Email is an open system, right? Anyone can send a message to anyone... unless they are on Gmail! School Interviews uses two email servers t...

Email is an open system, right? Anyone can send a message to anyone… unless they are on Gmail! School Interviews uses two email servers t…

  • aebrer@kbin.social
    5·
    1 year ago

    I switched to ProtonMail and have really enjoyed it. I was using my own domain with Gmail so my email address didn’t even change.

    • sab@kbin.social
      4·
      1 year ago

      For those considering Proton Mail: There is one great benefit or disadvantage, depending on how you see it. As all traffic is encrypted, Proton Mail does not support standard IMAP or POP3. It’s therefore best used with the official Proton Mail app rather than third party apps. On desktop, you can use your favourite email client (Thunderbird et al) only if you install a “bridge” which decrypts incoming emails before forwarding them to the client: this bridge is, in turn, only available to paying subscribers.

      That said, it’s a great service, and the fact that they have a viable business model which doesn’t depend on selling out their users might be a good thing.

        • sab@kbin.social
          2·
          1 year ago

          Proton is end-to-end encrypted - they don’t have the keys themselves. With TLS, encryption is between you and the server, but the information can be decrypted on the server side.

          At least that’s my understanding of it. If you want Proton’s own words, they wrote an explanation on their website. :)

    • Kaldo@kbin.social
      1·
      1 year ago

      Any advice or hints on how to switch over? I wanted to do it years ago but I dread having to change my main mail address on everything, from apps, tools and games to bills or RL document-related stuff, it sounds like a horrible mess and ton of work

      • aebrer@kbin.social
        3·
        1 year ago

        My recommendation (assuming you have a normal @gmail addy and not a custom domain like I had) would be to use email forwarding. So you can leave your Gmail as is, but set it up (in the settings) to automatically forward all your email to your new protonmail address. Then you can gradually change the important contacts/sites to your new email at your leisure.

        I do highly recommend buying a domain and setting up your own email address though, it gives you a lot more portability going forward. You can actually do a lot with your own domain, and it helps you maintain trust better.

        Anyway, enough preaching lol, protonmail also maintains a guide to help people switch: https://proton.me/easyswitch

        • dorkian-gray@kbin.social
          0·
          1 year ago

          If you’re recommending setting up a forward/IMAP collection from a Gmail account, don’t forget to mention deleting the messages from the server as well! Emails left on a server for more than 30 days are considered “abandoned property” for the purposes of warrantless search.

            • pjhenry1216@kbin.social
              1·
              1 year ago

              The most I could find is that the Electronic Communications Privacy Act allows for warrants to be issued for emails less than 180 days old. I’ve found vague references and snippets from articles no longer available that seem to claim some acts that have passed since then allow for simple subpoenas instead of full on warrants for said emails, but 180 days is the only threshold I’ve found and again, it’s for less than 180 days that’s at danger.

      • pjhenry1216@kbin.social
        2·
        1 year ago

        Can you describe what part? If it’s the lack of IMAP it’s because ProtonMail does not act as a typical mailbox. There’s a nonzero chance you can lose all of your email (you need to lose access to your account and access to all of your devices at the same time). Your email is only “readable” at the time of transmission (ie when it’s actively being sent or received). Your received emails (and copies of your sent email) are then one-way encrypted by Proton in your inbox. Your private key that can decrypt them is stored on Proton’s servers, but that key is encrypted with your password and that password is only stored via one-way hash on their servers (you can see where a loss of access now becomes slightly possible). When your Proton client accesses the mailbox, it receives the content and decrypts it locally. Proton has absolutely zero ways of decrypting your email on their own. And their SMTP server does not save a copy of your emails in transit. This is why you’ll see “zero access encryption data at rest” used in reference to Proton. Data at rest is basically data that is stored on an effectively "permanent"medium (ie not RAM, and there are caveats, but they’re edge cases). So when your email is just sitting there (at rest), no one but you can read them. Proton can’t even be forced legally to hand them over because they couldn’t do so even if they wanted to. It’s virtually the most secure email can be out of the box, aside from key management which is still really secure (them having even an encrypted version of your key makes it slightly more vulnerable). If you setup email encryption (ie, something like PGP or GPG), you can make it even more secure, but that has all the same caveats as it does elsewhere. The recipient needs your public key and you need their public key.