Jump to content

Proton Mail: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
→Development: Promotional in tone and nature. Also dubious notability. Source was the company's own blog.
Tag: references removed
→Development: I was "forced" to reduce "overwhelming" promotional melodramatic tone.
Line 31: Line 31:


=== Development ===
=== Development ===
On 16 May 2014, ProtonMail entered into public beta.<ref>{{Cite web|url=https://protonmail.com/blog/protonmail-now-public-beta/|title=ProtonMail now in Public Beta!!|last=|first=|date=16 May 2014|website=ProtonMail Blog|accessdate=31 January 2016}}</ref> Within three days, ProtonMail was met with an overwhelming response and was forced to temporarily suspend beta signups while they worked to expand server capacity.<ref>{{Cite web|url=https://www.infosecurity-magazine.com/news/uber-secure-protonmail-beta-maxes-out-servers-in/|title=Über-Secure ProtonMail Beta Maxes Out Servers in Just 60 Hours|last=|first=|date=22 May 2014|website=Infosecurity Magazine|accessdate=19 October 2015}}</ref>
On 16 May 2014, ProtonMail entered into public beta.<ref>{{Cite web|url=https://protonmail.com/blog/protonmail-now-public-beta/|title=ProtonMail now in Public Beta!!|last=|first=|date=16 May 2014|website=ProtonMail Blog|accessdate=31 January 2016}}</ref> It was met with enough response that after three days they needed to temporarily suspend beta signups to expand server capacity.<ref>{{Cite web|url=https://www.infosecurity-magazine.com/news/uber-secure-protonmail-beta-maxes-out-servers-in/|title=Über-Secure ProtonMail Beta Maxes Out Servers in Just 60 Hours|last=|first=|date=22 May 2014|website=Infosecurity Magazine|accessdate=19 October 2015}}</ref>


On 31 July 2014, ProtonMail received {{US$|550377}} from 10,576 donors through a crowdfunding campaign on [[Indiegogo]], while aiming for {{US$|100000}}.<ref>{{Cite web|url=https://www.indiegogo.com/projects/protonmail/#/|title=ProtonMail|last=Yen|first=Andy|date=31 July 2014|website=[[Indiegogo]]|accessdate=19 October 2014}}</ref> During the campaign, [[PayPal]] froze ProtonMail's PayPal account, thereby preventing the withdrawal of {{US$|251721}} worth of donations. PayPal stated that the account was frozen due to doubts of the legality of encryption, statements that opponents said were unfounded.<ref>{{Cite web|url=https://www.bit-tech.net/news/tech/software/protonmail-paypal/1/|title=ProtonMail hit by PayPal account freeze|last=Halfacree|first=Gareth|date=1 July 2014|website=bit-tech|accessdate=19 October 2015}}</ref><ref>{{Cite web|url=https://www.dailydot.com/layer8/paypal-protonmail-freeze/|title=PayPal freezes account of email encryption startup ProtonMail [Update]|last=Howell O'Neill|first=Patrick|date=1 July 2014|website=[[The Daily Dot]]|accessdate=19 October 2015}}</ref> The restrictions were lifted the following day.<ref>{{Cite web|url=https://protonmail.com/blog/paypal-freezes-protonmail-campaign-funds/|title=Paypal Freezes ProtonMail Campaign Funds|last=Yen|first=Andy|date=30 June 2014|website=ProtonMail Blog|accessdate=19 October 2015}}</ref>
On 31 July 2014, ProtonMail received {{US$|550377}} from 10,576 donors through a crowdfunding campaign on [[Indiegogo]], while aiming for {{US$|100000}}.<ref>{{Cite web|url=https://www.indiegogo.com/projects/protonmail/#/|title=ProtonMail|last=Yen|first=Andy|date=31 July 2014|website=[[Indiegogo]]|accessdate=19 October 2014}}</ref> During the campaign, [[PayPal]] froze ProtonMail's PayPal account, thereby preventing the withdrawal of {{US$|251721}} worth of donations. PayPal stated that the account was frozen due to doubts of the legality of encryption, statements that opponents said were unfounded.<ref>{{Cite web|url=https://www.bit-tech.net/news/tech/software/protonmail-paypal/1/|title=ProtonMail hit by PayPal account freeze|last=Halfacree|first=Gareth|date=1 July 2014|website=bit-tech|accessdate=19 October 2015}}</ref><ref>{{Cite web|url=https://www.dailydot.com/layer8/paypal-protonmail-freeze/|title=PayPal freezes account of email encryption startup ProtonMail [Update]|last=Howell O'Neill|first=Patrick|date=1 July 2014|website=[[The Daily Dot]]|accessdate=19 October 2015}}</ref> The restrictions were lifted the following day.<ref>{{Cite web|url=https://protonmail.com/blog/paypal-freezes-protonmail-campaign-funds/|title=Paypal Freezes ProtonMail Campaign Funds|last=Yen|first=Andy|date=30 June 2014|website=ProtonMail Blog|accessdate=19 October 2015}}</ref>

