How Secure Is Proton Mail

[Adam-F]

Good Afternoon All,

I have been thinking of creating a Proton Mail account for awhile now, but the controversy from 2021 is putting me off.

Are they as trustworthy as they say on their website?

How did want went down in 2021 affect their reputation going forwards?

Also if I do create an account, how does importing an email account work, when I comes to using my current email address as a username for accounts to services that I have already created years ago.

Will I be able to login to those account with my Proton Mail account address.

Thanks

 

[peterblaise]

ANY storage and release of information to any service "out there" is as
'secure' as the people who have access to it, such as disgruntled
employees taking it with them as they leave, or leaving the door open
for others to access it, or selling access on the side.

The only option for complete security is to not have anything
accessible by others, maybe not even by ourselves ( to prevent
physical theft of someone invading our space ).

Encryption?

It's a cat-and-mouse game of how much work we do versus how
much work others do.

With AI coming into the game, we may need our own AI on our side
to one-up the cat-and-mouse game once again.

 

[peterblaise]

Regarding technical questions, it's up to any subscription /
membership service to allow us to change our email address or
require a new membership.

I use forwarding and "receive from" features of email services to see
all my stuff in one place without having to change any membership
credentials.

It's a lot of work, and I use print-out lists to keep track.

I also keep some Proton and other accounts isolated with no directly
traceable connection to me, only ever accessed via proxies and Tor
and such, with no record on any computer, only hand-written notes
in code.

 

[Rocky Beach]

The 2021 incident, for those who didn't know, was that Proton complied with a legal request and gave out a customer's ip address.

Said customer should have been using Tor to connect or at least a VPN. That would obscure their ip address.

Proton mail does have a free tier. Nothing stopping you from creating an account and kicking the tires, so to speak. Their mobile app is ok. Last I recall of the web ui was that I thought it was basic.

Proton is also moving their infrastructure out of Switzerland. There are Swiss laws proposed or put in place that would make their business more challenging.

Addendum: Proton isn't the only game in town. If you haven't checked out Tuta, they seem to be really good. I use them for backup email purposes right now. If my email provider turns over, I'll probably go Tuta.

 

[AlanD]

Also if I do create an account, how does importing an email account work, when I comes to using my current email address as a username for accounts to services that I have already created years ago.

Will I be able to login to those account with my Proton Mail account address.

Thanks

The use of any email address as a login to another service is merely a convenient way for the other service to identify customers. That service would require a unique identifier, and email address is one thing that must be globally unique.

In a well designed system, there should be no relationship between the identifier that you use to login and the email address that they use to communicate with you. Thus, if you switch to a Proton email address, all that you should need to do would be update your contact details on each other site, but still retain the login credentials that you have always used.

 

[a viewer]

mail is designed to be a store and forward system, though many servers now can connect directly to the destination server. However, email never considered security. This entails that along the way they could copy your messages. Think the sales point of proton was that they would "never" provide the messages stored on their servers. It isn't like vpn that can store the logs in ram

For secure messages you need the sender to encrypt the message. Rather trivial with s/mime, but nobody uses it. Even tuta that claims to encrypt the messages, doesn't work if the sender isn't a tuta user.

Proton already said they would leave switzerland if the law changes where they need to provide messages. However, this is becoming the norm worldwide and might be more a marketing ploy.