Comment on Proton is transitioning towards a non-profit structure | Proton
sudneo@lemm.ee 4 weeks agoIt’s not “insecure”, it’s simply a supply chain risk. You have the same exact problem with any client software that you might use. There are still jurisdictions, there are still supply chain attacks. The posture is different simply by a small tradeoff: business incentive and size for proton as pluses vs quicker updates (via JS code) and slower updates vs worse security and dependency on a handful of individuals in case of other tools.
Any software that makes the crypto operations can do stuff with the keys if compromised or coerced by law enforcement to do so.
In any case, if this tradeoff doesn’t suit you, the bridge allows you to use your preferred tool, so this is kinda of a moot point.
The main argument for me is that if you rely on mail and gpg not to get caught by those who can coerce proton, you are already failing.
endofline@lemmy.ca 4 weeks ago
I used bridge for many years. It was totally unusable - 1) you cannot delete emails with it ( deleted emails were coming back ), 2) synchronization issues so it made me move to another “plain and simple” email provider offering pop3 and imap and also gpg integration ( but without that e2e hype talk )
sudneo@lemm.ee 4 weeks ago
I can’t comment on this, since I don’t use the bridge for a while. But it’s just an IMAP/SMTP server, so not sure why certain features wouldn’t work. What service did you end up using which has gpg integration?
endofline@lemmy.ca 4 weeks ago
I used protonmail for 3 years - bridge issues have been being ignored by protonmail support in my opinion. “Clean cache and try again”. I stopped using protonmail and switched to mailbox.org. So far so good.
sudneo@lemm.ee 4 weeks ago
From what I read though, the GPG security model for mailbox.org is the same as it is for Proton webmail (except for the browser plugin, where the difference is not really there). I like mailbox.org, to be clear, but I don’t get how it is an alternative to the bridge.