Leaving Proton Mail

Disclaimer: I am not a cyber security specialist nor do I have any formal education within any technological fields. This is a personal website and a personal blog.

When I first started my dabbling in free software, one of the first things I did was move my email. I used to have it provided by Outlook simply because it was easy. I paid nothing and got all my emails in the browser, and could install their dedicated app. I chose Proton mail because they provided a similar service but on better terms. The main selling points for me were:

• Being free software (or what I then used to call 'open source')
• Being ran by a non-profit
• Being end to end encrypted
• Being for what I believe to be a better internet.

Four years later, I am finding myself more and more in doubt on whether or not these bullet points are that true or not. This blog explains why, and also details why I will now be moving away from Proton as my email provider.

Proton and free software

Proton proudly present themselves as an 'open source' company with among other things almost 200 public repos on GitHub. "We believe in the power of open source", they write on their website, before elaborating that transparency is the key to trust and that all their apps are open source. They also claim that this 'enhances the security of [their] products' and that making code freely accesible incourages innovation in privacy tech. This is good and for the most part, this is all also true - you can for instance check and confirm for yourself that claude code is actively being used in the development of their webapps with the latest commit as of writing being 7 hours ago.

However, this here is a great example of one of the misleading parts of their marketing that lacks nuance.

While it's true that their apps are 'open source', their server backends are not. This is not mentioned at any point on their website and seems to me as a clear contrast to their 'belief in the power of open source'. An old twitter-reply and reddit-comment seem to elaborate on why - they do not believe that it adds any trust since we cannot verify the backend code anyways. While it's true that we cannot highlight it, it to me still doesn't exactly increase my trust in Proton and is also a great case in the difference between ideas of 'free software' and 'open source'.

It also really hurts the entire idea of the web clients being truly open as well, as any commit to them is directly related to a proprietary, closed-off backend. My contribution will not help a community, but rather only a private company. Their claims about being 'by the community, for the community' simply just don't add up.

Proton as a non-profit

There are many reasons why I value non-profits. The first one is the organisation giving a promise from the get-go that they are not out to make big bucks, but rather to serve a goal. The second one is being so serious about this promise that they decide to organise this through a legal system that includes publishing documents detailing how your money is gotten and also how it is used, making it so that you don't even need to trust them in what they say they focus on - you can just go and check yourself.

The About Proton-page gives a brief summary of the company history. They were started in 2014 after crowdfunding and has grown big without ever forgetting their 'humble begginings' among other cliches. Fair enough, cliches exist for a reason. They also write about their 'non-profit structure'. This structure, however, is not actually being non-profit.

Protons services are owned, operated, and provided by Proton AG a Swiss for-profit company which is owned in majority by the Proton Foundation, a separate non-profit legal entity. If this seems confusing, it is simply because that is the goal; it allows Proton to talk as much as they want about non-profit ideals while not needing to stick to the non-profit rules.

I donate money to Signal. If I want to see how that money is spent or how the company is doing, I can even check their tax filings. For Proton, I can not.

I do not make this comparison randomly, as Proton themselves write in their Proton is transitioning towards a non-profit structure. After 760 words, they write:

While comparisons may be drawn to the non-profit Signal Foundation or Mozilla Foundation, the Proton Foundation seeks to tread a different path. (...) Proton must have a profitable and healthy business at its core. For this reason, our services will continue to be offered through the for-profit Swiss corporation Proton AG, which now operates under the supervision of the non-profit foundation, which is its primary shareholder.

Later on they claim that Proton is 'not profit-driven', which may be true, but unlike Signal, Mozilla, or a plethora of other non-profits, we are left with no way of checking. For talking so much about how transparency builds trust in their open source-segments, they sure don't seem to find that important when it comes to economics.

