I’ve been using Proton Mail and VPN for a while now, and I’m just wondering how everyone else feels about them. I have this kind of inherent alight distrust of them just because they seem like they offer a lot for free and kind of have a Big Tech vibe about them, but there’s nothing for me to really substantiate that distrust with, its mostly just a feeling. That being said, I do use their services as mentioned and they work pretty well, even on the free teir. So aside from that one instance where they gave that guy’s info to the feds, is there any reason not to trust them with my data?
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 57 users / day
- 383 users / week
- 1.5K users / month
- 5.7K users / 6 months
- 1 subscriber
- 2.97K Posts
- 74.6K Comments
- Modlog
Tor Browser only protects your IP address.
Emails received from outside senders are only end to end encrypted if the sender is using OpenPGP or S/MIME. Otherwise, Proton receives them in plain text (the TLS encryption is terminated at their SMTP server). They promise that they don’t look at them before encrypting them for storage, but you have to trust that promise.
Injecting malicious code means either XSS or if their build pipeline gets hacked. These companies release builds through a pipeline (usually download source -> download dependencies -> build from source -> package -> sign -> notarize (for Apple) -> release), and anywhere along that pipeline can be vulnerable. They might update a dependency that got hacked and now they’re hacked too. One of their build servers might get hacked and now they’ve released a malicious build. You’re trusting them to verify not only their code and their build servers, but also every dependency update. That’s potentially millions of lines of code per year to vet. It’s probably fine, but you’re still trusting them.
As for whether an attack is their fault, it really doesn’t matter. The end result is your leaked data. They could do everything they possibly can to protect you, but they could still get hacked. You are trusting them when you use their service. I believe they’re trustworthy, which is why I’ve been using their service for years.
A note about me: I know all of this because I have worked in big tech for ~11 years (Facebook, Google, then LinkedIn), I wrote an end to end encrypted messenger (called Tunnelgram, now discontinued), and I wrote my own email service over the past two years (called Port87).