Is ProtonMail still good? Alternatives?

Years ago I got put onto protonmail as a reliably safe email from a friend and have been using it ever since. Ever since Web 3.0 being on the rise the internet has changed a lot and im wondering if its still as reliable as it used to be? Are there any better alternatives around these days?

There are better alternatives but they still aren't any good because email is soykaf. There is disroot, riseup, and danwin. Good luck using disroot or riseup for official business, I doubt you could even use danwin, maybe you could. You should really just stay away from email in general. Protonmail is horrible though it's a honeypot, there is such a wealth of information against them online at this point I think it is widely known to avoid them.

>>69877 I figured its probably soykaf now, thankfully I dont have to worry about that, but I do want to find something good going forward. Its not official business or anything hush hush its just that with web 3.0 being fully AI now I want to at least not be knowingly using a honey pot anymore and get more hip to whats practical and applicable.

>>69878 Well what I gave you should probably suffice then. I would say danwin is best just because Riseup is invite only and Disroot has a vetting process, from which you can be rejected. Riseup and danwin both have hidden services. None of these providers demand javascript for signup, and they all support mail clients. The best one is probably Riseup but you need to find someone willing to invite you.

>>69877 >Protonmail is horrible though it's a honeypot, there is such a wealth of information against them online at this point I think it is widely known to avoid them. Perhaps you'd be willing to provide said evidence to support your assertion then, because all I've seen against protonmail is situations where they were forced to comply on unencrypted emails. If you actually encrypt your messages there is nothing they or anyone else can do about it.

>>69879 If anyone is a suspicious as fuarrrk, potential honeypot, it's Riseup. They have all sorts of ToS stipulations that they could only possibly enforce if they were reading your emails. Reminder that only a fool trusts an external host with their communications these days. Even if you have reason to believe that your guy is legit, the NSA (and perhaps other spook agencies) still runs a dragnet surveillance program on all internet activity between you and your guy. If you're not encrypting, then you're not private, it's just that simple.

Just soykaf-canned my current proton account. Was in the habit of rotating accounts a lot over the years anyway.

>>69880 If Protonmail wasn't such a terrible provider you wouldn't be at as great a risk of being identified by authorities because you would be able to access their service relatively anonymously. You cannot sign up for Protonmail without enabling javascript and webgl in your browser. Their bloated client depends upon javascript to function. You have to use their web client, you need to pay for mail client support, and they only accept traceable methods of payment. They only accept "valid" email domains for account verification. Aside using email for verification you can use SMS, or make a traceable bribe for them to allow you to register an account. Their end to end encryption is dubious at best, as far as I know keys are generated upon sign up, these keys have to be stored on their servers for PGP to function. They admittedly collect a fair amount of metadata from emails routed through their service, and retain said data indefinitely. They used to redirect users registering an account through their hidden service to their clearnet domain to harm anonymity. They have a history of attempting to cover up their shady practices. Every year they hand over the data of thousands of users to the authorities. They comply with the majority of orders made by the authorities. >>69881 But of course no, it is Riseup that is the honeypot provider. I have only heard of one incident where Riseup complied with demands made by the authorities. You shouldn't be placing any trust in a mail provider, or the provider of any service online. You should be able to access and utilize the services of a provider without sacrificing your anonymity and the security of your device. Protonmail is not a service that has any respect for user anonymity, or privacy for that matter, they regularly sell their users down the river. If you wish to argue that they must comply with legal demands in order to sustain their business, fine. That is a valid argument to make, and all the more reason to avoid them, there is clearly a large amount of attention from governmental entities being directed at Protonmail, far more attention than any other email provider. >Reminder that only a fool trusts an external host with their communications these days According to who? You can self host if you like, it'll cost you money, you need to make the necessary transactions to get a server up and running, it isn't always so easy to attain cryptocurrency anonymously in order to make payments. There's nothing to say the people providing your server aren't monitoring activities occurring on the device. You'll also be the only person using the service. Short of hosting a service right on your own system, the connection made to your server will be observable to automated surveillance systems, even still whatever communications service you're running on your own system will obviously make internet connections which will be monitored and recorded by automated surveillance systems, only they'll be directly traceable back to you.

