Sending Secure, Encrypted Email with ProtonMail

As handy as email is for both personal and corporate communications, it's often not very secure. Your private data can be used by service providers for various purposes, such as targeted advertising, and is at a risk of being exposed to government agencies upon request.

Whether you're transmitting important documents such as confidential memos, patent designs, or even personal information, it's worth considering ways to better protect your privacy. One very interesting option is ProtonMail.

ProtonMail is a web-based, encrypted email service that was founded in 2013 at the CERN research facility. It's a free and open-source service, the code of which is available on GitHub.

ProtonMail uses client-side encryption to establish a zero-knowledge system, in order to enforce strict data privacy and protection for its users.

Security Mechanisms of ProtonMail

Secure Email Servers

The ProtonMail email servers are located in Switzerland, and your data is protected by the Swiss Federal Data Protection Act, as well as the Swiss Federal Data Protection Ordinance. These laws are some of the strongest privacy protection laws in the world.

ProtonMail states:

As ProtonMail is outside of US and EU jurisdiction, only a court order from the Cantonal Court of Geneva or the Swiss Federal Supreme Court can compel us to release the extremely limited user information we have.

In addition to this, ProtonMail ensures that your data stays on its servers, so that it is never exposed on the cloud. ProtonMail claims that its primary datacenter (which itself is guarded by multiple passwords on a system level) is located under 1000 meters of granite rock, in a heavily guarded bunker that can survive a nuclear attack. Apart from the fact that your data may survive a nuclear holocaust, this also ensures an extra layer of hardware security.

End-to-end Encryption

ProtonMail uses SSL for communication between its servers and your computer. Although message data is already encrypted before being sent, SSL adds an extra layer of security, preventing man in the middle attacks. ProtonMail requires two passwords -- one for signing in and one for decrypting your mailbox. The latter cannot be recovered if you forget it.

Anonymity

ProtonMail doesn't require any information that can be used to personally identify an account holder while signing up. Also, it doesn't track or record information such as the user's IP address. Since your emails are encrypted, there's no way even for the staff to read your emails.

Secure Communication With Other Email Providers

Communication between ProtonMail users is encrypted by default, which is denoted by the presence of a blue-colored lock icon. In addition to this, ProtonMail also supports sending encrypted emails to other email providers such as Gmail, Yahoo and AOL via symmetric encryption. This is sent in the form of a hyperlink, which the recipient receives in an email. Here is a screenshot of the encrypted mail that I've sent from my ProtonMail account to Google Inbox:

The recipients are asked for a passphrase (to be shared via a secure channel) which is used to decrypt the encrypted message:

Upon correctly entering the passphrase, the message gets decrypted and is displayed as shown in the following screenshot:

Self-destructing Emails

There's an additional feature that distinguishes this secure email service from its competitors. Encrypted emails can be set to automatically self-destruct in the recipient's mailbox after a certain amount of time. This feature only applies to the encrypted emails sent to the non-users of ProtonMail (regular emails sent to non-ProtonMail users cannot be marked for self-destruction).

Continue reading %Sending Secure, Encrypted Email with ProtonMail%

by Tanay Pant via SitePoint