I know it seems paradoxical, but the argument is all email is unencrypted anyways! It’s only encrypted after being seen by the server, at the provider’s word. So just like unencrypted email, a server vulnerability can leak your emails even in a service like ProtonMail (Well, unless using PGP or in-platform encryption which is very rare). To me this is misleading to the everyday user and a really dangerous issue that I want to bring more attention to
As far as I remember, encryption is done at the client end on the browser. Protonmail and others don’t see your unencrypted email as you claim.
This seems like a fundamental misunderstanding on how E2EE works.
Additionally, ProtonMail publishes source which I’m sure many security experts have had the chance to scrutinize. The whole thing is a bunch of “oh but what if”…and no solid concrete evidence.
It even says on their website:
With Proton Mail, emails are encrypted at all times, so we can never access your messages. The content of your emails is encrypted on your device before being sent to our servers, meaning only you and your intended recipient can decrypt it.
Which also covers your garbage about “oh they don’t tell you that they don’t encrypt the subject!”. They do – right there. The subject of an email is not the “content” of the email.
The email is encrypted in transit using TLS. It is then unencrypted and re-encrypted (by us) for storage on our servers using zero-access encryption. Once zero-access encryption has been applied, no-one except you can access emails stored on our servers (including us). It is not end-to-end encrypted, however, and might be accessible to the sender’s email service.
This is exactly what this article addresses. ProtonMail does NOT encrypt on the client side unless you use PGP or email other ProtonMail users. Imagine sending an email to a gmail user. To actually send the email, ProtonMail’s servers have to read the full un-encrypted contents to post over to Gmail’s servers. The gmail user, and by extension Google, has full access to the email’s contents unencrypted.
This is not disputed by ProtonMail, but unfortunately they hide it behind secondary pages on their website. It’s not just ProtonMail either, but really all E2EE email services
But you just posted the following quote from their website, which is clearly misleading. Imagine a non-technical user reading this, and trusting secrets to ProtonMail.
With Proton Mail, emails are encrypted at all times, so we can never access your messages. The content of your emails is encrypted on your device before being sent to our servers, meaning only you and your intended recipient can decrypt it.
gmail (and other services) users can recieve PGP encrypted mail, if they use a mail client that supports this. And the sender knows whether that recipient can recieve it beforehand, because the sender needs their puplic key to send them an encrypted mail.
if the recipient opens that encrypted mail in a client that does not support PGP, they cannot read the mail body and attachments, neither can the mail provider.
the provider can deliver the encrypted mail they can’t decrypt, because the mail headers (address etc) are not encrypted. the provider only learns what they need to know to deliver it.
I know it seems paradoxical, but the argument is all email is unencrypted anyways! It’s only encrypted after being seen by the server, at the provider’s word. So just like unencrypted email, a server vulnerability can leak your emails even in a service like ProtonMail (Well, unless using PGP or in-platform encryption which is very rare). To me this is misleading to the everyday user and a really dangerous issue that I want to bring more attention to
As far as I remember, encryption is done at the client end on the browser. Protonmail and others don’t see your unencrypted email as you claim.
This seems like a fundamental misunderstanding on how E2EE works.
Additionally, ProtonMail publishes source which I’m sure many security experts have had the chance to scrutinize. The whole thing is a bunch of “oh but what if”…and no solid concrete evidence.
It even says on their website:
Which also covers your garbage about “oh they don’t tell you that they don’t encrypt the subject!”. They do – right there. The subject of an email is not the “content” of the email.
Here is a reference from ProtonMail: https://proton.me/support/proton-mail-encryption-explained
This is exactly what this article addresses. ProtonMail does NOT encrypt on the client side unless you use PGP or email other ProtonMail users. Imagine sending an email to a gmail user. To actually send the email, ProtonMail’s servers have to read the full un-encrypted contents to post over to Gmail’s servers. The gmail user, and by extension Google, has full access to the email’s contents unencrypted.
This is not disputed by ProtonMail, but unfortunately they hide it behind secondary pages on their website. It’s not just ProtonMail either, but really all E2EE email services
Everyone knows all of this already. This is FUD.
But you just posted the following quote from their website, which is clearly misleading. Imagine a non-technical user reading this, and trusting secrets to ProtonMail.
gmail (and other services) users can recieve PGP encrypted mail, if they use a mail client that supports this. And the sender knows whether that recipient can recieve it beforehand, because the sender needs their puplic key to send them an encrypted mail.
if the recipient opens that encrypted mail in a client that does not support PGP, they cannot read the mail body and attachments, neither can the mail provider.
the provider can deliver the encrypted mail they can’t decrypt, because the mail headers (address etc) are not encrypted. the provider only learns what they need to know to deliver it.