Beware ProtonMail

In this episode of ‘Connor Complains About Things’…

I’ve been a customer of ProtonMail for well over a year at this point. ProtonMail is a service that employs at-rest encryption and offers greater privacy than, say, Gmail. I started using ProtonMail as an attempt to wean myself off of Google services, which I did eventually achieve. On paper, it looked like a good choice, but as a post I recently saw on HN pointed out to me, the service is mostly a security theater.

Before you read any further, keep in mind that I’m hard to please and you shouldn’t take my opinion as fact. Try it for yourself or read reviews from others.

False Claims

Let’s start with the surface details. On ProtonMail’s Security page, they claim to offer end-to-end encryption. End-to-end encryption with current generation email protocols is not possible. I’m not the first to point this out – Nadim Kobeissi wrote an interesting paper in which he analyses ProtonMail’s cryptographic architecture and determines that E2EE is not guaranteed – unless using PGP encryption (a terrible workaround which should not exist), but there’s no mention of it on this page, which I believe is both intentional and disingenuous.

Closed Source

I’m disappointed in ProtonMail’s choice to keep a large portion of their software closed source, including their Bridge client which allows for traditional IMAP clients to fetch emails from the service. ProtonMail’s backend is also completely closed source, and I don’t think users shouldn’t be kept in the dark from the code that processes their important data, especially on a service that boasts about the security it offers. Whilst they have open sourced their frontend, it’s entirely possible for a malicious, altered version of the site to be served without the user’s knowledge making the proprietary Bridge the only truly secure way of accessing emails. This should make alarm bells ring.

Closed API

It’s not realistic to build your own client either. ProtonMail have chosen to keep their API private for unclear reasons, forcing developers to reverse engineer the API to interact with the service programmatically. Naturally, projects built from such reverse engineering are liable to breakage due to undocumented API changes and behaviour.

Slow Updates

Features come out at a snail’s pace on ProtonMail. Of course, I’m not suggesting for a moment that they “move fast and break things”. Users have been asking for features such as U2F (a form of two-factor authentication) for years, and the response from the team nearly always seems to be along the lines of “we’re working on it”.

Lack of Control

With ProtonMail, I don’t feel like I have much control. If I want to disassociate/delete an alias, I can’t. If I want to re-encrypt my emails with a new encryption key, I can’t. If I want to find out whether authentication logs are encrypted, I can send support an email and hope for a coherent response.