I've been following this on X/Twitter and I think one of the most egregious things that's important to point out is that folks from Phrack reached out to Proton in private multiple times, and Proton ghosted them. Proton only engaged with them and then reinstated the accounts after Phrack went public and their X/Twitter post went viral.
It also looks like one of the writers filed an appeal with Proton and Proton denied the appeal, so they manually investigated the incident and refused to reinstate the account and then only did after this got attention on X/Twitter.
So make no mistake about it: Proton didn't just disable the accounts after whatever CERT complained, which would have been bad enough - they also didn't do anything about it until this started getting lots of eyes on social media.
Proton does not require a shred of proof that you are a real human being either, fyi. I'm not actually attacking them for this specifically, because I feel that we need privacy focused tools, however the fact that I was able to create a few hundred proton email addresses in seconds by injecting usernames/passwords was scary, even to me. I'm surprised they aren't on spam block lists worldwide. Their captcha is child's play that a script can defeat with simple image examination. i encourage them to buff up their spam controls, just a bit, and decrease moderation by a lot unless they can promptly deal with cases such as this.
I'll go out on a limb and say it: it's an American cybersecurity agency. Proton's CEO/Proton[1] loves the current US admin. I wouldn't be surprised if they comply now and ask questions later, if at all.
1. According to the now-deleted Reddit comment from the official Proton account glazing Republicans, so I assume they were speaking on behalf of all of Proton. https://theintercept.com/2025/01/28/proton-mail-andy-yen-tru.... I have zero evidence except for the CEOs questionable public statements, but I wouldn't be surprised if Proton turned out to be the 21st century Crypto AG.
They say: "Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the size of Proton, especially since the message was sent to our legal team inbox on a Saturday, rather than through the proper customer support channels."
The true value of a company can be measured by our ability to communicate with them. If we can't communicate except after public outrage, then what does that say about the company?
Here's a genuine question: is Proton Mail the least shitty of companies that provide email services?
I self-host email and will continue until I die. But for others who need a company to do this for them, is Proton Mail the least shitty of options? Does this change the evaluation? I'm genuinely curious about the opinion of others here.
To answer your question, from my limited experience: no.
There are better or less shitty companies like Fastmail, Runbox (tried them), even Purelymail (but 1 or 2 people setup), Mailbox (shitty support, solid setup; I am a customer), Migadu (good name, I have never used them), there's Tuta (but somehow they seem off to me; like Proton they also do not allow IMAP/POP - Proton allows with some circus), MXRoute has good name at places like LET forum. There's even Zoho if you just a mail service (but then if you use Zoho then only reason to not use Google or MSFT will be cost or just the middle finger :D) … and many more.
So there are options.
PS. as per self hosting email - I can't self host my seedbox properly on a VPS, I don't think I should even try email :)
I self hosted for 20 years, worked flawlessly, gave up because of security concerns. I would like to go back to it.
Question: How do you manage the security on such a box? Is there any simplification I missed?
I couldn’t keep up with it. So many patches, unrelated to mail, broke something in the stack, bringing the server into a critical state. Often, I had to lock down everything before going up again, consuming a day’s effort or two. These were two days without mail.
Proton dropped from the top spot on my list of “user-first email platforms” when they announced they’ll be deleting accounts that haven’t logged into their service in some arbitrary amount of time. If I can’t rely on my email / messaging / phone / communications provider to keep an open line for as long as I need it – whether that’s one year or two years or twenty years, then I’m not going to use it. And if they require payment in exchange for providing that service, then it better accept privacy-preserving payment, but even then, I’m probably not going to use it.
Proton had a great thing going where their VPN service and business service funded the cost of maintaining free accounts. The fact that they chose to destroy years of trust by announcing a deletion policy, indicated to me that they no longer care about their users more than they care about running a business.
I’m not even asking for something unreasonable. It’d be one thing if they didn’t want to maintain free accounts with no activity but hundreds of gigabytes of storage. But they haven’t stratified the limit by storage usage. If you’ve got a free account consuming a few megabytes of storage, maybe an email you setup for the government service you interact with every few years… well you better make sure you remember to do the arbitrary chore of logging into that account every year, or Proton will just delete it, no questions asked.
