Available in | |
---|---|
Headquarters | |
Owner | Proton AG |
URL | proton |
Commercial | No |
Registration | Required |
Users | 100 million (April 2023) [2] |
Launched | May 16, 2014 |
Current status | Online |
Repository | github |
---|---|
Written in | TypeScript and Go |
License | GNU GPLv3 [3] [4] [5] [6] |
Website |
|
Proton Mail (previously written as ProtonMail) is a Swiss end-to-end encrypted email service founded in 2013 headquartered in Plan-les-Ouates, Switzerland. [7] [8] Proton Mail is now run by Proton AG, which also operates Proton VPN, Proton Drive, Proton Calendar, Proton Pass and Proton Wallet. It uses client-side encryption to protect email content and user data before they are sent to Proton Mail servers, unlike other common email providers such as Gmail and Outlook.com. [9] [10]
Proton Mail received its initial funding through a crowdfunding campaign, and initial membership was by invitation only; however, beginning in March 2016, Proton Mail was opened to the public. Acquiring more than two million users by 2017, [11] membership grew to almost 70 million by 2022. [12]
The source code for the back-end of Proton Mail remains closed source. [13] [14] However, Proton Mail released the source code for the web interface, iOS and Android apps as well the Proton Mail Bridge app, under an open-source license. [15] [16] [17] [18]
On May 16, 2014, Proton Mail entered into public beta. [19] It was met with enough response that after three days they needed to temporarily suspend beta signups to expand server capacity. [20] Two months later, Proton Mail received US$550,377 from 10,576 donors through a crowdfunding campaign on Indiegogo, while aiming for US$100,000. [21] During the campaign, PayPal froze Proton Mail's PayPal account, thereby preventing the withdrawal of US$251,721 worth of donations. PayPal stated that the account was frozen due to doubts of the legality of encryption, statements that opponents said were unfounded. [22] [23] The restrictions were lifted the following day. [24]
On March 18, 2015, Proton Mail received US$2 million from the non-profit Fondation Genevoise pour l'Innovation Technologique (FONGIT) and Charles River Ventures, although by 2022, the company no longer had venture capital investors. [25] [26] On August 14, 2015, Proton Mail released major version 2.0, which included a rewritten codebase for its web interface. On 17 March 2016, Proton Mail released major version 3.0, which saw the official launch of Proton Mail out of beta. With a new interface for the web client, version 3.0 also included the public launch of Proton Mail's iOS and Android beta applications. [27]
From November 3–7, 2015, Proton Mail was under several DDoS attacks that made the service largely unavailable to users. [28] During the attacks, the company stated on Twitter that it was looking for a new data center in Switzerland, saying, "many are afraid due to the magnitude of the attack against us". [29]
On January 19, 2017, Proton Mail announced a Tor onion site. [30] On November 21, 2017, Proton Mail introduced Proton Mail Contacts, a zero-access encryption contacts manager. Proton Mail Contacts also utilizes digital signatures to verify the integrity of contacts data. [31] On 6 December 2017, Proton Mail launched Proton Mail Bridge, an application that provides end-to-end email encryption to any desktop client that supports IMAP and SMTP, such as Microsoft Outlook, Mozilla Thunderbird, and Apple Mail, for Windows and MacOS. [32]
In July 2018, Proton Mail reported it was once more suffering from DDoS attacks. CEO Andy Yen claimed that the attackers had been paid by an unknown party to launch the attacks. [33] In September 2018, one of the suspected Proton Mail attackers was arrested by British law enforcement and charged in connection with a series of other high-profile cyberattacks against schools and airlines. [34]
On July 25, 2018, Proton Mail introduced address verification and Pretty Good Privacy (PGP) support, making Proton Mail interoperable with other PGP clients. [35]
In September 2020, Proton Mail helped found the Coalition for App Fairness, which aims to gain better conditions for the inclusion of their apps in app stores. [36] Proton also founded the Coalition for Competitive Digital Markets, which brings together 50+ European tech companies supporting open, interoperable and competitive digital markets. [37]
Around July 2021, Proton Mail's security and cryptographic architecture were both independently audited by Securitum, a European security auditing company, who uncovered no major issues or security vulnerabilities, and the audit results were publicly published. [38]
Around September 2021, Nadim Kobeissi published an article arguing that as Proton Mail was generally accessed through a web client, "no end-to-end encryption guarantees have ever been provided by the Proton Mail service." [39]
In April 2022 ProtonMail acquired SimpleLogin, a company based in Paris, France that provides email aliasing addresses. SimpleLogin functionality is integrated into Proton Mail, but the masked mail service is also available independently to use with any email provider. [40] [41]
In May 2022, Proton AG updated the visuals, user interface, and logos of all its products, including Proton Mail, to achieve a consistent design throughout its software. Proton Mail's subscription now includes access to all Proton VPN, Proton Calendar, Proton Drive and Proton Pass. [42]
In April 2024, Proton Mail launched a desktop app for Windows and macOS. A version for Linux is in beta. [43] [44] [45] The desktop client is only available for users with a paying subscription, despite Proton AG's earlier comments that it would be "gradually be made available to all users, including free". [46] The app also allows access to Proton Calendar. [43] [47]
Also in April 2024, Proton acquired the end-to-end encrypted note-taking-app Standard Notes. [48]
In June 2024, Proton started the transition to becoming a non-profit. [49]
In July 2024, Proton launched Proton Docs, a document editor & Proton Wallet. [50] [51]
Proton Mail uses a combination of public-key cryptography and symmetric encryption protocols to offer end-to-end encryption. When a user creates a Proton Mail account, their browser generates a pair of public and private RSA keys:
This symmetrical encryption happens in the user's web browser using AES-256. Upon account registration, the user is asked to provide a login password for their account.
