4

I personally use ProtonMail and have done a lot of reading into encrypted emails. But one think that keeps getting mentioned in regards to ProtonMail and other such services is that they are not as secure as using PGP. So I would like to know why is this?

4

Yes, there are security differences compared to using a mail client. When using ProtonMail, you have to trust them on each of your visits that their website (and your connection to it) is not compromised.

Technically, ProtonMail offers a security scheme that's comparable to Thunderbird with a plugin for OpenPGP (see Enigmail). That is, your emails are encrypted on the client side (before they leave your browser) and ProtonMail can't possibly hand over your credentials or emails to the authorities on demand or lose them to an attacker, since your data never reaches their servers in plain text. (See their page on security details.)

But, while ProtonMail can't access your data now, they could change the client-side logic at any time without you noticing. This could be caused by an attacker, a rogue employee, or maybe a government order. In practice, a simple change to the Javascript shipped for their login screen would suffice to grab your credentials during login and redirect them somewhere else instead of keeping them in the browser as promised. Similarly, they could deliver malicious JS that redirects your emails once they are decrypted and displayed. Such an attack appears much more practical and easier to hide than attacking your TB client by shipping malicious code in a rogue update.

But also note that you have to trust the client-side code you download either way. When using Thunderbird, that means trusting the code of the TB client and the Enigmail plugin (and their regular updates). When using the web service, that means trusting the shipped markup and JS your browser downloads on each of your visits.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.