Maybe they’ll send you some reminders if you gave them a “recovery” email, but that defeats the point of signing up to a privacy-preserving email service and calls into question the premise that they even are one.
(In related news, I need to text myself on Google Voice every few months or they’re gonna delete the number I use for 2FA on critical services… and this is an account that has $4 of credit loaded into it from ten years ago…)
> Proton dropped from the top spot on my list of “user-first email platforms” when they announced they’ll be deleting accounts that haven’t logged into their service in some arbitrary amount of time.
... for free accounts only, after 12-24 months of not having logged in at all.
> And if they require payment in exchange for providing that service, then it better accept privacy-preserving payment, but even then, I’m probably not going to use it.
They allow you to physically send in cash.
> I’m not even asking for something unreasonable
I don't disagree in principle, but the way you're asking for these things does in fact make you come across as an unreasonable customer.
I've had multiple proton accounts and can vouch for (pure anecdote of course) two of those working fine despite me forgetting to use them completely for at least four years. So not sure how true what you say is. These are both free accounts btw.
The amount of hate that Proton gets here for the above still ambiguous situation (and in many other comment threads) is bizarre and oddly hive-minded.. The company is far from perfect but compared to the overtly parasitical openly done deep scanning of your email content and utter disregard for any responsiveness to user complaints from any major American tech company's email service, Proton is positively saintly by comparison. Id' suggest growing and regularly watering a bit of perspective.
EDIT: I see a number of comments about Proton's "jankiness" and service unreliability here too. I haven't experienced any of that either on desktop or mobile.
No, Proton did not knowingly block journalists’ email accounts. Our support for journalists and those working in the public interest has been demonstrated time and again through actions, not just words.
In this case, we were alerted by a CERT that certain accounts were being misused by hackers in violation of Proton’s Terms of Service. This led to a cluster of accounts being disabled.
Because of our zero-access architecture, we cannot see the content of accounts and therefore cannot always know when anti-abuse measures may inadvertently affect legitimate activism.
Our team has reviewed these cases individually to determine if any can be restored. We have now reinstated 2 accounts, but there are other accounts we cannot reinstate due to clear ToS violations.
Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the size of Proton, especially since the message was sent to our legal team inbox on a Saturday, rather than through the proper customer support channels.
The situation has unfortunately been blown out of proportion without giving us a fair chance to respond to the initial outreach.
This makes the situation even worse for me. CERTs lack any legal authority to compel action or enforce compliance. Without a thorough and fast post mortem analysis, this incident is deeply concerning for anyone who relies on Proton as their primary email provider. I guess getting trigger happy just comes as soon as you get a bigger user base but that's exactly when you get caught slipping. Like they did with the false positives it honestly reads like:
"We have good relationships and trust this CERT so we carpet bombed all accounts they send us without even looking at them."
I wonder what would have happened to accounts or users without the reach on socials.
I don't follow. They can't tell if their terms of service have been violated so they took CERT's word for it? How did they decide to restore two accounts then?
I've need a paying subscriber to Proton since 2018, but I recently canceled my subscription (which ends in November). I just got fed up with the constant bugginess and jankiness of their offerings.
Any suggestions for mail hosting and VPN? I hear good things about Fastmail and mailbox.org (I see they very recently rebranded to just mailbox and revamped their offering).
Also, I've been a heavy user of the SimpleLogin alias service. Any suggestions for easily porting all those accounts to a new provider? Manually changing each and every account to a new email seems painful.
Fastmail is fine. It's somewhat limited in its UX, but technically speaking, everything works, and it's snappy. Very few outages. I really like their integrations with calendars, contacts, and mail for 3rd party sites/services. Not a ton of features or deals re: custom domains or multiple users, but it's fine if it's just for yourself. edit They literally -JUST- turned on Offline support for their app and web interface, so my only real complaint is gone. Go with Fastmail.
For a VPN, what do you need it to do? For tinfoil hat privacy stuff, get a VPS in Estonia or something. If you just want a secure tunnel while working remote, get a WiFi access point with Wireguard and Dynamic DNS at your home (it's free plus you probably have more bandwidth).
I moved from Proton to Fastmail (and Mullvad for VPN).
I was a a founding paying member of Proton Mail. I loved them and evangelised them for years. But after a decade, the quality of the offering, especially the mail and calendar, is almost a joke, and the company seems very distracted chasing the next big thing (the half baked password manager being one).
