0

I am quite happy with, indeed grateful for, protonmail. There is one point I'd like to understand better regarding end-to-end encryption. I asked this twice at protonmail.com, and twice it was removed by the moderator. I hope someone here can answer.

I infer that an outgoing message is transmitted via https to the protonmail server where it is pgp-encrypted and the plaintext discarded; the reverse for incoming messages. Is this basically correct?

If so, then "end-to-end encryption" doesn't mean quite what I thought, and I would like to know a little more about how the plaintext is handled by the server.

I don't distrust protonmail. I understand that if I felt the need I could download public and private keys and encrypt locally, but then I might as well use gmail.

Improve this question
9
  • "I infer that an outgoing message is transmitted via https to the protonmail server where it is pgp-encrypted and the plaintext discarded; the reverse for incoming messages. Is this basically correct?" - what is the setup you are talking about? Access to the mailbox via IMAP and SMTP or access by using the web interface or by using the mobile app?
    – Steffen Ullrich
    Oct 21, 2019 at 15:56
  • I use web interface, but I'd be interested in information about the others too
    – vincent
    Oct 21, 2019 at 16:20
  • 2
    @vincent the user interface pgp encrypt your message and then send it to protonmail, not the other way around ;) the encryption is happening on the client
    – Xavier59
    Oct 21, 2019 at 16:41
  • @vincent: it is clearly documented that "Data is encrypted on the client side using an encryption key that we do not have access to.". This contradicts your assumption that "message is transmitted via https to the protonmail server" (since the server would have access to the encryption key in this case). And even the image there shows clearly that the message is encrypted with the public key of the recipient before entering the server.
    – Steffen Ullrich
    Oct 21, 2019 at 16:45
  • 2
    vincent, ProtonMail uses OpenPGP.js to do all client-side cryptography using javascript running in the user's web browser. See protonmail.com/blog/openpgpjs-3-release.
    – mti2935
    Oct 21, 2019 at 17:19

2 Answers 2

Reset to default
1

Server never receives plain text, which is very easy to verify. Log int to your protonmail and observe all communication which browser does with server. at some stage you will see message like that