Revision as of 18:53, 4 October 2019

ProtonMail
File:ProtonMail screenshot.jpg
Screenshot of the ProtonMail website, showing the user's inbox and a composer window.
Type of site
Webmail
Available inEnglish, Spanish, German, French, Italian, Japanese, Dutch, Polish, Portuguese, Romanian, Russian, Turkish, Ukrainian
OwnerProton Technologies AG, Geneva, Switzerland
Created by
  • Dr. Andy Yen
  • Jason Stockman
  • Wei Sun
URLprotonmail.com protonirockerxow.onion[1]
CommercialYes
RegistrationRequired
Users> 10 Million
Launched16 May 2014; 10 years ago (2014-05-16)
Current statusOnline
Content license

ProtonMail is an end-to-end encrypted email service founded in 2014 at the CERN research facility by Andy Yen, Jason Stockman, and Wei Sun.[4][5] ProtonMail uses client-side encryption to protect email contents and user data before they are sent to ProtonMail servers, unlike other common email providers such as Gmail and Outlook.com. The service can be accessed through a webmail client, the Tor network, or dedicated iOS and Android apps.[6]

ProtonMail is run by Proton Technologies AG, a company based in the Canton of Geneva,[7] and its servers are located at two locations in Switzerland, outside of US and EU jurisdiction.[8] The service received initial funding through a crowdfunding campaign. The default account setup is free, and the service is sustained by optional paid services. As of January 2017, ProtonMail had over 2 million users,[9] and grew to over 5 million by September 2018[10] and over 10 million by the end of 2018.[11] Initially invitation-only, ProtonMail opened up to the public in March 2016.

History

Development

On 16 May 2014, ProtonMail entered into public beta.[12] It was met with enough response that after three days they needed to temporarily suspend beta signups to expand server capacity.[13]

On 31 July 2014, ProtonMail received US$550,377 from 10,576 donors through a crowdfunding campaign on Indiegogo, while aiming for US$100,000.[14] During the campaign, PayPal froze ProtonMail's PayPal account, thereby preventing the withdrawal of US$251,721 worth of donations. PayPal stated that the account was frozen due to doubts of the legality of encryption, statements that opponents said were unfounded.[15][16] The restrictions were lifted the following day.[17]

On 18 March 2015, ProtonMail received US$2 million from Charles River Ventures and the Fondation Genevoise pour l'Innovation Technologique (Fongit).[18]

On 14 August 2015, ProtonMail released version 2.0; a significant update, it included a new codebase for its web interface and introduced significant performance enhancements. The ProtonMail team simultaneously released the source code for the web interface under an open-source license.[19]

On 17 March 2016, ProtonMail released version 3.0, which saw the official launch of ProtonMail out of beta. With a new interface for the web client, version 3.0 also included the public launch of ProtonMail's iOS and Android beta applications. These applications are built natively for each respective platform maintaining the gestures and actions familiar with each operating system.[20] The mobile apps proved to be a hit, with reports of increased efficiency and the ability to leave other email providers such as Gmail due to the usability and feature set found in ProtonMail.

On 19 January 2017, ProtonMail announced support through Tor, at the hidden service address protonirockerxow.onion.[21][22]

On 21 November 2017, ProtonMail introduced ProtonMail Contacts, a zero-access encryption contacts manager. ProtonMail Contacts also utilizes digital signatures to verify the integrity of contacts data.[23]

On 6 December 2017, ProtonMail launched ProtonMail Bridge, an application that provides end-to-end email encryption to any desktop client that supports IMAP and SMTP, such as Microsoft Outlook, Mozilla Thunderbird, and Apple Mail, for Windows and MacOS.[24]

On 25 July 2018, ProtonMail introduced address verification and PGP support, making ProtonMail interoperable with other PGP clients.[25]