Comparing Fastmail’s UI and feature set with Proton, you quickly realise they are leagues apart.
And no Fastmail doesn’t provide e2e encryption. For that I use Signal, and for the few occasions where I need e2e encryption in email, I use PGP.
My only wish is that there was more client support for JMAP protocol. Even thunderbird doesn’t support it, and I can’t go back to IMAP because I like labels. Thankfully Fastmail’s own web interface is so good it is not a big issue.
I'm using Fastmail and Mullvad. Both seem to work pretty well and are reasonably priced. You could also host your own on VPSs if you're feeling adventurous.
My experience is the apps are missing very fundamental features. Which would be fine... If you could use other clients. But you can't, except for email, kind of.
Like, the calendar on mobile doesnt even have a search function. What if I want to know when an event is happening? I just have to scroll and scroll until I find it? Come on now. Also no storage backup in proton drive??? What??? That's, like, 90% of the purpose of proton drive!
Fastmail is a good product with technical chops, contributes to open source and cares generally about being good members of the international email space, standards etc.
Fastmails interface is very plain, and it works very fast and works well.
They support a plethora of ways to do mail and have many advanced users so their mail support is very good, maybe close to running your own mail server without having to deal with rbls and getting spamlisted
I've been on Zoho for my (and my partner's) email for 4+ years and it has been great. Chose them because there is no per-domain charge, so I have like 12 domains on it.
The configurability is extensive in both web app and ios email app. Service has been fast and stable. They rarely change anything in the UI (no random tinkering is what I mean) so it is predictable and easy to use.
For mail hosting, take a look at Posteo.de (no custom domains though), mailbox.org, runbox.com, mailfence, migadu, and cranemail. All these are cheaper and a lot more affordable than something like Fastmail. All of them support IMAP, using which you can move your email elsewhere (or easily backup/have local copies).
I am a Fastmail customer. Absolutely horrible customer support but pretty solid email. Do not even think about using the "suit" they offer alongside email.
The rebranding and "revamp" is limited to the logo and colour changes :D everything under the hood is still the same good old OX inferiority. Hell, you may never want to use their webmail either (my 99.9999% mail usage is via IMAP clients). They are fine other than that.
Fastmail is pretty good if their price and offerings are not an overkill for you. You should check Runbox as well - really good.
Simple Login alt: addy.io? Fastmail and Mailbox (auto-deletes in 30 days unless you "touch" it :D) also have disposable email as part of email offerings. Don't know about Runbox.
Similar case, I recently migrated from @mozmail to SimpleLogin and wondered if I made the right choice.
I heard using your own domains solves the migration issue but that makes your email pretty identifiable just by looking at your domain.
I wonder whats a suitable replacement candidate after Mozmail and Simple Login? One of the reasons I migrated away from Mozmail to Simple Login was that you can't initiate a email sending, which made it difficult to contact support if needed. Plus Mozmail are on Amazon SES.
Fastmail has an open source API they call jmap. You could probably find or write something that could help convert to the fastmail masked email. I was able to setup an integration with a local llm to read my email and act on it in about an hour.
I like fastmail they seem to have a move slow and don't break things mentality that I like from my email.
I use Fastmail and I’m mostly happy with it. Their design team is thoughtless so their web and mobile offerings are disappointing. The mail hosting itself seems to be excellent though.
Can proton even win here? The obvious solution would be "we don't take down unless there's a court order", but then you'd get exposé pieces saying how protonmail is a den for drug dealers/pedophiles/doxxers/cyber criminals.
> The obvious solution would be "we don't take down unless there's a court order", but then you'd get exposé pieces saying how protonmail is a den for drug dealers/pedophiles/doxxers/cyber criminals
I think it'd be crazy to make a service worse because of worry over potential hit pieces that might whine about a perfectly reasonable policy. It isn't as if Proton Mail hasn't been accused of those things before anyway (along with accusations of being a honeypot and not private enough).
It's better to have integrity and fight for your users than to cave just to avoid click bait articles by people with irrational views.
PSA: Proton deletes “unused” accounts after one year, and defines unused in some opaque sense where receiving but not sending emails is “unused” so I’m in a nasty position of my iCloud account being unrecoverable. Going to have to spend nontrivial time off boarding my account.
