Tuta vs Proton

lawman

wuseman I use Addy.io to overcome this

Every email in and out is gpg encrypted even if the server/receiver doesn't have gpg.

One of the brilliant options in addy.io

n3t_admin

lawman Every email in and out is gpg encrypted even if the server/receiver doesn't have gpg.

you don't understand encryption, do you?

lawman

n3t_admin why do you say that?

febbble

greenwood

If you suscribe ro the paid tier, you can access Proton by IMAP and use Thunderbird as a mail client.

Alan_the_coder

What about Infomaniak? They are also located in Switzerland.

leafnose

Alan_the_coder
They have some good services, but their stance regarding state surveillance is morbidly conformist and retrograde. This may or may not be important when considering them.
Here’s a short and noncomprehensive summary of what Infomaniak’s spokesman explained in May:

For instance, he recognised that the new surveillance law is a bit extreme, he also said that if the Federal Council came with this bill, it’s probably because of companies like Proton.
Infomaniak thinks that Proton is obstructing justice, and says that the digital world should not be a Wild West, and that we (as a society) don’t want to have criminal acts, to attract (bad foreign) citizens, or rather to assist authoritarian states in their development.
For Infomaniak, Proton business model is not desirable. For them, Swiss and Europeans citizens don’t want to have a guilty conscience regarding legal issues, where the justice would not be able to do its work, giving the hypothetical example of a girl having been raped in a family, where justice would not be able to trace the network back, because data would not be accessible.

The spokesman seems to see a problem in the fact that more and more people are distrustful of the Swiss government, while Switzerland is a model of democracy in the world. He also thinks that although the Swiss state has spied on its citizens in the past, it is still a model of democracy.

Regarding cooperation with foreign authorities for data access, it seems that for Infomaniak, democratic countries are in the OECD, and that it’s enough not to question the request.
He doesn’t agree in calling Protomail heroes for saving lives in authoritarian countries, for the reason that Protonmail doesn’t only host heroes. He then says that he has himself a Protonmail address for trash mails, and that he would use it to access illegally copyrighted content, like in the past.

Then the usual argument of not wanting to protect paedophiles and other networks…
He even seems to say that Swiss prisons are full because justice cannot follow…

Obviously, they don’t like US state surveillance, and would have preferred the Swiss government choosing them instead of US companies for some big contracts.

Link: https://www.rts.ch/play/tv/les-beaux-parleurs/video/faire-bonne-figure?urn=urn:rts:video:f357b48c-e80a-3330-b5c6-972e254d401f (begins at 55:42)

n3t_admin

lawman how exactly can the recipient read your encrypted mail? How can they even encrypt the mail sent to you without GPG support? And more importantly: who holds the keys?

generalnie7

I use Proton Suite (VPN, Drive), I think it's the only option that could replace Google suite and alike for normies in the future. I like Tuta as they're more in the FOSSy vibe, providing Google independent notifications etc.
I don't use neither as my primary email - to migrate from my current provider, I wait for something with a free tier (even 500MB, I'm willing to pay a little, but want to have the free tier for whenever I feel like canceling subscription) AND a native IMAP support. I have high hopes for the announced Thunderbird mail service.

lawman

n3t_admin

Encrypted email storage with plain text recipient protocol

1) encrypted inbox

A) sender emails plain text to your alias

B) Addy encrypts with your public key and forwards to your inbox

C) your inbox only has encrypted emails with your public key. Email host can't access.

2) encrypted sent items

A) you send email encrypted with your own public key + Addy forwarding public key - via your alias reply address

B) your sent item stores encrypted sent email only. Email host can't access.

C) Addy decrypts email and forwards in plain text to recipient

Long term storage is controlled by keys nobody except you has access to.

You don't rely on third party encrypting with private keys stored on their server, using web app which they code. Eg. Proton, tuta etc.
https://simplifiedprivacy.com/protonmail/propaganda-unencrypted.html

n3t_admin

lawman okay, so Addy holds the keys and the only bonus is that your mail host can't access your mail? The mail still travels unencrypted through MTA/MDAs. I don't see a threat model this makes sense in. You either encrypt mail all the way through (E2EE) or you don't. But thinking you have some sort of privacy because the mail is encrypted for half of its lifetime, is laughable.

lawman

Add doesn't hold the keys. Only you do.