>>69876 i wouldn't know i only use protonmail cus it sounds cool

>>69876 fuarrrking hell.. I have a lot to say so I'll just list it out. 1) Email is a fundamentally old and insecure protocol. While you could try to implement features to make it 'safer', you can't put whipped cream on a pile of manure to make it taste good. 2) Protonmail is as much of a honeypot as any other email service. All of them could collect any data about you. At the end of the day, it's all email It's all the same soykafty system that feds can harvest metadata from. 3) The French activist case involved PM being given a *legal order* to hand over data. *They had no other option*. They could not shut down like LavaBit did because unlike LavaBit, they have a significant amount of users and businesses that rely on their service. They had already tried to contest the order prior to handing over information to authorities. What they did mishandle about this situation was silently removing the 'No logging IPs' text on their website. While they later did clarify what the situation was, it was ultimately misleading to have that on the website. 4) Their web mail objectively is like kicking dead whales down the beach, their onion service is slow as soykaf and requires JS, and it's stupid how you need to pay in order to use a separate bridge application just to use your preferred email client. These are 100% valid complaints. 5) Their anti-abuse measures often trying to get you to give another email, a phone number or a captcha is not great for anyone with a higher threat model. They do need something to combat abuse, but I think Tutanota's system of not allowing sending or receiving email for 48 hours is a reasonable approach. Cock.li and Riseup's system of invites makes their services way too inaccessible, because you then have to hunt down and beg people online for invites if you aren't fortunate to know someone who already has one for you. 6) Selfhosting is not a reasonable option for most people. The amount of headache it takes to get your VPS approved to use email ports, set up anti-spam, as well as have the domain be registered enough to not be automatically marked as spam by big providers makes it too much of a hassle for most people who just need an email for signing up for some stuff and occasionally sending an email here and there. For most people, this isn't worth it. Besides, what's the point of selfhosting your email to 'escape the botnet' when you'll inevitably need to send an email to some Gmail account where Google will know that you emailed someone and what your email address is? This isn't to say you aren't allowed to. If you want to, more power to you if that's the route you wish to take and don't let anyone stop you. My point is that of accessibility and ease of use along with the effort it takes to set up being way out of scope for the average Joe. If you just need some alternative to Gmail but still generally accessible, not likely to be marked as spam and normal person-friendly, ProtonMail is fine. It's not great, but it's fine. Tutanota, Disroot and DanWin1210.de are the other providers that I personally think are okay. To reiterate, you should never trust any of these services to not be able to read your emails or data. Act according to your threat model, like PGP encrypting your emails offline and using Tor when possible. Sometimes, Tutanota blocks Tor and it's stupid, maybe in those cases you'll have to settle with using Mullvad or something like that. Everyone who is losing their minds screaming "pRotoN is fEd honEyYpoTTttT GRRR!!!" needs to seriously shut up and use the restroom instead of the bucket under their desk. Please think critically about how PM was given a legal order. Not a suggestion, an ORDER. I have never been able to get a Riseup invite (not that I need one anyway so I don't care), so I can't speak to their trustworthiness as a service.

>>69876 The Shadow Wiki has a good comparison of email providers. http://abrx6wcpzkfpwxb5eb2wsra2wnkrv2macdtkpnrepswodz5jxd4schyd.onion/email.xhtml https://m.13f0.net/shadow_wiki/email.xhtml I use https://posteo.de for personal/pseudonymous identities and https://anonaddy.com email forwarder for most low-security tasks. This is a good visual representation of email metadata. https://labs.rs/en/metadata/

Set up a skiff account for email. Anyone know if this is any good?