> defines unused in some opaque sense where receiving but not sending emails is “unused”
"You are considered active if you log in and use our services once a year. Simply logging in to any Proton service on our web, desktop, or mobile apps at least once a year is enough."
Do they still use that old shady billing? You could get "credits" from coupon to upgrade your plan, and once it ends, it automatically subscribes and your account bill goes to negative. Unless you pay that, your account is locked. Happened to me some long time ago and haven't used Proton since.
Ladar Levison and Lavabit certainly earned themselves credibility there a dozen years or so back.
Sadly https://lavabit.com/ currently just says "We are not accepting new users at this time. Mail services remain online, while we work on improving our website code. "
And this is why I host my own email server, even if I am not a journalist investigating governments or anything of the sort. It's a matter of control over my computing.
not all heroes wear capes, much less releases personal AI assistant to navigate your own data while the MAIL CLIENT AND CALENDAR APP is on beta on Linux for YEARS
So, is this a case where Random Cybersecurity/Tech Group mistakes responsible disclosure for hacking, and then reported it to Proton, which took their word for it and disabled the account?
As far as I can remember, you don't even get IMAP access on the Proton free tier. For me, that's a non-starter. The privacy claims are also mostly marketing, as it is basically impossible to verify what Proton actually does when approached by a three-letter agency. I wouldn't use email anyway if I had something to hide, the email protocol wasn't designed with secrecy of communications in mind. For that, Signal seems far better, or perhaps a self-hosted, encrypted Matrix room.
It's because the journalists were covering the professor-student rape scandal at UIUC Champaign that was covered up by Champaign and other governing bodies.
You can disable an account without knowing who owns it, although they do have credit card/payment information now, and I don't think new accounts get encryption services unless they pay.
That said, if your inbox is encrypted, protonmail does so on the client side with a second password. They can maybe delete the account, but proton mail doesn't know what the encrypted data is. What happens to new emails sent to a disabled address is anyone's guess though. Honestly I think they're doing the best they can given the circumstances
>But last month, Proton disabled email accounts belonging to journalists reporting on security breaches of various South Korean government computer systems following a complaint by an unspecified cybersecurity agency
Last time I checked, hacking was still a crime in most jurisdictions - even if the target is considered a geopolitical adversary. This sort of activity is also against the Proton ToS. Once KrCERT and Proton were alerted to this activity, they would have been legally obligated to act.
That's not to say I feel any sympathy to the target - who by all counts has done a fair bit of damage. But this sort of hacktivism / vigilantism simply isn't helpful. There's a high likelihood that one or more nation states / law enforcement agencies may have had active operations directed against this threat actor derailed by such activity.
tl;dr - If you're going to conduct such activities, practice proper OPSEC. And don't let your desire for attention / recognition take priority over staying on the right side of the law.
I'm worried and surprised to see the many comments here that, contrary to what I'm used to reading here, nobody seems to have dug deeper, looked critically at the evidence. Quite a lot of just ad hominem and insinuations.
This looks like brigading to me. Which is the only way for govs to fight against protonmail: spreading doubt.
Hence I am reinforced to continue being a strong supporter of Proton.
Hmm going to wait and see how this plays out, maybe it's time to look at alternatives, assuming that my custom domain email isn't somehow locked to them.
From the Proton/X discussion in the Intercept article
"Big Tech CEOs are tripping over themselves to kiss the ring precisely because Trump represents an unprecedented challenge to their monopolistic dominance.”
They don't know how this is going, from what I see Trump threatens something not to change something, but to get something. If there is any anti-trust drive it's there to shake the tree, not to break up big tech. Trump loves big US corporations, like those in the 50s and 60s, those pre-Bell-breakup.
Side note regarding proton that it seems that people are mentioning the fact that ip is being tracked with user creation in proton mail?
So if someone downloads proton vpn and uses it that way, then I always considered it to be the best vpn (even better than mullvad) but I guess I was wrong...
I would still use protonvpn but I will try to migrate towards quite frankly more services from now on.. Email should just be a way to discuss what should be your matrix account or xmpp or even signal...
Another thing that I want to point out is that I had once went into network permissions etc. in proton docs and tried to write a comment and write stuff etc. and I am not sure about the writing stuff but although these do feel "encrypted" but I saw a thing in the api response when I did curl or something which showed logs so I assumed proton keeps logs..
