Disturbing facts about ProtonMail<\/a><\/p>\n\n\n\n\n\n\n\n\n\n\n\n February 18, 2021<\/p>\n\n\n\n Original article (was) here: https:\/\/privacy-watchdog.io\/truth-about-protonmail\/<\/a>.<\/p>\n\n\n\n Update 2021\/11\/04<\/strong>. My thanks to the HN<\/a> guys for their help and bunch of useful recommendations on this case. So, I have changed some things in this post:<\/p>\n\n\n\n Update 2021\/10\/28<\/strong> domain registrator received abuse complaint against this article:<\/p>\n\n\n\n [redacted]<\/p>\n\n\n\n Legal Counsel Proton AG —<\/p>\n\n\n\n 1. Protonmail Behaves like a CIA\/NSA \u201cHoneypot<\/a>\u201d<\/strong><\/p>\n\n\n\n Protonmail has an Onion domain<\/a> that allows users to visit their site using the TOR browser. Protonmail even has an SSL cert for that onion address even though it\u2019s completely unnecessary. When a user makes a new account with Protonmail on TOR they are re-directed from Protonmail\u2019s \u201c.onion\u201d to \u201c.com\u201d address. This breaks your secure encrypted connection to their onion address, enabling your identification. There are absolutely no technical reasons for this feature. In fact, the only other websites that operate like this are suspected NSA\/CIA Honeypots.<\/p>\n\n\n\n This is a huge security issue that was either created because Protonmail is managed by Particle physicists who do not understand computer security OR they have been forced to operate their website in a similar way as CIA\/NSA honeypots. Both possibilities are serious concerns.<\/p>\n\n\n\n 2. Protonmail Does Not Provide \u201cEnd to End Encryption\u201d<\/strong><\/p>\n\n\n\n Professor Nadim Kobeissi mathematically proved<\/a> that Protonmail does not provide End to End Encryption. Meaning, Protonmail has the ability to decrypt their own user\u2019s data. When this was shown to be true, Protonmail users were outraged they had been lied to. Protonmail was forced to issue a public statement<\/a>. Their statement begins like you would expect it would.. by shitting on the security researcher that revealed their dishonesty. Then they continued to say: \u201cWe lied to our users because other email companies did\u201d. No apologies. They can decrypt any of their user\u2019s data be sending them scripts that allow them to do so. However they advertise that they can not. Protonmail\u2019s admission<\/a> proves they offer the same security that Gmail offers.<\/strong> Both Gmail and Protonmail offer encryption that they can decrypt whenever they want.<\/p>\n\n\n\n 3. Protonmail\u2019s Was Created Under CIA\/NSA Oversight<\/strong><\/p>\n\n\n\n Gmail & Protonmail were both created in CIA\/NSA funded departments with their oversight. Protonmail has tried to hide this part of their history. We wrote a whole article about it here<\/a>.<\/p>\n\n\n\n 4. Protonmail is Part Owned by CRV and the Swiss Government<\/strong><\/p>\n\n\n\n After a successful crowdfunding campaign with promises to \u201cremain independent\u201d Protonmail sold equity ownership<\/a> to CRV<\/a> and FONGIT<\/a>. At the time of the equity sale a CRV founder, Mr Ted Ditersmith, was working for the US State Department closely with President Obama. His position as a delegate required close contact with CIA & NSA administration. Mr. Ted Ditersmith had also witnessed the Edward Snowden revelations and made statements that he planned to use his corporate knowledge to \u201cfight terrorism\u201d. FONGIT<\/a> is a Non Profit organization that is financed by the Swiss Government<\/a>. Protonmail staff member, Antonio Gambardella<\/a>, also works for the Swiss Government.<\/p>\n\n\n\n 5. CRV, In-Q-Tel & the CIA<\/strong><\/p>\n\n\n\n The CIA openly operates a front company, In-Q-Tel<\/a>, whose stated purpose is to invest in tech companies on behalf of the CIA. In-Q-Tel has stated they have a specific interest in the information contained in e-mails<\/a> and encrypted communication<\/em>. In-Q-Tel has been shown to be the bridge between the CIA and Gmail<\/a>. An analysis of staff members reveals CRV & In-Q-Tel connections. The US media confirms these connections when they interview CRV<\/a> so that they can understand In-Q-Tel. Additionally, The mastermind, cryptographer & back end developer that created Protonmail, Wei Sun, now works for Google<\/a>.