ThePythonicCow
23rd January 2015, 08:55
Ever since the US Government forced Lavabit (http://en.wikipedia.org/wiki/Lavabit) to shutdown in August 2013, and a similar email service Silent Circle (http://en.wikipedia.org/wiki/Silent_Circle_%28software%29) shutdown one day later, because they "could see the handwriting on the wall", there has not been a good free, secure, encrypted, but easy to use email service.
Now, there is one: ProtonMail.ch (https://protonmail.ch/).
There is a waiting line to get an account - I waited 5 months to get my account. You can now send email to my account pauljackson@protonmail.ch, and if you are sending that email from another ProtonMail.ch (https://protonmail.ch/) account, it will be securely encrypted, all the way from your computer, to mine, with no one in between, not even ProtonMail, having the decryption keys.
At some point, perhaps already, once they have enough server hardware online, the waiting time will be reduced to open a new account.
ProtonMail runs all their own server hardware and systems, in order to minimize the risk of some hack being placed in their servers. However even if their servers were hacked, this would not necessarily compromise the security of email sent through them, as email between two ProtonMail accounts is encrypted end-to-end, from the sender's computer to the receiver's. So long as the end users computers aren't compromised, and no one is able to sneak in some hack into the Javascript code that does the encrypting/decrypting, then it would be difficult even for the NSA to spy on what is sent.
ProtonMail was initially funded by an IndieGoGo campaign that ended in July 2014, that raised $US 550,377 (and their goal was only $US 100,000).
They expect to sell premium accounts for money, to fund ongoing operations when that initial funding runs out, but they are committed to keeping the basic account Free, forever. Currently my free pauljackson@protonmail.ch account provides me with 500 MB of email message storage and allows me to send 1000 messages per month. That's plenty for my secure email needs, though I will still be maintaining a separate Fastmail.fm account as my main email service: jackson@fastmail.fm.
Here are the opening comments from a few articles about ProtonMail. Follow the link provided for each article to read more of the article.
From ProtonMail Is A Swiss Secure Mail Provider That Won’t Give You Up To The NSA (TechCrunch.com) (http://techcrunch.com/2014/06/23/protonmail-is-a-swiss-secure-mail-provider-that-wont-give-you-up-to-the-nsa/):
===============
https://tctechcrunch2011.files.wordpress.com/2014/06/protonmail.jpg?w=738
In the wake of the Lavabit’s demise and increased interest in secure mail services, Switzerland-based ProtonMail (https://protonmail.ch/) is looking to zap a little life into the old PGP mail server market. Currently crowdfunded far past its goal (https://www.indiegogo.com/projects/protonmail/) of $100,000, the service wants to make it cheap and easy to get a secure email account with just enough paranoia built in to keep you safe.
I asked one of the creators, co-founder Andy Yen, why we should trust them. He said we didn’t have to.
“One of our goals is actually to build a system that does not require trusting us,” he said. “We’ve taken the first step with our zero access architecture which means we cannot actually read any of our users’ encrypted messages. When the code base becomes more mature, we also plan to open source the ProtonMail software.”
The service works by encrypting all the messages in the user’s web browser before it even reaches the ProtonMail servers. This means ProtonMail doesn’t hold the password and can never decrypt user messages. It’s this unique proposition — that there is no way to get everyone’s email if the server is compromised — that seems to have struck a chord with backers.
===============
From NSA-proof email? ProtonMail delivers (GeekSided) (http://geeksided.com/2014/05/21/nsa-proof-email-protonmail-delivers/):
===============
Nobody needs to be reminded about the NSA spying revelations and the very wide net that spying cast. If you’re reading this, the NSA has enough information about you that you’d feel embarrassed if they decided to share it. One of the ways they did (or do) this is intercepting email, which is disturbingly easy to do. ProtonMail (https://protonmail.ch/) wants to make that more difficult.
For instance, as we reported (http://geeksided.com/2014/05/16/google-emails-whether-like/) on just a few days ago, Google gets its hands on the majority of emails sent nowadays. And when somebody has all of these easy-to-access emails, those emails are vulnerable to being snooped on. Lo and behold, the NSA broke into (http://www.gettingthingstech.com/gmail-will-now-encrypt-emails-protect-nsa/) Google’s private data centers and had virtually carte blanche access to all user data for quite a while, which includes the content of emails.
Ever since, it’s been hard for many people to figure out what a secure way to send emails would be. First, we need a little history.
The original private email providers go down
Lavabit was the industry leader in this sort of email and it is believed Edward Snowden used Lavabit to communicate once he went rogue from the NSA. See, Lavabit was an extremely secure email service with user privacy as its focus. Emails were always encrypted and unusable for even Lavabit, since they didn’t have the decryption keys (those only belong to the users).
