Is Proton Mail Really Private, Secure, and Anonymous?

[@N.S.A.]

I use it. It's fast and secure.

[@jorionedwards]

Seems sus.

[@MentalOutlaw]

Thank you for the clarification, I'll be deleting the video now to replenish my social credit score.

[@looweegee252]

@@MentalOutlaw lol it's going on your PERMANENT RECORD

[@rabywastaken]

that's hilarious lmao

[@N.S.A.]

@@MentalOutlaw As long as you understand.

[@nothingiseverperfect]

*Looks at my carrier pigeon:* “You hear that little guy? I made the right choice!”

[@nicholasbrooks7349]

What if the feds shoot it down? , ever thought about that!

[@kashmirwillwin3124]

@@nicholasbrooks7349 And what if the birds being a government spy drones conspiracy theory is true. Time to learn telepathy

[@GatoCoder]

@Mialisus I don't see why the choice is that bad in pfp

[@franchufranchu119]

Save-or Deez nuts lmao

[@felipedaiber2991]

Me with a shotgun: no you didnt

[@WahrerKuroKiba]

Me: switches to Protonmail Kenny:

[@xeome5596]

exactly

[@dadecountyboos]

same

[@daringcuteseal]

lol

[@grumpyspoder]

same lol made the switch a week ago and then he decides to drop this lol

[@bat4]

@@grumpyspoder Yeah, kzbin.info/www/bejne/h2STpKqvra2MZtk

[@ghollisjr]

If you want something done right, you gotta do it yourself. --The Feds.

[@samaelsilas7500]

Limp Bizkit - Boiler. ;) but "the feds" joke is brilliant!

[@wapuvdvdv]

@@LinusIslamTips thank you linus islam tips :D

[@CanadianB.O.W]

Always thought that anyway lol

[@Imperio_Otomano_the_realest]

@@LinusIslamTips what

[@SquirrelTheorist]

DIY ... email

[@MrYAMAHA32177]

I have developed, (through mainline breeds) a new hybrid carrier pigeon for inner city communication within a 40 mile radius. Should be rolling out the first adults by the end of the second quarter and very excited with the testing so far.

[@heidiho7314]

Finally! Fully compliant with RFC 1149, I assume?

[@sirpretzel822]

Are there any plans on making the genetic sequence open source?

[@harrygarry2637]

@@heidiho7314 government already has robot birds for this exact reason. Minus 70 social credit points

[@johnarnold893]

🤣🤣🤣🤣🤣

[@frwystr]

bro let’s get one pigeon and maybe a uhhhhh chicken?

[@hedgeearthridge6807]

Hopefully in the future we can completely re-invent email, with an open-source protocol that does center on privacy (and isn't a complete pain in the ass to use), because what we currently have is extremely outdated. The hardest part would be getting normies to accept it, and of course big tech wouldn't like it because they thrive on getting to process your emails for advertising data.

[@Cookiekeks]

Why is the email protocol outdated? Just curious to know.

[@greenl7661]

Zk proofs do that. No incentives for migration sadly

[@wheezybackports6444]

OpenSMTP

[@r05ejan8]

​@@Cookiekeks Like the Big Man said... among other things... the inter-domain transfer protocols for email are incompatible with any sort of encryption... even if you go through the effort to PGP encrypt the body of your email... the header which includes info such as IP addresses and email addresses of the sender and receiver are in plaintext for ALL to see.... this stuff was standardized LONG ago when nobody cared about encryption... things have changed and for good reasons encryption is standard for many fundamental services we use everyday..... email is a leftover of times bygone.... much to our detriment.

