No, I mean they own the contents of your correspondence because you can't get the emails out.
>how is SMTP/IMAP access supposed to work? you send the plaintext password to their server to decrypt and hope they're not storing your password?
No, you send it over TLS. You can also take some cues from Google and do IMAP-specific passwords or OAuth over IMAP/SMTP.
Isn't this just a variant of the "can't access your mails without using their client" argument? If you're really keen on using your favorite IMAP client, pay for premium and use their bridge.
>No, you send it over TLS. You can also take some cues from Google and do IMAP-specific passwords or OAuth over IMAP/SMTP.
How does that solve the issue of them (protonmail) stealing your password (and thus the private key used to encrypt your emails)? They need your private key to decrypt your emails server-side. If they have your private key, they can decrypt all future and past emails. Worst of all, it's totally undetectable, unlike the backdoored javascript threat that you mentioned earlier.
No, that's absolute bullshit. Paying to export your own data from a service is nuts. Not implementing features which have been expected from every mail server for the past 20 years is nuts. This behavior is inexcusable.
>They need your private key to decrypt your emails server-side
No, they don't, they can just send you PGP encrypted emails over IMAP and you can decrypt them client-side. This is how it works for everyone else.
The only thing really fundamental to email is SMTP.
It looks like you can using beta.protonmail.com.[1]
[1] https://protonmail.com/support/knowledge-base/how-to-export-...
This goes back to the my original point that protonmail is pgp for most people. You sound like the sort of person who'd use a self hosted email server + some IMAP/POP3 client + some PGP client with self managed keys. Maybe having an open stack is important to you, but people like you are definitely in the minority. Most people don't know and/or care what PGP, IMAP, or MTA is, but they want something more secure than gmail/outlook.
And for the record, I wrote my comments on "Hacker" News, not in my local newspaper. The readers here are not "most people" and I can expect many more of them to have similar values to me.
A year ago, they posted on Reddit: "Audits have been done, about one per year usually. Cyberkov has done 3 audits since 2014 (they recommend it for their activities with Palestinian activists, so security audits are necessary)"
Do you claim that the independent security firm Cyberkov is lying too?
With the preponderance of evidence they've provided (security audits, open source, and transparency into how everything works), if you're saying that this is a big scam and they're lying about everything, it's really up to you now to provide some evidence.
I don't think you understand how zero-knowledge encryption works.
When I signed up for the free tier nowhere did it say you can't forward your mail or access ot via IMAP or POP3.
A bit misleading IMHO.