Hacker News Reader

Comment by ritonlajoie | Hacker News Reader

On a related thought, using a 'secure' (or so they say ?) email provider à là protonmail is just secure if you send your email to another protonmail user.

Problem with services like that is they omit to tell their users that email is not E2E, and sending from protonmail to gmail will just disable the benefits of using protonmail.

So yes, if you are trying to send encrypted email to a GMAIL user, your only way is to use GPG. Or to get them onboard of protonmail and the likes. It's... impossible.

View on HN

When sending to a non-protonmail account, you have the option to encrypt the message contents-- recipient has to open a link and enter the password. I think decryption is done in the browser in that case too (not 100% sure tho)

That is correct. The recipient can reply from that webpage as well, however you can't have a conversation there (your replies to their replies don't show up in that page, they have to get new URLs in their email).

From what I remember, Protonmail is more about protecting the client and contents of the inbox from snooping than protecting the email content in transit between their servers and other people's clients. Supposedly, they use in-browser encryption to encrypt traffic between the browser and webmail server, and encrypt the mailbox so access to the server won't provide easy access to your account's contents. They also claim that hosting in Switzerland reduces the risk of server-side government interference.

I don't want to be a defender of snake-oil email providers but I think a 'secure' e-mail provider hopefully does more then just GPG to other users.

They hopefully have a good secure authentication system (Protonmail just added SRP and 2Fa) and hopefully have correct policy for things such as DKIM, SPF.

They hopefully also keep up with security updates and stuff like that.

Doing these things seems normal to many, but the reality is that many E-Mail providers have non of those things.

Reply on news.ycombinator.com