[@jan_harald]

email works perfectly well for what it was invented for, just like regular mail... and the hardest part is not only getting people to switch, but also getting half a century worth of programs to ALSO switch... there's a *LOT* of mail integrations going around... not to mention it's easy to just use something like gpg or s/mime to establish secure connections (and you can secure even metadata if the other side knows how to decrypt it, which isn't standard), so instead of "fixing" the protocol with something that will probably take 5 years to stabilize in the first place (c'mon, rust doesn't even have a spec, while being all the rage, and Go's moving at a pretty fast pace, also, just to name a few "modern" things), instead the effort should be focused on overlaying on top of it, and making the secure layer as easy to use as possible, so instead of "go run this command to generate keys and then make an email subkey and then download that extention to your mail client, and then tell it to use that subkey and then figure out the recipient's key" etc it would instead automatically generate you a key and publish it somewhere (possibly on a regular keyserver), and automatically fetch the recipient's key based on their email with the user merely needing to press a button, if even that, and to back up their key (doable automatically, but everyone shouldn't send their private keys to any singular location, so would need additional questions about that)

[@wclifton968gameplaystutorials]

If they really wanted privacy or security then they should've opened up shop in Liechtenstien since they don't work with the US Government or the Chinese Government unlike the Swiss government which works with both

[@steffeneilers8530]

Liechtenstien is probably too small for that, don't they follow the Swiss in most decisions? Also, I find this thing of thinking that countries won't bend over for Uncle Sam so dumb. It's understandable from their perspectives.

[@nootics]

@@steffeneilers8530 i like to call liechtenstein the 27th canton ("state") of Switzerland that likes to act as their own monarchy lmao

[@lennykump8396]

Tutanota didn't give personal information of their customers away even though a court of the FRG tried to force them to. That's not a good point in my opinion. Also Liechtenstein probably doesn't care about some Chinese company just because the company could gain something from it.

[@survivor303]

The swiss thing with their laws was a real thing back in the 90's. Now they are as corrupted as everyone else :)

[@MrEdrftgyuji]

They also work closely with the EU, despite not being a EU member.

[@asosa9502]

I use Proton Mail and I don't really care if it's a honeypot. My reason for switching to Proton Mail is that I didn't want Google having all of my emails. The feds are going to have my emails whether I'm on gmail or on Proton Mail, so I might as well make sure Google doesn't have them too. And yes, I did consider self-hosting, but self-hosted emails are blocked by a large number of email providers because they are a huge source of spam. Just assume that everything you do over email is completely public and you'll be fine.

[@Nash_Nismo]

Yep, screw Google

[@companymen42]

Yea its kinda like the government is the devil you know vs corporations are the devil you dont.

[@fearsomefoursome4]

@@computerdores You mean the data that google gives the NSA willy nilly even without the rubber stamp of FISA courts. Did you not watch snowden?

[@AR15ORIGINAL]

@@computerdores If your threat model includes feds, you shouldn't use email at all. We're talking STRICTLY about corporate tracking on this context. Also, google literally cooperated with the feds in the past. In all likelihood, they are already secretly sharing the plaintext contents of everybody's gmails. Why pretend otherwise?

[@jorgesandoval4602]

Agreed, I'll do it exactly for the same reason

[@PinakiGupta82Appu]

You predicted, and it turned out to be true today, on 14th September 2021. The French government issued a gag order that was forwarded to Interpol and the Interpol rushed to The Honourable Swiss Federal Tribunal. Ironically, that order got passed and the French government forced ProtonMali to log IP addresses of users (mass surveillance) to crack down on an environmental activist. Drug dealers, traffickers, pirates, firearm brokers, virus crystal suppliers are freely roaming around. Protestors, dissenters, activists and journalists are considered to be the heftiest criminals nowadays. Anonymous throwaway type email providers over TOR networks with PGP encryption may be a better choice unless there are some decentralised TOR type chat clients. Though most (not all) TOR clients are also honeypots. Being rational and neutral is regarded as the most dangerous form of extremism these days. You'll be shunned for having an opinion. You own nothing. You don't have any choice. The mighty earl is always right. Might is right.

[@e99g]

So which Email provider (even in Tor) has the most privacy

[@tomtravis858]

They were forced under law to do it, they were even transparent and changed their claims after it happened, it's not like they wanted to comply.

[@sanjacobs6261]

Protonmail shared what IPs connected. Not much of a big deal considering that Google would openly give away the content of every single email you've ever sent and received to any government that asks.

[@MrR0flLol]

@@sanjacobs6261 google never made privacy their main selling point. Not like protonmail.

[@HarrisonMartinson]

"most tor clients are honeypots"? Does that mean I should only download the official client unless I know what I'm doing?

[@Crypdography]

Pro-tip: If you need to encrypt a message do it yourself.

[@cahallo5964]

how would the other end get the key if communication is only through the internet

[@Gurkewasser22]

@@cahallo5964 guess

[@cahallo5964]

@@Gurkewasser22 that makes no fucking sense

[@Gurkewasser22]

Day 8455 explaining jokes to strangers

[@cahallo5964]

@@Gurkewasser22 I have autism you have to explain the joke to me so I can steal it and tell it in several diferent places until it stops being funny to me

[@Marco-yk8kp]

Day 5 of asking Kenny to make a video on "Mozzilla is made by the feds" situation.

[@Jorgeee]

He won’t do that video because Mozilla is obviously not made by the feds.

[@jan_harald]

"made by"...yeah...totally... just like chrome isn't made by the feds, but a company which is very willingly handing over data, and also loves to get ALL the data it can out of everyone... mozilla's on real rough times due to chrome monopoly, and are 1) doing just telemetry, which is disable-able (just use a fork like idk, GNU IceCat, if you're paranoid, lol) and 2) trying to appeal to as many people as they can to attempt to make more normies use it (believe it or not, you can't really live a company off of purely linux geeks who use your software for free), which explains why they're changing the UI, and why they're moving along with chrome's extentions and ideas and other than firefox, they can't even afford any long-living projects, FirefoxOS was a great idea, only to be killed and turned proprietary by KaiOS, while ChromeOS is still a thing, and only non-browser things they have are lockwise (pretty much just standalone version of the password manager in the browser, for phones, so not that significant) and thunderbird, which actually has a surprisingly considerable amount of "web browser" as part of it, iirc...

[@vijaysridhar351]

What about brave ??

[@IWILL360URMOM]

Doesn’t use librewolf... NGMI.

[@Marco-yk8kp]

@@Jorgeee he literally said it in a video, and he even said people asked him to expland and make a vid on it.

[@skeilnet]

The thing is Proton mail is not designed for this level of security, it still need to comply with Swiss law. As always you’re never better served than by yourself. There is no easy route.

[@bennihtm]

Does Swiss law state, that they have to de-anonymize Tor traffic?

[@electric26]

​@@bennihtm redirecting to a clearnet site doesn't de-anonymize Tor users unless the government or entity(s) you're attempting to remain anonymous to run the exit node being used. It is pretty much just a benefit for servers unless you're at a high enough threat levels for governments to contact each other/collaborate. TLDR: it's probably good enough for most users. P.S. they don't redirect to the clearnet version anymore (you can do everything through Tor as far as I can tell)

[@sgill4833]

Very eye opening, all emails are essentially insecure.

[@anneonymous4884]

Oddly enough, the only secure way to send messages is probably physical mail.

[@Normal_Boii]

Carrier pidgeon it is, then

[@ns-yz1hj]

*sadly looks at protonmail account "You aren't who I thought you were..."

[@GabrielTobing]

Me: Well sht we got a problem.

[@binarywoif2852]

I mean, even the most suspicious things about ProtonMail are less suspicious than average email services.

[@mansurtxafapapaias3517]

do not allow get into anyone?

[@crusaderACR]

The most suspicious parts are the lies. Which you don't find elsewhere.

[@TheStiepen]

Please note that traffic between mailservers can actually be encrypted, and will be if supported by both ends. It would however be possible for an attacker to block the encrypted connection, to force fallback to plaintext. To my knowledge something like hsts does not exist for SMTP

[@vxicepickxv]

Would attaching encrypted compressed file attachments work?

[@TheStiepen]

@@vxicepickxv that's basically what pgp does. That also has the advantage that your mail provider cannot read your emails. It's main disadvantage is that it's annoying to use.

[@ondrejsedlak4935]

That is what is called the 'optional' ssl/tls flag, which most email servers set (including the one I run). You can set the encryption flag to 'enforce', but that will cause some emails to bounce as a few cheapo servers do not enforce encryption in transit. As for Proton mail being "encrypted", that is basically half bullshit. They use PGP which relies on the recipient using a private key for end to end encryption and is almost always an opt-in option for non-Proton users. Yes Proton mail won't canvass your emails but most of their claims are marketing bullshit. Gmail is more than welcome to canvass my emails as it's always used for non-essential stuff. My private email server however is never canvassed.

[@GuardianofRoin]

Protonmail: It's not private, but it's about as close as you're gonna get with email.

[@ryannorthup3148]

Just. Use. Enigmail.

[@skyracer-mk8hg]

"We do not keep any IP logs which can be linked to your anonymous email account" That's where the catch is: They might keep logs of non anonymous email accounts (Which are all of them)

[@MrEdrftgyuji]

They may not be telling the truth. It is a bit crazy to think, but government agencies have been known to bend the truth on occasions. All for your own good of course.

[@Bond2025]

None of the accounts are anonymous, they are all linked to a phone number that gives a precise location and/or a payment method that is traced to you like a debit card, credit card or paypal. They also scan all your plain text emails as they leave and arrive at the servers before and after they encrypt and decrypt them. It's one massive honeypot - the next EncroChat.

[@Bagginsess]

If it's a honey pot at least the glowies have to pay the other glowies for the data instead having google directly feed it into their servers.

[@krissyramsey3934]

Can we all just take a moment to consider how sad it is that we have to worry about things like cyber-security? What has this world come to?

[@the9file]

security has mattered for the entire history of civilization. there are better uses of your time

[@soulextracter]

if you really wanna worry, go watch a couple of videos from The Lockpicking Lawyer here on youtube. There isn't a lock he can't pick in like 30 seconds flat maximum lol. Granted not every home invader is going to have his skills, but still.

[@finesseandstyle]

cyber-security, laws and rules are made precisely because without them there would be chaos

[@theunfortunatespectacle7381]

Back in the good old days, all we had to worry about was cholera, typhus or DDT. Good times

[@skaruts]

@@finesseandstyle if there were no laws, then people would find ways to enforce order on their own. No one likes to live in chaos, therefore chaos is never the outcome. People solve problems on their own if a government isn't there to pretend to do it. Rules and security are two good examples of people doing just that. And they're more effective than any laws that exist, because laws are not preventive measures.

[@ScibbieGames]

The switch to the clearnet domain seems like a dumb oversight from the frontend developer. Maybe they will address it in the future. But these are fair concerns I suppose.

[@araa5184]

Damn, wanted to know what you would rate it in terms of bio-illuminascent levels

[@TheSuperBoyProject]

Like 3

[@Atilolzz]

Its amazing how the costanza meme survived for a decade and is still very relateable

[@cherubin7th]

Biggest problem is that most of your emails will go to people with surveillance accounts on gmail or others like that anyway.

[@jan_harald]

email works perfectly well for what it was invented for, just like regular mail... and the hardest part is not only getting people to switch, but also getting half a century worth of programs to ALSO switch... there's a *LOT* of mail integrations going around... not to mention it's easy to just use something like gpg or s/mime to establish secure connections (and you can secure even metadata if the other side knows how to decrypt it, which isn't standard), so instead of "fixing" the protocol with something that will probably take 5 years to stabilize in the first place (c'mon, rust doesn't even have a spec, while being all the rage, and Go's moving at a pretty fast pace, also, just to name a few "modern" things), instead the effort should be focused on overlaying on top of it, and making the secure layer as easy to use as possible, so instead of "go run this command to generate keys and then make an email subkey and then download that extention to your mail client, and then tell it to use that subkey and then figure out the recipient's key" etc it would instead automatically generate you a key and publish it somewhere (possibly on a regular keyserver), and automatically fetch the recipient's key based on their email with the user merely needing to press a button, if even that, and to back up their key (doable automatically, but everyone shouldn't send their private keys to any singular location, so would need additional questions about that)

