Disturbing facts about ProtonMail

Original article (was) here: https://privacy-watchdog.io/truth-about-protonmail/.

Update 2021/11/04. My thanks to the HN guys for their help and bunch of useful recommendations on this case. So, I have changed some things in this post:

Update 2021/10/28 domain registrator received abuse complaint against this article:

Dear Madam or Sir,

Our Company, Proton AG, is a provider of secured Internet services, including ProtonMail, and end-to-end encrypted email service.

We have recently been made aware of an article hosted on the website encryp.ch, and accessible via the following link: https://encryp.ch/blog/truth-about-protonmail/.

This article is highly defamatory. It claims untrue and groundless “facts” about our Company and our services, which can cause great damages to our reputation and the conduct of our business.

After investigation, it appears that the website is held by your Company.

We would be very grateful if you could take down the content of this article, and provide us with all available information regarding its author.

We remain at your disposal for further questions.

Best regards,

Legal Counsel
Proton AG

1. Protonmail Behaves like a CIA/NSA “Honeypot

Protonmail has an Onion domain that allows users to visit their site using the TOR browser. Protonmail even has an SSL cert for that onion address even though it’s completely unnecessary. When a user makes a new account with Protonmail on TOR they are re-directed from Protonmail’s “.onion” to “.com” address. This breaks your secure encrypted connection to their onion address, enabling your identification. There are absolutely no technical reasons for this feature. In fact, the only other websites that operate like this are suspected NSA/CIA Honeypots.

This is a huge security issue that was either created because Protonmail is managed by Particle physicists who do not understand computer security OR they have been forced to operate their website in a similar way as CIA/NSA honeypots. Both possibilities are serious concerns.

2. Protonmail Does Not Provide “End to End Encryption”


3. Protonmail’s Was Created Under CIA/NSA Oversight


4. Protonmail is Part Owned by CRV and the Swiss Government


5. CRV, In-Q-Tel & the CIA


6. Protonmail Follows CIA Email format & Metadata Requirements


7. Swiss MLAT Law Could Give the NSA Full Access


8. Protonmail Uses Radware for DNS/DDOS Protection

Privacy companies like Protonmail are required to use a DNS/DDOS service because of the frequent attacks against their service. Protonmail uses a company called Radware for this purpose. Radware is a low-quality service that has failed to provide adequate protection. Protonmail has been taken offline, sometimes by teenage kids, because they insist on using a sub-par service. It’s worth noting that Radware’s international office is a few miles away from the headquarters of the most powerful Intelligence agency on earth, The Isreali Mossad. Radware can gain complete access to all Protonmail user’s accounts in two ways. They could inject a few lines of code that would reveal all users log in username and passwords, thus allowing them to log in as if they are that user. They could also be given users usernames & passwords by Protonmail. Remember Protonmail has admitted they can access all user’s accounts and decrypt their data. Additionally, it has been reported that Radware has direct connections to the Israeli Defense Force.

9. Protonmail Developers Do Not Use Protonmail

Protonmail’s developers are in a position to know the real security offered by Protonmail. And Protonmail’s developers do not use Protonmail. If you were served food by a cook who refused to eat the food, would that be a cause of concern to you? This is the same situation. Protonmail developers do not use Protonmail, there are likely good reasons for this.

10. Protonmail engages in illegal cyberwarfare

In 2017 Protonmail seems to have used illegal cyber warfare capabilities to unlawfully break into a suspects server. You can see the tweet they posted and read about it here. They soon deleted the tweet and said: “We cannot confirm nor deny if anything happened.” In 2013 the European Union parliament voted to make hacking a crime that carried a prison sentence of 2 years. “Hacking back” is also illegal under Swiss law. Based on Protonmail’s admissions only, they conducted an illegal hack.

11. Protonmail has a history of Dishonesty

From Protonmail’s creation lied to their users. Starting when they crowdfunded $550k to “remain Independent”, a promise they broke almost immediately by selling equity ownership to a US corporation with ties to President Obama and John Podesta.

12. Protonmail does not protect users, if it could cause any legal risk

Protonmail collaborating with EUROPOL in a clear case of political repression against anti-gentrification activists in Paris, and setup IP logging specifically for that user… So even in the clearest violations they are not standing up for users if it means taking legal risks for them.

13. Protonmail censoring “untruth” information about themself, even if you are a small blog

Prontonmail joining the long list of censor trolls asking registrars about identity of domain owner?! (see an aforementioned abuse complaint from Proton AG). They broke away from a tradition of free speech (debunk claims publicly), and from a traditional form of law enforcement. It is very unusual for corporate trolls with armies of lawyers to contact anyone to censor such vague claims on a random blog in a dark corner of the internet. It’s not exactly like the website named like protonmailtruth.ch or whatever.

In our opinion Protonmail is not an email solution you would use if you want privacy or security. Your emails are probably going to end up in a US data center right next to your Gmail emails.