Hacker News Reader

Comment by mvip | Hacker News Reader

If you really want secure email, having it hosted and owned by a U.S. company is a recipe for disaster. Since we know that the U.S. gov't will gladly issue gag orders and blackmail, why even bother? It's great that Lavabit is innovating but Protonmail is already ahead by simply not being in the U.S..

View on HN

> Protonmail is already ahead by simply not being in the U.S.

Protonmail is not ahead in terms of technology. Lavabit is developing new email protocols, Protonmail is just a centralized service, and only its client is open-source: https://github.com/ProtonMail/WebClient

Protonmail is a walled garden of its own because it has no IMAP or POP (hasn't had it for more than two years since it was requested). So you're stuck with using the Protonmail apps on iOS or Android or using the web version. None of them are good choices to have one's own copy of all mails in an easily portable form. The only option Protonmail provides is to individually save or print emails. So there's no easy way to export your mails and switch to another provider.

This used to be true. Their IMAP support is currently in beta.

If it's really a beta in the true sense of the word, it's not reliable enough to export one's mails. It would be better to wait till it's out of beta for those who need flexibility to move out.

how do you get it? I've had an account there a long time and see nothing allowing IMAP config.

Beta features are reserved for paying customers (and in this case you also have to apply to get the IMAP functionality). Free accounts don't get it until it becomes stable.

> The best way is to upgrade your account to a paid account and take advantage of the numerous extra features we provide with paid accounts. [0]

[0] https://protonmail.com/pricing

So the employees of their "support centers in [California]"[0] can't be blackmailed and gagged? Or do they not have access to the systems?

[0] https://protonmail.com/about

They can be blackmailed but can't be gagged as any request for a person's data (including access to it) from a Swiss company MUST go through Swiss court. And even gag orders can't compel someone to break the law. Same situation as three letter agencies requesting EU data from Microsofts' datacenter in Ireland, which whilst it is an American company (and thus they are obliged to deliver by law) is illegal under EU and Irish law, thus preventing Microsoft from giving said data without breaking the law.

You seem to have a lot of faith in the law and legal process, and assume everyone else does.

Laws are a high latency side-chain of authority; a guide perhaps; and for some a business opportunity.

And then we have Organised Crime, moles, plants; informants, sympathesiers, casual snitches, quadruple agents, the desperate, and machine learning eating meta-data for breakfast.

If you've got something to hide "it's not legal for support staff to [whatever]" is most definitely not a security measure.

It has kept Microsoft from sharing its EU data with American agencies so far.. and considering Microsoft has been under the microscope (haha) since it's EU antitrust suit I don't think they could pass the data without some serious ramifications. As far as ProtonMail goes.. well they certainly could force the support employees somehow, but if that ever gets out there would again be serious ramifications. Plus, why do you think the US Enterprise IT services/hardware industry took a serious hit when all the NSA leaks happened? What do you think will happen if it gets out that the US is even forcing foreign companies to obey to US law? I'm not counting on the NSA to behave - I'm counting on America as a whole to be greedy and put business above enforcement.

>It has kept Microsoft from sharing its EU data with American agencies so far..

At least publicly. Behind the scenes there could be a sharing bonanza for all we know.

And you seem to be painting Swiss legal system with the exact same brush as the USA governmental and legally sanctioned framework for spying on people.

The Swiss legal system doesn't have to be involved at all if they can get the data directly from the US datacenters, no matter what the Swiss law and/or international treaties say is the "formal" process.

I believe the point is that there are no US data centers. And protonmail states all the data is encrypted anyway and never decrypted on their servers (obviously except the initial receive/send of the mail).

Do you think that really matters ?

It's a start. It's better than nothing, unfortunately.

>They can be blackmailed but can't be gagged as any request for a person's data (including access to it) from a Swiss company MUST go through Swiss court.

LOL.

The good thing is Protonmail and Lavabit can profit from each other.

The more services there are, the better.

Reply on news.ycombinator.com