As they say it, this requires that you previously shared a password with the recipient by some unspecified mean. They mean that when the recipient is not a ProtonMail registered user, they send a normal email with an embedded link to their site, so that the user may download the encrypted email and the piece of Javascript that decrypts it. Securely communicate with other email providers. It works well and no Web service can protect against that (only network-wide systems like Tor stand a theoretical chance to defeat traffic analysis). On a similar note, even if the site operators are idealist enough not to log anything, eavesdropping on the network provider side is enough to get a lot of metadata and, e.g., work out who talks to who. Almost invariably, the claim of not logging turns out to be fake after a while. if the service is used to coordinate some terrorist actions). They claim not to log anything however, experience of past anonymous remailers shows that the logs are the only thing that stands between the remailer operators and jail, in some extreme cases (e.g. I don't believe that one, at least not in the long term. Taking into account the pitfalls of doing crypto in Javascript.Īnonymous. This is possible, if encryption is Javascript-based on the sender's browser, and decryption is again Javascript-based on the recipient's browser. If they want to read your messages without you noticing it, they can.Įnd-to-End Encryption. Even if all encryption technically occurs in your browser, that would still be done using the Javascript code that they send to you every time you connect to their service. When you write your message, you do it in their Web site. Electrons don't have a nationality, and, contrary to a piece of paper, an electronic message does not have a well defined geographic position at all times. However, they suggest that by being a 'Swiss service', the data immediately come under the cover of Swiss law, which is a rather bold statement. Switzerland is a real country and there are people who live there.

Well, I see no reason to find this implausible.

Now let's see the claims of that 'ProtonMail' service: At best, the service may be honest and do its best not to have a look at the messages at they flow. Strictly speaking it is not possible, for the following reason: if the Web service encrypts the message, then the Web service gets to see the unencrypted message at some point (note: I write service, not server).

Proton encrypted email