I think I know the answer, bit maybe I’m missing something
Since proton only sends and receives encrypted emails to other proton accounts, that means that when you get or send an email to someone else, they have to send / receive unencrypted and there is no way for us to verify what they are doing. Right?
Also if most accounts are google Microsoft, they still get 90% of my emails. By switching to proton I think I’ve gained nothing, while losing convenience , added another trust point, and having two different companies have my data instead of just one
Proton drive, calendar and VPN I think are fine
Sorry for the poor syntax. I’m at work working on email related things, and this topic kept distracting me. I might correct it later
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn’t great, if contents of the website are behind a paywall maybe copy them into the post
- Don’t promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
much thanks to @gary_host_laptop for the logo design :)
- 0 users online
- 113 users / day
- 519 users / week
- 1.44K users / month
- 4.49K users / 6 months
- 1 subscriber
- 4.29K Posts
- 109K Comments
- Modlog
You could self host your email
Yes. But then again. If no one I know uses a private provider, my emails will still get scanned and read.but it its 1000% less convenient
the thing with proton is you don’t really know that they’re private and they pretty much always collaborate with the police and their android vpn app collects some data that it doesn’t need to. I would suggest you:
a corporation is a legal extension of the state, hence why all of them will always collaborate when ordered by the courts or otherwise required by law.
some will even collaborate when they are not required by law such amazon ring providing pigs access for no reason, facebook censoring content per request of US or Israel… needless bullshit but hey it helps get government contracts ;)
bottom line, expecting corpo to do anything for you for 5 bucks a month is naive, at best they should not do it for no reason and they should not sell your data.
but even that is a tall order for these parasites.
yeah, the solution is to use a provider which is not a company.
I don’t know how old are you or where you live, but for everyone I know it’s non optional. My government requires an email. And for any site I want to use I require an email. Even Lemmy.
that’s why I said ‘ideal’…
Privacy is multiplayer. When the government needs it, we must do more to spread these ideas.
I don’t understand what you are trying to say
I wouldn’t say you have gained nothing. The amount of data provided to google or microsoft when using their email is significantly more. For example, your app or client is checking email all of the time, giving them telemetry on your location and activity, all your devices, 24/7. Google logs and analyzes all of your interactions with Gmail’s web pages, how long you have certain emails open for, what you don’t bother to open, what you tag as important, etc.
Much of the one-way email you sign up for from companies and organizations come from smaller outfits like sendgrid or their own infrastructure, so you are cutting google out of information about your associations and interests.
Also, in regards to that 90%, you can either be part of the problem for all your contacts, or part of the solution. The network effect is huge.
Interesting. Damm it. I was hoping to go back to gmail because its more convenient. But if it actually provides better privacy, then I guess I can stay :(
I pay the amount of maybe 10 $ a year for having my own domain hosted at a mail-hotel, and that means I control my own e-mail. I think it’s worth it. There more who switch, the better.
Could you elaborate? What is an email hotel? I’m guessing you mean an email hosting.
just like a webhotel, just for mail instead… So yeah, like you can pay someone to host your website, you can pay someone to host your e-mails with your domain name…
That sounds like the worst option of all. At least I can trust google has some protections in place to stop employees from looking at you email, because if they didn’t there would be thousands of cases all the time.
In your case, you never know who is looking. At any point a rogue admin can issue a bank password reset and just read the email
I’ve never heard of the term web hotel before. I’m guessing its web hosting
Sounds like you don’t know what you are talking about. :-) That’s fine, but unless you know something about the topic, you shouldn’t really be judging…
I know exactly who is looking. And I would also know if anyone tampers with the passwords. I guess you don’t have the skills, and that’s fine. You might even think that there’s anything in the world that is totally secure. There’s not a single thing that is secure.
Oh, what is this? - https://www.forbes.com/sites/zakdoffman/2025/08/25/google-warns-most-gmail-users-must-change-passwords/
Good for you
Google literally opens all your email and scans the contents to build an ad profile on you. They scan all attachments too.
