Protonmail and the false sense of privacy

I like e-mail as a means of communication, specially for three factors: (1) is built around open protocols (2) is, at a certain degree, universal and the foundation of having a identity online while being accessible and simple (3) it exists at least 50 years. With that being said, some necessities arise that weren’t given too much thought when it were created originally: the desire for privately communicate with others.

There’s a some options to obtain private communication when using email, but none of those are really simple and when they do present as simple, I usually get suspicious. For instance, some weeks ago, there was a headline about a activist going to jail after Protonmail leaked delivered the IP address (and by which you can obtain the localization of someone) of this activist. It’s at least odd, given that Protonmail advertise itself as if it’s the way of “securely sending emails”, “regain your privacy”, “don’t let anyone spy the content of your emails”. In a certain way, posing as a magnificent and innovative tecnology that with one stroke magically solves the hairy and ugly problem that is sending emails privately. This is pure marketing, as it seems.

Some people would even argue that this is a strategy known as Embrace, Extend, Extinguish and perhaps it is. This strategy works by adopting a technology that exists already in the wild, “fixing” it and eventually when a large portion of its users are using the “improved” version, they kill the old one, efectually locking users at the new, proprietary one.

The best weapon for this strategy is marketing. You need it to introject into users the idea that in order to communicate privately, you’ll need a Proton mail account — after all, the rest is arcaic and complex — and barely mentions that they use open standards and technologies. That anyone with a computer can use: all you need is to generate a PGP key-pair ¹ and distribute your public key to other people so they can send you encrypted emails.

Not only marketing do, of course, there’s also the lack of transparent communication. Instead of doing like Gmail, which practically makes impossible to send emails using your personal PGP key, Protonmail allows you, but they dont make it too easy. The only documentation about it, is hidden on a FAQ, and I only discovered by poking at the docs, which by the way is not even translated. Not only this, but Proton tricks you into feeling very insecured about doing this whole process, showing you messages that yell “don’t do this, invite this contact to join our beautiful Proton family instead”.

So false promises that they don’t keep any info, even though we have cases which directly tell us that they keep your IP address and god knows what else.

To me, the worst part of it, is that people who already uses the service, will have a tough time to get rid of it, after all in order to use Proton, you’ll need to allow them to kidnap your email address, as you’ll have to create an account which gives you an @protonmail.com address.

That means that if you’ll want to move to another service, or another domain, you’ll have to ensure that every single contact and places you may have used that email address, knows how to reach you on your new one, which virtually wouldn’t happen if you already utilized your own domain. All you’ll had to do is point to the new service and you would be good to go.

Essentially what that means, is that it makes it harder to migrate between email providers. If you feel threatened or simply thinks you don’t want to use Proton anymore, you’ll have a long process ahead of you to get out of the service, which effectively is what makes most people stay with those services at all, even if they don’t really want to use it anymore.

The solution, unfortunately is not simple. Privacy and criptography is a fundamental right, and it sure shouldn’t be dictated by companies and corporations who’ll always put profits over you. The simplest form, even though it may sounds insane, is that organizations create and host their own email service, within their domain and users to create and share their own public criptography keys.

Yes, you can host your own email server, all you’ll need is a server and a internet domain name. I know this may sounds like an herculian task, but it isn’t. The choice here is to be more connected to the decision between practicality versus security. Comfort versus privacy.

If organizations want to tackle on the email subject, the best way is to work cooperatively to build open tools which allows the ecosystem to flourish, work to create processes, improve protocols and create utilities which makes it simpler and accessible to someone to host their own email. The logic here is to build bridges to independency, not to build “safer” walls.