Questions tagged [protonmail]

ProtonMail is a free and web-based encrypted email service using client-side encryption.

Filter by
Sorted by
Tagged with
3 votes
1 answer
322 views

Is using email (protonmail with Tor Browser / obfs4 bridges) to contact embassy in potentially hostile foreign countries safe?

Suppose one wants to use email (say using protonmail with Tor Browser / obfs4 bridges) to discuss sensitive matters (such as asylum seeking / embassy protection) with embassy in potentially hostile ...
user avatar
0 votes
0 answers
257 views

Are emails sent from ProtonMail to Tutanota (or vice versa) ever not encrypted?

Both mail accounts, ProtonMail and Tutanota are encrypted, and as the knowledge base from ProtonMail states, ‘emails from ProtonMail users to non-ProtonMail users’ are ‘otherwise encrypted with TLS if ...
user avatar
22 votes
4 answers
1k views

Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?

From time to time, questions come up in this board concerning web applications that utilize client-side cryptography (or ‘in-browser’ cryptography), where these applications claim to be designed in ...
user avatar
  • 19.6k
3 votes
1 answer
320 views

If my protonmail password is compromised, does that potentially mean that my whole account is, permanently?

My (limited) understanding is that my password is used to encrypt the keys which are used to encrypt my mail messages on protonmail's servers. Does that mean that knowledge of my password could ...
user avatar
1 vote
0 answers
88 views

Which algorithm is used ProtonMail SRP session IDs? [closed]

Having read up on a bunch of different SRP implementations I understand that the session ID is generally not random, although it’s missing from the documented SRP write up they did. Anyone know how ...
user avatar
  • 183
1 vote
0 answers
93 views

Is the shared secret from ProtonMail SRP actually used for anything after logging in?

Is this value just used to log in or is it used as a key for anything else later on? I see that the pm-srp code does make a point of keeping it around but it isn’t clear for what purpose, and some ...
user avatar
  • 183
4 votes
2 answers
874 views

Can protonmail access my passwords and hence my secrets?

protonmail provides encrypted "zero-access" encryption mailboxes. The way they explain "zero-access" is, at least for me, similar to zero-knowledge encryption. However protonmail has in its servers my ...
user avatar
  • 143
0 votes
2 answers
274 views

Does plaintext reach protonmail server?

I am quite happy with, indeed grateful for, protonmail. There is one point I'd like to understand better regarding end-to-end encryption. I asked this twice at protonmail.com, and twice it was ...
user avatar
2 votes
3 answers
761 views

In PGP how can I be sure about the public key?

I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
user avatar
  • 131
1 vote
1 answer
171 views

What are the risks of redirecting my email with Google Domains?

I have bought a domain from Google Domains. One of the features they offer is to redirect all email sent to that domain to any other email address of my choice. Now I'm wondering; is it secure and ...
user avatar
0 votes
1 answer
2k views

Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?

I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC. What caught my eye were two things they recommended in the domain setup: ...
user avatar
1 vote
1 answer
2k views

Are emails from ProtonMail to Tutanota end-to-end encrypted?

So I know that sending emails from a ProtonMail Email to a ProtonMail email is end-to-end encrypted. And I know that sending emails from a Tutanota Email to a Tutanota email is end-to-end encrypted. I ...
user avatar
0 votes
2 answers
707 views

DMARC on ProtonMail custom domain

I began using ProtonMail email service, I like it that much, that I connected my domain yesterday and did appropriate changes to DNS. This page of ProtonMail's knowledgebase says how DMARC shall be ...
user avatar
16 votes
2 answers
3k views

Why is some meta data not encrypted in Proton Mail?

In a different Question, in the first answer is written that some meta data doesn't get encrypted. What you shouldn't forget about encrypted e-mail, is that while the message body is properly ...
user avatar
1 vote
2 answers
224 views

How can encrypted messages from proton mail help data requesters?

I am reffering to a part of this news video: Hak5 news video starts at 5:33 I found out that proton mail can only give out encrypted message to requesters(reference): ProtonMail can only hand over ...
user avatar
6 votes
1 answer
2k views

Protonmail cannot read my mail — but can detect if it is spam?

All is in the title really. How can protonmail detect spam if if cannot read mail content? It could be based on metadata. But then spam detection would probably not be very good. And what metadata ...
user avatar
  • 205
2 votes
3 answers
8k views

Security of emails from ProtonMail to Gmail

I understand that Gmail to Gmail is not very secure. On the other hand, ProtonMail is a very good option with great features. But there is one thing I don't quite understand: Why should I use ...
user avatar
5 votes
1 answer
195 views

What can stop a browser to cache data from ProtonMail conversations?

I think this question arises primarily from my insufficient understanding of browser caching. Let's log in to ProtonMail, and read a message. My understanding is that an encrypted 'blob' of data gets ...
user avatar
41 votes
4 answers
13k views

What's the point in hashing phone numbers?

