Hacker News Reader

Comment by WithinReason | Hacker News Reader

Do you have any proof that they store all the keys to emails? Because in none of the cited cases did they provide email contents to law enforcement, only data that you know is not encrypted, like recovery email.

View on HN

Your encryption key is stored encrypted so that we have no access to it. It is decrypted when you enter your password, which we have no access to. The article above confirms that, in fact, and all of these cases are proof that our encryption cannot be bypassed by legal means. All the data stored encrypted on our servers (email content, calendars, attachments, etc.) is inaccessible to us: https://proton.me/blog/zero-access-encryption. All we can provide is the unencrypted metadata which we need to have access to in order for the services to work properly.

> However, after receiving the email, we encrypt it immediately using the Proton Mail account owner’s public encryption key.

Email contents could still be siphoned, copied and shipped before the encryption process starts.

How can you clarify that does not occur between then and that?

For emails between Proton Mail users, it's end-to-end encrypted, meaning the encryption happens client side before the message even reaches the Proton server. If a message is coming from Gmail, then of course that cannot be encrypted until it reaches the server, unless of course the Gmail user is using PGP, which Proton Mail is interoperable with.

How do you suggest they technically not read the email at all? It is delivered unencrypted by Gmail, what do you want protonmail to do with it?

Well they double pinky promise, of course

Reply on news.ycombinator.com