The 'end-to-end encrypted email'

On the Proton Mail-website, the company claims:

Proton Mail is the world’s largest end-to-end encrypted email service. Proton Mail makes sure no one can access your emails by using end-to-end encryption and zero-access encryption. All of Proton Mail’s encryption happens in the background, meaning anyone can use encrypted email, regardless of technical ability.

Assuming that we can take Protons word for it, this is partially true. Emails sent between two accounts on Proton Mail are allegedly encrypted with keys automatically provided to you by Proton on registration so that you can just use it™ without giving anything a second thought. They also use 'zero-access encryption' in which the data is encrypted once it reaches the server (so still readable by the server at arrival), only being decryptable with a private key. Funnily enough, the article they have descriing what 'zero-access encryption' is gives certain LLM-vibes and kind of contradicts itself:

Zero-access encryption protects data after it reaches the service by encrypting it so that only the user can decrypt it, even though the service may briefly access the data before encryption.

For example, Lumo, our private AI assistant, uses zero-access encryption: your conversations are encrypted on your device before being stored on Proton’s servers

And, on the Types of encryption-page, they say that "End-to-end encryption protects data in transit, while it moves between sender and recipient. Zero-access encryption extends that protection to storage" - though the end of which the data is encrypted is supposed to be you, not the proton mail server storage.

It's clear Proton themselves don't actually understand what this term entails. Not that weird, as it (unlike E2EE) is (to my knowledge) only used in marketing. Looking more into it, many of their 'what is (x) encryption' pages give a strange feeling of being LLM-written, further diminishing my trust in the company.

Anyways. Back to the mail page.

Even though the word "encrypted" is written there 8 times, Proton never highlights on this page that this only applies between two users of Proton Mail. A devils advocate might highlight that Protons offers this for all emails services due to inbuilt PGP, but this is only partially true (more on that later) and requires many more manual steps than "happens in the background".

Emails are handled over three main protocols: IMAP, POP3, and SMTP - none of which supports any encryption. When the email leaves your computer, it is sent as plain text and arrives at the server as plain text. It is also stored both at the server you send from and the one where it arrives, plus whatever middlemen that might intercept and devices that download the email locally. This is an undeniable truth and a limitation of the technology itself, not of the provider. This is part of the reason why so many other forms of encrypted communication has been made, such as Signal and Matrix. While Proton can increase security on their own servers by having the emails stored in an encrypted format, this also doesn't help to protect against much more than if someone gets access to the server - be it law enforcement, through a digital break in, or through a physical seizing of the server.

Now, over to the second problem.

E2EE works by having contents encrypted with a public key and later decrypted with a private key. In essence, this means that this information is unreadable for anyone who doesn't possess the private key.

GPG does this in a good way. You create your own keypair and store your key somewhere safe (usually your own computer, or if you're really cool, on a post-it you've put on your monitor). The encryption is enabled by you creating and managing your key yourself. You encrypt the contents of the email with the key locally on your PC, paste them into the email, and send the email to your recipient. The recipient downloads the email and decrypts it with the key they have locally on their PC. The key is not known to neither the email provider nor the email server. If you try to connect to your email-account from a different PC without the key available, the contents are unreadable.

Now. Here's a quick question.

What happens if I log out of all my proton accounts, travel to the other side of the globe, walk into the first library or internet café I find, and log on to mail.proton.me with my username and password?

The Disroot Privacy Policy actively specifies that "All emails, unless encrypted by the user (with GnuPG/PGP, for example) are stored unencrypted on our servers. Given that email works on a federated protocol, when interacting with email addresses hosted on third party servers (e.g. Gmail.com, Posteo.org), data is sent to other independently operated and owned servers in the network over which we have no control." Even if it sounds more scary, at least they are being honest about it and encouraging you to encrypt your stuff yourself.

Protons scope

When I signed up for Proton, it was smaller in scope. They provided an email, a VPN service, and had recently also started a calendar. At that point, I already felt that the focus was at times a bit thin. The calendar made a lot of sense though, as it's nice to have your email with all the RSVP-stuff synced directly to your schedule.