[@normahostetler7859]

Us, soccer moms, want to be able to freely post on social media and not be called domestic t.e.r.r.o.r.i.s.t.s. All social medias require an email and it ties it back to us.

[@atomick2398]

Your thumbnails are top tier Jesus Christ

[@ronodipbasak4524]

5:50 - "SMTP port 25 that can not be encrypted" Don't most providers use SSL encryption like on port 465 or 587?

[@GlenMerlin]

I know gmail allows port 25 but SSL encryption is the default

[@auscompgeek]

Any and all mail going between providers always go over port 25. Ports 465 and 587 are only for submission.

[@user-td6rb]

“there isn’t any hard evidence that protonmail is a honeypot, but protonmail is a honeypot”

[@andalinta]

@DownloadPizza he literally said that in the video. What are you talking about?

[@neoish]

The contradiction.

[@xrichxlen]

Do NOT click the description link! The "privacy watchdog" link, now (May 2023), links to a dangerous page where suspicious animations occurred and I quickly received Trojan malware (HTML FakeAlert WRN). I tried to post a version of this comment this earlier, but YT did its comment-deletion thing - I am unsure of why. Perhaps this one is different enough to be allowed.

[@Lystr0saur]

I have absolutely 0 clue what the terms this guy uses in his videos mean, nor do I understand much of what's going on; yet these videos feel very informative and entertaining to me somehow.

[@zeeweenor]

ffs kenny i just switched to proton now you gotta do a followup on the best secure email service

[@shrimp_on_internet]

Self hosting is pretty secure

[@imgladnotu9527]

@Big man pretty sure email hosting doesnt take much. All you need is a stable internet connection i suppose.

[@trik9464]

@Big man riseUp probably

[@kekag]

He answers your question directly in the video: 14:18

[@trik9464]

@Big man riseup email

[@evpowered6574]

When it comes to email the best you're going to get for privacy is your own domain and email hosting. Overall, consider what you send over email to be public.

[@rampageviii7186]

how do u buy a domain? there aint no monero offering registrars. with domain hosting still fucked tho

[@XaFFaX]

You can use any kind of throwaway email services as second email. I am almost sure they do not have filters for all of them. Hardly it will make you more "visible" if you are using a "common" service rather than setting up your own email server on a obscure VM somewhere in the middle of nowhere.

[@v3eboy228]

Love it, you have a.. dare I say it?.... BASED way of presentation man. Been a longtime protonmail user, and the issues you're raising are alarming

[@chadkayser3691]

3:30-3:45 Just a PSA they did use this approach through their newsletter if you had a free email with them. They provided candid dialogue about how no VPN or email encryption is 100% secure. They also explained pretty effectively why and then went into detail about what you're saying at 5:45. It made it clear (and they also said it meant) you had to put your trust in them. *Batman voice* _but you can't put your trust in anybody._ Ok that may be excessive, but yeah thanks for this eye-opener. Also fantastic username 9:50 Dangit that watchdog article is dead.

[@toastybaconbus5737]

What email service would you recommend to receive banking and insurance information. Main goal is to protect from identity theft, not hide from the gov or any such thing.

[@Bond2025]

UK Banks and financial people BLOCK ProtonMail. I found this when I tried using an account.

[@systemthirtytwo]

This is gonna be interesting.

[@XZenon]

>melt the server with thermite I was about to comment that lmao I may not agree with you in every video but damn I love your sense of humour.

[@MentalOutlaw]

Ya, the problem with thermite though is the ignition source has to be hot enough to get it going.

[@XZenon]

@@MentalOutlaw Magnesium strip + Christmas lights

[@ItsOnlyLogixal]

Ngl melting down the server with thermite when an intruder is detected was the funniest part of this video because who hasn't thought about that?

[@johntr7565]

Again: "If you want something done, do it yourself" Waiting for the video on self-hosted mail server :D

[@tac7826]

It's not a US honeypot. It's probably a Swiss honeypot, maybe a WEF honeypot or Swiss intel.

[@Bond2025]

With access granted to NSA and GCHQ.

[@hof_prod]

but what about some 10minmail for the Recovery E-Mail?

[@zimboiii9025]

why do they make it so difficult?

[@hof_prod]

@@zimboiii9025 if you really think about it, its okay how they do it. Companies that are not interested in your Privacy e.g. Google require you to use your phone number to create an account. They "just" force you to have an other mail, for which you easily can use gorillamail or 10minemail

[@marknefedov]

Hated and Mental, greatest crossover ever!

[@zyansheep]

I was literally wondering about this today, your timing is impeccable

[@yes-ge4nm]

Hello fellow pirate

[@DxBlack]

You will note that nowhere on their website do they claim their service is for individuals who need the utmost high of privacy and anonymity...it's for secure white and grey activities, like businesses; not government whistleblower or drug dealers.

[@ryannorthup3148]

I doubt even greys would be safe & secure here.

[@iansmith8747]

As I recall you can use a disposable email account for verification (and therefore this is not a deanonymizing step), the goal being to add difficulty in setting up spam accounts.

[@Pro720HyperMaster720]

I think the Onion domain was mainly intended for accessing the service, maybe someone should ask in their community pages for features and improvements that they extend it for registration

[@downrightlefthiill8081]

Damn. Damn damn damn damn. I dodged a bullet here. Phew! You're a hero my guy. Idk what I'll do without you. ❤

[@Ultrajamz]

Whats more interesting is if websites begin to not require emails but instead require a signal account or something.

[@TheUnarch]

I second that thought!

[@RyanRoadReaper]

If it talks like a honeypot, and acts like a honeypot, it is a honeypot

[@vijaysridhar351]

😂😂

[@Identitools]

Can't use email, can't use telegram, can't use whatsapp, can't use signal, can't use social media, can't use carrier pigeons because they ate too much bread. What can people use?

[@BurgerKingHarkinian]

Smoke signals 👌🏼

[@yestermonth]

@@BurgerKingHarkinian Already being used by Californians and Aussies

[@ddicas]

What awesome coincidence: I'm right now creating a kind of "documentary + hands on" about privacy stuff for almost everything and all kinds of people and you upload this video :D (Seriosly, I just finished recording right now the desktop operating system security step and also installed gentoo on my laptop haha) I'm thinking about to invite some people (The Hated One, Newman) to this project and would like to invite you, Kenny, to participate (I've no idea when I'll finish the "hands on" video to start the documentary video, but anyway, I'll post a comment with this 2 video links when I finish everything) Anyway, again, great video and regards from Brazil o/

[@baguettedad]

r/suddenlycaralho

[@ddicas]

Gostei da comunidade K se for tirar print, coloca o Genchu (do Gentoo) do lado huauhahua

[@jakedw25]

"Email a known drug dealer on April, 20th"...😂😭😂👌

[@namelessbrown]

Exposing himself

[@xastronix]

The point is, is it better then Gmail or other big companies? Definitely YES!

[@borntodie2071]

Me: makes a protonmail account and start using it for bussiness and shit MO: "It's all spookiness and glowies" Well fugg me i guess

[@justethical280]

Haha Mental Outlaw, even though i'm a person who is fairly good in security and IT , i still like the way you present this kind of news/information LoL. Stay safe man. Greetings from The Netherlands.

[@matyasmarkkovacs8336]

What about Tutanota? It encrypts the subject line too and gives more storage for a free account. What should I do if I want to switch from GMail?

[@bennihtm]

I think Tutanota is just fine. I used ProtonMail and just switched to Tutanota. Tutanota doesn't de-anonymizes you when you register. Unfortunately, at the time of writing this, it doesn't have a Tor Hidden Service, but they are considering it.

[@alwaysbanned4812]

@@bennihtm yeah tutanota is a no go. Google the new law from germany requiring the forced BACKDOOR into the emails for law enforcement, they are by law complying because they are in germany.

[@yestermonth]

@@alwaysbanned4812 holy shit

[@TheUnitedNations.]

Do these concerns extend to ProtonVPN?

[@twei__]

Not really afaik, but proton drive *could* be affected

[@dayumnson9769]

Are you about clickbaiting or actually informing people? Did you even read their homepage? All their clients and bridges are e2e encrypted and open source. It seems that this is more "how you feel" than what it is. anyway, you do you.

[@ximi2377]

Thoughts on Steam Deck?

[@Amplifimusic]

Based

[@DzDesignHD]

Get a cheap tablet, Put lineage on it and use an open source app or touch portal. Works pretty well for me

[@kloa4219]

concerned about it's 64gb storage, pc games are big nowadays

[@ScibbieGames]

@@kloa4219 or the more expensive 512GB version. But regardless it does have expandable storage using SD cards. I just don't know how fast that would be lol

[@romancvijanovic7130]

Some mail providers have starttls enabled on port 25. Thus making it possible to have an encryption connection between two MTAs. But the standard is for it to be transported in plaintext.

[@arbazna]

Regarding port 25, it could be encrypted via STARTTLS as far as I know.

[@eDoc2020]

More importantly, there's also a new MTA-STS standard which turns STARTTLS from opportunistic to mandatory for supported servers.

[@JamesQHolden]

CERN uses it, I'd imagine they'd be uptight with security hiring one of the finest scientists out there

[@imgladnotu9527]

For a second there i mis-percieved CERN as SERN there.

[@kashmirwillwin3124]

@@imgladnotu9527 SERN sounds like a bootleg version of CERN some anime about time travel would come up with to bypass copyright. elpsykongru

[@MrEdrftgyuji]

They don't really care if US/Western government agencies spy on them. They only really care about the Chinese or private organisations / hackers.

[@retroman7581]

@@kashmirwillwin3124 the organisation is near, we need to move!

[@fosres]

Hi Mental Outlaw, may you do a video on Tutanota? Its also another end-to-end encrypted email service.

[@russellpearce3749]

I am not trying to hide from anyone or do anything illegal. I just like the fact that they don't sell data and I don't get hit with Annoying ads protonmail is fine for me

[@wouldbabyhitlerkillyou4217]

ah yes, the ole "I have nothing to hide anyway" moot point

[@teriyakipuppy]

There's a saying in the kitchen. "When in doubt, throw it out!"

[@suuuken4977]

At 10:20 when it required an email to authenticate you're a human, couldn''t you just use a temporary email service online via the tor network and then it will be untraceable? Am i missing some key detail?

[@Cookiekeks]

12:05 now you sparked my interest. Hope a video on this thing without IPs follows

[@drasticfred]

"Encryption of email body/contents" is just a marketing/advertisement polishing feature by this company. Almost all email you receive in plaintext. Plus you can encrypt all your email body/contents by yourself without relying a third party, no hassle required.

[@damnmodz5468]

"Having multiple free accounts is not considered an acceptable use of our service (e.g. bulk-signups, large number of free accounts created by a single organization or individual). Free accounts can also only be created and maintained by their effective users (e.g. it is not acceptable to create accounts in anyone else’s name and later transfer credentials to that third party)." How can they enforce this if they do not keep log of IP addresses?

