?'s about startmail and proton mial

[Frldyz]

I've been reading a lot about how unsecure a lot of free email services are.

I saw a video on youtube about startmail and proton mail.

I've read a lot of good things about them being secure. But I don't quit understand how it works.

My understanding is:
When I send an email it is encrypted with a code. The recipient then receives the email but cannot read it until they un-encrypt it by answering a question or entering a code.

Is that right?

Does it have to work like that?

What if I email a company or a manufactuer of a product and they receive that. they aren;t gonna go thru that hassle. Especially when they don;t know me.
So they will just delete it.
And when I email people I know they will think its spam.

[xenopeek]

My understanding is:
When I send an email it is encrypted with a code. The recipient then receives the email but cannot read it until they un-encrypt it by answering a question or entering a code.

That's indeed what the StartMail and ProtonMail support pages on this method describe:
- https://support.startmail.com/index.php ... ion-method
- https://protonmail.com/support/knowledg ... ide-users/

As I understand it, it sends an email to the recipient with a link back to the StartMail or ProtonMail website. The person that is supposed to have the link can visit the website with it and will be asked to answer a question or enter code only they are supposed to know, and then can read the decrypted message on the website.

Personally I don't see much value in this. It will for sure confuse the heck out of any of my contacts, and like you say many will see it as spam at best but probably as a phishing attack. If you have the need for encrypted messages, better to both be on StartMail or ProtonMail as that way email is automatically encrypted between (not across these services though!). Or use an encrypted messenger program you both use.

Only ProtonMail is free, right? StartMail offers a trial but eventually you'll have to pay. Aside from the iffy encryption of email to outside recipients, their prices are incredibly steep if you look at what else you get. The account limits on both would be crippling to me. Especially for custom domains, catch-all-addresses and aliases.

[jimallyn]

I have been reading a lot lately about computer security and privacy for activists, and several times I have seen people recommend against ProtonMail. I don't remember the exact reasons why. What I have seen recommended a lot is using GPG encrypted email, like the Enigmail plugin for the Thunderbird email client. There are a couple of websites that have lots of good information on computer security and privacy, among them:

https://ssd.eff.org/

https://cldc.org/security/

Spend some time wandering around those sites, read some of the articles, and make a decision on what you want to do. I know if you use Enigmail, you can decide for each email whether or not to encrypt it. If you have emails that need to be completely private, encrypt it. (This assumes, of course, that the people you email have the ability to decrypt your emails.) If you are sending email to a company, don't encrypt it.

[KBD47]

I have protonmail and tutanota mail, both can send encrypted email that requires a password, but you can disable that and use them like gmail or any other email account.

[Frldyz]

I've heard something about "mail forwarding".
What exactly is that?

Does that mean if I still have an aol email account that I'm currently using and someone sends an email to my aol account. It will automatically be forwarded to my proton mail?

What if I send a mail or reply from my proton mail?
Does it show up to the recipient coming from my aol account?

[xenopeek]

Does that mean if I still have an aol email account that I'm currently using and someone sends an email to my aol account. It will automatically be forwarded to my proton mail?

If you configure aol as such, yes.

What if I send a mail or reply from my proton mail?

That depends on whether proton mail gives you the option to send email from other accounts or not.

Personally I'm using FastMail. They have a thorough approach to security https://www.fastmail.com/help/ourservice/security.html. TLS required for all connections to the servers, 2FA for login, no ads / no tracking / "I'm the customer not the product", default blocking of external content like images, content security policy on the website to prevent 3rd party scripts from running, encrypting email in-transit between mail servers, implementing DKIM signing and SPF (also for your own domains) for sender authentication, and of course run the servers with free software. They also actively participate in, and initiate development of, free software and open standards related to email. It's an employee owned company. To be clear; it's a paid email service not offering end-to-end GPG encryption but doing everything else right. Especially if you want to host your own domains with them.

Anyway, with FastMail you can configure up to 50 fetch accounts on your account. So you can retrieve email from up to 50 email accounts with other email services and retrieve them into your FastMail mailbox (delivered into specific folder if you want). You can also send email through those email accounts, using the mail server of the other account.

[Portreve]

Tutanota lets you send standard email that's not encrypted.

I wish the various different services out there would get their act together and be compatible. This really isn't helping the adoption of encryption for securing emails.