Proton Mail also offers users an option to log in with a two-password mode that requires a login password and a mailbox password.
Upon logging in, the user has to provide both passwords. This is to access the account and the encrypted mailbox and its private encryption key. The decryption takes place client-side either in a web browser or in one of the apps. The public key and the encrypted private key are both stored on Proton Mail servers. Thus Proton Mail stores decryption keys only in their encrypted form so Proton Mail developers are unable to retrieve user emails or reset user mailbox passwords. [52] This system absolves Proton Mail from:
Proton Mail exclusively supports HTTPS and uses TLS with ephemeral key exchange to encrypt all Internet traffic between users and Proton Mail servers.
In September 2015, Proton Mail added native support to their web interface and mobile app for PGP. This allows a user to export their Proton Mail PGP-encoded public key to others outside of Proton Mail, enabling them to use the key for email encryption. The Proton Mail also supports PGP encryption from Proton Mail to outside users. [54]
An email message sent from one Proton Mail account to another is automatically encrypted with the public key of the recipient. Once encrypted, only the private key of the recipient can decrypt the message. When the recipient logs in, their mailbox password decrypts their private key and unlocks their inbox.
Email messages sent from Proton Mail to non-Proton Mail email addresses may optionally be sent in plain text or with end-to-end encryption. With encryption, the message is encrypted with AES under a user-supplied password. The recipient receives a link to the Proton Mail website on which they can enter the password and read the decrypted message. Proton Mail assumes that the sender and the recipient have exchanged this password through a backchannel. [52] Such email messages can be set to self-destruct after a period of time. [55]
Proton Mail maintains data centers in three countries: Switzerland (one in Lausanne and another in Attinghausen in the former K7 military bunker under 1,000 meters (3,300 ft) of granite), Germany and Norway. [56]
Each data center uses load balancing across web, mail, and SQL servers, redundant power supply, hard drives with full disk encryption, and exclusive use of Linux and other open-source software. In December 2014, Proton Mail joined the RIPE NCC in an effort to have more direct control over the surrounding Internet infrastructure. [57]
Technological reviews of Proton Mail are generally positive. IT Pro's review scores it 4 out of 5 stars. It lauds the end-to-end encryption of emails, including for non-Proton Mail users, a robust security, and the interfaces of both the web and mobile versions of the email client, with criticisms of the client's search function and the service's price versus the competition. [58] PCMag also rates the service 4 out of 5 stars, praising the security, in addition to loading embedded images without returning the IP address to senders and setting expirations for messages, but questioning the cap on daily messages even with a subscription. [59] TechRadar gives the service 4.5 out of 5 stars, calling it one of the best secure email services, although it noted limitations such as that it is not suited for voluminous messaging, the reluctance of websites to adopt the service, and that email subject lines are not encrypted. [60]
Proton Mail was the recipient of three Lovie Awards, one gold and The People's Lovie in 2016, [61] and one silver in 2017. [62]
According to Proton Mail's transparency report, it is legally obligated to follow Swiss court orders if Swiss law is broken.
