ProtonMail

From Wikipedia, the free encyclopedia

ProtonMail
Protonmail logo.svg
ProtonMail screenshot.jpg
Screenshot of the ProtonMail website, showing the user's inbox and a composer window.
Type of site
Webmail
Available inEnglish, Catalan, Chinese, Dutch, French, German, Hungarian, Italian, Japanese, Polish, Romanian, Russian, Spanish, Turkish, Portuguese, Ukrainian
Headquarters
  Switzerland
OwnerProton Technologies AG, Geneva, Switzerland
URLprotonmail.com
CommercialYes
RegistrationRequired
Launched16 May 2014; 7 years ago (2014-05-16)
Current statusOnline
Client (for proprietary web service)
Repositorygithub.com/ProtonMail
Written inJavaScript and PHP
License
Website

ProtonMail is an end-to-end encrypted email service founded in 2013 in Geneva, Switzerland by scientists who spent time at the CERN research facility.[5] ProtonMail uses client-side encryption to protect email content and user data before they are sent to ProtonMail servers, unlike other common email providers such as Gmail and Outlook.com. The service can be accessed through a webmail client, the Tor network, or dedicated iOS and Android apps.[6]

ProtonMail is run by its parent company Proton Technologies AG, which is based in the Canton of Geneva.[7] The company also operates ProtonVPN, a VPN service. ProtonMail received initial funding through a crowdfunding campaign. Although the default account setup is free, the service is sustained by optional paid services. Initially invitation-only, ProtonMail opened up to the public in March 2016. In 2017, ProtonMail had over 2 million users,[8] and grew to over 5 million by September 2018,[9] 20 million by the end of 2019,[10] and over 50 million in 2020.[11]

History[]

Development[]

On 16 May 2014, ProtonMail entered into public beta.[12] It was met with enough response that after three days they needed to temporarily suspend beta signups to expand server capacity.[13] Two months later, ProtonMail received US$550,377 from 10,576 donors through a crowdfunding campaign on Indiegogo, while aiming for US$100,000.[14] During the campaign, PayPal froze ProtonMail's PayPal account, thereby preventing the withdrawal of US$251,721 worth of donations. PayPal stated that the account was frozen due to doubts of the legality of encryption, statements that opponents said were unfounded.[15][16] The restrictions were lifted the following day.[17]

On 18 March 2015, ProtonMail received US$2 million from Charles River Ventures and the Fondation Genevoise pour l'Innovation Technologique (Fongit).[18] On 14 August 2015, ProtonMail released major version 2.0, which included a rewritten codebase for its web interface. On 17 March 2016, ProtonMail released major version 3.0, which saw the official launch of ProtonMail out of beta. With a new interface for the web client, version 3.0 also included the public launch of ProtonMail's iOS and Android beta applications.[19]

On 19 January 2017, ProtonMail announced support through Tor, at the hidden service address protonirockerxow.onion.[20][21] On 21 November 2017, ProtonMail introduced ProtonMail Contacts, a zero-access encryption contacts manager. ProtonMail Contacts also utilizes digital signatures to verify the integrity of contacts data.[22] On 6 December 2017, ProtonMail launched ProtonMail Bridge, an application that provides end-to-end email encryption to any desktop client that supports IMAP and SMTP, such as Microsoft Outlook, Mozilla Thunderbird, and Apple Mail, for Windows and MacOS.[23]

On 25 July 2018, ProtonMail introduced address verification and Pretty Good Privacy (PGP) support, making ProtonMail interoperable with other PGP clients.[24] In December 2019, ProtonMail launched "ProtonCalendar", a fully encrypted calendar.[25]

The source code for the back-end remains closed source.[26][27] However, ProtonMail released the source code for the web interface under an open-source license.[28] ProtonMail also open sourced their mobile clients for iOS and Android,[29][30] as well the ProtonMail Bridge app.[31] All of their source code can be found on GitHub.

