Hacker News Reader

ProtonMail is OpenPGP under the hood, not 'custom' encryption. Tutanota is custom.

My bad, will edit accordingly.

The in-browser, over-the-wire javascript crypto implementation still makes me nervous. I'd love to hear some compelling evidence to the contrary, but as I understand most of what has been stated before about in-browser crypto hasn't changed much [0].

[0] https://tonyarcieri.com/whats-wrong-with-webcrypto

It's going to be less secure than native clients, for sure. ProtonMail has native mobile clients though, and will have a desktop one (IMAP/SMTP bridge) soon, which should alleviate webmail concerns.

That's awesome to hear about the desktop app. It's certainly a project with important goals :)

Does this mean ProtonMail is more reliable? Would you recommend using ProtonMail?

It means that the crypto is certainly more solid (roll-your-own is a terrible idea in cryptography) and can in principle interoperate with other OpenPGP implementations, at least once the client supports it.

I like ProtonMail a lot, but full disclosure: I work there, so I'm biased.

Is ProtonMail your only active email account?

I have a legacy ones in case old/forgotten contacts send me a message, but they all forward to ProtonMail.

Reply on news.ycombinator.com