Another problem I feel is that since proton is only encrypted via your password which you enter into the system and it seems that you can change the password if you have something like phone verification. Fundamentally something like this can only work if they have the keys, so they are having the keys to your encrypted account.
I am sure that there are ways of adding your own private key too but how many people using proton are doing that?
Fundamentally, this is how the stack will work or has to work imo. You are trusting them because of lack of conflicts. They have built their name on privacy and so everyone will leave if it they are less private but the thing is, is that they might be using some open source tech that might have an update that couldn't be audited or somehow get hacked themselves and since proton might have some juicy targets like journalists. People's lives may be on the cutting edge.
I heard this somewhere that I wish to share, you want technologically private solutions not because you don't trust someone but rather that it should remove the need of trusting in the first place. Proton hasn't / can't reach it imo.
I don't mean any hate towards proton but that was my understanding. I still use it and in fact Please let me know if I caught something wrong or what I am saying is correct. My purpose is not to spread misinformation but rather inform my opinions/correct them if I am wrong.. (I may be wrong, I usually am [my most loved line from the book how to win friends and influence people])
I feel as if we need to get things like pi etc. or whatever and atleast to me hosting something like matrix seems okay-ish I am not sure. Email just doesn't feel as if a good protocol for privacy.
fivefives55555|5 months ago
It also looks like one of the writers filed an appeal with Proton and Proton denied the appeal, so they manually investigated the incident and refused to reinstate the account and then only did after this got attention on X/Twitter.
So make no mistake about it: Proton didn't just disable the accounts after whatever CERT complained, which would have been bad enough - they also didn't do anything about it until this started getting lots of eyes on social media.
eek2121|5 months ago
overfeed|5 months ago
1. According to the now-deleted Reddit comment from the official Proton account glazing Republicans, so I assume they were speaking on behalf of all of Proton. https://theintercept.com/2025/01/28/proton-mail-andy-yen-tru.... I have zero evidence except for the CEOs questionable public statements, but I wouldn't be surprised if Proton turned out to be the 21st century Crypto AG.
a0123|5 months ago
baxtr|5 months ago
j-bos|5 months ago
According to Proton's response in the linked reddit post: https://news.ycombinator.com/item?id=45227356
They say: "Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the size of Proton, especially since the message was sent to our legal team inbox on a Saturday, rather than through the proper customer support channels."
johnklos|5 months ago
Here's a genuine question: is Proton Mail the least shitty of companies that provide email services?
I self-host email and will continue until I die. But for others who need a company to do this for them, is Proton Mail the least shitty of options? Does this change the evaluation? I'm genuinely curious about the opinion of others here.
crossroadsguy|5 months ago
There are better or less shitty companies like Fastmail, Runbox (tried them), even Purelymail (but 1 or 2 people setup), Mailbox (shitty support, solid setup; I am a customer), Migadu (good name, I have never used them), there's Tuta (but somehow they seem off to me; like Proton they also do not allow IMAP/POP - Proton allows with some circus), MXRoute has good name at places like LET forum. There's even Zoho if you just a mail service (but then if you use Zoho then only reason to not use Google or MSFT will be cost or just the middle finger :D) … and many more.
So there are options.
PS. as per self hosting email - I can't self host my seedbox properly on a VPS, I don't think I should even try email :)
traceroute66|5 months ago
True, but sadly too many people don't care.
Look at how many people will happily throw $$$ per month at Claude when it is basically absolutely impossible to contact a human being at Antrhopic.
> is Proton Mail the least shitty of companies that provide email services?
Tutanota could be worth a look.
gond|5 months ago
Question: How do you manage the security on such a box? Is there any simplification I missed?
I couldn’t keep up with it. So many patches, unrelated to mail, broke something in the stack, bringing the server into a critical state. Often, I had to lock down everything before going up again, consuming a day’s effort or two. These were two days without mail.
jegp|5 months ago
dbpcut|5 months ago
[deleted]
chatmasta|5 months ago
Proton had a great thing going where their VPN service and business service funded the cost of maintaining free accounts. The fact that they chose to destroy years of trust by announcing a deletion policy, indicated to me that they no longer care about their users more than they care about running a business.
