Experience with and opinion on ProtonMail and co.?
Hi,
I saw that Proton now has a Family Plan that includes all of their services including mail, calendar, drive, etc.
I've been looking to detach my and my family's life a bit from the big corps like Google, Microsoft, Apple, and Proton sounds interesting.
At the same time I am wondering if they're really to be trusted any more than any other company. I found some critique of the E2E encryption being basically snake oil and not properly implemented etc. I am of course aware that there're always tradeoffs and while privacy is definitely nice, I don't need to go to an extreme degree of "no logs whatsoever, never even turning anything over to the police", I think I am just mostly looking to make me and my family less of a product of advertising, possibly AI/ML and so on, so some compromise is definitely possible.
I am curious, does anyone here have any experience with or opinions on the company and their products?
I've been using Proton's services for several years and honestly have nothing to complain about. Their threat model page may be what you're thinking of regarding E2E problems, that it's not always 100% not because of their encryption but simply because of how email works. Also, their PGP implementation website has a European Union Horizon 2020 Framework programme badge on it... Good enough for the EU, good enough for me?
I don't know, I'd rather trust a company with a reputation for explicitly trying to do better, than trust The Big Ones where privacy and security is only an implicit requirement. And especially not ones where your account can just be turned off on a whim, like what happened to the Re-Logic founder.
Oh yes, I remember seeing this as it happened. It really is a liability and their support is not very.. human.
I'm also several years into using Proton.
I've never had an issue with their email service, and I really like the web interface. I'm not a power user when it comes to email (honestly, I'd rather avoid email where I can) but Proton offers things like good filtering so that I can keep my inbox organised.
The E2E stuff is kind of a nice to have but not something I care that much for. I don't send private communications via email, and even if I did, they're not private once I've sent the email to someone using Gmail or not practicing good opsec themselves.
I make use of Proton's VPN as it made sense to bundle there's in with the email I'm already paying for. I'd like to make use of their calendar, but my primary use of calendar is a shared one with my family. They are more than happy with and do not wish to change from Google calendar, which means... I also use Google calendar :/
My primary motivation to use Proton is just as an alternative to using Google for everything. I'm happy with their service and think you get a lot for the price. I'd probably be just as happy with Tutanota or Fastmail.
I am not as satisfied with Proton as you — the web interface is okay, but their iOS app is quite bad: clicking on notifications of a new email will often fail to load it, and this bug has been present for more than a year now I believe. I also find it a bit pricey (used to use their VPN, but didn’t lengthen it for this year) for something relatively trivial like email alone.
Also, I have since grown a bit of a dislike for the company as emails are just fundamentally insecure and I feel it is a bit just security theater. But I feel the tone of my comment is overly negative, it really is not a bad product overall and does its job.
I felt the same way about using Gmail. About 3 years ago, I transitioned into Proton mail. I used it for my business emails and used it in conjunction with my own domain. I paid for a premium level that also provided cloud storage and VPN access.
It all worked very nicely for a while. I was thrilled to not share my business data with Google. And then a handful of people told me they weren't receiving my emails. Some were automatically being shuffled into their Spam folder, others just never received anything. Even emails that they initiated and that I was replying inline to werent appearing. I did some additional research and found some anecdotes from other users who claimed that some of the Big Email providers (Gmail, Yahoo) were experimenting with making it their policy to mark every email from any Proton mail as Spam due to those emails not including specific tracking information. It sounded like corporate sabotage, honestly. But still, I persisted through occasional hiccups.
Eventually the inbox delivery issues for me were growing more severe and I feared it was impacting my ability to run my business (and my income as too many clients weren't responding for my comfort level). I really wanted it to work. But after awhile, I realized my business wasn't something I wanted to play with in this way and I transitioned everything back to GSuite, or Google Workspace, or whatever it's called now which is similar pricing to the Proton suite of services minus the VPN. And although I don't like it for the data collection concerns, everyone is again replying promptly and I haven't experienced any deliverability issues since. Therefore, I concluded it wasn't an issue with thr emails from my domain specifically being tagged as Spam, but rather an issue with Proton mail itslef being mishandled by some other major providers. It may have been addressed by now. This was about 10 months ago that I stopped using them
Big tech is definitely fucking with smaller providers:
After self-hosting my email for twenty-three years I have thrown in the towel. The oligopoly has won.