DDoS attacks

From 3 to 7 November 2015, ProtonMail was under several DDoS attacks that made the service largely unavailable to users.[26] ProtonMail believed that it was affected by two separate attacks, the first led by a group of hackers known as the Armada Collective demanding ransom payment. The second attack was by an unknown, more technically advanced group exhibiting capabilities more commonly possessed by state-sponsored agents, This second group never contacted Protonmail nor made any ransom demands, their sole objective being to take ProtonMail offline. The first attack was tied to a ransom of 15 bitcoins (roughly US$16,000 at the time), which ProtonMail eventually paid due to pressure from ISPs and other companies affected by the attack. The DDoS attacks, however, did not stop, and instead began to take on more sophistication, with rates exceeding 100 Gbit/s. The company received an email from the Armada Collective in which they denied responsibility for the ongoing attack.[27][28][29][30] During the attack, the company stated on Twitter that it was looking for a new data centre in Switzerland, saying, "many are afraid due to the magnitude of the attack against us". They have since posted that they "have a comprehensive long term solution which is already being implemented".[28][31]

In July 2018, ProtonMail reported it was under renewed DDoS attacks, with CEO Andy Yen stating that the attackers had been paid by an unknown party to launch the attacks.[32] In September 2018, one of the suspected ProtonMail attackers was arrested by British law enforcement and charged in connection with a series of other high-profile cyberattacks against schools and airlines.[33]

Encryption

ProtonMail uses a combination of public-key cryptography and symmetric encryption protocols to offer end-to-end encryption. When a user creates a ProtonMail account, their browser generates a pair of public and private RSA keys:

  • The public key is used to encrypt the user's emails and other user data.
  • The private key capable of decrypting the user's data is symmetrically encrypted with the user's mailbox password.

This symmetrical encryption happens in the user's web browser using AES-256. Upon account registration, the user is asked to provide a login password for their account. ProtonMail also offers users an option to log in with a two-password mode which requires a login password and a mailbox password.

  • The login password is used for authentication.
  • The mailbox password encrypts the user's mailbox that contains received emails, contacts, and user information as well as a private encryption key.

Upon logging in, the user has to provide both passwords. This is to access the account and the encrypted mailbox and its private encryption key. The decryption takes place client-side either in a web browser or in one of the apps. The public key and the encrypted private key are both stored on ProtonMail servers. Thus ProtonMail stores decryption keys only in their encrypted form so ProtonMail developers are unable to retrieve user emails or reset user mailbox passwords.[34] This system absolves ProtonMail from:

  • Storing either the unencrypted data or the mailbox password.
  • Divulging the contents of past emails but not future emails.
  • Decrypting the mailbox if requested or compelled by a court order.[35]

ProtonMail exclusively supports HTTPS and uses TLS with ephemeral key exchange to encrypt all Internet traffic between users and ProtonMail servers. Their 4096-bit RSA SSL certificate is signed by QuoVadis Trustlink Schweiz AG and supports Extended Validation, Certificate Transparency,[36] Public Key Pinning, and Strict Transport Security. Protonmail.com holds an "A+" rating from Qualys SSL Labs.[37]

In September 2015, ProtonMail added native support to their web interface and mobile app for Pretty Good Privacy (PGP). This allows a user to export their ProtonMail PGP-encoded public key to others outside of ProtonMail, enabling them to use the key for email encryption. The ProtonMail team plans to support PGP encryption from ProtonMail to outside users.[38]

Email sending

An email sent from one ProtonMail account to another is automatically encrypted with the public key of the recipient. Once encrypted, only the private key of the recipient can decrypt the email. When the recipient logs in, their mailbox password decrypts their private key and unlocks their inbox.

Emails sent from ProtonMail to non-ProtonMail email addresses may optionally be sent in plain text or with end-to-end encryption. With encryption, the email is encrypted with AES under a user-supplied password. The recipient receives a link to the ProtonMail website on which they can enter the password and read the decrypted email. ProtonMail assumes that the sender and the recipient have exchanged this password through a backchannel.[34] Such emails can be set to self-destruct after a period of time.[39]

Two-factor authentication

ProtonMail currently supports two-factor authentication with TOTP tokens for its login process[40]. According to official ProtonMail feedback site, U2F support for YubiKey and FIDO physical security keys is currently under development and will be available soon[41].

Data centres

Architecture of a ProtonMail data centre.

ProtonMail maintains and owns its server hardware and network in order to avoid trusting a third party. It maintains two data centres in Lausanne and Attinghausen (in the former K7 military bunker under 1,000 meters of granite rock) for redundancy.[39][42][43] Since the data centres are located in Switzerland, they are legally outside of US and EU jurisdiction. Under Swiss law, all surveillance requests from foreign countries must go through a Swiss court and are subject to international treaties. Prospective surveillance targets are notified and can appeal the request in court.