The US government demanded (http://www.wired.com/2013/10/lavabit_unsealed) Lavabit build a backdoor in their technology to record email metadata (sender and receiver addresses, subject titles, etc.), something they weren’t willing to do. Not only would this jeopardize Snowden’s communications, but everyone that uses Lavabit. Obviously, at the time, this was all secret so as not to tip off the spying targets.
The government wrote in the charges against Lavabit for contempt of court, “The representative of Lavabit indicated that Lavabit had the technical capability to decrypt the information, but that Lavabit did not want to ‘defeat [its] own system.”
Instead of help the US government have unfettered access to its users, Lavabit decided to close down. Even with that measure, Lavabit’s owner, Ladar Levison, could find himself imprisoned. Snowden called (http://www.nbcnews.com/news/other/lavabit-com-owner-i-could-be-arrested-resisting-surveillance-order-f6C10908072) that decision “inspring.”
That’s better than HushMail, the “secure” email provider that turned over (http://www.wired.com/2007/11/encrypted-e-mai/) clear-text copies of email content to authorities when asked in 2007.
Another secure provider, Silent Mail, decided to shut down (http://www.huffingtonpost.com/2013/08/09/silent-circle-shutting-down-encripted-email_n_3732779.html) after hearing about Lavabit’s fate. While they continue to run their other Silent Circle offerings, it was decided that email by its nature was just too vulnerable to guarantee security.
Enter ProtonMail
Seeing the fate of Lavabit and knowing the need for email security after all of the attention paid to the government surveillance, three Harvard and MIT students teamed together to create a new alternative. Where did they meet? Well, they just happened to be working at CERN, which is where the discovery of the so-called “God” particle took place. Over lunch, they decided to put their efforts towards something completely different: it became ProtonMail.
===============
From Best Secure & Encrypted Email Providers (VPNPick.com) (http://vpnpick.com/best-secure-encrypted-email-providers/):
===============
The one that stuck out the most over all other secure email services is ProtonMail. When the leaked documents by whistleblower Edward Snowden first surfaced, scientists at CERN (http://home.web.cern.ch/), the European Organization for Nuclear Research, discussed their concerned over NSA surveillance and other programs alike. A group of physicists and engineers collectively put their massive computing capabilities to work at creating and secure email service like no other.
ProtonMail was born and it quickly gained notoriety among the privacy community with its bold stance against government surveillance. They kept full control of all their mail servers in Switzerland to avoid any forced shut downs or requirements to provide any server data to U.S. or other foreign surveillance organizations. Forbes has called ProtonMail “the only email system the NSA can’t access” (http://www.forbes.com/sites/hollieslade/2014/05/19/the-only-email-system-the-nsa-cant-access/) but what makes them better than most other encrypted email providers? Even Gmail now offers some level of end-to-end encryption.
ProtonMail had a huge response to their Beta launch and are currently at full server capacity and expansion is underway. You can still head to their website and reserve your own @protonmail.ch (https://protonmail.ch/) address and invitations will be sent out as soon as server capacity allows.
ProtonMail offers full end-to-end email encryption, from start to destination. The encryption happens at the user’s level, making it impossible for ProtonMail to have ever seen the original content. The email is already encrypted when it reaches their Switzerland servers and the recipient’s email password is the only key to that email.
Unlike most other secure email providers, ProtonMail does not require any kind of setup, allowing just about anyone to easily use the website on their browser on all devices thanks to a clean responsive design.
ProtonMail does not have the keys to decrypt any of the emails sent across their network, unlike services like Gmail, who do have the power to decrypt email messages. If authorities would request keys, they would not even have that possibility, only retaining encrypted data on the servers.
Strategically based in Switzerland, ProtonMail will decline any third party requests from overseas organizations or governments. Local government values privacy and has a very low wiretapping and data seizure track record, used explicitly to prevent crime.
ProtonMail has refused offers from various investors to keep their integrity intact. Instead, they have opted for crowd funding methods to keep them afloat, allowing their user base community to donate to the cause, while keeping conflict of interest investors at bay. This decision has proven to be fruitful as they have recently surpassed 200% of their latest campaign goal amount.
ProtonMail will be offered free of cost, but with limited storage. As an additional revenue stream, users will be able to pay $5 for 1Gig of inbox storage. The funds are essentially for expansion and maintenance of the infrastructure.
===============
What are the vulnerabilities? There always are some; if some well funded agency wants my data bad enough, they will have it. Someone could get a bug into my computer, which is not in a highly secure environment protected by three layers of carefully vetted and armed guards (who would be no match for the US Military anyway.) Someone could force ProtonMail to sneak a hack into their Javascript code that downloads to each user who encrypts or decrypts email, where the hack leaked the data to someone else. Someone could send a couple of goons to visit me, who could easily get whatever they want out of me after less than a minute of physical brutality.