Tl;dr version is big tech marks smaller servers' emails as spam automatically. They also block large swathes of IP ranges just because one IP in the block has been caught spamming.
It's also an exceptionally convenient way of forcing users to use the email services provided only by large companies.
Hmm, this is what I was afraid of, sounds rather anticompetitive.... Thanks for the insight though.
If that is indeed the case, EU certainly would be interested. I can't imagine proton mail wouldn't be aware of this problem though, so why haven't they done anything if this is true. Or at least talked about it.
You could always just buy a domain and use an mx server for your emails, it's what I do. I think it's like $30 per year or so, but I get unlimited email accounts. Way better than gmail and the mx server I route through does a great job with delivering to inbox, as they're pretty strict on no mass emails.
I had only a single incident like this and it generally works well, especially as it has become bigger over the years, but unfortunately I really can’t make this feeling go away when I wait for the recipient to respond.
If you're looking to move away from using an email services provided by the big corps, Fastmail is your best bet. Email is what they do and they're great at it. I'm using their service myself.
You're right about Protonmail. I believe they rolled their own crypto, in the browser no less, both of which is a big no-no. I don't know if that's still the case, but I remember that being the case when they first launched. But that's beside the point.
I wouldn't go so far as to say Protonmail is snakeoil, but their main selling point, privacy, is not simply not attainable with a protocol like email. Even with PGP, which is bad and notoriously hard to use, you will leak metadata and that's all that matters.
Email will never be private, nor secure, because that's not how it was designed. Whatever company you go with, it'd be best to keep this in mind.
Also, in the end, the recipient of your emails will likely be using Gmail or Outlook, so you can't really escape the big corps no matter how badly you want to. That's just a sad fact.
Yeah, have been using Fastmail for years with my own email domains. Have been very pleased with them.
Yep, I'm using it with my own domain as well. In fact, I had to deal with that whole process again yesterday because I switched my registrars. The whole process took like 10 minutes.
Yeah, their wizard process is very easy to use.
I've been using protonmail for years without issues, but have always been a little disappointed by some missing features (and just generally clunky apps). My subscription is up for renewal soon so I decided last night to try out Fastmail for a bit and see if I want to switch permanently.
Holy smokes, this is a fantastic experience. Sure, I give up the ability to send encrypted emails (which, as you point out, is only partially effective if the message metadata can't also be protected)... but honestly I've only done that once in the years I've spent with protonmail so it's not something I'm likely to actually miss. The slick (and effective!) UI/UX with Fastmail is so nice.
Switching back and forth with protonmail's interface this morning really shows me how much I've been missing. I think I'm going to stick with Fastmail for a while.
Thanks for the rec!
Glad to hear you like it! I too love the UI/UX. It reminds me of the old web, where apps were designed with functionality and usability in mind, instead of this bloated mess we have now.
I personally use their competitor, Tutanota which has been a great experience. The major differences between each platform can be found here: https://tutanota.com/protonmail/
I love that the developers of Tutanota listen to the users and implement features and prioritize them based on a ranking of how many users vote for a feature.
I had a bad experience with Tutanota when I used it around a year or two ago, because they were not following RFC 5321, and so their mail would not be delivered to domains that use greylisting for spam protection (https://en.wikipedia.org/wiki/Greylisting_(email)). I also had trouble delivering to some Office 365 domains.
to be fair office 365 has trouble delivering to office 365
I also have tutanota, used it for years. Deleted my protonmail.
Oh! I haven't heard of Tutanota before, thanks, I'll look more into them. Though I am also looking into Proton because of the comprehensive package of services, not just mail.
A big question: How used to Google/MS/Apple services is your family? ProtonMail is a viable alternative, but it's also lacking in some features that some people might care about.
