10 ms·

> Is there anything preventing Proton from disclosing the email content or metadata? Mmh.. The fact that it is encrypted client-side ? I mean the code is open-

by redat00 6mo ago

> Is there anything preventing Proton from disclosing the email content or metadata? Mmh.. The fact that it is encrypted client-side ? I mean the code is open-source fgs. [0][1][2] [0]https://github.com/ProtonMail/android-mail https://github.com/ProtonMail/android-mail [1]https://github.com/ProtonMail/ios-mail https://github.com/ProtonMail/ios-mail [3]https://github.com/ProtonMail/WebClients https://github.com/ProtonMail/WebClients

streetfighter64 6mo ago
Yeah, if you trust that they will never push a backdoor to your client on the request of Swiss law enforcement. It's a web app "fgs". They also admit to scanning all mail to and from non-Proton accounts "for spam". So what's stopping them from one day adding a small if statement that just writes that data to disk, for specific "interesting" users? Regarding metadata, I sure hope you have nothing to hide in the below emphasized: > Account Activity: Due to limitations of the SMTP protocol, we have access to the following email metadata: *sender and recipient email addresses, the IP address incoming messages originated from, attachment name, message subject, and message sent and received times*. We do NOT have access to encrypted message content, but unencrypted messages sent from external providers to your Account, or from Proton Mail to external unencrypted email services, are scanned for spam and viruses to pursue the legitimate interest of protecting the integrity of our Services and users. Such inbound messages are scanned for spam in memory, and then encrypted and written to disk. We do not possess the technical ability to scan the content of the messages after they have been encrypted. We also have access to the following records of Account activity: number of messages sent, amount of storage space used, total number of messages, last login time. User data is never used for advertising purposes.
- redat00 6mo ago
  https://datatracker.ietf.org/doc/html/rfc5321 https://datatracker.ietf.org/doc/html/rfc5321
  - streetfighter64 6mo ago
    Please quote where in that document the answer to my question is: > Is there anything preventing Proton from disclosing the email content or metadata? Also please link me to the source code of Proton's server-side code, so I can audit their scanning of all incoming and outgoing mail, to verify it's not logging them. What you linked above is just the clients.
    - Yiin 6mo ago
      that's why they have independent audits.

by redat00 6mo ago

streetfighter64 6mo ago

Yeah, if you trust that they will never push a backdoor to your client on the request of Swiss law enforcement. It's a web app "fgs". They also admit to scanning all mail to and from non-Proton accounts "for spam". So what's stopping them from one day adding a small if statement that just writes that data to disk, for specific "interesting" users? Regarding metadata, I sure hope you have nothing to hide in the below emphasized: > Account Activity: Due to limitations of the SMTP protocol, we have access to the following email metadata: *sender and recipient email addresses, the IP address incoming messages originated from, attachment name, message subject, and message sent and received times*. We do NOT have access to encrypted message content, but unencrypted messages sent from external providers to your Account, or from Proton Mail to external unencrypted email services, are scanned for spam and viruses to pursue the legitimate interest of protecting the integrity of our Services and users. Such inbound messages are scanned for spam in memory, and then encrypted and written to disk. We do not possess the technical ability to scan the content of the messages after they have been encrypted. We also have access to the following records of Account activity: number of messages sent, amount of storage space used, total number of messages, last login time. User data is never used for advertising purposes.

redat00 6mo ago
https://datatracker.ietf.org/doc/html/rfc5321 https://datatracker.ietf.org/doc/html/rfc5321
- streetfighter64 6mo ago
  Please quote where in that document the answer to my question is: > Is there anything preventing Proton from disclosing the email content or metadata? Also please link me to the source code of Proton's server-side code, so I can audit their scanning of all incoming and outgoing mail, to verify it's not logging them. What you linked above is just the clients.
  - Yiin 6mo ago
    that's why they have independent audits.