WEAK POINT FOR BOTH - Both Addy and proton see the plaintext coming in and out
ADDY WINS - Proton holds the keys. Addy doesn't.
ADDY WINS - Proton controls the web app relied on for the encryption. Addy lets you encrypt with your own client.
ADDY WINS - Addy works free with multiple apps and encryption. Proton requires subscription for multiple accounts.
ADDY WINS - proton holds the emails long term with encryption secret key stored on their server using their web code. Addy doesn't store emails. Your own unlimited email services hold emails long term with no access to your secret key.
ADDY WINS - Addy doesn't logs. Proton unsure but it does store recovery email which it has given to governments in previous requests, which led to identifying owner.

Trying to be impartial but I see above.

If you have a better solution
A) where your keys are more secure
B) you have more free identifies available
C) with less logs
D) with more freedom on email clients used

Id he interested to hear?

Which solution do you currently use?

Thx

n3t_admin

lawman WEAK POINT FOR BOTH - Both Addy and proton see the plaintext coming in and out

ADDY WINS - Proton holds the keys. Addy doesn't.

ADDY WINS - Proton controls the web app relied on for the encryption. Addy lets you encrypt with your own client.

ADDY WINS - Addy works free with multiple apps and encryption. Proton requires subscription for multiple accounts.

ADDY WINS - proton holds the emails long term with encryption secret key stored on their server using their web code. Addy doesn't store emails. Your own unlimited email services hold emails long term with no access to your secret key.

ADDY WINS - Addy doesn't logs. Proton unsure but it does store recovery email which it has given to governments in previous requests, which led to identifying owner.

All of this crap is irrelevant. The mail will be in clear text at the next MTA anyways. I don't know why you buy this marketing nonsense (if it even exists; I couldn't find any of this on addy.io - so I guess you just made up those false marketing claims).

lawman If you have a better solution

For what? What are you trying to achieve?

lawman A) where your keys are more secure

On your machine and your machine only. It's not that difficult, really.

lawman B) you have more free identifies available

Get a VPS, set up your own instance.

C) with less logs

Same as above. Also the "no logs" - is always just a claim. Always assume the service does keep logs and adjust your threat model accordingly.

lawman D) with more freedom on email clients used

You can use all the mail clients you want, as long as they support GPG. This is the only real solution to somewhat fix the horrible security and privacy aspect of mail.

lawman Which solution do you currently use?

None. I treat email as compromised (as should you). Never send any sensitive information out via mail. Restrict your mail usage as much as possible. Use TOTP/OAuth/FIDO for 2FA instead of mail wherever possible.

This advise will be much more useful in contrast to that addy.io crap that has no practical application, apart from signing up to dodgy newsletters.

lawman

n3t_admin All of this crap is irrelevant. The mail will be in clear text at the next MTA anyways. I don't know why you buy this marketing nonsense (if it even exists; I couldn't find any of this on addy.io - so I guess you just made up those false marketing claims).

What does the vps route resolve and how do you utilise it? It seems interesting.

The claims are true from my experience of using it. If they are true would you see any benefit to other email solutions?

I agree email would be avoided where possible but not always possible.

Where you do need to use email, what host and system do you use? Self hosting solution isn't easier for me.

Meatheadmarty

n3t_admin @lawman I agree with lawman on this, although @n3t_admin I agree that email is not good for anything private.

The reason why addy with pgp is better is that email is your remote VPS can be cloned easily, including without your knowledge.

There isn't a way to easily store email on a VPS with encryption, as far as I know.

With addy.io, if you put in your public key, and then forward everything to another email account with PGP and it geta sent encrypted with the public key then it's deleted when downloaded and then decryoted, at best there is a shared database that may have backups or may not with PGP and metadata. Unfortunately, since subjects of emails won't be encryped, any database backups would reveal metadata.

Can't you run addy.io on your own VPS?

n3t_admin

lawman What does the vps route resolve and how do you utilise it? It seems interesting.

