to gmail from my proton
Sorry misunderstood.
Gmail user needs to setup pgp on another client before they can receive pgp email from a proton user.
Tuta users cannot do that as their encryption scheme is not pgp compliant.
.
If you and your recipient are capable to use pgp then don't use protonmail. Just use regular e-mail provider even Gmail.
Bear in mind that Protonmail officially scans all unencrypted e-mails.
The difference is protonmail encrypts it at rest with private keys under your exclusive control.
They can only scan unencrypted emails while they are in-transit (same as any other provider) which they obviously use for spam detection.
The value of protonmail is precisely encryption-at-rest combined with automatic open pgp encryption.
What's the difference? They scan all encrypted e-mails before they "encrypt" them with private keys without password which they keep.
The private key you import/generate is encrypted clientside with your password (which is also only known clientside, since serverside only sees the salted hash).
Email is inherently insecure and non-private. I don't know exactly what your point is. Protonmail takes steps to improve the situation as much as possible but you still claim that it's better to just use gmail.
First of all what is the purpose of importing the key?
I can generate my key and export it to Protonmail.
That's what I meant by "importing". You can import your local gpg key into PM, or if you change your reference frame, you are exporting it from your OS to PM.
I agree with you. E-mail is a history.
The point is that Protonmail and Tutanota have nothing in common with privacy and security. They use those words to fool people. It's marketing.
If you are capable to use pgp, it's better to use it in yahoo, gmail or other email provider with pop3 imap access.
Disagree. At least with those providers you have encryption at rest and with PM you can also use pgp.
You can claim that is "privacy theatre" since they can clone and archive unencrypted emails in-transit. True.
But doing that severely goes against their business model, specially when you are a paying customer. It is a trusted relationship in that respect, but at least the incentives are on your side.
Using gmail or other mainstream providers is strictly worse in every way. And you know that they are actively scanning your unencrypted emails not just for spam prevention, but to sell your data and to give your up to Law Enforcement.
Protonmail doesn't support Subjects encryption, they keep your private keys. You cannot even generate own private keys protected with passphrase.
They don't support subject encryption since that would break open pgp compatibility which is essential when mailing other providers.
You can generate your own private keys and import them. They need to be unencrypted when importing because they are re-encrypted with your protonmail account password so that they can be unencrypted automatically when you login. It is a convinience tradeoff so that the user does not need to worry about manually unlocking keys after login.
Both webclient and app are FOSS so this is just easily verifiable. The important thing is you can make sure they don't compromise or sweep your private keys.
You should be...
"Crypto AG rejected these accusations as "pure invention", asserting in a press release that "in March 1994, the Swiss Federal Prosecutor's Office initiated a wide-ranging preliminary investigation against Crypto AG, which was completed in 1997. The accusations regarding influence by third parties or manipulations, which had been repeatedly raised in the media, proved to be without foundation.""