Some services (for instance ProtonMail) claim to store hashes of phone numbers, instead of phone numbers themselves (while they don't say how they hash it). Now, given that the number of potentially ...
user avatar
-2 votes
1 answer
133 views

Transferring potentially malicious e-mail attachments to air-gapped machine

Overview: I am interested in having an e-mail account designated for receiving anonymous tips as part of a larger anonymous tip infrastructure at my business. My professional domain's e-mail is ...
user avatar
  • 187
1 vote
3 answers
1k views

How does mail email services decrypt an encrypted mail without having the sender's Public Key? [duplicate]

I started using ProtonMail which is an encrypted mail service assuming it works flawless between ProtonMail users. My question is how does a Gmail user decrpyt my message without having my public ...
user avatar
0 votes
1 answer
192 views

Secure email hosting service for a law firm [closed]

I am looking for an email hosting service for a small law firm (4-5 accounts). What i am looking for is: Possibility of sending password (or question/answer) encrypted message to a user outside of my ...
user avatar
2 votes
1 answer
714 views

Is a secret PGP key considered compromised if it reaches the net?

I started to reverse engineer the ProtonMail system a bit and noticed that ProtonMail keeps all the ASCII armored private keys in their plain text form on their servers, and the only thing protecting ...
user avatar
  • 129
0 votes
1 answer
394 views

Could ProtonMail find out a user's real location from inside Tor?

This article claims that allowing javascript must be treated as a potential security hole on anything (inside or outside Tor). So, the best we can do is hope that ProtonMail doesn't become evil? How ...
user avatar
  • 9
0 votes
1 answer
225 views

Does pre-shared "secret" part of salt stored in ProtonMail client make SRP auth sequence any safer?

Looking for an encrypted mail provider I checked ProtonMail and asked them why do they use “semi-random password salts (one random part, one non-random part)” compared to SRP 6a fully random salt. Got ...
user avatar
7 votes
5 answers
4k views

How to export my Protonmail private key?

From: https://github.com/scastiel/protonmail-export 1) Open the ProtonMail app and log out completely. You should now see the login screen. 2) Open the dev tools of your browser, and the ...
user avatar
7 votes
3 answers
14k views

Is my IP address leaked when I send messages on Protonmail?

When I send a message on protonmail, does my IP address show up in the header or any other place? Will I need a VPN to be completely anonymous?
user avatar
  • 81
3 votes
1 answer
926 views

How are Proton Mail key Encrypt and Decrypt for the non-proton mail service providers?

There is a service called ProtonMail. It encrypts the mail while sending between two proton-mail users, but how does it encrypts and decrypts while sending the to the non proton-mail services ...
user avatar
-1 votes
1 answer
5k views

Does ProtonMail record IP address? [closed]

ProtonMail is said to be privacy friendly email service but some technical issues seem blurry to me. First, it requires JS. Second, its mobile app has to be downloaded from Google Play Store or iOS ...
user avatar
  • 99
12 votes
2 answers
2k views

Cannot understand supposed ProtonMail vulnerability from wired.com article

Currently I'm reading an article about ProtonMail here and I don't understand it. Now let’s address ProtonMail’s weaknesses. One of the big issues is that it isn’t easy to know whether a message ...
user avatar
  • 463
5 votes
2 answers
833 views

ProtonMail: Wouldn't it be better if each user had their own private key?

ProtonMail keeps the encrypted private keys of all their users on their servers. The mailbox password, which is known only to the user, decrypts the private key of that user. Would it not actually be ...
user avatar
  • 486
3 votes
2 answers
596 views

Why does the ProtonMail Android app require Identity permissions?

The ProtonMail Android app is supposed to be a privacy-centered alternative for data-mined email services such as Gmail, Yahoo, and Outlook. If this is truly the case, why does the Android app require ...
user avatar
5 votes
1 answer
3k views

Does the use of JavaScript make ProtonMail insecure?

I like the look of ProtonMail. However, what has stopped me from signing up is that JavaScript seems to be used at various points in the site, and for someone to read your email they must click on a ...
user avatar
  • 1,272
12 votes
3 answers
2k views

How does ProtonMail manage search?

There is a service called ProtonMail that encrypts email on the client, stores encrypted messages on their server and sends it encrypted in some fashion (depending on what email service the recipient ...
user avatar
  • 123
3 votes
3 answers
1k views

Can Google Chrome read/scan my ProtonMail inbox page?

If I used Google Chrome to visit ProtonMail website, it would not be difficult for Google to read my emails since it would just need to scan/read the content of the page. Messages are encrypted just ...
user avatar
2 votes
1 answer
2k views

How was my email intercepted? [closed]

I've recently sent an email to a non-Protonmail user, using a code phrase. Someone on the recipient's home network was able to intercept the email and responded to me in detail as to the content of my ...
user avatar
12 votes
3 answers
4k views

ProtonMail security concerns

This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
user avatar
  • 430
25 votes
4 answers
17k views

Is email encryption, as claimed by ProtonMail, possible?

Is it possible to create a Web service that encrypts all messages, such that only the writer, and the person to whom the mail is sent, can read it? In other words, is the theory behind ProtonMail ...
user avatar
  • 251
5 votes
1 answer
2k views

Wrapping my head around Protonmail

I've been trying to grasp how Protonmail could work. From what it gather, it works like this: When you signup, you create an account password and a mailbox password. A PGP private/public key pair is ...
user avatar
  • 51
30 votes
6 answers
22k views

How are ProtonMail keys distributed?

There is a service called ProtonMail. It encrypts email on the client side, stores encrypted message on their servers, and then the recipient decrypts it, also on the client side and the system "...
user avatar
  • 301