The VPS route is for self hosting.

lawman The claims are true from my experience of using it. If they are true would you see any benefit to other email solutions?

Not really, and I'm repeating myself for the third time: the next MTA that addy will contact, will have the content in plain text. Would you use Signal if they only encrypted your message until they hit their servers and then send it unencrypted for the rest? No? Me neither.

lawman Where you do need to use email, what host and system do you use? Self hosting solution isn't easier for me.

iCloud Mail.

RNDMNM

Can we not turn this forum into a dick measuring contest like they do on Reddit? It does nothing for the community, especially for people like me who just want suggestions and answers since I don't understand half this bullshit anyway. Let's be respectful and helpful, rather than egotistical. I'm not calling anyone out specifically, just been noticing a lot of these posts turning into "I'm smarter than you", "No, I'm smarter than YOU!", etc. without any real evidence of "the smartness" -- only conjecture.

I started with Proton, but noticed over time they wanted to charge for every tiny feature and were prioritizing Apple over others which annoyed me. Then, I tried Tutanota and enjoyed their simplicity, but had problems getting emails in a timely manner because they always had something going on with their servers. After they shortened to Tuta and added "Post Quantum Cryptography" I thought to myself, maybe they'd be the better option since we have a lot of bad actors in the world and Tuta seemed to care more about my security and privacy than Proton did. But, at this point who even knows anymore what's what and who's good. I try not to use email unless I have to anyway. I used AnonAddy back-in-the-day before he changed to Addy.io and liked it, but found SimpleLogin to be easier to comprehend (before Proton acquired it).

My setup is to run everything through email aliases that go to whichever email company seems to fit my needs at the time. I've never been able to get Thunderbird to work (no idea why; maybe I need my hand held more). But, I wrote all that to say unfortunately this thread didn't help me make an informed decision at all. Just created more confusion. So, I guess I'll just stick with what I've been using. Maybe I'll try this Migadu I've seen mentioned.

Kelly

I will never use tuta again after they extorted me by deleting my account and then charging me a ~$20 fee to reactivate my account.
A very stressful experience considering this was my primary github email.

lawman

Meatheadmarty

Your can run addy.io self hosted as an option from what I understand.

Subject can be encrypted with PGP

Franckienogotobollywood

I understand the interest that a person with a very high threat pattern and having to have anonymity by using proton on tor can have. But for people who do not have a threat model and even those who do not want their data to be sold, would not pay all your life, every month an email or a password manager. You can have your whole life for free. After everyone does what they want. But you will pay dearly for a private email that ultimately will not protect you because let's be honest proton users you know a lot of people who use proton? It didn't even protect an environmental activist in France and proton receives a number of requests every month for requests for information on user accounts. So well, everyone will make their own opinion but I prefer not to pay.

Sagichnicht

Franckienogotobollywood

Franckienogotobollywood that's just not true. Everything proton gave the police (and everything they could give them) was the IP address.

Franckienogotobollywood

Sagichnicht That was enough to arrest the activist

Sagichnicht

Franckienogotobollywood So what do you think the alternative would be here? Risking millions of people's emails, because they don't give out an IP address following a court order?

n3t_admin

But you will pay dearly for a private email that ultimately will not protect you because let's be honest proton users you know a lot of people who use proton? It didn't even protect an environmental activist in France and proton receives a number of requests every month for requests for information on user accounts.

Franckienogotobollywood That was enough to arrest the activist

Yes, what did you expect? I know some people live under the delusion that these are some "rebellious" services that will fight every court order by non-compliance. I would like to invite all those back to reality.
Every non-shady service will comply with law enforcement to the extent they are capable of. And if they log IP addresses (or a forced to by a court), they will absolutely give up that information.

The French activist simply had bad OpSec (as I said before: you don't trust email) like the hundreds before him that got busted. You simply can't fix a broken, horrible thing like email by slapping a "hosted in Switzerland" label on it and implementing some proprietary encryption. If you try to fix email, you'll end up creating a Signal alternative. So just use Signal at this point.

« Previous Page Next Page »