>>69876 the "swiss privacy" meme is a meme. along with "swiss security". there had been a history of swiss companies that are actual honeypots and even security companies that actually actively sabotaged security (don't remember it though the detail is it was used against iran). they knew that a lot of people just put trust into the swiss meme blindly which is why it was targeted and used by adversaries for convenience - it was actually just swiss cheese!! also reminder that spies are likely in these workforce the same way vpn companies would without a doubt at least have one government spy working on any such company covertly in another soil undercover. nothing stopping them from inserting bugs and a massive datadump. >mainstream mail (gmail ymail outlook) these tend to have personalization on, or will be able to read your mail anyways so they can track purchases from your online transaction on mail. highly avoid if you can. otherwise would be fine to use for convenience or commercial purposes only (some mainstream business, or some kind of raspberry pi e-mail controlled system contraption). these services reject communication with other unpopular mail services. for example I used to use openmailbox and gmail/yahoo/outlook actually outright rejects anything coming from openmailbox - my mails didn't even go to the spam section. if you're communicating with others it's far better to use mainstream or semi-mainstream services >semi-mainstream these are proton/tuta. they may be honeypots latching on the swiss meme but you are far less exposed to tracking companies and "personalization" that the big 3 offers (opt-out and may reset at any point their default policies change). but also mail coming from these don't get outright rejected by the big 3. either way this is obviously so much better choice but don't expect it to protect you from glows or hide your darknet purchases. legitimate companies like those mentioned so far like to keep their transactions/activity clean so they really avoid any suspicious activity especially ones involving dirty money (like laundering cases or w/e that may give them extra work/burden to do). either way nothing is really stopping companies for just complying with the local authorities, they after all follow the rules of the land and they can risk losing their company BUT really there are only a very few that would rather lose their company. kudos to those heroes.

>>70372 >don't expect it to protect you from glows or hide your darknet purchases I'd say this goes for email in general, even more dubious providers like DNMX or Sector.City. If you must use email for very sensitive situations, encrypt the communications offline and leave stuff like subject lines empty to try to limit as much collectable metadata as possible. There's no 100% effective solution, but there's mitigations, and I think that's what should be focused on rather than chasing some magical cure for glowie activities. The Swiss secrecy stuff is a meme for sure. What's the meta nowdays, Cayman Islands? Haiti?

don't lose your account or they will charge you forever and not respond to emails or tickets asking to close your account. also outbound mail went straight to spam 99% of the time. total soykaf service honestly

>>69876 when was it reliable it never had anything more than other email services are you retarded? >ahuuuuuuur duuuuh duuuuuurr it had some js crypto making it end to end that could be swapped out at any time and you wouldnt notice

>b-but it was hosted in a bunkers!!!

The truth is that ProtonMail is more than good enough for the average user, as long as you aren't doing anything illegal. I would not use it for illegal activities.

i use proton coz its easy to sign up on it no phone+sms bullshit so you can stay relatively anonymous >>69877 >>69908 >email sux ive been hearing this for a while now. If email is like kicking dead whales down the beach what should an anon use? it seems like everything requires email even matrix

>>70940 that's because matrix is soykaf, xmpp is far better and doesnt require email for signup

>>70940 You can use matrix without an email. You just have to use a homeserver that doesn't ask for email during registration. Last I looked, there wasn't a shortage of of servers who just had a sign up form that asked you for the desired username, and password.

Just noticed today that my free skiff account was telling me I had maxed out the amount of emails I could send in 24 hours. I did send a bunch yesterday but thats something I never noticed with any email provider before. Tried searching what the limit is but was unable to find information on the site. Might consider getting a cheap payed for account for 3$ per month if it was unlimited, but who knows. Anyone know whats up with this limit?

>>69876 Unironically what is the point of using protonmail over gmail? Most people use gmail. Most organizations and companies use gmail. Because of this, it is vastly more secure to use gmail. Privacy focused emails are mostly a scam. The reality is that email itself is insecure and not private. If you want to maximize privacy, self host it. Don't pay for le privacy email.

>>72673 I prefer protonmail because gmail is intrinsically connected to the rest of the internet and that bothers me. If i get derezzed from protonmail or they fuarrrk something up, i just create a different e-mail. If someone relying on google products gets their gmail account fuarrrked, it's giga over. But yeah, you have to define what parameters are important to you and make a decision on that, "privacy" is too broad a concept to make a decision based on that alone, it's just propaganda. What aspect of privacy do they offer that you want? Of the answer is none, then don't bother.

>>70940 Unfortunately, until society collectively moves to a better standard we are stuck with using email for vast majority of accounts and stuff. >>72673 I argue selfhosting does not improve privacy all that much more. What difference does it make if you send an email to a Gmail account from a selfhosted email over a mailbox.org email? Gmail still stores that info on their servers anyway. Selfhosting email has pretty low return on investment of time and energy. And that's not even considering having to essentially convince all other major providers/services that your email server and domain is legitimate and should not be blocked. I think for now, it's better to prioritize using different emails and email aliases to make it more difficult to make one email link to multiple other things.