{ 
   "Message":{ 
      "ToList":[ ...],
      "CCList":[ ...],
      "BCCList":[...],
      "Subject":"test",
      "Unread":0,
      "MIMEType":"text/html",
      "Flags":0,
      "Sender":{...  },
      "AddressID":"pzS3cXCi2Aky0EgfL89rRoI6W2t1RyhlMiIP6_4lVQCtRA4f2yj6ULUB7bJ9KAvoW6Ql1plW1sBtgf1XKZryXQ==",
      "Body":"-----BEGIN PGP MESSAGE-----\r\nVersion: OpenPGP.js v4.6.2\r\nComment: https://openpgpjs.org\r\n\r\nwcBMA+jYaqQbPJMUAQf+PsXHCJBAW44WqhzMWXjH0iwgDoCIstEmlm66OLZX\r\nCBHNtnLRR1lKxUiXyJNu3lHg3Z6XonawnHbM8vlDG7F6h/Iam7VujbeXjh3d\r\ndr9IdpRzE0ONA9vET04+qDCR+49ESG3tXI94qFYqh36BHi81+ro426JVz8Z4\r\nPoxu6PRpZWMvtYikDOayM25fQooDVH9AOu6qxncMY2DSKMjsS/RxLzB7iYSC\r\nCOPgdjbGWXQWcOW4UKwn24btRadyQc+7JzF93wn1aH3YFN5fVD1hQzSiYNnZ\r\n4T2+aV4RxM1cv8Rbvc3JpYNfzg+zbgQoI82mfQuyLLU3A82ap2T9YefXi/T0\r\nvdLpAVWTcy3DJOlSKNpOE6Xp711wUcey7Uaaw1b9sXaiwhLLR8LdRoE9HIsw\r\nas/z7Gh8gzH1RawavsIOBntN5H72FpddNtxLo18/B0dna38NeDLaM4zMmXj5\r\nytR5yqHZopbftDaWXxG8p1aP7CnEQyEusU9/yUH4Ah1mxlYDDEJDGZhl0ECv\r\n8ipBYzo4iewygpA7yLCf6fEXh0PgbXq3I0TD7Lr6WRodHGRO8b2X0RyawY94\r\n8h2kaxw0awXf1DqR4CIqS99wOmQIUGugrOfEHTaXxHKdFmxJL3z6NbgEbMvs\r\nq9ZJfeOgnxhcpg79CvetohnRW91z9XospN4IwJfUcHQZk3TPqzTVJy13Vs+P\r\n0Cw+OHK6Vej/FkiubRAVguJmmF4STy5z/0AecR1ZPsxFrjX/InvbOPaMdsCw\r\nezcCD8tHvkc1oTpGTZ6ktCDOhR17w5qru5xWtBPJFtdWi3Sk5Ux94yYR3rpU\r\nx+dAU9v9+LK0PumzMQqrWmpnbZyw4yp4jTB0VmQ4YtQGmXEr/t5iI3BnNhV9\r\nwZuqK7zA1EKJGe+76URE1OGsJwkldfL4Q/0u5FJbpGnfSZsMlwbHJOj5VkVe\r\nFPtJOCsOxBtpk/aKP+jm0OmZDNyDuYtfGHU9X3hPJDTom5lcL4B0ml433lvS\r\nZJ4jnnZxKPo+hT9DzpxeIbnPeJQjRsRDfowRsPb2KGIFQxeyHagmDNcVBK1L\r\n4A0KdpvKh2Yo16E=\r\n=he+D\r\n-----END PGP MESSAGE-----\r\n"
   },
   "id":"harAqr3eDuzKm0qAFFI3fDrbtU4F_kvPxKRzPfEHTJfl5duG6e8huhP7VyhopXX-gHZx1nclEP6RXMzT4oDbRA==",
   "AttachmentKeyPackets":{}
}

If you look at section Body you will noticed it is encrypted using PGP before send to server.

Yes, if you have keys, then you could decrypt this message on your own.

Using Gmail instead proton mail will not give you key benefit which proton mail does. This message is passed to back end encrypted which indicates, it will be stored in drafts as encrypted, which won't necessary happened in case of Gmail.

Improve this answer
3
  • Yes encryption is performed in your Browser but consider this. Who controls the key? When you use Protonmail, there is no key generated that you hang on to and must subsequently provide. Similarly when you exchange email with a non-Protonmail user, they don't have a key nor do they encrypt/decrypt their end, so the Proton mail server must be handling clear text at least for non-Protonmail interfaces and they must own the key for encryption/decryption. It can't possibly be end-to-end encryption!
    – user10216038
    Oct 21, 2019 at 21:49
  • @user10216038 Googled "protonmail pgp key storage" and just clicked first result ... protonmail.com/support/knowledge-base/…. Pgp private key is stored server side encrypted with your password so they only store an encrypted version of your private key. At least DYOR before answering without any background.
    – Xavier59
    Oct 22, 2019 at 8:07
  • @Xavier59 - Good to know that's how they say they handle the keys. However clearly any email exchange with a non-Protonmail user must involve clear text in and out of the server.
    – user10216038
    Oct 24, 2019 at 17:24
-1

mti2935 has answered my question in the comment above: Cleartext never leaves my device; client-side pgp encryption is done using javascript.
I'm happy to learn that my inference that encryption was done at the server is wrong.

Improve this answer
2
  • 1
    Please do not include commentary in answers (or questions)
    – schroeder ♦
    Oct 21, 2019 at 19:25
  • Downvotes have reasons on the tooltip. One of them is "does not show research effort". If the answer is in the product's FAQ, then you should have done a little more reading before asking.
    – schroeder ♦
    Oct 21, 2019 at 19:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .