ProtonMail
ProtonMail is an end-to-end encrypted email service founded in 2013 in Geneva, Switzerland by scientists who met at the CERN research facility. ProtonMail uses client-side encryption to protect email content and user data before they are sent to ProtonMail servers, unlike other common email providers such as Gmail and Outlook.com. The service can be accessed through a webmail client, the Tor network, or dedicated iOS and Android apps.
ProtonMail is run by Proton Technologies AG, a company based in the Canton of Geneva,. Its servers are located at two locations in Switzerland, outside of US and EU jurisdiction. The company also operates ProtonVPN, a VPN service. ProtonMail received initial funding through a crowdfunding campaign. Although the default account setup is free, the service is sustained by optional paid services. Initially invitation-only, ProtonMail opened up to the public in March 2016., ProtonMail had over users, and grew to over 5 million by September 2018 and over 10 million by the end of 2018.
History
Development
On 16 May 2014, ProtonMail entered into public beta. It was met with enough response that after three days they needed to temporarily suspend beta signups to expand server capacity. Two months later, ProtonMail received from 10,576 donors through a crowdfunding campaign on Indiegogo, while aiming for. During the campaign, PayPal froze ProtonMail's PayPal account, thereby preventing the withdrawal of worth of donations. PayPal stated that the account was frozen due to doubts of the legality of encryption, statements that opponents said were unfounded. The restrictions were lifted the following day.On 18 March 2015, ProtonMail received from Charles River Ventures and the Fondation Genevoise pour l'Innovation Technologique. On 14 August 2015, ProtonMail released major version 2.0, which included a rewritten codebase for its web interface. The ProtonMail team simultaneously released the source code for the web interface under an open-source license. On 17 March 2016, ProtonMail released major version 3.0, which saw the official launch of ProtonMail out of beta. With a new interface for the web client, version 3.0 also included the public launch of ProtonMail's iOS and Android beta applications.
On 19 January 2017, ProtonMail announced support through Tor, at the hidden service address protonirockerxow.onion. On 21 November 2017, ProtonMail introduced ProtonMail Contacts, a zero-access encryption contacts manager. ProtonMail Contacts also utilizes digital signatures to verify the integrity of contacts data. On 6 December 2017, ProtonMail launched ProtonMail Bridge, an application that provides end-to-end email encryption to any desktop client that supports IMAP and SMTP, such as Microsoft Outlook, Mozilla Thunderbird, and Apple Mail, for Windows and MacOS.
On 25 July 2018, ProtonMail introduced address verification and PGP support, making ProtonMail interoperable with other PGP clients. On 30 October 2019, ProtonMail open sourced its iOS app, releasing the code on GitHub and publishing its audit results by SEC consulting. In December 2019, ProtonMail launched "ProtonCalendar", a fully encrypted calendar.
On 15 April 2020, ProtonMail open sourced the ProtonMail Bridge app, releasing the code on GitHub and publishing its audit results by SEC consulting. Subsequently, on 23 April 2020, ProtonMail also open sourced its Android app. The code for Android is released on GitHub and published its audit results by SEC consulting.
DDoS attacks
From 3 to 7 November 2015, ProtonMail was under several DDoS attacks that made the service largely unavailable to users. During the attacks, the company stated on Twitter that it was looking for a new data center in Switzerland, saying, "many are afraid due to the magnitude of the attack against us".In July 2018, ProtonMail reported it was once more suffering from DDoS attacks, with CEO Andy Yen claiming that the attackers had been paid by an unknown party to launch the attacks. In September 2018, one of the suspected ProtonMail attackers was arrested by British law enforcement and charged in connection with a series of other high-profile cyberattacks against schools and airlines.