In September 2020, it was known that Protonmail has joined the Coalition for App Fairness which aims to gain better conditions for the inclusion of their apps in app stores.[32]

DDoS attacks[]

From 3 to 7 November 2015, ProtonMail was under several DDoS attacks that made the service largely unavailable to users.[33] During the attacks, the company stated on Twitter that it was looking for a new data center in Switzerland, saying, "many are afraid due to the magnitude of the attack against us".[34]

In July 2018, ProtonMail reported it was once more suffering from DDoS attacks. CEO Andy Yen claimed that the attackers had been paid by an unknown party to launch the attacks.[35] In September 2018, one of the suspected ProtonMail attackers was arrested by British law enforcement and charged in connection with a series of other high-profile cyberattacks against schools and airlines.[36]

Block in Belarus[]

On 15 November 2019, Proton confirmed that government of the Republic of Belarus had issued a block across the country of ProtonMail and ProtonVPN IP addresses. The block was no longer in place 4 days later. No explanation was given to ProtonMail for the block, nor for the block being lifted.[37]

Block in Russia[]

On 29 January 2020, the Russian Federal Service for Supervision of Communications, Information Technology and Mass Media reported that it had implemented a complete block of ProtonMail services within the Russian Federation.[38] As a reason for the block, it cited ProtonMail's refusal to give up information relating to accounts that allegedly sent out spam with terror threats.[39][40] However, ProtonMail claimed that it did not receive any requests from Russian authorities regarding any such accounts.[41][42] In response to the block, the ProtonMail Twitter account recommended legitimate users circumvent the block via VPNs or Tor.

In March 2020, the company announced that even though the Russia ban was not particularly successful and the service continues to be largely available in Russia without utilising a VPN, ProtonMail will be releasing new anti-censorship features in both ProtonMail and ProtonVPN desktop and mobile apps which will allow more block attempts to be automatically circumvented.[43]

Encryption[]

ProtonMail uses a combination of public-key cryptography and symmetric encryption protocols to offer end-to-end encryption. When a user creates a ProtonMail account, their browser generates a pair of public and private RSA keys:

  • The public key is used to encrypt the user's emails and other user data.
  • The private key capable of decrypting the user's data is symmetrically encrypted with the user's mailbox password.

This symmetrical encryption happens in the user's web browser using AES-256. Upon account registration, the user is asked to provide a login password for their account.

A lost login password can be recovered by sending an e-mail to Protonmail Support. Two of the questions that are asked, in order for Support to provide renewed access to the account are:

  • Do you remember to which addresses you have sent your last messages?
  • Do you remember the email subjects from the last sent messages?

This implies that these data are readable by support agents and hence by data analysis services. They constitute meta-data, so that networks of communicating accounts along with subject headers can be charted.

ProtonMail also offers users an option to log in with a two-password mode which requires a login password and a mailbox password.

  • The login password is used for authentication.
  • The mailbox password encrypts the user's mailbox that contains received emails, contacts, and user information as well as a private encryption key.

Upon logging in, the user has to provide both passwords. This is to access the account and the encrypted mailbox and its private encryption key. The decryption takes place client-side either in a web browser or in one of the apps. The public key and the encrypted private key are both stored on ProtonMail servers. Thus ProtonMail stores decryption keys only in their encrypted form so ProtonMail developers are unable to retrieve user emails or reset user mailbox passwords.[44] This system absolves ProtonMail from:

  • Storing either the unencrypted data or the mailbox password.
  • Divulging the contents of past emails but not future emails.
  • Decrypting the mailbox if requested or compelled by a court order.[45]

ProtonMail exclusively supports HTTPS and uses TLS with ephemeral key exchange to encrypt all Internet traffic between users and ProtonMail servers. Their 4096-bit RSA SSL certificate is signed by QuoVadis Trustlink Schweiz AG and supports Extended Validation, Certificate Transparency,[46] Public Key Pinning, and Strict Transport Security. Protonmail.com holds an "A+" rating from Qualys SSL Labs.[47]

In September 2015, ProtonMail added native support to their web interface and mobile app for PGP. This allows a user to export their ProtonMail PGP-encoded public key to others outside of ProtonMail, enabling them to use the key for email encryption. The ProtonMail team plans to support PGP encryption from ProtonMail to outside users.[48]

A drawback of keeping the mail bodies encrypted is that the ProtonMail servers cannot search within them while they can search for their metadata. The problems gets worse as the mail archives get larger and users have difficulties narrowing down their search targets. A workaround is using ProtonMail Bridge to download and decrypt the messages and search for them locally.[49]

Email sending[]

An email message sent from one ProtonMail account to another is automatically encrypted with the public key of the recipient. Once encrypted, only the private key of the recipient can decrypt the message. When the recipient logs in, their mailbox password decrypts their private key and unlocks their inbox.