Today, Proton has gone a tiny bit further having these as well as "Drive", "Docs", "Sheets" (wonder where they got the names from), password manager, crypto wallet, an LLM for some reason, and now recently, an online conferencing tool called "Meet". Also wonder where they got that name from.

To me it feels like they're spreading their focus a bit thin, focusing on being an "everything"-platform rather than providing a main product as well as they can. Bitwarden has been maybe the best password manager for quite some time, and both Nextcloud and ownCloud are great at handling your files privately - Nextcloud even has an E2EE plugin. Jitsi, Jami, BigBlueButton, and even Matrix/Element can handle video conferencing, and their own 'chatgippity junior' feels like a product that just absolutely noone ever asked for (it's also being developed with a CLAUDE.md, not a LUMO.md). It feels as if the mission is no longer "providing this service as best as we can for everyone", but rather "providing a little bit of everything at an as passable level as possible".

Personally I'd rather see it the other way around.

Proton and what I believe to be a better internet.

Okay. Final section.

I touched on the Lumo AI above this. This is the opposite of what I believe to be a better internet. I Am An AI Hater summarizes my thoughts on this the best at the moment.

However, even though this is big, this was not the main part I was thinking of.

My reasoning for sticking with Proton has been "yeah it's not the best, but it's reputable so I can trust them and even if I disagree with a bunch of technical stuff at least the guys behind it are good guys". After one too many PR scandals though, there was one that I just can't stomach as well as the rest. Which is...

The CEO being a Trump man. And in a "originally-official-but-now-unofficial-after-backlash" comment, Protons official stance seems to have been "Until corporate Dems are thrown out, the reality is that Republicans remain more likely to tackle Big Tech abuses."

Um.

Here are some articles from 404media:

• Cops Search Thousands of Flock Cameras for Reasons of ‘LMAO,’ ‘IDK,’ ‘Hehe,’ and ‘asdfg’
• ‘We Did Not Invite You.’ Citizens Rage at Town Hall Over Proposed Nuclear AI Data Center
• Smear Campaign Says Anti-Flock Movement Is Chinese Propaganda
• The Republican Nominee for New York Governor Made a Creepy, AI-Generated Video of Mamdani and Hochul
• ICE Wants the Country’s Voter Data

Or literally anything else that has happened this presidential period.

Or Venezuela and Iran.

Youknow what I'm not even gonna write anymore on this. This segment explains itself pretty well.

Finishing words

I pay a yearly subscription for my Proton Mail which as already renewed for this year. Originally I had planned to wait until next year with swapping, but realizing that I could simply just change this into a VPN subscription has made me speed up this process a bit. While I'm not completely decided on where I'm going yet, Disroot currently looks like a very good alternative.

My end goal is to leave Proton completely, but for the time being it seems I will continue to use their VPN (at least until the subscription runs out). Afterwards, maybe I'll have a look at Airvpn or something else - this is a field I need to research more before I land on a decision. Before anyone recommends me Mullvad over email, I want to say that this is completely off-limits as their CEO almost single-handedly (over 70%) funds a horribly racist party in Sweden, a country where I have many friends who this party (and by extension CEO and by extension most influential person of company) do not want well.

I expect to have moved my email away from there within a month, and will run autoreply for a period afterwards. I will also consider migrating my emails over to my own domain instead of the one of the provider for easier portability in the future. I might also consider hosting it myself, although, oh god. There's a limit to how much pain I want to inflict onto myself.

For now though, I'll just do research on other good alternatives. Recommendations here are appreciated.

Reply via email

1. While the terms often refer to the same thing, they have two different angles. 'Free software' talks about the freedom and views having the source code available as a means to an end, whereas 'open source' only talks about said end. In general, the term free software is more about a movement to build a better world whereas open source is more about practical differences. See Why "Free Software" is better than "Open Source" for more info.
2. Worth noting that this term is kind of stupid. See wikipedia