Of course it’s dissapointing that protonmail did this, although i wouldn’t say that the policy was changed “on a dime”, as it said that ip logging was not “on by default”[1]. But while dissapointing, i can imagine courts pressuring Proton to start ip logging since it’s easier rather than, say, change the entire backend to not encrypt the emails anymore. But to be fair i would say that if your threat model might include the government somehow, you should probably not trust any service with sensitive details like your ip. But as protonmail does what it sets out to do (encrypt your emails + some more) and as there aren’t too many alternatives exept maybe tutanota, i think i’ll stick with it. As for the VPN, it’s open source[2][3][4] (atleast the clients, I don’t know about the server), but as I don’t know how to audit code, take that with a grain of salt. And it does semi-regular(?) audits, although the last ones seem to be from 2019(?)[3] and a penetration test (or maybe it was an audit, doesnt seem like it though) from 2021[5][6]. But they said that they’re planning an audit in the next months. [7].
[2]https://github.com/ProtonVPN
[3]https://protonvpn.com/blog/open-source/
[4]https://itsfoss.com/protonvpn-open-source/
[5]https://drive.proton.me/urls/XWPWPN079G#KSgiJSoTkysU
[6]https://proton.me/community/open-source
Additional sources: https://proton.me/blog/security-audit-all-proton-apps
Please tell me if i got something wrong, i’d be happy to fix any issues
Edit: formatting issues and added back the start and the end that was removed
…Tor Browser?
Also by “injecting malicious code” do you mean XSS? Yeah, that can happen, and it’s usually not Protons fault. The emails are end-to-end encrypted and encrypted while in your inbox with public and private keys.