Email messages sent from ProtonMail to non-ProtonMail email addresses may optionally be sent in plain text or with end-to-end encryption. With encryption, the message is encrypted with AES under a user-supplied password. The recipient receives a link to the ProtonMail website on which they can enter the password and read the decrypted message. ProtonMail assumes that the sender and the recipient have exchanged this password through a backchannel.[44] Such email messages can be set to self-destruct after a period of time.[50]

Location and security[]

Both ProtonMail and ProtonVPN are located in Switzerland to avoid any surveillance or information requests from countries under the Fourteen Eyes, and/or under government surveillance laws like the United States' Patriot Act or outside the bounds of law.

The company claims that it is also located in Switzerland because of its strict privacy laws.[51]

Data portability[]

ProtonMail limits data portability by locking support for external email client softwares through IMAP and POP3 protocols behind a paywall. As of 2021, users are unable to back up their email account locally without paying.[52]

Data centres[]

ProtonMail maintains and owns its own server hardware and network in order to avoid utilizing a third party. It maintains two data centres, one in Lausanne and another in Attinghausen (in the former K7 military bunker under 1,000 metres (3,300 ft) of granite rock) as a backup. Since the servers are located in Switzerland, they are legally outside of the jurisdiction of the European Union, United States, and other countries. Under Swiss law, all surveillance requests from foreign countries must go through a Swiss court and are subject to international treaties. Prospective surveillance targets are promptly notified and can appeal the request in court.[citation needed]

Each data centre uses load balancing across web, mail, and SQL servers, redundant power supply, hard drives with full disk encryption, and exclusive use of Linux and other open-source software. In December 2014, ProtonMail joined the RIPE NCC in an effort to have more direct control over the surrounding Internet infrastructure.[53]

Two-factor authentication[]

ProtonMail currently supports two-factor authentication with TOTP tokens for its login process.[54] As of October 2019, according to official ProtonMail blog, U2F support for YubiKey and FIDO physical security keys is currently under development and will be available soon after the release of v4.0.[55]

Account types[]

As of 13 March 2021, ProtonMail offers the following plans:[56]

Plan Messages Per Day Folders/Labels Storage Aliases Custom Domains Price Support
Free 150 3 500 MB 1 Address - Free Limited Support
Plus 1000 200 5 GB 5 Addresses 1 €5 /mo or €48 /yr Normal Support [c 1]
Professional Unlimited Unlimited 5 GB 5 Addresses/User 2 €8 /mo or €75 /yr Priority Support [c 1]
Visionary Unlimited Unlimited 20 GB 50 Addresses 10 €30 /mo or €288 /yr Priority Support [c 1][c 2]
  1. ^ Jump up to: a b c Custom domains can use SPF, DKIM, and DMARC[57]
  2. ^ ProtonVPN included[56]

In popular culture[]

ProtonMail was mentioned in the 2015 Bear Grylls novel Ghost Flight.[58]

ProtonMail was featured in seasons 1, 3, and 4 of the American TV drama series Mr. Robot.[59]

ProtonMail was also featured in the 2019 films Sound of Metal and Knives Out.[60]

See also[]

References[]