But ... so far at least ... I don't see anyway for the NSA to bulk collect and read such email, and I don't see a way for a less well funded organization to look at my email without my knowledge.
Now, there is one: ProtonMail.ch (https://protonmail.ch/).
There is a waiting line to get an account - I waited 5 months to get my account. You can now send email to my account pauljackson@protonmail.ch, and if you are sending that email from another ProtonMail.ch (https://protonmail.ch/) account, it will be securely encrypted, all the way from your computer, to mine, with no one in between, not even ProtonMail, having the decryption keys.
At some point, perhaps already, once they have enough server hardware online, the waiting time will be reduced to open a new account.
ProtonMail runs all their own server hardware and systems, in order to minimize the risk of some hack being placed in their servers. However even if their servers were hacked, this would not necessarily compromise the security of email sent through them, as email between two ProtonMail accounts is encrypted end-to-end, from the sender's computer to the receiver's. So long as the end users computers aren't compromised, and no one is able to sneak in some hack into the Javascript code that does the encrypting/decrypting, then it would be difficult even for the NSA to spy on what is sent.
ProtonMail was initially funded by an IndieGoGo campaign that ended in July 2014, that raised $US 550,377 (and their goal was only $US 100,000).
They expect to sell premium accounts for money, to fund ongoing operations when that initial funding runs out, but they are committed to keeping the basic account Free, forever. Currently my free pauljackson@protonmail.ch account provides me with 500 MB of email message storage and allows me to send 1000 messages per month. That's plenty for my secure email needs, though I will still be maintaining a separate Fastmail.fm account as my main email service: jackson@fastmail.fm.
Here are the opening comments from a few articles about ProtonMail. Follow the link provided for each article to read more of the article.
From ProtonMail Is A Swiss Secure Mail Provider That Won’t Give You Up To The NSA (TechCrunch.com) (http://techcrunch.com/2014/06/23/protonmail-is-a-swiss-secure-mail-provider-that-wont-give-you-up-to-the-nsa/):
===============
https://tctechcrunch2011.files.wordpress.com/2014/06/protonmail.jpg?w=738
In the wake of the Lavabit’s demise and increased interest in secure mail services, Switzerland-based ProtonMail (https://protonmail.ch/) is looking to zap a little life into the old PGP mail server market. Currently crowdfunded far past its goal (https://www.indiegogo.com/projects/protonmail/) of $100,000, the service wants to make it cheap and easy to get a secure email account with just enough paranoia built in to keep you safe.
I asked one of the creators, co-founder Andy Yen, why we should trust them. He said we didn’t have to.
“One of our goals is actually to build a system that does not require trusting us,” he said. “We’ve taken the first step with our zero access architecture which means we cannot actually read any of our users’ encrypted messages. When the code base becomes more mature, we also plan to open source the ProtonMail software.”
The service works by encrypting all the messages in the user’s web browser before it even reaches the ProtonMail servers. This means ProtonMail doesn’t hold the password and can never decrypt user messages. It’s this unique proposition — that there is no way to get everyone’s email if the server is compromised — that seems to have struck a chord with backers.
===============
From NSA-proof email? ProtonMail delivers (GeekSided) (http://geeksided.com/2014/05/21/nsa-proof-email-protonmail-delivers/):
===============
Nobody needs to be reminded about the NSA spying revelations and the very wide net that spying cast. If you’re reading this, the NSA has enough information about you that you’d feel embarrassed if they decided to share it. One of the ways they did (or do) this is intercepting email, which is disturbingly easy to do. ProtonMail (https://protonmail.ch/) wants to make that more difficult.
For instance, as we reported (http://geeksided.com/2014/05/16/google-emails-whether-like/) on just a few days ago, Google gets its hands on the majority of emails sent nowadays. And when somebody has all of these easy-to-access emails, those emails are vulnerable to being snooped on. Lo and behold, the NSA broke into (http://www.gettingthingstech.com/gmail-will-now-encrypt-emails-protect-nsa/) Google’s private data centers and had virtually carte blanche access to all user data for quite a while, which includes the content of emails.
Ever since, it’s been hard for many people to figure out what a secure way to send emails would be. First, we need a little history.
The original private email providers go down
Lavabit was the industry leader in this sort of email and it is believed Edward Snowden used Lavabit to communicate once he went rogue from the NSA. See, Lavabit was an extremely secure email service with user privacy as its focus. Emails were always encrypted and unusable for even Lavabit, since they didn’t have the decryption keys (those only belong to the users).
The US government demanded (http://www.wired.com/2013/10/lavabit_unsealed) Lavabit build a backdoor in their technology to record email metadata (sender and receiver addresses, subject titles, etc.), something they weren’t willing to do. Not only would this jeopardize Snowden’s communications, but everyone that uses Lavabit. Obviously, at the time, this was all secret so as not to tip off the spying targets.