<\/p>\n\n\n\n 6. Protonmail Follows CIA Email format & Metadata Requirements<\/strong><\/p>\n\n\n\n Leaked documents at Wikileaks show that the CIA requires emails to be stored as an EML filetype. There are several ways to store emails, and Protonmail has selected the format that the CIA requires. Protonmail offers no protection for users\u2019 metadata and has officially stated that they turn metadata over to Law Enforcement. Edward Snowden revealed that the US government cares least about the content of emails. Mr. Snowden revealed the US Law Enforcement cares most about who a person is talking to, the dates & times of the emails, and the subject of the email. Subject and metadata encryption are not difficult to provide. However, Protonmail refuses to offer any protection on data that is most valuable to the CIA & FBI and they store it as plain text (No encryption). Edward Snowden stated the NSA \u201cisn\u2019t able to compromise the encryption algorithms underlying these technologies. Instead, it circumvents or undermines them by forcing companies to cooperate in other ways<\/a>. Protonmail has refused to protect the information the NSA wants, this is a concern.<\/p>\n\n\n\n 7. Swiss MLAT Law Could Give the NSA Full Access<\/strong><\/p>\n\n\n\n Protonmail\u2019s Servers Reside In Switzerland, a country with an MLAT treaty that could allow the NSA to continue it\u2019s the mission of recording \u201cnearly everything\u201d about a person\u2019s internet communication. Any doubts the MLAT treaty applies are removed when you take into account that Protonmail is part-owned by FONGIT, a Swiss Government-financed company. Protonmail has also recently revised<\/a> its Privacy Policy<\/a> to include wording and requirements from the MLAT treaty. Their actions show they are capitulating with the MLAT treaty. Revisions include a change to their privacy policy allowing them to track your location while you use their service in some situations.<\/p>\n\n\n\n 8. Protonmail Uses Radware for DNS\/DDOS Protection<\/strong><\/p>\n\n\n\n Privacy companies like Protonmail are required to use a DNS\/DDOS service because of the frequent attacks against their service. Protonmail uses a company called Radware<\/a> for this purpose. Radware is a low-quality service that has failed to provide adequate protection. Protonmail has been taken offline, sometimes by teenage kids<\/a>, because they insist on using a sub-par service. It\u2019s worth noting that Radware\u2019s international office is a few miles away from the headquarters of the most powerful Intelligence agency on earth, The Isreali Mossad. Radware can gain complete access to all Protonmail user\u2019s accounts in two ways. They could inject a few lines of code that would reveal all users log in username and passwords, thus allowing them to log in as if they are that user. They could also be given users usernames & passwords by Protonmail. Remember Protonmail has admitted they can access all user\u2019s accounts and decrypt their data. Additionally, it has been reported that Radware has direct connections<\/a> to the Israeli Defense Force.<\/p>\n\n\n\n 10. Protonmail engages in illegal cyberwarfare<\/strong><\/p>\n\n\n\n In 2017 Protonmail seems to have used illegal cyber warfare capabilities to unlawfully break into a suspects server<\/a>. You can see the tweet they posted and read about it here<\/a>. They soon deleted the tweet and said: \u201cWe cannot confirm nor deny if anything happened.\u201d In 2013 the European Union parliament voted<\/a> to make hacking a crime that carried a prison sentence of 2 years. \u201cHacking back\u201d is also illegal under Swiss law. Based on Protonmail\u2019s admissions only, they conducted an illegal hack.<\/p>\n\n\n\n 11. Protonmail has a history of Dishonesty<\/strong><\/p>\n\n\n\n From Protonmail\u2019s creation lied to their users<\/a>. Starting when they crowdfunded $550k to \u201cremain Independent\u201d, a promise they broke almost immediately by selling equity ownership to a US corporation with ties to President Obama and John Podesta<\/a>.<\/p>\n\n\n\n\n
Disturbing facts about ProtonMail<\/h1>\n\n\n\n
\n
---\nDear Madam or Sir,\n\nOur Company, Proton AG, is a provider of secured Internet services, including ProtonMail, and end-to-end encrypted email service.\n\nWe have recently been made aware of an article hosted on the website encryp.ch, and accessible via the following link: https:\/\/encryp.ch\/blog\/truth-about-protonmail\/.\n\nThis article is highly defamatory. It claims untrue and groundless \u201cfacts\u201d about our Company and our services, which can cause great damages to our reputation and the conduct of our business.\n\nAfter investigation, it appears that the website is held by your Company.\n\nWe would be very grateful if you could take down the content of this article, and provide us with all available information regarding its author.\n\nWe remain at your disposal for further questions.\n\nBest regards,<\/code><\/pre>\n\n\n9. Protonmail Developers Do Not Use Protonmail<\/del><\/p>\n\n\n\nProtonmail\u2019s developers are in a position to know the real security offered by Protonmail. And Protonmail\u2019s developers do not use Protonmail<\/a>. If you were served food by a cook who refused to eat the food, would that be a cause of concern to you? This is the same situation. Protonmail developers do not use Protonmail, there are likely good reasons for this.<\/del><\/p>\n\n\n\n