Hacker News Reader

It solves the problem of protonmail having to turn over emails to various authorities. This isn't solved with gpg as most people you would be sending to don't use it.

I don't think it's meant to solve e2e encryption.

View on HN

But most of the email recipients (and senders too) don't use ProtonMail either, so those won't be encrypted, and then ProtonMail can still turn over the messages. The ideal situation with this approach is that everyone uses ProtonMail (no decentralization at all), to have everything encrypted. While the ideal situation with OpenPGP is that everyone uses that, which allows for multiple independent mail servers.

Edit: or do they perhaps not store sent messages (that is, they have to queue them, and attempt resending on failure, but beyond that), and/or encrypt incoming ones with the user's public key upon arrival?

Edit 2: apparently the stored messages are indeed additionally encrypted by ProtonMail [1]. That looks useful.

Edit 3: now I wonder why not to do that with OpenPGP too.

Edit 4: looked around, apparently some do that. [2]

[1] https://proton.me/support/proton-mail-encryption-explained

[2] https://jnphilipp.org/posts/auto-encrypt-all-incoming-email-...

Reply on news.ycombinator.com