Why should you trust ProtonMail? | Hacker News Reader

Why should you trust ProtonMail?

protonmail.com

50 pointsSantosh8324 comments

I run a marketplace website. Most (actually I think all) of my users who use protonmail are scammers trying to sell fake goods - therefore banned. I might even ban all with @protonmail.com.

Do you think that reflect poorly or well on ProtonMail's trustworthiness?

I'm thinking it doesn't matter if ProtonMail's technology is trustworthy if the users are using it for untrustworthy purposes. Tor browser technology might be fancy, but expect the end IPs to be blacklisted or recaptcha'd to death. If you use mailgun (instead of a more restrictive service like Postmark) expect your emails to go to the junk folder. ProtonMail may share the same fate.

Maybe flag seller accounts with that mail so they're at a lower tolerance for abuse? Seems a bit overreaching to ban an entire email provider over some bad actors.

yeah that’s how we are doing it now. Flagged and then manual review. Often the same bad actors will just generate a new protonmail account... which leads us to browser fingerprinting

how about custom domains? are they more or less trustworthy than a gmail/hotmail/yahoo account?

On our website, custom domains are usually an employer domain and are rarely scammers.

Protonmail is one of the few mailers that allow registration over Tor. I like that, because I value my privacy, but of course this also opens up abuse.

In the ProtonMail Threat Model document[1], in the "What ProtonMail does not guard against" section, you should add "Dissenting Opinions".

I know of at least one case where a vocal right-wing personality had his account removed because he listed it as his contact.

I understand ProtonMail is a private company and can do what they want. So they should be honest about not being a safe place for dissenting opinions.

[1]: https://protonmail.com/blog/protonmail-threat-model/

> had his account removed because he listed it as his contact.

Do you have any link for that?

There used to be a list of deplatforming events that had the person, the platform, the date, and the alleged reason for deplatforming.

I have no idea where that is hosted now though.

Though experiment: what if the "dissenting opinion" is advocating for human trafficking, with a specialization for children to be sold as sex slaves? Or something equally awful.

Does the business have the right to refuse to service a customer that society should rightly condemn?

I live in a city with population of about 15 million people, and for some time we had bakeries, claiming in print that they wouldn't serve f###### (anti-gay slur). Not sure if they're still around, but quite sure I don't like letting businesses discriminate whomever they'd like to.

A private business should have the right to refuse service for any reason they choose. I believe the point the original OP was trying to make is that a business should be transparent about its willingness to refuse service to those they find, "socially awful".

Then the business could say that they don't serve people who advocate for illegal activity. If they also don't want to serve dinner people who advocate for legal activity, then they should be transparent about it

I've been using this with my own domain for several years now and have no complaints so far. Effective and reliable from my perspective. Satisfied customer looking forward to their next security-forward features and deeply grateful to have the correspondence most sensitive to me off gmail and similar!

Currently in process of moving away from yahoo mail (after 25+ years of using it) to proton. Highly recommend it.

I am on the fence about moving over to ProtonMail since forever now. What are the reasons you highly recommend it?

No parent comment. My reasons are 1) Custom domain if you're a paid member

2) Better and more responsive UI (better is subjective but you can feel that it loads much more quickly than GMail or Outlook)

3) e2e encryption is great if you use it for business, some businesses are skeptical of free public email services since the emails aren't really private.

The fact that Yahoo got bought by Verizon was the last straw for me. Started with their BS move of getting rid of YM, best ever IMO.

I just canceled my Visionary account and moved back to my grandfathered GSuite Free Tier. I missed the classification of promotional/social/updates that Google offered and the speed at which the service worked. Sure, I may have been able to create filters to do the same on ProtonMail, but I just couldn’t find the time. CloudFlare’s Warp VPN has also eliminated my need for ProtonVPN at this time.

I may re-evaluate ProtonMail if they ever introduce FIDO2 support. Despite how you may feel about Google, I do believe my account is safer with them than ProtonMail as my Google account cannot be logged into with the appropriate security key.

Can you please elaborate on the setup with security key?

It's Google's Advanced Protection Program.

https://landing.google.com/advancedprotection/

First only available to Google accounts, and then recently released to GSuite customers. They will encourage you to use their keys, but a YubiKey or other FIDO2 key works just as well. Once enabled, you can remove all other forms of recovery from your account (so no SMS, backup codes, TOTP codes, etc).

If you are willing to pay for protonmail.com, why not just use GSuite or O365 Business? The content of your emails are not used for marketing and you get more features/products for your money. My threat model is not disgruntle employees searching through my emails, or govt. out to get me.

Reply on news.ycombinator.com