Questions tagged [protonmail]
ProtonMail is a free and web-based encrypted email service using client-side encryption.
42 questions
2
votes
1
answer
67
views
Can Protonmail read non-Protonmail arriving on port 587 (TLS encrypted) right before it encrypts it w/my private key?
I've read the FAQ on this and I do not believe it answers this question:
https://proton.me/support/proton-mail-encryption-explained
Can Protonmail read plain text emails arriving on port 587 (TLS, ...
- 21
1
vote
0
answers
120
views
Can an email address attached to key be traced back to me? [closed]
I used my actual protonmail email address at the start of creating my own key. Can this email address be traced to me?
So when I sign something with my key and it's decrypted, can anyone see the email ...
- 11
3
votes
1
answer
428
views
Is using email (protonmail with Tor Browser / obfs4 bridges) to contact embassy in potentially hostile foreign countries safe?
Suppose one wants to use email (say using protonmail with Tor Browser / obfs4 bridges) to discuss sensitive matters (such as asylum seeking / embassy protection) with embassy in potentially hostile ...
- 33
0
votes
0
answers
569
views
Are emails sent from ProtonMail to Tutanota (or vice versa) ever not encrypted?
Both mail accounts, ProtonMail and Tutanota are encrypted, and as the knowledge base from ProtonMail states, ‘emails from ProtonMail users to non-ProtonMail users’ are ‘otherwise encrypted with TLS if ...
24
votes
3
answers
2k
views
Solution to the ‘Browser Crypto Chicken-and-Egg Problem’?
From time to time, questions come up in this board concerning web applications that utilize client-side cryptography (or ‘in-browser’ cryptography), where these applications claim to be designed in ...
- 24k
3
votes
1
answer
443
views
If my protonmail password is compromised, does that potentially mean that my whole account is, permanently?
My (limited) understanding is that my password is used to encrypt the keys which are used to encrypt my mail messages on protonmail's servers. Does that mean that knowledge of my password could ...
- 31
1
vote
0
answers
149
views
Which algorithm is used ProtonMail SRP session IDs? [closed]
Having read up on a bunch of different SRP implementations I understand that the session ID is generally not random, although it’s missing from the documented SRP write up they did. Anyone know how ...
- 203
1
vote
0
answers
142
views
Is the shared secret from ProtonMail SRP actually used for anything after logging in?
Is this value just used to log in or is it used as a key for anything else later on? I see that the pm-srp code does make a point of keeping it around but it isn’t clear for what purpose, and some ...
- 203
4
votes
2
answers
2k
views
Can protonmail access my passwords and hence my secrets?
protonmail provides encrypted "zero-access" encryption mailboxes.
The way they explain "zero-access" is, at least for me, similar to zero-knowledge encryption.
However protonmail has in its servers my ...
- 143
0
votes
2
answers
440
views
Does plaintext reach protonmail server?
I am quite happy with, indeed grateful for, protonmail. There is one point I'd like to understand better regarding end-to-end encryption. I asked this twice at protonmail.com, and twice it was ...
- 9
2
votes
3
answers
1k
views
In PGP how can I be sure about the public key?
I was reading about Protonmail's system and I couldn't find an anwser to something. In PGP communication is encrypted using assymetric cryptography: public and private keys. If you want to send ...
- 131
1
vote
1
answer
264
views
What are the risks of redirecting my email with Google Domains?
I have bought a domain from Google Domains. One of the features they offer is to redirect all email sent to that domain to any other email address of my choice. Now I'm wondering; is it secure and ...
- 113
0
votes
1
answer
2k
views
Soft-fail vs Hard-fail SPF + Monitor vs Reject+Strict DMARC, could it be counterproductive?
I have a ProtonMail premium plan with one custom domain and a single email address. My domain DNS is protected with DNSSEC.
What caught my eye were two things they recommended in the domain setup:
...
- 1,737
3
votes
1
answer
2k
views
Are emails from ProtonMail to Tutanota end-to-end encrypted?
So I know that sending emails from a ProtonMail Email to a ProtonMail email is end-to-end encrypted. And I know that sending emails from a Tutanota Email to a Tutanota email is end-to-end encrypted. I ...
- 165
0
votes
2
answers
1k
views
DMARC on ProtonMail custom domain
I began using ProtonMail email service, I like it that much, that I connected my domain yesterday and did appropriate changes to DNS.
This page of ProtonMail's knowledgebase says how DMARC shall be ...
- 1,737
16
votes
2
answers
4k
views
Why is some meta data not encrypted in Proton Mail?
In a different Question, in the first answer is written that some meta data doesn't get encrypted.
What you shouldn't forget about encrypted e-mail, is that while the message body is properly ...
- 329
1
vote
2
answers
300
views
How can encrypted messages from proton mail help data requesters?
I am reffering to a part of this news video: Hak5 news video starts at 5:33
I found out that proton mail can only give out encrypted message to requesters(reference):
ProtonMail can only hand over ...
- 329
8
votes
1
answer
3k
views
Protonmail cannot read my mail — but can detect if it is spam?
All is in the title really. How can protonmail detect spam if if cannot read mail content?
It could be
based on metadata. But then spam detection would probably not be very good. And what metadata ...
- 225
2
votes
3
answers
10k
views
Security of emails from ProtonMail to Gmail
I understand that Gmail to Gmail is not very secure. On the other hand, ProtonMail is a very good option with great features. But there is one thing I don't quite understand:
Why should I use ...
6
votes
1
answer
289
views
What can stop a browser to cache data from ProtonMail conversations?
I think this question arises primarily from my insufficient understanding of browser caching. Let's log in to ProtonMail, and read a message. My understanding is that an encrypted 'blob' of data gets ...
