Tuta vs Proton

Meatheadmarty

n3t_admin @lawman I agree with lawman on this, although @n3t_admin I agree that email is not good for anything private.

The reason why addy with pgp is better is that email is your remote VPS can be cloned easily, including without your knowledge.

There isn't a way to easily store email on a VPS with encryption, as far as I know.

With addy.io, if you put in your public key, and then forward everything to another email account with PGP and it geta sent encrypted with the public key then it's deleted when downloaded and then decryoted, at best there is a shared database that may have backups or may not with PGP and metadata. Unfortunately, since subjects of emails won't be encryped, any database backups would reveal metadata.

Can't you run addy.io on your own VPS?

lawman

Meatheadmarty

Your can run addy.io self hosted as an option from what I understand.

Subject can be encrypted with PGP

Franckienogotobollywood

I understand the interest that a person with a very high threat pattern and having to have anonymity by using proton on tor can have. But for people who do not have a threat model and even those who do not want their data to be sold, would not pay all your life, every month an email or a password manager. You can have your whole life for free. After everyone does what they want. But you will pay dearly for a private email that ultimately will not protect you because let's be honest proton users you know a lot of people who use proton? It didn't even protect an environmental activist in France and proton receives a number of requests every month for requests for information on user accounts. So well, everyone will make their own opinion but I prefer not to pay.

Sagichnicht

Franckienogotobollywood

Franckienogotobollywood that's just not true. Everything proton gave the police (and everything they could give them) was the IP address.

Franckienogotobollywood

Sagichnicht That was enough to arrest the activist

Sagichnicht

Franckienogotobollywood So what do you think the alternative would be here? Risking millions of people's emails, because they don't give out an IP address following a court order?

n3t_admin

But you will pay dearly for a private email that ultimately will not protect you because let's be honest proton users you know a lot of people who use proton? It didn't even protect an environmental activist in France and proton receives a number of requests every month for requests for information on user accounts.

Franckienogotobollywood That was enough to arrest the activist

Yes, what did you expect? I know some people live under the delusion that these are some "rebellious" services that will fight every court order by non-compliance. I would like to invite all those back to reality.
Every non-shady service will comply with law enforcement to the extent they are capable of. And if they log IP addresses (or a forced to by a court), they will absolutely give up that information.

The French activist simply had bad OpSec (as I said before: you don't trust email) like the hundreds before him that got busted. You simply can't fix a broken, horrible thing like email by slapping a "hosted in Switzerland" label on it and implementing some proprietary encryption. If you try to fix email, you'll end up creating a Signal alternative. So just use Signal at this point.

Franckienogotobollywood

Sagichnicht Post your mail to the post office if you really care about your privacy, if you want to stay in digital continue to use proton but on tor and make sure that all your recipients use tor. Otherwise it's useless. Giving only the IP address is already too much because it allows you to go back to you. Personally for my case I use gmail and iCloud mail because I have nothing secret to transmit, I am not an activist or secret agent frankly if the police ask to search my phone I would give them all the passwords, but it will never happen because I am everyone. You have to keep it simple guys, if all your contacts are on gmail, use gmail. It's just my opinion

Franckienogotobollywood

Sagichnicht If a court requires that your ip be transmitted, it is because you have something to reproach yourself for

EnragedBoot

Franckienogotobollywood

Franckienogotobollywood
I have much to say about this, but I'll just leave it at the following:

This is a very un-nuanced way to view the matter.

lawman

Franckienogotobollywood

This is a leap of logic and far too much trust in governments run by people that often have self interests over community interest.

Meatheadmarty

n3t_admin But what if an environmental activist shouldn't need to be an expert on OpSec?

So many people in the privacy community said Proton was reliable and trustworthy, proton said "we never log your IP address" in marketing material and then didn't warn users at all that various information would be logged without encryption.

n3t_admin

Meatheadmarty But what if an environmental activist shouldn't need to be an expert on OpSec?

Their choice. If someone decides to drift into semi-/illegal territory, they should be aware of the risks and take according precautions.
The fact he WAS using Protonmail, indicates that he at least thought about it. But instead of doing his due diligence, he decided to stop his research when the marketing started - and that's the definition of bad OpSec.

Franckienogotobollywood

n3t_admin Proton has done lying marketing like many others.

n3t_admin

Franckienogotobollywood have you seen me arguing for Proton anywhere?
I'm not arguing for either side. All email is broken - period. Trying to fix a system that will be vulnerable from the other side in 99% of cases is nonsensical.

fboro

I went with TutaMail and compared to proton I like it more but it's only feeling as I doubt there's any difference functionality-wise

Bismark

If you test your own email servers spam detection using tuta, they will immediately disable your account. Ask me how I know. lol
https://spamassassin.apache.org/gtube/

They were nice and it took a couple days but they re-enabled my account.

Stayjuice

I’d chose tuta I trust German companies more than any other in Europe because they have laws supporting encryption and privacy

Ilgar

I like tuta but I don't trust for profit companies incorporated in 14 eyes jurisdictions.
Regarding proton and Switzerland – they changed laws lately so it isn't data haven either.

JollyRancher

EMail isn't really a good idea if you need truly secure communications.

Proton is easy to use, has most features most people want, and is decent for most threat models (especially if all parties to an email are on Proton). For 99% of people and use cases, it is a good default email provider.

Tuta is somewhat better from a security & privacy perspective but in every other respect it tends to lag behind Proton. Still, its a solid option.

In either case, short of a targeted effort from a major NatSec actor you are going to be just fine unless you were stupid (recovery email or phone are the big ones).

« Previous Page Next Page »