I’m not even asking for something unreasonable. It’d be one thing if they didn’t want to maintain free accounts with no activity but hundreds of gigabytes of storage. But they haven’t stratified the limit by storage usage. If you’ve got a free account consuming a few megabytes of storage, maybe an email you setup for the government service you interact with every few years… well you better make sure you remember to do the arbitrary chore of logging into that account every year, or Proton will just delete it, no questions asked.
Maybe they’ll send you some reminders if you gave them a “recovery” email, but that defeats the point of signing up to a privacy-preserving email service and calls into question the premise that they even are one.
(In related news, I need to text myself on Google Voice every few months or they’re gonna delete the number I use for 2FA on critical services… and this is an account that has $4 of credit loaded into it from ten years ago…)
nullhole|5 months ago
One year, to be exact: https://proton.me/support/inactive-accounts
neobrain|5 months ago
... for free accounts only, after 12-24 months of not having logged in at all.
> And if they require payment in exchange for providing that service, then it better accept privacy-preserving payment, but even then, I’m probably not going to use it.
They allow you to physically send in cash.
> I’m not even asking for something unreasonable
I don't disagree in principle, but the way you're asking for these things does in fact make you come across as an unreasonable customer.
southernplaces7|5 months ago
The amount of hate that Proton gets here for the above still ambiguous situation (and in many other comment threads) is bizarre and oddly hive-minded.. The company is far from perfect but compared to the overtly parasitical openly done deep scanning of your email content and utter disregard for any responsiveness to user complaints from any major American tech company's email service, Proton is positively saintly by comparison. Id' suggest growing and regularly watering a bit of perspective.
EDIT: I see a number of comments about Proton's "jankiness" and service unreliability here too. I haven't experienced any of that either on desktop or mobile.
l___l|5 months ago
illiac786|5 months ago
mightysashiman|5 months ago
0-_-0|5 months ago
Hi everyone,
No, Proton did not knowingly block journalists’ email accounts. Our support for journalists and those working in the public interest has been demonstrated time and again through actions, not just words.
In this case, we were alerted by a CERT that certain accounts were being misused by hackers in violation of Proton’s Terms of Service. This led to a cluster of accounts being disabled.
Because of our zero-access architecture, we cannot see the content of accounts and therefore cannot always know when anti-abuse measures may inadvertently affect legitimate activism.
Our team has reviewed these cases individually to determine if any can be restored. We have now reinstated 2 accounts, but there are other accounts we cannot reinstate due to clear ToS violations.
Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the size of Proton, especially since the message was sent to our legal team inbox on a Saturday, rather than through the proper customer support channels.
The situation has unfortunately been blown out of proportion without giving us a fair chance to respond to the initial outreach.
Thank you for your understanding, The Proton Team
BoredPositron|5 months ago
"We have good relationships and trust this CERT so we carpet bombed all accounts they send us without even looking at them."
I wonder what would have happened to accounts or users without the reach on socials.
IshKebab|5 months ago
unknown|5 months ago
[deleted]
nsagent|5 months ago
Any suggestions for mail hosting and VPN? I hear good things about Fastmail and mailbox.org (I see they very recently rebranded to just mailbox and revamped their offering).
Also, I've been a heavy user of the SimpleLogin alias service. Any suggestions for easily porting all those accounts to a new provider? Manually changing each and every account to a new email seems painful.
0xbadcafebee|5 months ago
For a VPN, what do you need it to do? For tinfoil hat privacy stuff, get a VPS in Estonia or something. If you just want a secure tunnel while working remote, get a WiFi access point with Wireguard and Dynamic DNS at your home (it's free plus you probably have more bandwidth).
aryonoco|5 months ago
I was a a founding paying member of Proton Mail. I loved them and evangelised them for years. But after a decade, the quality of the offering, especially the mail and calendar, is almost a joke, and the company seems very distracted chasing the next big thing (the half baked password manager being one).
Comparing Fastmail’s UI and feature set with Proton, you quickly realise they are leagues apart.
And no Fastmail doesn’t provide e2e encryption. For that I use Signal, and for the few occasions where I need e2e encryption in email, I use PGP.
My only wish is that there was more client support for JMAP protocol. Even thunderbird doesn’t support it, and I can’t go back to IMAP because I like labels. Thankfully Fastmail’s own web interface is so good it is not a big issue.