Each data centre uses load balancing across web, mail, and SQL servers, redundant power supply, hard drives with full disk encryption, and exclusive use of Linux and other open-source software.[44] In December 2014, ProtonMail joined the RIPE NCC in an effort to have more direct control over the surrounding Internet infrastructure.[45]

Account types

As of 21 July 2017, ProtonMail is offered with multiple plans:[46]

Plan Messages Per Day Folders/Labels Storage Aliases Domains Price Support
Free 150 3/3 500 MB 1 Address - Free Limited Support
Plus 1000 200/200 5 GB 5 Addresses 1 $5 /mo or $48 /yr Support [c 1]
Professional Unlimited Unlimited/Unlimited 5 GB 5 Addresses/User 2 $8 /mo or $75 /yr Priority Support [c 1]
Visionary Unlimited Unlimited/Unlimited 20 GB 50 Addresses 10 $30.00 /mo or $288.00 /yr Priority Support [c 1][c 2]
  1. ^ a b c Custom domains can use SPF, DKIM, and DMARC[47]
  2. ^ ProtonVPN Included[46]

ProtonMail is mentioned in the 2015 Bear Grylls novel Ghost Flight.[48]

ProtonMail was featured in Seasons 1 and 3 of the American TV drama series Mr. Robot in December 2017.[49]