Nationwide block in Belarus
On 15 November 2019, Proton confirmed that Belarus had issued a nationwide block of ProtonMail and ProtonVPN IP addresses. The block was no longer in place 4 days later. No explanation was given to ProtonMail for the block, nor for the block being lifted.Block in Russia
On 29 January 2020, the Russian Federal Service for Supervision of Communications, Information Technology and Mass Media reported that it had implemented a complete block of ProtonMail services within Russia. As a reason for the block, it cited ProtonMail's refusal to give up information relating to accounts that allegedly sent out spam with terror threats. However, ProtonMail claimed that it did not receive any requests from Russian authorities regarding any such accounts. In response to the block, the ProtonMail Twitter account recommended legitimate users circumvent the block via VPNs or Tor.In March 2020 the company announced that even though the Russia ban was not particularly successful and the service continues to be largely available in Russia without utilising a VPN, ProtonMail will be releasing new anti-censorship features in both ProtonMail and ProtonVPN desktop and mobile apps which will allow more block attempts to be automatically circumvented.
Data centers
ProtonMail maintains and owns its own server hardware and network in order to avoid utilizing a third party. It maintains two data centers, one in Lausanne and another in Attinghausen as a backup. Since the data centers are located in Switzerland, they are legally outside of US and EU jurisdiction. Under Swiss law, all surveillance requests from foreign countries must go through a Swiss court and are subject to international treaties. Prospective surveillance targets are promptly notified and can appeal the request in court.Each data center uses load balancing across web, mail, and SQL servers, redundant power supply, hard drives with full disk encryption, and exclusive use of Linux and other open-source software. In December 2014, ProtonMail joined the RIPE NCC in an effort to have more direct control over the surrounding Internet infrastructure.
Encryption
ProtonMail uses a combination of public-key cryptography and symmetric encryption protocols to offer end-to-end encryption. When a user creates a ProtonMail account, their browser generates a pair of public and private RSA keys:- The public key is used to encrypt the user's emails and other user data.
- The private key capable of decrypting the user's data is symmetrically encrypted with the user's mailbox password.
- The login password is used for authentication.
- The mailbox password encrypts the user's mailbox that contains received emails, contacts, and user information as well as a private encryption key.
- Storing either the unencrypted data or the mailbox password.
- Divulging the contents of past emails but not future emails.
- Decrypting the mailbox if requested or compelled by a court order.
In September 2015, ProtonMail added native support to their web interface and mobile app for Pretty Good Privacy. This allows a user to export their ProtonMail PGP-encoded public key to others outside of ProtonMail, enabling them to use the key for email encryption. The ProtonMail team plans to support PGP encryption from ProtonMail to outside users.
Email sending
An email sent from one ProtonMail account to another is automatically encrypted with the public key of the recipient. Once encrypted, only the private key of the recipient can decrypt the email. When the recipient logs in, their mailbox password decrypts their private key and unlocks their inbox.Emails sent from ProtonMail to non-ProtonMail email addresses may optionally be sent in plain text or with end-to-end encryption. With encryption, the email is encrypted with AES under a user-supplied password. The recipient receives a link to the ProtonMail website on which they can enter the password and read the decrypted email. ProtonMail assumes that the sender and the recipient have exchanged this password through a backchannel. Such emails can be set to self-destruct after a period of time.
Two-factor authentication
ProtonMail currently supports two-factor authentication with TOTP tokens for its login process. As of October 2019, according to official ProtonMail blog, U2F support for YubiKey and FIDO physical security keys is currently under development and will be available soon after the release of v4.0.Account types
, ProtonMail is offered with multiple plans:| Plan | Messages Per Day | Folders/Labels | Storage | Aliases | Domains | Price | Support |
| Free | 150 | 3/20 | 500 MB | 1 Address | - | Free | Limited Support |
| Plus | 1000 | 200/200 | 5 GB | 5 Addresses | 1 | $5 /mo or $48 /yr | Support |
| Professional | Unlimited | Unlimited/Unlimited | 5 GB | 5 Addresses/User | 2 | $8 /mo or $75 /yr | Priority Support |
| Visionary | Unlimited | Unlimited/Unlimited | 20 GB | 50 Addresses | 10 | $30.00 /mo or $288.00 /yr | Priority Support |
In popular culture
ProtonMail was mentioned in the 2015 Bear Grylls novel Ghost Flight.ProtonMail was featured in Seasons 1 and 3 of the American TV drama series Mr. Robot in December 2017.
ProtonMail was also featured in the 2019 film Knives Out. The service did not pay for its appearance in the movie but was contacted by the filmmakers for permission to use the brand name.