Of course. But you didn’t switch to a trustless provider. You switch to a nobody that has nothing to lose by reading you email. Also my point is that google has programs reading every email, but not people. They probably have a lot of locks to stop employees form accessing users email
Hold on, am I missing something? I don’t see anyone in here talking about that time proton openly endorsed the Republican party. Did we forget about or forgive them for that? Is it just irrelevant right now? They backtracked later but like https://archive.ph/2yWGz
When organizations make a move like that, they usually don’t stop pushing in that direction, even if they backtrack in response to pushback. While I’m sure they’re still better than google, I have a hard time trusting them after that. It feels relevant to talk about because like you said, using proton is adding another trust point.
Got banned on their sub for criticizing that clown Andy the bootlicker.
They are happy to shill free speech when they take your money, but no free speech when they get criticized.
Tells you what you need to know about corpo.
Their email is best in class though. Other services are mid at best.
That has nothing to do with privacy
Kind of tired of beating the dead horse on that story, but part of privacy is that you need to trust the company that you’re dealing with.
He’s out there openly praising on authoritarians move to install a puppet government and open the gateway to corporate corruption. If our privacy companies are going to be sneaky and dirty, we want it done in the shadows. All he had to do was stay quiet. But he got noisy, then the PR department started gaslighting, and none of that’s a good look for a privacy company.
The thing is, Trump doesn’t give two shits about anybody, and the guy running the company should have known this.
But now it’s old news, it can die. He can prove that he can run the company by good faith measures and doing the right thing instead of by trying to gaslight people through PR.
My general opinion is that if a company requires trust, it’s not a good privacy option. We have suffered the consequences of trusting companies a lot of times. I’m not doing that again. All I care right now is the code. If we have to alternatives with the same product but one CEO is an asshole and the other not, then I’m going with the non asshole. But I’m not going to sacrifice my privacy to switch companies jus because UNTIL NOW the other provider seems nicer. That can change at any time. Email is specially a problem since switching emails is the most time consuming part
You have to trust that:
Code is good, but there’s a lot of operational information there that doesn’t get exposed by being open.
Code in the face of no malice wouldn’t be a large worry. They rolled over on a French activist and doxxed them for the French government. Those logs should not have existed in a privacy company.
Again, this is all old news now. Let’s see him make hard decisions to protect the clients and turn the PR side of things from “the empire did nothing wrong” to hey, let’s have an open dialog.
i don’t care about their VPN. the issue you describe is very real, but it’s inherit to all vpn providers. what i care right now, is their email service. you can switch vpn providers in less than 15 minutes, but email takes days. so i wouldn’t want to go around doing all of that every time some employee says something stupid.
and btw, if you use native installed apps, then the worry of them serving malicious javascript goes way down because any change they make on the complied package would be very likely to be very obvios to someone, because its open source ( i won’t go into detail here).
Yeah, I feel you about not wanting to move your email. Email is inherently insecure. My only real problem with their email is that they give people and false sense of security that their email is secure. It’s only secure as long as it’s on their network and it’s not like it’s end-to-end. If i remember correctly, their back-end email server is one of the things that’s not open.
Their CEO did fuck up with that, so for me they are on thin ice, but I haven’t seen anything else problematic since then.
Email is never private, even with encrypted email, headers give away metadata. HOWEVER, Tuta & Proton are not scanning your emails to market shit to you and train AI. That’s the main advantage.
Except that proton released their LLM AI so maybe they will start doing that?
No they probably won’t, proton is not a big enough company to train it’s own large language model instead they are using already available open source models.
Problem is where you send emails to is.
Yeah. That’s ops whole point.
You can’t know if they are not reading you emails to do anything. That is the issue. Because of how email works, we know that they COULD. And experience tells us that tech companies profit from breaking promises and laws.
IMAP + GPG
POP is better than IMAP, the emails get deleted from the servers.