I'd be rather curious to see what the claimed issue is, because I don't think I've ever read any (credible) claim the PM has issues with it's encryption.
As for myself, I've been using PM, to varying degrees, for years now (paid). For the most part, it's okay and has no issues as a basic email provider. Their dev cycles can be crazy long (compared to larger companies like Google and MS), so features that get talked about/promised might not show up for a VERY long time.
We're not particularly tied to any of those services a great deal. Feature wise, it should be okay :)
Someone has made an analysis, and PM responded.
That's not something I've considered but that's not necessarily a dealbreaker. Thanks for the insight though :)
I'm still in the process of moving everything off of Google's mail service. I started months ago but life got to me.
To be honest, I think secure email is something of a lost cause; the last time I checked end-to-end encryption on email only works if all the servers and clients involved support the same encryption schemes and adoption is very low. The exception is if you use something like PGP - which nobody does.
Besides that, most email I get these days are automated notifications and I have yet to see any of those systems enable encryption. Nowadays they don't even send you meaningful messages half the time; I get so many emails that say "You have a message! Go into our website to read it."
With that being said, I moved to Fastmail. They were highly recommended by a few people here on Tildes, They're full-featured including things like calendar and contacts syncing, and most importantly they not only have a masked email feature that generates fairly anonymous email aliases on-the-fly, but they have an integration with 1Password so I can do it automatically through them complete with a record of what site I used it on.
Oooh I like having anon emails. Use those a lot.
I already moved to proton mail so not sure if I want to move again. But their app on mobile sucks and I'll see if fastmail is slightly cheaper.
The way that I see it, you have a choice between:
Is B more likely to be secure than A? Probably not, but I'd argue they also don't have as big a target painted on their back and they have fewer avenues for an attacker to get a foothold because there's not a million things going on.
Would I ever choose to go with business A when I have a choice? Guess.
I've been a paid user of proton for a few years now and I had to report an issue with my email a while back. To their credit, I gave them permission to view my email to help diagnose as I was having trouble reproducing the issue, and their response was "We'd love to, thanks for giving us permission, but even as a tech I can't access that. We don't have any keys to your data."
So take it as you will. To be fair, that's their whole model. All my data is secure with them, no logs or access on their end.
https://www.wired.com/story/protonmail-amends-policy-after-giving-up-activists-data/
I remember this popping up a while back. TL:DR No service provider is safe place for incriminating data, which belongs solely in your meat based data storage, not the cloud.
But, assuming you and your family have no such concerns, migrating away from Google/Apple, using an encrypted open source messenger app like Signal, and using Linux wherever possible is a great idea.
Anytime you use a service that is not open source, or a service where the decisions of human beings or algorithms decide where your data goes, it really comes down to who you trust more, and I don't think anyone can actually verify the trustworthyness of the decision makers in companies like proton.
It is what it is. It sucks. I trust them more than Google, but not by too wide of a margin. At the end of the day apple's ADP encryption is something I would trust more. Because supposedly my data is encrypted on my end before it reaches their servers, and they don't have the keys.
That is kind of what I meant. It is definitely a valid concern but not really concerning us.. Like you say, anything like this should not be in the cloud, as hard as that could sometimes be.
I've used the free tier for a while, but switched to my own self-hosted email. I didn't use it for the anonymity, but for the encryption - eventually, I didn't want to put up with the app and the web interface and switched to my own encrypted SMTP server. Much happier that way.
I also get a VPS at my registrar, and I use that for hosting. Email too, very easy to set up and compatible with the regular email clients of the world. I hear if you have a google domain or transfer it over there, they offer a free tier email service for that custom domain, but don’t quote me on that
I use Posteo for a few years now, and I have zero complaints. Small company, zero ads, secure and encrypted, running on green energy, for 1€ per month.
Someone else already mentioned fastmail. I switched to https://mailbox.org/en/ two years ago as they are reasonably priced, are located in Germany (EU privacy laws and all that), are privacy minded, allow using my own domain and have been around for a while.
