Quote:
Originally Posted by stephenMM
I also only use proton email. It's Swiss based and double encrypted. Even they don't know who their clients are, so they have no data base to turn over to anyone. They also have a great VPN. They ask for no personal information whatsoever.
|
Protonmail complies with
hundreds of government orders for user data. Don't think they know who their users are? When one signs up for Protonmail, personally identifiable information is demanded in order to proceed. Sign up demands either SMS which personally identifies you via your phone number. Or you donate to them, revealing your identity through a financial transaction + time correlation. Or you supply an existing email (and they block verification through email providers who
don't require PII).
Next: Encryption. Who holds the private keys? Did you generate a private key that resides on your local device
and nowhere else? Proton engages in a lot of "trust us to do it for you" design.
An excerpt from
An Analysis of the ProtonMail Cryptographic Architecture
Quote:
5.1.1 ProtonMail Webmail Does Not Provide End-to-End Encryption
A crucial security assumption, based on ProtonMail’s self-professed security goals in its specification documents (§2.1), is that the ProtonMail server P is untrusted. In Fig. 2a, we see that this untrusted server P must serve an authentic OpenPGP implementation J every time A logs into ProtonMail or, in some cases, multiple times in between A same single ProtonMail session. Since P is untrusted and since no authentication mechanism is implemented to check for the correctness of J, P can arbitrarily and untraceably compromise any information that A sends as part of her ProtonMail session. This includes A’s PGP secret key and any emails she has sent and received.
|
Look, I also endeavor for online privacy like you do, but we need to be realistic about repping things to people. Protonmail is orders of magnitude better than Gfail in terms of user privacy, but they sure do obtain PII and retain metadata.
Please register to participate in our discussions with 2 million other members - it's free and quick! Some forums can only be seen by registered members. After you create your account, you'll be able to customize options and access all our 15,000 new posts/day with fewer ads.
