Security oriented free gmail alternative (proton mail) opens public beta

Since I'm the first security person here I might as well just start off the anti-javascript crypto thread:

Their claim "Zero Access to User Data" is completely untrustable. There is no realistic way to be confident that this time you logged in you didn't get served backdoored javascript that sends that 'local browser only' password up to the server. This already happened in the past with Hushmail so you should keep this attack in mind.

Any system that is based on crypto code that you get in this way is inherently silly and doesn't buy you anything if the server is malicious, which is all this feature is billed as. At best you gain nothing, at worst you gain false confidence in your security.

The Swiss bit sounds interesting, but I know nothing about Swiss law and I don't see how that would stop active exploitation by an outside state actor from breaking into their service and exploiting the fact that the crypto code is sent down every time you page fetch(after a login even, how nice for targeting!). That's one of the NSA's major roles, I doubt they'd have much issue pulling it off if they wanted/needed to.

Not that I don't want more alternatives to Gmail, but Google's End-to-End extension seems to have more trustworthy security design than this, and I'd rather wait for that to appear. ProtonMail or other email providers could, in theory, use that extension, too, though.

As a side node, the above is something I wouldn't have been able to say if Google wouldn't have started working on an end-to-end solution, and I would probably be much more interested in starting to use another email provider that did (this as a response to people who have been saying here before that "Google shouldn't use end-to-end security because it would hurt their business" - not doing so would hurt their business in the long term, is like how I like to look at it).

I would recommend having a look at Unseen (https://unseen.is/), early days but a promising privacy focused startup. Priavcy policy here (https://unseen.is/privacy.html).

Also Qwant (https://www.qwant.com/) who also have a strong privacy focus for a search engine, privacy policy and settings here (https://m.qwant.com/privacy).

For a secure email service provider, they are very vague about the details. For example, they say there is a second password with which the messages are encrypted and this is only under user's control. Questions:

- So how does the receiver decrypts the message?

- If user wants to change / rotate their password, does it go back and update the old messages?

- Does this second password encrypt your meta data as well?

This is another interesting and massive PHP project aimed at user data security and privacy. Looks so impressive and it's a promising mail app by CERN engineers.

Looks like their public beta has been overwhelmed already, so you'll still have to wait until they have extra capacity.