The only downside is that you can't set up automatic payments, instead you basically top up your credits. So you need to be mindful of that.
Did not know about the policy reversal. I’ve liked their service so far (I pay for the storage and vpn but not the family plan) I need to review this for when the renewal occurs. Will look into their competitor.
You wont find any provider that has a policy of "we will ignore a legal court order". PM had no option to comply.
At least in Switzerland, getting a court order to get this kind of personal data is harder than in most other countries. And PM at least fights these things in courts, like them winning a court case that "confirmed that email services cannot be considered telecommunications providers, and consequently are not subject to the data retention requirements imposed on telecommunications providers".
I used ProtonMail for a while and tried very hard to like it but ran into two issues:
Search capability within emails was terrible/non-existent due to messages being unencrypted just-in-time to read. This made me very concerned about moving ~20 years of messages out of gmail.No longer an issue as per ShinRamyun's commentI like the idea and wish it worked better for me, but it just wasn't something I could devote enough effort to to make viable.
Just in case anyone else sees this:
I do just about everything I can to avoid using Google services; I host my own Nextcloud instance, I use Protonmail, etc, etc. But you can create a Google account with a non-Google email address, and that way when people blindly share Google Docs with your email address, you'll actually get access to it.
I think if you infrequently interact with other Google services then that is probably a fine solution. But for a variety of reasons I am using Google Drive most days. At that point I was just making things harder for myself without really accomplishing anything. Other people with different workflows might have better luck.
Search was a problem, but they fixed that up almost two years ago. You need to activate it per browser/device because it gets stored locally but it's there.
Your second point is the bigger issue. When nobody else uses it, the encryption they offer is useless. I still have my account but moved away from being a paying customer because I only interact with two other addresses that use ProtonMail's services.
Oh that's great. Really glad to hear they fixed the search thing. But yeah, I never once emailed another person on Proton Mail so it was hard to justify all the extra hoops I was going through to not even get encryption in any meaningful way.
Now we just need search for proton calendar >_<
I switched from a legacy Google Apps account to MXRoute in an attempt to decouple from Google ever so slightly. It's more DIY than FastMail or ProtonMail, but the price is right and I have six domains and like fifty email aliases set up happily. I really didn't want to pay per-user like FastMail or ProtonMail, or per-domain like Tutanota.
The owner/admin is active and available. He's a little bit out there but is incredibly dedicated to providing a good service, so that's about all you can ask for really.
Thanks for the recommendation. I'm a paying Proton user but I only really use their email and calendar, which I'm already having issues with because of its lack of CalDAV integration. I don't care about encryption over email that much, so the lack of IMAP without the bridge is a pain without much upside. MXRoute looks to be cheaper and I'd rather just host things like CalDAV/CardDAV myself. I'll definitely be taking a closer look.
I switched from gmail/gcalendar about a year ago and everything has been okay so far. The only person that wasn't getting my emails was my title company.
The only downside to proton is that there is no way to search for calendar events. It's mindblowing to me how this feature is still missing. (it's in beta on android)
I don't use ProtonMail for business, but I'm of the opinion it's good enough for everyday communication. With my custom domains everyone I email does receive it. I'd double check if your family is using any features that are truly unique to those platforms before switching.
User for quite a few years now, largely satisfied, and it generally keeps getting better (e.g., search is Now A Thing).
Strongly appreciate the cryptographic support and privacy mindset.
I use a Protonmail address for my main email, and have had few problems.
Still can't get over the fact that they made the website much worse with their rebranding a couple years ago, doesn't really instill trust.
I used Protonmail, it was pretty nice, but as I like using apps like KMail, it was more hassle than worth with setting up bridges and the like.
So I went with Startmail instead, which so far has been pretty good and works well with my own domain.
I think their email service is quite good but their calendar application both on desktop and Android leaves a lot to be desired. Google Calendar just has so much more customization built in which makes it convenient, like built in maps and conferencing which is something I use quite regularly if I am creating an event