How do the emails get decrypted then? I imagine your password would decrypt the keys which would allow them to decrypt the emails?
It seems like the next time you log in they would be able to capture your password and decrypt your emails.
It seems like the next time you log in they would be able to capture your password and decrypt your emails.
Your decrypted key isn't sent off your local computer. So it's not a case of waiting for you to log in and swipe your key. They never get the key.
In the past you could have a separate login password and decryption password. You still can in the advanced settings if you want.
Second, I am not talking about swiping the key, but the password. When you log in, you send your password to their server. They presumably hash the password and compare the hashes then send you the decryption key if the hash is correct.
The problem with that is they could keep the password you entered (pre hash). If hashes are good then use the password you entered themselves with the key to decrypt your email.
It sounds like the separate decryption password may work around this, but is not the default meaning a large chunk of the users are vulnerable to proton logging passwords.
They explain what they do here : https://proton.me/blog/encrypted-email-authentication