IMAP can delete too. When it’s not your server, there’s no proof it’s actually deleted. So, use GPG.
yeah, just that I like the protocol design better. also GPG isn’t that great, so maybe sending files encrypted with ssh or age(or lxmf uri messages)
Right. So back to gmail?
No private registration or payment.
Sorry. I don’t understand
Tuta has no IMAP, vendor lock-in, bad.
Proton has IMAP with extra steps, almost vendor lock-in, bad.
Gmail has IMAP, good. So, we can use it with our own libre app, with GPG, but first we need an account.
Making a new Gmail account is not private. Also, paying for paid Gmail is not private.
https://sh.itjust.works/comment/20802308
what about cock.li or disroot, if you don’t like getting blackholed?
Good points.
There is an advantage of using a provider that suports MTA STS. This is Strict Transport Security and forces at least transport encryption.
There is an advantage to use a provider you pay for too and at least claims not to read your email.
It is also nice if they can host your domain and have good delivery.
Edit: I meant MTA STS not SMTP STS.
Haven’t heard of MTA sts. I’ll have to research it, but it probably doesn’t change the fact that when exchanging emails with another provider, they have to work with plaintext
Google is promoting MTA-STS. MS is at least testing it and some others. Proton mail might support, check. I use NameCheap shared hosting mail. They support incoming but not outgoing.
Sure it is clear inside each org but secures between. Nice because you can secure in your org by contract. Not as good as e2ee of course.
i read the first part of google’s article about MAT-STS. it is good for secury, but does nothing to prevent providersfor reading in and out email
No but if you have a contract with a providor you pay for, those are the terms. For example Google free servicies they mine data but their paid services they do not. Sure e2ee is better but transport encryption is good.
Makes sense. I still don’t trust them though
Yes, there is that.
GPG and mailbox.org or anothet “just” email service
Makes me feel like I’m doing the best I reasonably can, even if it’s of limited effect. Also, built-in aliasing service.
This is the best reply so far. Probably not enough for me to stay, but at least not pretending it’s safer
Tuta lets you encrypt a message for the sender only, with a passphrase.
They’ll have to follow a link but still…
I have private email for two reasons: using my own domain, and to promote it in general. Sure, everyone else is on Google/MS right now, but as they continue to enshittify things, maybe more people will want to move away from that. And the more people do that now, the faster/easier it will be for others.
Note that ProtonMail actually supports automatic encryption to email accounts that publish their public keys in a Web Key Directory, which I’ve set up for mine. When you type such an email address in the To field, it’ll turn into a special color with a lock symbol.
Likewise, ProtonMail also exposed a WKD so people can send encrypted emails to ProtonMail accounts. I don’t know of any mail clients that support this though (I used the command line to pull keys)
Wow, til I learn about WKD! I used to have a key on keyservers, but hated how that was basically a spam trap and the fact that anyone could upload a key there for my own address. It was easy because I own my own domain and already have a web server there.
I set it up and tested it with help from https://www.webkeydirectory.com/
Looks like it’s being added to clients: https://wiki.gnupg.org/WKD/DistributionOfWKD
deleted by creator
deleted by creator
The thing that razorblades have real tangible consequences. I’m talking about something you can’t even verify. Sire, in principle those that claim not to do something are better, but with that logic, WhatsApp, telegram, and the Facebook messenger are perfectly valid communication platforms and all 3 claim e2ee.
SMTP relays make IP reputation a complete non-issue. As long as you aren’t sending hundreds of emails a day, there are multiple free options (free tier, subsidized by paying corporate customers who send a lot of emails).
deleted by creator
That’s a big assumption, and that kind of behavior is specifically prohibited in the privacy policy of most, if not all SMTP relay providers, as well as GDPR regulations. If you think they’re violating their own privacy policy and government regulations and doing it anyway, there’s no reason to think Proton isn’t as well, or any other email provider, so that’s kind of a non-starter argument IMO. Plus this only applies to outgoing emails, not incoming. I don’t know about you, but I send about 5-10 outgoing emails a year, there’s not much to be gleaned there. Incoming is what you’d want to protect more than anything.