I used protonmail in its early days but stopped after they started putting resources to pursuing cryptocurrency when their mail service was still not totally complete and while they also had ambitious plans for a whole office ecosystem as an alternative to Google docs etc. Seeing the zeal for this cryptocurrency angle at the time evaporated any trust I had in their product decision-making.
That and I remember a lot of their marketing being around the fact that they had ex-CERN employees but IIRC they weren’t working on anything cryptography or security related at CERN so it sounded like they were just assuming scientists are smart so people will just assume their product is safer, which was a bit sus.
This chatbot thing is totally in line with that so I guess they haven’t really changed.
Unrelated to protonmail, but related to getting the wrong guy for the job. The telegram CEO said that the cryptography of telegram was coded by his brother. (The CEO is also famously not a persona non grata in Russia which likely means the FSB has access to telegram (And if they have access, more people can have it))
Nikolai Durov has two Ph.Ds in maths, and is convinced he is the smartest man in the world, and Telegram’s cryptography follows directly
The cool trick they do is that not even Proton can decode your email. That’s because it never exists on their systems as plain text — it’s always encrypted! The most Proton can do if a government comes calling is give them the metadata — who you emailed and when — but not the text itself.
This is not actually true when using Proton’s web mail interface, because the encryption and decryption is performed by javascript which is sent from Proton’s server to the (signed-in, easy to identify) user every time they load the page. So, when the government comes calling, they can simply ask Proton to send certain users some slightly different javascript once which exfiltrates the targeted users’ keys to them. sadtrombone.mp3
that’s utterly trivial for a sufficiently paranoid user’s browser to detect, and damning for proton if it is (not to mention, pushing hostile JavaScript doesn’t work for users on the imap bridge or using mobile apps they update via methods that can’t easily be tracked like Obtainium on Android)
the mechanisms proton uses to exfiltrate encrypted data and get their users arrested are far more subtle and deniable than that basic shit. specifically, they’ve been silently overcomplying with law enforcement data requests for years, which has led to documented arrests of activists, and all of their LLM features represent a significant data leak, as all of them are implemented in a way that sends cleartext to proton’s servers while maintaining the illusion that the feature is more secure than it is.
I wouldn’t be at all surprised if they were doing more evil shit than the above, but I would be very surprised if any of it were in the form of JavaScript that the user could, you know, deobfuscate and read
How hard is it to actually have a company that provides a useful product and doesn’t veer off into insanity at the first possible occasion. Why does it always end up like this.
Because a company has to be x more valuable than it was last quarter. Then it has to be done again, and again, and again, forever.
No it doesn’t though. Like it literally doesn’t. Who says it does? Proton isn’t even publicly listed so there’s literally no reason for that.
This is just a con by Big Growth to sell more charts with lines going up.