Due to the encryption utilized, Proton Mail is unable to hand over the contents of encrypted emails under any circumstances, but according to Proton's privacy policy, Proton Mail can be legally compelled to log IP addresses as part of a Swiss criminal investigation. [63] For this reason, the company strongly suggests that users who need to hide their identity from the Swiss government use their Tor hidden service/onion site.[ citation needed ]
On November 15, 2019, Proton confirmed that the government of the Republic of Belarus had issued a block across the country of Proton Mail and Proton VPN IP addresses. The block was no longer in place four days later. No explanation was given to Proton Mail for the block, nor for the block being lifted. [64]
On January 29, 2020, the Russian Federal Service for Supervision of Communications, Information Technology and Mass Media reported that it had implemented a complete block of Proton Mail services within the Russian Federation. [65] As a reason for the block, it cited Proton Mail's refusal to give up information relating to accounts that allegedly sent out spam with terror threats. [66] [67] However, Proton Mail claimed that it did not receive any requests from Russian authorities regarding any such accounts. [68] [69] In response to the block, the Proton Mail Twitter account recommended legitimate users circumvent the block via VPNs or Tor.[ citation needed ]
In March 2020, the company announced that even though the Russia ban was not particularly successful, and the service continues to be largely available in Russia without using a VPN, Proton Mail will be releasing new anti-censorship features in both Proton Mail and Proton VPN desktop and mobile apps which will allow more block attempts to be automatically circumvented. [70]
In 2020, Proton Mail received 3,572 orders from Swiss authorities and contested 750 of them. [71]
Around August 2021, Proton complied with a court order in a case involving death threats made against immunologist Anthony Fauci. [72]
Around September 2021, Proton began logging the IP address of a French climate activist, after receiving a court order. [73]
In October 2021, Proton won a Swiss court case that confirmed that email services cannot be considered telecommunications providers, and consequently are not subject to the data retention requirements imposed on telecommunications providers. [74]
In May 2024, Proton was reported having disclosed personal data of a person involved in Catalan independence activism and accused of a felony by the Spanish authorities. [75]
As of September 22, 2023, Proton Mail offers the following account types for individuals: [76] [77]
Account type | Messages per day | Storage | Aliases | Custom domains | Price | Support |
---|---|---|---|---|---|---|
Proton Free | 150 | 1 GB* | 1 Address | - | Free | Limited Support |
Mail Plus | Unlimited | 15 GB | 10 Addresses | 1 | €4.99 /mo or €47.88 /yr or €83.76 /2yr | Priority Support |
Proton Unlimited | Unlimited | 500 GB | 15 Addresses | 3 | €12.99 /mo or €119.88 /yr or €191.76 /2yr | Priority Support |
Proton Family | Unlimited | 3 TB | 90 Addresses | 3 | €29.99 /mo or €287.88 /yr or €479.76 /2yr | Priority Support |
*The default Proton Mail free storage is 500 MB that users can increase to 1GB if they meet certain criteria.
As of September 22, 2023, Proton Mail offers the following account types for businesses: [78]
Account type | Storage | Aliases | Custom domains | Price | Hide My Email aliases |
---|---|---|---|---|---|
Mail Essentials | 15 GB | 10 Addresses | 3 | €6.99 /mo | - |
Business | 500 GB | 15 Addresses | 10 | €10.99 /mo | Unlimited |
Enterprise | Customizable | Customizable | Customizable | Customizable | Customizable |
Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication. PGP is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications. Phil Zimmermann developed PGP in 1991.
An email client, email reader or, more formally, message user agent (MUA) or mail user agent is a computer program used to access and manage a user's email.
Hushmail is an encrypted proprietary web-based email service offering PGP-encrypted e-mail and vanity domain service. Hushmail uses OpenPGP standards. If public encryption keys are available to both recipient and sender, Hushmail can convey authenticated, encrypted messages in both directions. For recipients for whom no public key is available, Hushmail will allow a message to be encrypted by a password and stored for pickup by the recipient, or the message can be sent in cleartext. In July 2016, the company launched an iOS app that offers end-to-end encryption and full integration with the webmail settings. The company is located in Vancouver, British Columbia, Canada.
S/MIME is a standard for public-key encryption and signing of MIME data. S/MIME is on an IETF standards track and defined in a number of documents, most importantly RFC 8551. It was originally developed by RSA Data Security, and the original specification used the IETF MIME specification with the de facto industry standard PKCS #7 secure message format. Change control to S/MIME has since been vested in the IETF, and the specification is now layered on Cryptographic Message Syntax (CMS), an IETF specification that is identical in most respects with PKCS #7. S/MIME functionality is built into the majority of modern email software and interoperates between them. Since it is built on CMS, MIME can also hold an advanced digital signature.
