This is a silly thing to take issue with. I use a password manager. When I need a new password I allow the manager to generate one for me. Is the password inherently insecure or bad because it was generated by "a company" and not myself? Proton generates your key for you, just like a password manager does, and they've integrated that functionality into their service for ease of use, and probably ease of administration as well. There is no way someone can screw it up and not be able to read their emails if Proton handles it.
Encrypting email is extremely niche in the first place, the fact that Proton can enable it quickly and seamlessly for users with no prior knowledge on how this all works is a good thing imo. Everyone with just enough knowledge to think they know better seems to get annoyed by this type of thing and starts spreading ridiculous FUD even while Proton is enabling encrypted email for millions of people who otherwise would be using Google Mail. Don't get so caught up in the details that you miss the big picture of what Proton is actually providing.
Right, but what the author is trying to implement is what is generally considered best practice for secure email.
You’re right that what Proton are doing is a compromise that’s reasonable for most people, but the author here is annoyed that there’s no way to turn it off so he can implement best practice E2EE himself.
Ironically he could probably do that with the vast majority of providers that aren’t Proton, so to me it seems like a totally reasonable ask that a self described privacy focused email provider has some way to allow you to implement best practice email security.
I'm on the fence about this since how would proton verify that "best practices" were followed? They are a privacy focused product and a feature like that could be used to decrease their services privacy. This author would likely implement best practices and many other likely would too, but say a competitor wanted to prove that their product was more secure, a feature like that could enable a competitor to showcase a security "flaw". And since headlines are all people read these days it would be damaging.
The feature the author described would be great but ProtonMail would need to make it fool-proof and temper-proof which requires a lot of Dev time and effort. I'm still waiting on proton bridge to work with calendar and contacts. Or contacts birthdays to show up in my calendar.
Like I said, its a good feature, but its likely a large ask for a niche group of customers.
Proton offers a service where they hide all your messages for you, but in a way they can't even see. This person is complaining that they can't hide their messages from proton in a different way that they're likely to screw up.
Yeah I have done that a few times but your assuming I am not a lazy person it is just not worth the extra steps. Not to mention privacy wise that isn't a very good idea. Especially if the email contains some confidential/sensitive information.
I was thinking it would be cool to have a native one button fix my grammar. Or maybe a spell check like interface that I can just select text and pick alternative phrases.
There would still be privacy issues that may not be acceptable for a privacy based company like Proton Mail but it could be something like this AI will never remember or save the data it is analysing.
It was hardly a scandal. They complied with their local laws, as would be expected. They’re very well-known to be a swiss company. Complying with swiss law shouldn’t be a surprise.
A more fair criticism would be that, after this event they changed the precise wording in their marketing (and maybe tos?) to more accurately reflect what they could offer.
The scandal didn't lie in following court orders, it lied in the marketing and the fact that the French ToS lacked any nuance to indicate that it would even be a possibility that ip would be logged.
Furthermore, even when dealt with court orders, other companies that don't tout privacy to be one of their core values, have chosen to fight such orders in court.
Proton could've at least tried to show that they were putting their money where their mouth is, by challenging the order.
Yup, this is the worst thing about ProtonMail. They must patch this. Not being able to use my own GPG encryption when needed is crazy for a private & secure service.
The point being made is that that means you must trust them with your private key, and you can't have say two private keys - one for low security content they store, and one for more sensitive stuff where the key stays on hardware under your control.
I'm sure they do, but this feels like 1% of 1% of users. To trash an email client that will be vastly superior to most for a ridiculously niche case even amongst nerds is a bit weird.