GCUMstlyHarmls|5 months ago
https://userforum-en.mailbox.org/topic/anti-spoofing-for-cus...
idle_zealot|5 months ago
const_cast|5 months ago
Like, the calendar on mobile doesnt even have a search function. What if I want to know when an event is happening? I just have to scroll and scroll until I find it? Come on now. Also no storage backup in proton drive??? What??? That's, like, 90% of the purpose of proton drive!
esseph|5 months ago
This is something I had not heard (also have been a paying user for a very long time).
I've never encountered a bug, to my knowledge. I did dislike that when they released photo storage they didn't have a proper search feature.
calvinmorrison|5 months ago
Fastmails interface is very plain, and it works very fast and works well.
They support a plethora of ways to do mail and have many advanced users so their mail support is very good, maybe close to running your own mail server without having to deal with rbls and getting spamlisted
Modified3019|5 months ago
That said, because I’ve not experienced any failure, I’ve not experienced how well Fastmail handles failure, which is the real measure of a company.
cscharenberg|5 months ago
The configurability is extensive in both web app and ios email app. Service has been fast and stable. They rarely change anything in the UI (no random tinkering is what I mean) so it is predictable and easy to use.
newscracker|5 months ago
crossroadsguy|5 months ago
The rebranding and "revamp" is limited to the logo and colour changes :D everything under the hood is still the same good old OX inferiority. Hell, you may never want to use their webmail either (my 99.9999% mail usage is via IMAP clients). They are fine other than that.
Fastmail is pretty good if their price and offerings are not an overkill for you. You should check Runbox as well - really good.
Simple Login alt: addy.io? Fastmail and Mailbox (auto-deletes in 30 days unless you "touch" it :D) also have disposable email as part of email offerings. Don't know about Runbox.
dunefox|5 months ago
8cvor6j844qw_d6|5 months ago
I heard using your own domains solves the migration issue but that makes your email pretty identifiable just by looking at your domain.
I wonder whats a suitable replacement candidate after Mozmail and Simple Login? One of the reasons I migrated away from Mozmail to Simple Login was that you can't initiate a email sending, which made it difficult to contact support if needed. Plus Mozmail are on Amazon SES.
citizenpaul|5 months ago
I like fastmail they seem to have a move slow and don't break things mentality that I like from my email.
DanOpcode|5 months ago
2cents5ewe27366|5 months ago
mulmen|5 months ago
gruez|5 months ago
autoexec|5 months ago
I think it'd be crazy to make a service worse because of worry over potential hit pieces that might whine about a perfectly reasonable policy. It isn't as if Proton Mail hasn't been accused of those things before anyway (along with accusations of being a honeypot and not private enough).
It's better to have integrity and fight for your users than to cave just to avoid click bait articles by people with irrational views.
vorpalhex|5 months ago
Most CERT requests are valid and good and should be obliged.. but there should be a manual check involved.
Especially when an appeal is filed. Especially when the content is obviously security reporting.
Both extremes are wrong - don't ignore CERTs and don't mindlessly oblige them. Find one of the many reasonable middlegrounds.
a0123|5 months ago
They currently do cooperate and they go get the odd bad press about this.
So doing what they actually claim to do would change nothing. Their current stance is just a cop out.
unknown|5 months ago
[deleted]
bix6|5 months ago
I’d like more details about the initial CERT contact if anyone knows anything
antonymoose|5 months ago
coppsilgold|5 months ago
"You are considered active if you log in and use our services once a year. Simply logging in to any Proton service on our web, desktop, or mobile apps at least once a year is enough."
<https://proton.me/support/inactive-accounts>
nicce|5 months ago
NullPrefix|5 months ago
BrandoElFollito|5 months ago
While I like the idea of a safe and uncompromising service, proton seems less so now.
bigiain|5 months ago
Sadly https://lavabit.com/ currently just says "We are not accepting new users at this time. Mail services remain online, while we work on improving our website code. "
rvnx|5 months ago
If this would be the case they would not be approved by any payment providers at all.
On top of that, add the possibility that hosting companies and upstream network peers would shut them down.
