fareastcoast

ProtonMail also isn't encrypting with a password, it's fully OpenPGP compliant using full length RSA keys. Also, how do we know Lavaboom is going to be around and stable? ProtonMail is financed by the Swiss government and developed at CERN.

I think the idea of ProtonMail is to serve the part of the population that mostly uses the browser. Obviously if you wanted to be super secure, there are more sophisticated methods out there, but they aren't exactly accessible to the non-HN population. I don't think we should say, just because a perfect browser based solution isn't possible, this shouldn't exist at all. It's like saying, do something only if you can do it perfectly.

I don't really agree with this. Gmail is compromised by the NSA sending one email to Google.

An attacker would have to (1) Gain access to the server in Switzerland (without the admins noticing) or (2) Break the SSL and execute a MITM attack.

It seems ProtonMail actively scans the code on the backend for unauthorized changes. It's not 100% secure against a very determined attacker (NSA), but for the citizen that wants more privacy without the hassle of PGP, it's pretty good until we can replace SMTP.

The JS doesn't appear to be compressed so it's possible to view source and see what exactly it's doing. So if it was actually backdoored, somebody will actually find out.

Well, selling out American millionaires is one thing, I have a feeling the Swiss would be less willing to sell out private communications to the NSA.