>>69880 >If you actually encrypt your messages there is nothing they or anyone else can do about it. But then what's even the point of using ProtonMail or any of the other "privacy" providers? If your soykaf is GPG encrypted it shouldn't matter whether you're using Gmail, Outlook, Disroot, Cock.li, danwin, etc. since no one would be able to read your e-mails unless the person you're communicating with leaks their private key, which in that case it would also be an issue regardless of the e-mail provider you choose.

>>73782 it does still matter because of the features they have and do not have, you can't use mail clients with any of those providers you mentioned aside danwin, disroot and cock.li, many of them require all sorts of soykaf like a "VALID" phone number and or email address, and you can't use any aside cock.li (last i tried), and danwin without enabling javascript in your browser

>>73783 >you can't use mail clients with any of those providers you mentioned aside danwin, disroot and cock.li What do you mean? You absolutely can use e-mail clients with Gmail and Outlook. >many of them require all sorts of soykaf like a "VALID" phone number and or email address That's true I guess, I hadn't thought of this angle. But this doesn't have anything to do with the e-mails being sent though, knowing that someone with a certain phone number sent a GPG encrypted message doesn't help you with figuring out what is inside that message without having the key.

>>72673 >protonmail over gmail? Gmail actively scans your emails to sell your info to advertisers. Protonmail at least claims not to do that, and so far there's no evidence that they do. Many people have ethical objections to using Google services. >proton over self-hosted The biggest issue is that mainstream mail systems reject emails from self-hosted servers or send it straight to the spam folder. Other issues are that signing up for services can be annoying because a lot of services have anti-spam systems that reject accounts that register with self-hosted mail servers, mail server maintenance and security is a chore, and it can cost more. Personally, I use protonmail because it let me register over its hidden service, pay for my account with btc, and never required personal information. I don't have any strong anonymity needs (my threat model is just that i dont want advertisers profiling me based on my emails, and i dont want to support google/microsoft/apple/etc), but I like that they make it possible for people with stronger anonymity needs to do everything over a hidden service without kyc. I wish they allowed for xmr payment directly but whatever, xmr to btc exchanges are everywhere. >The reality is that email itself is insecure and not private. Yeah man everyone knows this. If you need strong privacy, there are services other than email that you should use. Unfortunately, a lot of services require an email address. Even IRL sevices like just going to the dentist can require an email now. >>73784 >knowing that someone with a certain phone number sent a GPG encrypted message doesn't help you with figuring out what is inside that message without having the key. Depending on your threat model, just knowing that it's associated with your phone number can be a bad thing. personally i dont want my mail host to know my phone number because I've seen too many services have vulnerabilities that allowed any random person to figure out the phone number associated with an account.

>>69876 Protonmail is a honeypot and I do not suggest using it. What can you use? cock.li is a highly respected provider that still protects your privacy. The only reservation I have with it, is that there's 'cock' in the domain-name, which is why I do not use it for 'official' business. A good alternative that I know of, is Runbox. The only downside that I can think of, is that you have to pay for the service.

>>73842 Protonmail is like Signal, it's good for tech illiterate people but if you want to do fancier soykaf or have a higher threat model, then it's not ideal, same goes with tutanota. I don't know much about cock.li but looking at the website it doesn't inspire confidence. I've heard good things about Startmail.

>>73999 >I've heard good things about Startmail. It doesnt take bitcoin/monero for custom domain accounts, for some reason. I cant find any good email providers. Not satisfied with protonmail but begrudgingly using it

>>73999 Nice numbers! Though I talk big, I'm kind of a tech illiterate. My strength is in trusting the right people. So Lains have to take that into account when reading my posts. >Protonmail is like Signal, it's good for tech illiterate people but if you want to do fancier soykaf or have a higher threat model, then it's not ideal, same goes with tutanota. Why is Signal not ideal? Can the messages on there be read by a third party? I vehemently am against Protonmail, because as I said, it's a honeypot that's run by people who don't value the privacy of their users. >I don't know much about cock.li but looking at the website it doesn't inspire confidence. What about it doesn't inspire confidence? I suggested it because it seems to hold privacy in high regard. >Startmail On first glance, that looks like it's a really decent e-mail service. I have it noted for potential future use. >>74000 Nice numbers, yet again! Any good business will try to make things work if it means business for them. So if what you suggest is something that's a dealbreaker for you, perhaps contact them and ask them what's their reasoning for not taking bitcoin/monero and see if something can be worked out.