Hizonner|5 months ago
You do know what law required Proton to act as it did at each step in the story, right? You wouldn't just come up with random non-sequiturs, right?
drnick1|5 months ago
abnercoimbre|5 months ago
segmondy|5 months ago
sitzkrieg|5 months ago
lo_zamoyski|5 months ago
daft_pink|5 months ago
luqtas|5 months ago
IncreasePosts|5 months ago
drnick1|5 months ago
pagansRpedos|5 months ago
bigiain|5 months ago
That's not what Phrak says here: https://phrack.org/issues/72/7_md
Where they say "Proton was used only for email and only to communicate with South Korea"
SilverElfin|5 months ago
guywithahat|5 months ago
That said, if your inbox is encrypted, protonmail does so on the client side with a second password. They can maybe delete the account, but proton mail doesn't know what the encrypted data is. What happens to new emails sent to a disabled address is anyone's guess though. Honestly I think they're doing the best they can given the circumstances
gruez|5 months ago
>But last month, Proton disabled email accounts belonging to journalists reporting on security breaches of various South Korean government computer systems following a complaint by an unspecified cybersecurity agency
mr90210|5 months ago
Soon or later we will default to analog means. It’s not looking good.
0xbadc0de5|5 months ago
That's not to say I feel any sympathy to the target - who by all counts has done a fair bit of damage. But this sort of hacktivism / vigilantism simply isn't helpful. There's a high likelihood that one or more nation states / law enforcement agencies may have had active operations directed against this threat actor derailed by such activity.
tl;dr - If you're going to conduct such activities, practice proper OPSEC. And don't let your desire for attention / recognition take priority over staying on the right side of the law.
Ey7NFZ3P0nzAe|5 months ago
This looks like brigading to me. Which is the only way for govs to fight against protonmail: spreading doubt.
Hence I am reinforced to continue being a strong supporter of Proton.
shauntest12321|5 months ago
ChrisArchitect|5 months ago
unknown|5 months ago
[deleted]
dotnet00|5 months ago
WarOnPrivacy|5 months ago
KingOfCoders|5 months ago
"Big Tech CEOs are tripping over themselves to kiss the ring precisely because Trump represents an unprecedented challenge to their monopolistic dominance.”
They don't know how this is going, from what I see Trump threatens something not to change something, but to get something. If there is any anti-trust drive it's there to shake the tree, not to break up big tech. Trump loves big US corporations, like those in the 50s and 60s, those pre-Bell-breakup.
demarq|5 months ago
Just a warning
yieldcrv|5 months ago
Imustaskforhelp|5 months ago
So if someone downloads proton vpn and uses it that way, then I always considered it to be the best vpn (even better than mullvad) but I guess I was wrong...
I would still use protonvpn but I will try to migrate towards quite frankly more services from now on.. Email should just be a way to discuss what should be your matrix account or xmpp or even signal...
Another thing that I want to point out is that I had once went into network permissions etc. in proton docs and tried to write a comment and write stuff etc. and I am not sure about the writing stuff but although these do feel "encrypted" but I saw a thing in the api response when I did curl or something which showed logs so I assumed proton keeps logs..
Another problem I feel is that since proton is only encrypted via your password which you enter into the system and it seems that you can change the password if you have something like phone verification. Fundamentally something like this can only work if they have the keys, so they are having the keys to your encrypted account. I am sure that there are ways of adding your own private key too but how many people using proton are doing that?
Fundamentally, this is how the stack will work or has to work imo. You are trusting them because of lack of conflicts. They have built their name on privacy and so everyone will leave if it they are less private but the thing is, is that they might be using some open source tech that might have an update that couldn't be audited or somehow get hacked themselves and since proton might have some juicy targets like journalists. People's lives may be on the cutting edge.
I heard this somewhere that I wish to share, you want technologically private solutions not because you don't trust someone but rather that it should remove the need of trusting in the first place. Proton hasn't / can't reach it imo.
I don't mean any hate towards proton but that was my understanding. I still use it and in fact Please let me know if I caught something wrong or what I am saying is correct. My purpose is not to spread misinformation but rather inform my opinions/correct them if I am wrong.. (I may be wrong, I usually am [my most loved line from the book how to win friends and influence people])
I feel as if we need to get things like pi etc. or whatever and atleast to me hosting something like matrix seems okay-ish I am not sure. Email just doesn't feel as if a good protocol for privacy.