  1. ^ "license.md". github.com/ProtonMail/WebClient. Proton Technologies A.G. 8 June 2016.
  2. ^ "iOS mobile app repository". github.com/ProtonMail/ios-mail. Proton Technologies A.G. 11 December 2019.
  3. ^ "Android mobile app repository". github.com/ProtonMail/proton-mail-android. Proton Technologies A.G. 24 April 2020.
  4. ^ "Proton bridge repository". github.com/ProtonMail/proton-bridge. Proton Technologies A.G. 24 April 2020. Retrieved 24 April 2020.
  5. ^ O'Luanaigh, Cian (23 May 2014). "CERN inspires entrepreneurs for email encryption". CERN. Retrieved 22 May 2020.
  6. ^ "ProtonMail, the Easy-to-Use Encrypted Email Service, Opens Up to the Public". 17 March 2016.
  7. ^ "Registre du Commerce du Canton de Genève". République et canton de Genève. 18 July 2014. Retrieved 20 February 2018.
  8. ^ "Fighting Censorship with ProtonMail Encrypted Email Over Tor". ProtonMail Blog. 19 January 2017. Retrieved 20 January 2017.
  9. ^ https://www.inverse.com/article/49041-protonmail-ceo-andy-yen-interview
  10. ^ "Changing the Business Model of the Internet". Aperture. 13 February 2020. Retrieved 7 April 2021.
  11. ^ https://www.theinformation.com/articles/how-protonmail-is-fighting-big-tech
  12. ^ "ProtonMail Unveils an Overdue Makeover and New Features". Gizmodo. Retrieved 6 July 2021.
  13. ^ "Über-Secure ProtonMail Beta Maxes Out Servers in Just 60 Hours". Infosecurity Magazine. 22 May 2014. Retrieved 19 October 2015.
  14. ^ Yen, Andy (31 July 2014). "ProtonMail". Indiegogo. Retrieved 19 October 2014.
  15. ^ Halfacree, Gareth (1 July 2014). "ProtonMail hit by PayPal account freeze". bit-tech. Retrieved 19 October 2015.
  16. ^ Howell O'Neill, Patrick (1 July 2014). "PayPal freezes account of email encryption startup ProtonMail [Update]". The Daily Dot. Retrieved 19 October 2015.
  17. ^ Yen, Andy (30 June 2014). "Paypal Freezes ProtonMail Campaign Funds". ProtonMail Blog. Retrieved 19 October 2015.
  18. ^ Yen, Andy (18 March 2015). "ProtonMail has raised $2M USD to protect online privacy". ProtonMail Blog. Retrieved 19 October 2015.
  19. ^ "Announcement: ProtonMail has launched worldwide!". ProtonMail Blog. 17 March 2016. Retrieved 21 July 2016.
  20. ^ "Fighting Censorship with ProtonMail Encrypted Email Over Tor". ProtonMail Blog. 19 January 2017. Retrieved 27 January 2017.
  21. ^ Martin, Alexander J. (19 January 2017). "ProtonMail launches Tor hidden service to dodge totalitarian censorship". The Register. Archived from the original on 20 January 2017.
  22. ^ "Introducing ProtonMail Contacts – the world's first encrypted contacts manager". ProtonMail Blog. 21 November 2017.
  23. ^ M., Irina (6 December 2017). "Introducing ProtonMail Bridge, email encryption for Outlook, Thunderbird, and Apple Mail". ProtonMail Blog. Retrieved 16 December 2017.
  24. ^ "Introducing Address Verification and Full PGP Support - ProtonMail Blog". ProtonMail Blog. 25 July 2018. Retrieved 28 September 2018.
  25. ^ Koch, Richie. "Mark the date! The ProtonCalendar beta is here". protonmail.com. Retrieved 24 January 2021.
  26. ^ "ProtonMail responds on Twitter". We don't have a stand-alone back-end that can be installed for small deployment, because our backend software is optimized for large deployments with millions of users and distributed infrastructure.
  27. ^ "ProtonMail responds on Reddit". We don't plan to open source the back-end code, because it doesn't add trust (users can't verify what code is running on the backend) and doing so would given away information about how we do anti-spam and anti-abuse.
  28. ^ "ProtonMail goes Open Source with version 2.0". ProtonMail Blog. 13 August 2015. Retrieved 31 January 2016.
