I’m not a proton employee, so I can’t give you the exact process used, but basically Protonmail probably uses asymmetrical encryption to encrypt incoming emails as soon as they receive it.
Asymmetrical encryption uses two keys. A public one, and a private one, both linked together by two one-way mathematical function. The public one can be used by anyone to encrypt a message using said one-way function, but cannot be decrypted without using the private key, which is itself encrypted by your password (which is both unknown to Proton, that why you cannot recover your data if you forget your password), and probably other parameters like your main Protonmail email address.
Now, on the client side, your password (and any other parameters) are used to locally decrypt the private key, which in return is used to locally decrypt the data send by Protonmail servers.
Sure, it isn’t true E2E encryption, but it is the closest to it you can get while talking with another server that do not support E2E encryption.
But there is more. If you send an email to another Protonmail client, said email will be truly E2E encrypted as both client will have access to each other public key, allowing them to encrypt the message on the client side, which will prevent Protonmail from ever read it. If I’m not mistaken, sames goes with any PGP enabled client (like Thunderbird with the Enigmail addon).
Hauskrampf@ttrpg.network 10 months ago
That’s why you need to install the proton mail bridge if you want to use it with apps like thunderbird. Of course, Emails not send from or too another proton account are not encrypted, but that’s something proton can’t change… Although you can put a password on your emails, so only people who know that password can access the mail, but that’s more of a workaround than a fix.