When Google said they were stopping 3rd party cookies, I thought it was just a simple security setting. The new system, Protected Audience, seems like 3rd party cookies without the whack-a-mole approach of listing every cookie advertisers can take, especially since there is nothing stopping data collectors from extracting data from it, like what Mozilla said in the article.
Hopefully there are fake data dumpers or cleaners for Protected Audience which would reduce the effectiveness of this system but looking how the Chrome team treats browser extensions, I doubt it.
On a related note? When my friend on proton send me (regular imap, openpgp) and several others (gmail, outlook) an email with all of us as recipients, it seems that proton cheats? I get to decrypt the message, where’s the others just read plain ø, unincrypted text.
At first i thought this smart. But now i kind of realize how much of a nightmare this seems to be.
On the other hand, i am not really sure how they do it? Is it to different mails, with fake headers? Or is it more like: if no encryption is available, show thisb (dentical) text instead?
The webmail provider released a dedicated browser that can only open the webmail and called it a “desktop” app.
Additionally, they don’t support IMAP. There’s an app to run on your computer that becomes a bridge. The proprietary protocol is translated to IMAP. You can’t use your favorite client if your operating system can’t run that bridge and you’re not a premium user because for “reasons” only premium users can run that local bridge
On a lighter note, the protocol might be proprietary but the bridge still seems to be fully open source : github.com/ProtonMail/proton-bridge
I don’t think think Proton shows bad will on this one. The only alternative I can think of (as a non expert) would be IMAP + GPG encrypted emails but very few desktop clients support GPG, which would make them less accessible 🤷♂️ Having their own protocol also probably makes it much much easier for them to iterate on it, opening up usually makes think much robust but also slower.
They don’t support IMAP because they want emails to remain end-to-end encrypted, and IMAP doesn’t have any way of doing that. The gateway decrypts the emails locally, then serves them as plain text.
We need something better than IMAP, that’s designed for modern use cases. Something that’s not stateful… Maybe a web service or something like that. JMAP seems promising but barely any providers have implemented it.
Still, if an user prefers the convenience of using any client instead of e2e, could enable it in a setting. Maybe the user subscribed because they liked the interface and the overall features of the plan, and not because of the encrypted email solution and just wants to add the account on the mobile client instead of a dedicated app
Being closed like this IMHO is just to increase user retention
If thex subscribed because of the interface (ehich is certainly plausible), what would they need IMAP support for? Also, if you really want IMAP, xou can have it, you just need their (open source) Proton Bridge for it (thats a sofrware) so that ut retains all features. But then I would need my own email client.
On mobile you’re forced to use their “open source” app that is only available on the closed source app stores and not on fdroid because it uses Google push services
Even so, your statement that it is only available on closed-source app stores is wrong. And it doesn’t even matter that it’s not provided by “My First F-Droid Repo Demo” (yes, that’d the name of the official repo). Many open source apps are on IzzyOnDroid, including Jerboa, what do you use to write on Lemmy?
Either way, your original comment is completely wrong and it doesnt help that it’s “only” available in the most popular extra repo.
I turned my WiFi off and opened the app it was just a white screen. I suppose its beta still. But my dream is to keep a local copy of all my mail just got a cache.
downloading emails and storing them locally for offline reading, categorizing, searching and drafting. “Caching” usually just means if you opened the app with connection, it won’t go bonkers and will probably let you finish your immediate task + some basic functionality if you lose it. Can’t close the app though.
The main benefit is since it is locally installed, it is harder for proton’s server to access your encrypted data by serving you malicious JS. A malicious desktop app/update could be served too, but that may be trickier.
To save myself the hassle of having to rebuild the electron app every once in a while? I’d rather not open my browser, go to their website and log in with 2fa every time I want to read an email.
Proton seems on the wrong side of the usability - privacy spectrum. Every last feature I’d want from an online provider is impossible or massively neutered by the overly strict security.
I wish there was a similar service in a trustworthy country with a more sane level of safety, like opt-in encryption for example.
“After years of pushing their proprietary and closed solutions to privacy minded people Proton decided that it was in their best interest to further bury said users into their service as a form of vendor lock-in. To achieve this they made more non-standard desktop clients for their groupware features (contacts and calendars) and the bridge will be discontinued soon.”
Only if there wasn’t CardDAV, CalDAV, IMAP, SMTP and dozens of other highly standardized protocols to handle e-mailing and groupware.
Is the bridge actually being discontinued? People have been saying that a lot recently but I’ve not seen any evidence for it, and not in the linked article.
I’m annoyed that they don’t support SMTP, but realistically they actually can’t unless they have the ability to read your email, which they don’t.
No, but what from their moves it is very clear it won’t live long.
they don’t support SMTP, but realistically they actually can’t unless they have the ability to read your emai
Technically they do use SMTP… and it’s possible for a provider and provide submission and generic SMTP do clients without having to read the email content.
There are lots of ways to do e2e encryption on e-mail (no server access to the contents) over SMTP (OpenPGP, S/MIME etc.). There are also header minimization options to prevent metadata leakage. And Proton decided NOT to use any of those proven solutions (in a standard and open way at least) and go for some obscure implementation instead because it fits their business better and makes development faster.
Because with proven concepts the swiss intelligence services would be locked out. And now people have to trust their claims of “swiss privacy laws” (who are shit - the worst in Central Europe. Switzerland had multiple scandals, from a system that had intelligence files on a large percentage of their “unreliable” citizens as part of the “Fichenskandal” to them recently admitting that most internet traffic within and all traffic leaving and entering Switzerland is monitored by the swiss intelligence services - without so much as a judges permit). Yeah, I know, they are audited…But since Snowden we all know how much that is worth.
The minute they discontinue Proton Bridge is the minute I cancel my subscription with them and change mail providers. No one is prying my beloved Thunderbird from me
They generally require to have data visible on the server and/or handle independently encryption/decryption with related tools and key management (including key discovery).
For some, it might be worth, for 99% of the population who wouldn’t be able to do this but also doesn’t want their content availablento the provider, it’s not.
Not going away from Proton myself, but yes this is damned infuriating. Although I’d deal with a reliable Android app. The Beta Android looks good, but why Proton has struggled so much with Android is beyond my current digging.
Tutanota doesn’t have a good way to export emails in bulk. Their feature set is getting richer, but once invested, the exit cost is quite high, speaking from experience.
news.itsfoss.com
Newest