  29. ^ "ProtonMail iOS app is open source". ProtonMail Blog. 30 October 2019. Retrieved 12 December 2019.
  30. ^ "The ProtonMail Android app is open source". ProtonMail Blog. 23 April 2020. Retrieved 24 April 2020.
  31. ^ "ProtonMail Bridge is open source on macOS, Windows, and Linux". ProtonMail Blog. 15 April 2020. Retrieved 24 April 2020.
  32. ^ Amadeo, Ron (24 September 2020). "Epic, Spotify, and others take on Apple with "Coalition for App Fairness"". Ars Technica. Retrieved 26 September 2020.
  33. ^ Leyden, John (5 November 2015). "ProtonMail still under attack by DDoS bombardment". The Register. Retrieved 5 November 2015.
  34. ^ @ProtonMail (5 November 2015). "We are seeking a datacenter in Switzerland brave enough to host ProtonMail, many are afraid due to the magnitude of the attack against us" (Tweet) – via Twitter.
  35. ^ Lynch, Justin (2 July 2018). "ProtonMail CEO: 'The attacks are continuing'". Fifth Domain. Sightline Media Group.
  36. ^ "Apophis Squad member responsible for attacks against ProtonMail has been arrested - ProtonMail Blog". ProtonMail Blog. 6 September 2018. Retrieved 28 September 2018.
  37. ^ https://protonmail.com/blog/blocked-belarus/
  38. ^ Tsydenova, Nadezhda; Ivanova, Polina (29 January 2020). Heinrich, Mark (ed.). "Russia blocks encrypted email service ProtonMail". Reuters.
  39. ^ "Почтовый сервис ProtonMail заблокировали в России из-за сообщений о минированиях". www.kommersant.ru (in Russian). 29 January 2020. Retrieved 29 January 2020.
  40. ^ Reuters (29 January 2020). "Russia Blocks Encrypted Swiss Email Service ProtonMail". The Moscow Times. Retrieved 29 January 2020.
  41. ^ "Protonmail не получала просьб о помощи в поисках лжеминеров". Interfax.ru (in Russian). Retrieved 29 January 2020.
  42. ^ "Россия не обращалась за информацией о "минерах", заявили в ProtonMail". РИА Новости (in Russian). 29 January 2020. Retrieved 29 January 2020.
  43. ^ ProtonMail (13 March 2020). "We are rolling out technologies which will help us better overcome attempts to block ProtonMail". Reddit. Retrieved 14 March 2020.
  44. ^ Jump up to: a b Stockman, Jason (22 May 2014). "How are ProtonMail keys distributed?". Stack Exchange. Retrieved 19 October 2015.
  45. ^ Khandelwal, Swati (26 May 2014). "ProtonMail: 'NSA-Proof' End-to-End Encrypted Email Service". The Hacker News. Retrieved 19 October 2015.
  46. ^ "SSL Certificate Update". Qualys SSL Labs. 19 January 2016. Retrieved 31 January 2016.
  47. ^ "SSL Report: protonmail.com". Qualys SSL Labs. 7 March 2016. Retrieved 7 March 2016.
  48. ^ Yen, Andy (22 September 2015). "ProtonMail adds Facebook PGP integration". ProtonMail Blog. Retrieved 19 October 2015.
  49. ^ "How to perform an advanced search". ProtonMail Support.
  50. ^ "ProtonMail Security Details". ProtonMail Security. 31 January 2016. Retrieved 31 January 2016.
  51. ^ "ProtonVPN - About Us". ProtonVPN. Retrieved 16 July 2021.
  52. ^ https://protonmail.com/support/knowledge-base/export-import-emails/
  53. ^ Yen, Andy (17 December 2014). "ProtonMail RIPE announcement". ProtonMail Blog. Retrieved 16 July 2021.
  54. ^ "Two Factor Authentication (2FA)". ProtonMail Support.
  55. ^ "If you aren't using two-factor authentication, your accounts are vulnerable". Customer Feedback for ProtonMail. 10 October 2019. Retrieved 29 May 2020.
  56. ^ Jump up to: a b "ProtonMail - Pricing". ProtonMail. Retrieved 13 March 2021.
  57. ^ "Anti-spoofing for Custom Domains (SPF, DKIM & DMARC)". ProtonMail. 2016.
  58. ^ Grylls, Bear (2015). Ghost Flight.
  59. ^ Yen, Andy (25 August 2015). "ProtonMail on Mr. Robot". ProtonMail Blog. Retrieved 18 March 2018.
  60. ^ ProtonMail (13 December 2019). "Protonmail in Knives Out!". Reddit. Retrieved 13 March 2021.

External links[]

Retrieved from ""