Comment by jszymborski | Hacker News Reader

Comment by jszymborski | Hacker News Reader

Parent Full thread

Email providers that I would trust:

* Fastmail.com -- good reputation and track record at reasonable prices

* mailbox.org -- long track record, privacy-oriented, German-based. Some people describe the mail UI as aging (it's OX suite), but I like it just fine.

* Protonmail.com -- UX & privacy focused email with fancy in-browser encryption. Protonmail-to-protonmail emails are E2E (OpenPGPjs). No IMAP, and in-browser (read: scary) encryption, albeit open-source. Based in Switzerland, although that means a lot less than they make it out to, re: privacy.

* tutanota.com -- V. similar to Protonmail. Based in Germany and a cheaper than protonmail. Uses a custom-implemented encryption protocol vaguely and unreassuringly described as a "..standardized, hybrid method.." comprised of RSA and AES [0].

[0] https://tutanota.uservoice.com/knowledgebase/articles/470732...

EDIT: Made some corrections re: protonmail & tutanota encryption, pointed out by bartbutler.

ProtonMail is OpenPGP under the hood, not 'custom' encryption. Tutanota is custom.

My bad, will edit accordingly.

The in-browser, over-the-wire javascript crypto implementation still makes me nervous. I'd love to hear some compelling evidence to the contrary, but as I understand most of what has been stated before about in-browser crypto hasn't changed much [0].

[0] https://tonyarcieri.com/whats-wrong-with-webcrypto

It's going to be less secure than native clients, for sure. ProtonMail has native mobile clients though, and will have a desktop one (IMAP/SMTP bridge) soon, which should alleviate webmail concerns.

That's awesome to hear about the desktop app. It's certainly a project with important goals :)

Does this mean ProtonMail is more reliable? Would you recommend using ProtonMail?

It means that the crypto is certainly more solid (roll-your-own is a terrible idea in cryptography) and can in principle interoperate with other OpenPGP implementations, at least once the client supports it.

I like ProtonMail a lot, but full disclosure: I work there, so I'm biased.

Is ProtonMail your only active email account?

I have a legacy ones in case old/forgotten contacts send me a message, but they all forward to ProtonMail.

Reply on news.ycombinator.com