40
votes
4
answers
14k
views
What's the point in hashing phone numbers?
Some services (for instance ProtonMail) claim to store hashes of phone numbers, instead of phone numbers themselves (while they don't say how they hash it). Now, given that the number of potentially ...
- 529
-1
votes
1
answer
168
views
Transferring potentially malicious e-mail attachments to air-gapped machine
Overview: I am interested in having an e-mail account designated for receiving anonymous tips as part of a larger anonymous tip infrastructure at my business. My professional domain's e-mail is ...
- 187
1
vote
3
answers
2k
views
How does mail email services decrypt an encrypted mail without having the sender's Public Key? [duplicate]
I started using ProtonMail which is an encrypted mail service assuming it works flawless between ProtonMail users. My question is how does a Gmail user decrpyt my message without having my public ...
- 257
0
votes
1
answer
226
views
Secure email hosting service for a law firm [closed]
I am looking for an email hosting service for a small law firm (4-5 accounts).
What i am looking for is:
Possibility of sending password (or question/answer) encrypted message to a user outside of my ...
- 109
2
votes
1
answer
1k
views
Is a secret PGP key considered compromised if it reaches the net?
I started to reverse engineer the ProtonMail system a bit and noticed that ProtonMail keeps all the ASCII armored private keys in their plain text form on their servers, and the only thing protecting ...
- 129
0
votes
1
answer
489
views
Could ProtonMail find out a user's real location from inside Tor?
This article claims that allowing javascript must be treated as a potential security hole on anything (inside or outside Tor). So, the best we can do is hope that ProtonMail doesn't become evil?
How ...
- 9
0
votes
1
answer
289
views
Does pre-shared "secret" part of salt stored in ProtonMail client make SRP auth sequence any safer?
Looking for an encrypted mail provider I checked ProtonMail and asked them why do they use “semi-random password salts (one random part, one non-random part)” compared to SRP 6a fully random salt. Got ...
- 1
7
votes
5
answers
4k
views
How to export my Protonmail private key?
From: https://github.com/scastiel/protonmail-export
1) Open the ProtonMail app and log out completely. You should now see
the login screen.
2) Open the dev tools of your browser, and the ...
- 71
8
votes
3
answers
19k
views
Is my IP address leaked when I send messages on Protonmail?
When I send a message on protonmail, does my IP address show up in the header or any other place? Will I need a VPN to be completely anonymous?
- 91
3
votes
1
answer
1k
views
How are Proton Mail key Encrypt and Decrypt for the non-proton mail service providers?
There is a service called ProtonMail.
It encrypts the mail while sending between two proton-mail users, but how does it encrypts and decrypts while sending the to the non proton-mail services ...
- 31
-1
votes
1
answer
6k
views
Does ProtonMail record IP address? [closed]
ProtonMail is said to be privacy friendly email service but some technical issues seem blurry to me. First, it requires JS. Second, its mobile app has to be downloaded from Google Play Store or iOS ...
- 99
12
votes
2
answers
2k
views
Cannot understand supposed ProtonMail vulnerability from wired.com article
Currently I'm reading an article about ProtonMail here and I don't understand it.
Now let’s address ProtonMail’s weaknesses. One of the big issues is
that it isn’t easy to know whether a message ...
- 463
5
votes
2
answers
1k
views
ProtonMail: Wouldn't it be better if each user had their own private key?
ProtonMail keeps the encrypted private keys of all their users on their servers. The mailbox password, which is known only to the user, decrypts the private key of that user.
Would it not actually be ...
- 486
3
votes
2
answers
689
views
Why does the ProtonMail Android app require Identity permissions?
The ProtonMail Android app is supposed to be a privacy-centered alternative for data-mined email services such as Gmail, Yahoo, and Outlook. If this is truly the case, why does the Android app require ...
- 31
5
votes
1
answer
4k
views
Does the use of JavaScript make ProtonMail insecure?
I like the look of ProtonMail. However, what has stopped me from signing up is that JavaScript seems to be used at various points in the site, and for someone to read your email they must click on a ...
- 1,300
13
votes
3
answers
3k
views
How does ProtonMail manage search?
There is a service called ProtonMail that encrypts email on the client, stores encrypted messages on their server and
sends it encrypted in some fashion (depending on what email service the recipient ...
- 133
3
votes
3
answers
2k
views
Can Google Chrome read/scan my ProtonMail inbox page?
If I used Google Chrome to visit ProtonMail website, it would not be difficult for Google to read my emails since it would just need to scan/read the content of the page. Messages are encrypted just ...
2
votes
1
answer
2k
views
How was my email intercepted? [closed]
I've recently sent an email to a non-Protonmail user, using a code phrase. Someone on the recipient's home network was able to intercept the email and responded to me in detail as to the content of my ...
- 29
12
votes
3
answers
4k
views
ProtonMail security concerns
This TED talk brought me here. First of all, to those who created ProtonMail: Nice job!!. Regardless of what people say, it's definitely a big step forward from tradition options like Hotmail, Gmail ...
- 430
25
votes
4
answers
18k
views
Is email encryption, as claimed by ProtonMail, possible?
Is it possible to create a Web service that encrypts all messages, such that only the writer, and the person to whom the mail is sent, can read it? In other words, is the theory behind ProtonMail ...
- 251
5
votes
1
answer
2k
views
Wrapping my head around Protonmail
I've been trying to grasp how Protonmail could work.
From what it gather, it works like this:
When you signup, you create an account password and a mailbox password. A PGP private/public key pair is ...
- 51
31
votes
6
answers
23k
views
How are ProtonMail keys distributed?
There is a service called ProtonMail.
It encrypts email on the client side, stores encrypted message on their servers, and then the recipient decrypts it, also on the client side and the system "...
- 311