Hacker News Reader

Comment by tlogan | Hacker News Reader

I still do not understand what is point of ProtonMail: they are same as others. Google, MS or Apple will not sent your data to gov without court order. ProtonMail is the same.

And I bet that these big corporations have better security.

Please advise…

View on HN

I'm sure Google and MS have a lot more data to give in an information request than ProtonMail. According to what ProtonMail has posted, they only turned over an IP address. Google and MS would probably have your account name, contents of your emails, login session times, all recorded IP addresses you've logged in from, all recorded devices you've logged in from, etc. I'm not sure about Apple though.

Google literally log every thing you do[1]

[1] https://www.wired.co.uk/article/how-to-delete-google-search-...

ProtonMail to ProtonMail emails are e2ee. Emails sent outside of ProtonMail ecosystem can still be secured with a password with a link to the email hosted at ProtonMail. ProtonMail uses zero-access encryption, which means it is technically impossible for them to decrypt user messages. When you sign up with Google you have to give them a phone number and other details which ProtonMail don’t require.

In relation to GMail specifically see[1]

[1] https://protonmail.com/blog/protonmail-vs-gmail-security/

> ProtonMail to ProtonMail emails are e2ee. Emails sent outside of ProtonMail ecosystem can still be secured with a password with a link to the email hosted at ProtonMail.

You can also encrypt emails with PGP with someone's public key from within ProtonMail, in this scenario you don't need to send them a password or a link. They do however have to have you in their address book with public key attached.

Proton to Proton might be E2EE. Proton to any other service is almost certainly not. I'd suggest that their marketing is not exactly transparent. Their 'zero-access encryption' only applies to mailboxes stored in their environment.

It's nice that they offer hosted secure mail, like those on offer from enterprise tools (Proofpoint, Mimecast etc.), but it's not really E2EE email. Signing up to Protonmail may not require a mobile number, but a recovery email (PII) must added and linked the account.

Here is an example of a Protonmail to Gmail message (potential PII removed):

  Delivered-To: xxxxx@gmail.com
  Received: by xxxxx with SMTP id {...};
          Mon, 6 Sep 2021 00:00:00 -0000
  X-Google-Smtp-Source: {...}
  X-Received: by xxxxx with SMTP id {xxx}.50.{xxx};
          Mon, 6 Sep 2021 00:00:00 -0000
  ARC-Seal: i=1; a=rsa-sha256; t={...}; cv=none;
          d=google.com; s=arc-20160816;
          b={...}
  ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-{...};
          h=mime-version:message-id:subject:reply-to:from:to:dkim-signature
           :date;
          {...}
  ARC-Authentication-Results: i=1; mx.google.com;
         dkim=pass header.i=@protonmail.com header.s=protonmail header.b={...};
         spf=pass (google.com: domain of xxxxx@protonmail.com designates {...} as permitted   sender) smtp.mailfrom=xxxxx@protonmail.com;
         dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com
  Return-Path: <xxxxx@protonmail.com>
  Received: from mail-{...}.protonmail.ch (mail-{...}.protonmail.ch. [{...}])
          by mx.google.com with ESMTPS id {...}.{...}
          for <xxxxx@gmail.com>
          (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);
          Mon, 6 Sep 2021 00:00:00 -0000
  Received-SPF: pass (google.com: domain of xxxxx@protonmail.com designates {...} as   permitted sender) client-ip={...};
  Authentication-Results: mx.google.com;
         dkim=pass header.i=@protonmail.com header.s=protonmail header.b=WRR3qgpc;
         spf=pass (google.com: domain of xxxxx@protonmail.com designates {...} as   permitted sender) smtp.mailfrom=xxxxx@protonmail.com;
         dmarc=pass (p=QUARANTINE sp=QUARANTINE dis=NONE) header.from=protonmail.com
  Date: Mon, 6 Sep 2021 00:00:00 -0000
  DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=protonmail.com; s=protonmail;   t={xxx}; bh={...}; h=Date:To:From:Reply-To:Subject:From; b={...}
  To: "xxxxx@gmail.com" <xxxxx@gmail.com>
  From: {...} <xxxxx@protonmail.com>
  Reply-To: {...} <xxxxx@protonmail.com>
  Subject: Testing proton mail "encryption".
  Message-ID: <1234567890@protonmail.com>
  MIME-Version: 1.0
  Content-Type: multipart/alternative; boundary="THE_BOUNDARY"
  X-Spam-Status: No, score=-1.2 required=10.0 tests=ALL_TRUSTED,DKIM_SIGNED,   DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,FREEMAIL_FROM,HTML_MESSAGE shortcircuit=no   autolearn=disabled version=3.4.4
  X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on mailout.protonmail.ch
  
  --THE_BOUNDARY
  Content-Type: text/plain; charset=utf-8
  Content-Transfer-Encoding: base64
  
  --THE_BOUNDARY
  Content-Type: text/html; charset=utf-8
  Content-Transfer-Encoding: base64
 
  --THE_BOUNDARY--

Nothing special, certainly no E2EE encryption (to be fair, the welcome email explains this is Protonmail <-> Protonmail only) and STARTTLS, so it may be opportunistic encryption for the transmission. Not sure what benefit the Base64 encrypted body has as it's more bytes that the unencrypted message. Of course, encrypting with PGP and sending over Tor helps with anonymity, but it still relies on the recipient keeping everything secure their end.

Email, no matter what you do to try and make it secure, is an inherently insecure protocol, that has been mangled beyond what it was intended for. I'm not suggesting that we shouldn't try to make it better, but that it might just be closing the proverbial stable doors.

> Proton to Proton might be E2EE. Proton to any other service is almost certainly not.

There is nothing stopping you from importing a public key into your contact in your address book, when you do that and send an email it will have a green closed lock. It supports fetching the key via WKD as well.

The lock icon indicates if it is encrypted https://protonmail.com/support/knowledge-base/encryption-loc...

That can be done with Thunderbird/Enigmail and with GPGTool in mail.app. If the key is on a public server, then decryption can be done by anyone. The point is that Proton is categorically not E2EE sending to 3rd parties. It can’t be because email doesn’t work like that. PGP is a bandaid. If you want to send email securely, don’t use email!

> The point is that Proton is categorically not E2EE sending to 3rd parties

Who said it was?

The comment must have been deleted.

The "data" in this case was the user's IP address and time they logged in.

Other providers might be able to be compelled to provide much more explicit data such as email content or the user's identity.

ProtonMail messages can be end-to-end encrypted and they aren't scanned for serving ads to you. ProtonMail might be the same with regards to metadata, but they offer an onion site to mitigate that risk to a certain extent.

Reply on news.ycombinator.com