End-to-end encryption (E2EE) is a private communication system in which only communicating users can participate. As such, no one else, including the communication system provider, telecom providers, Internet providers or malicious actors, can access the cryptographic keys needed to converse. End-to-end encryption is intended to prevent data being read or secretly modified, other than by the true sender and recipient(s). The messages are encrypted by the sender but the third party does not have a means to decrypt them, and stores them encrypted. The recipients retrieve the encrypted data and decrypt it themselves. Because no third parties can decipher the data being communicated or stored, for example, companies that provide end-to-end encryption are unable to hand over texts of their customers' messages to the authorities.
The following tables compare general and technical information for a number of notable webmail providers who offer a web interface in English.
Email encryption is encryption of email messages to protect the content from being read by entities other than the intended recipients. Email encryption may also include authentication.
LastPass is a password manager application. The standard version of LastPass comes with a web interface, but also includes plugins for various web browsers and apps for many smartphones. It also includes support for bookmarklets.
Exchange ActiveSync is a proprietary protocol designed for the synchronization of email, contacts, calendar, tasks, and notes from a messaging server to a smartphone or other mobile devices. The protocol also provides mobile device management and policy controls. The protocol is based on XML. The mobile device communicates over HTTP or HTTPS.
Fastmail is an email hosting company based in Melbourne, Australia. In addition to its Fastmail-branded services, the company also operates Topicbox, a mailing list service, and Pobox, an email service it acquired in 2015.
Tresorit is a cloud storage platform that offers functions for administration, storage, synchronization, and transfer of data using end-to-end encryption.
Tuta, formerly Tutanota, is an end-to-end encrypted email app and a freemium secure email service. The service is advertisement-free; it relies on donations and premium subscriptions. As of June 2023, Tutanota's owners claimed to have over 10 million users of the product. The company announced a transition to 100% renewable electricity in March 2019. This decision coincided with employee participation in Fridays for Future protests. On 1st October 2024, Tuta launched its standalone encrypted calendar app. Tuta Mail has recently integrated post-quantum cryptography features through its new protocol - TutaCrypt replacing standard encryption methods like RSA-2048 and AES-256 for its newly created accounts after March 2024.
Mailfence is secure encrypted email service that offers OpenPGP based end-to-end encryption and digital signatures. It was launched in November 2013 by Belgium-based company ContactOffice Group that has been operating an online collaboration suite since 1999.
Autocrypt is a cryptographic protocol for email clients aiming to simplify key exchange and enabling encryption. Version 1.0 of the Autocrypt specification was released in December 2017 and makes no attempt to protect against MITM attacks. It is implemented on top of OpenPGP replacing its complex key management by fully automated exchange of cryptographic keys between peers.
Proton VPN is a VPN service launched in 2017 and operated by the Swiss company Proton AG, the company behind the email service Proton Mail. According to its official website, Proton VPN and Proton Mail share the same management team, offices, and technical resources, and are operated from Proton's headquarters in Plan-les-Ouates, Switzerland. On June 17, 2024 the company announced that it will be transitioning to a non-profit structure under the Proton Foundation.
Bitwarden is a freemium open-source password management service that is used to store sensitive information, such as website credentials, in an encrypted vault. The platform hosts multiple client applications, including a web interface, desktop applications, browser extensions, mobile apps, and a command-line interface. The platform offers a free US or European cloud-hosted service as well as the ability to self-host.
Proton AG is a Swiss technology company offering privacy-focused online services. It was founded in 2014 by a group of scientists who met at CERN and created Proton Mail.
Skiff was an email service startup company and collaboration tool, that provided privacy-friendly end-to-end encrypted Email and Cloud services. The company's commercial strategy was focused in offering to its clients a Source-Available or Open-Source, transparent and audited Email, Calendar, and Cloud Storage services without trackers or advertisements.
mailbox.org is an encrypted email service provider based in Germany. The encryption system uses PGP like most other encrypted email providers. It also features address books, calendars, video conferencing, online office and tasks management. It competes against Microsoft 365 and Google Workspace as a German based provider. Its target customers include private, business, school and public authorities.
Proton Pass is a password manager developed by the Swiss software company Proton AG. It stores login credentials, email aliases, credit card data, passkeys, 2FA secret keys, and notes in virtual vaults that are encrypted using 256-bit AES-GCM.
We don't plan to open source the back-end code, because it doesn't add trust (users can't verify what code is running on the backend) and doing so would given away information about how we do anti-spam and anti-abuse.
Proton Mail's crowdfunding campaign has surged past $500,000 with the support of over 10,000 backers
We have been following SimpleLogin closely for a long time as many Proton Mail users utilize it to prevent their Proton Mail addresses from being leaked to spammers
{{cite web}}
: CS1 maint: bot: original URL status unknown (link)