The government wrote in the charges against Lavabit for contempt of court, “The representative of Lavabit indicated that Lavabit had the technical capability to decrypt the information, but that Lavabit did not want to ‘defeat [its] own system.”
Instead of help the US government have unfettered access to its users, Lavabit decided to close down. Even with that measure, Lavabit’s owner, Ladar Levison, could find himself imprisoned. Snowden called (http://www.nbcnews.com/news/other/lavabit-com-owner-i-could-be-arrested-resisting-surveillance-order-f6C10908072) that decision “inspring.”
That’s better than HushMail, the “secure” email provider that turned over (http://www.wired.com/2007/11/encrypted-e-mai/) clear-text copies of email content to authorities when asked in 2007.
Another secure provider, Silent Mail, decided to shut down (http://www.huffingtonpost.com/2013/08/09/silent-circle-shutting-down-encripted-email_n_3732779.html) after hearing about Lavabit’s fate. While they continue to run their other Silent Circle offerings, it was decided that email by its nature was just too vulnerable to guarantee security.
Enter ProtonMail
Seeing the fate of Lavabit and knowing the need for email security after all of the attention paid to the government surveillance, three Harvard and MIT students teamed together to create a new alternative. Where did they meet? Well, they just happened to be working at CERN, which is where the discovery of the so-called “God” particle took place. Over lunch, they decided to put their efforts towards something completely different: it became ProtonMail.
===============
From Best Secure & Encrypted Email Providers (VPNPick.com) (http://vpnpick.com/best-secure-encrypted-email-providers/):
===============
The one that stuck out the most over all other secure email services is ProtonMail. When the leaked documents by whistleblower Edward Snowden first surfaced, scientists at CERN (http://home.web.cern.ch/), the European Organization for Nuclear Research, discussed their concerned over NSA surveillance and other programs alike. A group of physicists and engineers collectively put their massive computing capabilities to work at creating and secure email service like no other.
ProtonMail was born and it quickly gained notoriety among the privacy community with its bold stance against government surveillance. They kept full control of all their mail servers in Switzerland to avoid any forced shut downs or requirements to provide any server data to U.S. or other foreign surveillance organizations. Forbes has called ProtonMail “the only email system the NSA can’t access” (http://www.forbes.com/sites/hollieslade/2014/05/19/the-only-email-system-the-nsa-cant-access/) but what makes them better than most other encrypted email providers? Even Gmail now offers some level of end-to-end encryption.
ProtonMail had a huge response to their Beta launch and are currently at full server capacity and expansion is underway. You can still head to their website and reserve your own @protonmail.ch (https://protonmail.ch/) address and invitations will be sent out as soon as server capacity allows.
ProtonMail offers full end-to-end email encryption, from start to destination. The encryption happens at the user’s level, making it impossible for ProtonMail to have ever seen the original content. The email is already encrypted when it reaches their Switzerland servers and the recipient’s email password is the only key to that email.
Unlike most other secure email providers, ProtonMail does not require any kind of setup, allowing just about anyone to easily use the website on their browser on all devices thanks to a clean responsive design.
ProtonMail does not have the keys to decrypt any of the emails sent across their network, unlike services like Gmail, who do have the power to decrypt email messages. If authorities would request keys, they would not even have that possibility, only retaining encrypted data on the servers.
Strategically based in Switzerland, ProtonMail will decline any third party requests from overseas organizations or governments. Local government values privacy and has a very low wiretapping and data seizure track record, used explicitly to prevent crime.
ProtonMail has refused offers from various investors to keep their integrity intact. Instead, they have opted for crowd funding methods to keep them afloat, allowing their user base community to donate to the cause, while keeping conflict of interest investors at bay. This decision has proven to be fruitful as they have recently surpassed 200% of their latest campaign goal amount.
ProtonMail will be offered free of cost, but with limited storage. As an additional revenue stream, users will be able to pay $5 for 1Gig of inbox storage. The funds are essentially for expansion and maintenance of the infrastructure.
===============
What are the vulnerabilities? There always are some; if some well funded agency wants my data bad enough, they will have it. Someone could get a bug into my computer, which is not in a highly secure environment protected by three layers of carefully vetted and armed guards (who would be no match for the US Military anyway.) Someone could force ProtonMail to sneak a hack into their Javascript code that downloads to each user who encrypts or decrypts email, where the hack leaked the data to someone else. Someone could send a couple of goons to visit me, who could easily get whatever they want out of me after less than a minute of physical brutality.
But ... so far at least ... I don't see anyway for the NSA to bulk collect and read such email, and I don't see a way for a less well funded organization to look at my email without my knowledge.