>>74001 Signal is not ideal because it requires you to use your phone number to signup. They, like Protonmail, make tradeoff to privacy/anonymity for ease of use and trying to appeal to a broader audience. Examples: https://github.com/ProtonMail/proton-bridge/issues/26 https://github.com/ProtonMail/proton-bridge/issues/321 https://github.com/ProtonMail/proton-bridge/issues/180 The last two can be avoided by using hydroxide (free proton-bridge alternative) but it shows a pattern. Signal uses the google play services, they don't play nicely with self hosting their service etc. https://drewdevault.com/2018/08/08/Signal.html I still think both are a big step up from gmail/whatsapp but don't use them to do illegal soykaf, basically. It's all about threat models. >Can the messages on there be read by a third party? No, signal is fully e2ee. >Protonmail, because as I said, it's a honeypot that's run by people who don't value the privacy of their users. Why do you say that? The few times Protonmail gave user's (meta)data to authorities it was very sparse, like user account creation and/or ip (use a vpn or tor). >What about it doesn't inspire confidence? Again, I haven't really looked into it, but it looks like a meme service, I don't think my privacy is a meme.

For my personal email which is solely used for cleanet accounts where I really don't want hackers getting access to my email, I use proton because they have like 3 layers of authentication. If you can crack my proton mail you deserve my credit card information. If I was doing anything 1337 I wouldn't be using email at all in any capacity, even self hosted, absolutely no email is secure enough for anything you want kept secret

>>74132 crack my cock li account hint: the password is 512 ASCII characters long

>>74149 Not him but it has nothing to do with your password Email is fundamentally insecure as a system, it was never intended to be a secure system, if you are trusting your email service with anything you truly wish to remain secret you're a fool. https://www.latacora.com/blog/2020/02/19/stop-using-encrypted/ Personally I use Tutanota, not out of any expectation of secrecy or protection from glowies but purely because I believe the 1 euro a month I pay them for an email that isn't being scraped to sell to advertisers is worth it.

>>74150 Is there even a better alternative to email though that fills it's same use case? Im not talking about communicating to another person but just receiving a message from say your bank or you are sending sensitive financial information to a government agency. In such a scenario the threat model is more an issue of theft rather than government spying. Then what? Are you stuck with email until something else becomes the standard ?

>>74149 Encryption and hashing algorithms will always more likely to be easier to break (or bruteforce) than keys themselves. Nobody needs to bruteforce your password, all they need to do is hack into the server holding your password, or confiscate server data like how the authorities already did to the owner of cock.li once before. Then they just need to dehash the hashed password, and there you go. In the case of encryption, they break the encryption. I had a 130 character random ASCII encryption key for a drive, feds wouldn't be brute forcing that, but there's no need if they can keep my drive until they are able to decrypt it. I don't know why the hell people think soykaf like Protonmail and cock.li are secure and trustworthy. Nothing is trustworthy, and email is insecure as the other anon said. There are few other options for email. There is danwin1210, and disroot, and some Tor-only email services which tend to get raided or disappear.

>>74157 Yeah basically lol If your threat model is theft and other standard malicious actors any non braindamaged email provider is probably fine, just don't go with AOL or some other meme provider and don't do crimes or things likely to attract attention over email

>>74163 Yeah but why did you bring up authorities? They are outside the threat model. Also, isn't hash secure enough? Is dehashing something as trivial as you make it out to be?

>>74175 maybe outside yours but not mine cock.li got raided once and had all of their data confiscated by the german police. hashing is secure unless they use some deprecated algorithm like SHA-1 which is unfortunately commonly used, you'll never know what cock.li uses since they don't say so on their site

>>74176 >sha-1 Can't we ask Vincent? >got raided Pretty much the reason you should ENCRYPT sensitive parts? By the way I PGP/MIME doesn't seem to be capable of encrypting the subject, which is a pity. Is PGP/Inline any better in that regard? Security considerations on the subject?

>>74150 Right you should always be using 2fa and encryption if available That's why I say my proton is pretty secure from skids that got a 0day leak where all of your passwords are already eggs post If you manage to hack my totp or steal my hardware key then you can get in but only if you also know my password and encryption password