See also

References

  1. ^ "ProtonMail - Tor Encrypted Email".
  2. ^ "license.md". github.com/ProtonMail/WebClient. Proton Technologies A.G. 8 June 2016.
  3. ^ "protonmail.com Site Info". Alexa Internet. Retrieved 1 April 2018.
  4. ^ "ProtonMail is Open Source!". ProtonMail Blog. 13 August 2015. Retrieved 19 October 2015.
  5. ^ Biggs, John (23 June 2014). "ProtonMail Is a Swiss Secure Mail Provider That Won't Give You up to the NSA". TechCrunch. Retrieved 19 October 2015.
  6. ^ "ProtonMail, the Easy-to-Use Encrypted Email Service, Opens Up to the Public". 17 March 2016.
  7. ^ "Registre du Commerce du Canton de Genève". République et canton de Genève. 18 July 2014. Retrieved 20 February 2018.
  8. ^ "Why Switzerland?". ProtonMail Blog. 19 May 2014. Retrieved 19 October 2015.
  9. ^ "Fighting Censorship with ProtonMail Encrypted Email Over Tor". ProtonMail Blog. 19 January 2017. Retrieved 20 January 2017.
  10. ^ https://www.inverse.com/article/49041-protonmail-ceo-andy-yen-interview
  11. ^ Andy Yen (31 December 2018). "A look back at 2018 and our vision for the future". ProtonMail Blog. Retrieved 25 January 2019.
  12. ^ "ProtonMail now in Public Beta!!". ProtonMail Blog. 16 May 2014. Retrieved 31 January 2016.
  13. ^ "Über-Secure ProtonMail Beta Maxes Out Servers in Just 60 Hours". Infosecurity Magazine. 22 May 2014. Retrieved 19 October 2015.
  14. ^ Yen, Andy (31 July 2014). "ProtonMail". Indiegogo. Retrieved 19 October 2014.
  15. ^ Halfacree, Gareth (1 July 2014). "ProtonMail hit by PayPal account freeze". bit-tech. Retrieved 19 October 2015.
  16. ^ Howell O'Neill, Patrick (1 July 2014). "PayPal freezes account of email encryption startup ProtonMail [Update]". The Daily Dot. Retrieved 19 October 2015.
  17. ^ Yen, Andy (30 June 2014). "Paypal Freezes ProtonMail Campaign Funds". ProtonMail Blog. Retrieved 19 October 2015.
  18. ^ Yen, Andy (18 March 2015). "ProtonMail has raised $2M USD to protect online privacy". ProtonMail Blog. Retrieved 19 October 2015.
  19. ^ "ProtonMail goes Open Source with version 2.0". ProtonMail Blog. 13 August 2015. Retrieved 31 January 2016.
  20. ^ "Announcement: ProtonMail has launched worldwide!". ProtonMail Blog. 17 March 2016. Retrieved 21 July 2016.
  21. ^ "Fighting Censorship with ProtonMail Encrypted Email Over Tor". ProtonMail Blog. 19 January 2017. Retrieved 27 January 2017.
  22. ^ Martin, Alexander J. (19 January 2017). "ProtonMail launches Tor hidden service to dodge totalitarian censorship". The Register. Archived from the original on 20 January 2017.
  23. ^ "Introducing ProtonMail Contacts – the world's first encrypted contacts manager". ProtonMail Blog. 21 November 2017.
  24. ^ M., Irina (6 December 2017). "Introducing ProtonMail Bridge, email encryption for Outlook, Thunderbird, and Apple Mail". ProtonMail Blog. Retrieved 16 December 2017.
  25. ^ "Introducing Address Verification and Full PGP Support - ProtonMail Blog". ProtonMail Blog. 25 July 2018. Retrieved 28 September 2018.
  26. ^ Leyden, John (5 November 2015). "ProtonMail still under attack by DDoS bombardment". The Register. Retrieved 5 November 2015.
  27. ^ "DDOS Update". ProtonMail. 5 November 2015. Retrieved 5 November 2015.
  28. ^ a b "ProtonMail Statement about the DDOS Attack". ProtonMail. 5 November 2015. Retrieved 5 November 2015.
  29. ^ "Armada Collective Blackmails Swiss Hosting Providers". Swiss Governmental Computer Emergency Response Team. 22 September 2015. Retrieved 6 November 2015.
  30. ^ Fox-Brewster, Thomas (5 November 2015). "ProtonMail Pays Crooks $6,000 in Bitcoin to Cease DDoS Bombardment". Forbes. Retrieved 5 November 2015.
  31. ^ @ProtonMail (5 November 2015). "We are seeking a datacenter in Switzerland brave enough to host ProtonMail, many are afraid due to the magnitude of the attack against us" (Tweet) – via Twitter.
  32. ^ Lynch, Justin (2 July 2018). "ProtonMail CEO: 'The attacks are continuing'". Sightline Media Group.
  33. ^ "Apophis Squad member responsible for attacks against ProtonMail has been arrested - ProtonMail Blog". ProtonMail Blog. 6 September 2018. Retrieved 28 September 2018.
  34. ^ a b Stockman, Jason (22 May 2014). "How are ProtonMail keys distributed?". Stack Exchange. Retrieved 19 October 2015.
  35. ^ Khandelwal, Swati (26 May 2014). "ProtonMail: 'NSA-Proof' End-to-End Encrypted Email Service". The Hacker News. Retrieved 19 October 2015.
  36. ^ "SSL Certificate Update". Qualys SSL Labs. 19 January 2016. Retrieved 31 January 2016.
  37. ^ "SSL Report: protonmail.com". Qualys SSL Labs. 7 March 2016. Retrieved 7 March 2016.
  38. ^ Yen, Andy (22 September 2015). "ProtonMail adds Facebook PGP integration". ProtonMail Blog. Retrieved 19 October 2015.
  39. ^ a b "ProtonMail Security Details". ProtonMail Security. 31 January 2016. Retrieved 31 January 2016.
  40. ^ "Two Factor Authentication (2FA)". ProtonMail Support.
  41. ^ "Yubikey / FIDO U2F Support for Two Factor Authentication". Customer Feedback for ProtonMail. 22 August 2018. Archived from the original on 29 September 2019. Retrieved 29 September 2019.
  42. ^ Patterson, Dan (13 November 2015). "Exclusive: Inside the ProtonMail siege: how two small companies fought off one of Europe's largest DDoS attacks". TechRepublic. Retrieved 31 January 2016.
  43. ^ "Im geheimen Datenbunker von Attinghausen". Schweiz aktuell (video) (in German). SRF. 5 September 2012. Retrieved 20 February 2017.
  44. ^ Yen, Andy (17 December 2014). "Infrastructure Upgrades". ProtonMail Blog. Retrieved 19 October 2015.
  45. ^ Yen, Andy (17 December 2014). "ProtonMail joins Réseaux IP Européens (RIPE NCC)". ProtonMail Blog. Retrieved 19 October 2015.
  46. ^ a b "ProtonMail Pricing". ProtonMail. Retrieved 21 July 2017.
  47. ^ "Anti-spoofing for Custom Domains (SPF, DKIM & DMARC)". ProtonMail. 2016.
  48. ^ Grylls, Bear (2015). Ghost Flight.
  49. ^ Yen, Andy (25 August 2015). "ProtonMail on Mr. Robot". ProtonMail Blog. Retrieved 18 March 2018.
Wikimedia Commons has media related to Proton Mail.
Retrieved from "https://en.wikipedia.org/w/index.php?title=Proton_Mail&oldid=919626710"