[@moonlitee]

trust me, they don't enforce it

[@moonlitee]

@@justacat.1428 oh maybe in that case, but i have like 20 accounts and they haven't done anything (doesn't mean they don't keep ip logs, they probably do)

[@nikos4677]

10:30 I remember creating an account using proton mail with tor circumventing this type of verification process. Just use your brain and you will figure out ways. Its still easy to create accounts as of now, when it gets harder I still am thinking of ways of bypassing it but I would rather to stay easy

[@yuiooiuy2167]

This video: "I'm going to take boiler plate snippets and make extrapolations for the entire company!" Also, Mental outlaw doesn't understand that https + onion are standard practice for orgs that understand encryption. I guess he was bored and needed a video with no real points or new information on his channel.

[@joshuawlawson]

Mental Outlaw and Techlore both spread a lot of FUD.

[@rafnavi4500]

Just saw an ad about proton on mooreslawisdead then the same day just hours apart, you upload this

[@guestimator121]

Wait a sec, port 25 is not the only port SMTP servers use, many of them use 465 and 587, which are encrypted. Only if the server doesn't support SSL/TLS, your server might decide to send the message without the encryption, but if both of them support it, the messages will be encrypted. The SMTP command for that is called "STARTTLS". TLS/SSL is a new(er) addition to the SMTP protocol, but most of the servers do support it. Postfix does. Maybe I am wrong, so please correct me if I am :-)

[@longiusaescius2537]

?

[@oqocraft2661]

@@longiusaescius2537 ?

[@Jasonhartley31]

You’re not wrong.

[@waltz9230]

Random but important question, why did Protonmail STOP asking what kind of encryption you wanna use upon account creation? I made a new account recently and this time it didn’t ask me if I wanted lighter or more robust (but slower) encryption. Granted, I creates my last account with the paid plan from the get-go where as with this new one I started with the free plan first. This is kind of odd.

[@libertyworker5886]

I've seen it on mobile and desktop, desktop no longer asks you but mobile(through a browser)asks you

[@John_Gaye]

The phone verification is easy to bypass with a free sms site, still spooky tho

[@streetcube-x3h]

How relevant the Video has become again... ironic

[@rdxdt]

As long as the feds dont steal my steam account it is fine

[@egg5474]

The feds want to play yandere simulator give me your password

[@rdxdt]

@@egg5474 my password is **************

[@WatchmanPrivacy]

Just created an account on Onion site today. It doesn't revert to clearnet. They fixed that. I understand the skepticism, but don't see much rationale presented here worth considering.

[@TIOLIOfficial]

No, it's not. It gave some French dude's IP information to the Swiss government when ordered to track him. This was in 2021.

[@Kirill97001]

5:30 Do inter-domain email exchanges support SMTPS [1] (via TLS/SSL)? [1] en.wikipedia.org/wiki/SMTPS

[@auscompgeek]

Nope - take a read of the History section of that article. There is no standardised way to tell MTAs to use the (now non-existent) SMTPS port.

[@Kirill97001]

You are correct, that smtps is deprecated in a way. The same history section mentions that it was replaced by STARTTLS, which provides the means to use TLS over the same SMTP port. I think that the infrastructure to securely send email exist, but whether Proton Mail takes advantage of it is a whole other question.

[@rallias1]

Ok, I'm going to pick the same nit here that got me kicked out of DEF CON 30's Hacker Jeopardy. Port 25 has the ability to use STARTTLS. If a mail server refuses to send a message to a server without STARTTLS, then no man in the middle is able to intercept the contents of that email, only the two MTA's at either side.

[@bystander02311]

IVPN also makes some honest claims about VPN security and they also accept cash. IVPN is slightly cheaper, I'd stick with it.

[@sirajqazi2361]

Bro, you recommended Protonmail in your "Complete online privacy guide" video (2020) Better update that one Nice vid btw!

[@ChimeraX0401]

If I'm not mistaken Protonmail uses STARTTLS which itself encrypts traffic, even Gmail does this. Are you really sure about your claims that protonmail doesnt do end-to-end encryption or you didnt know that they are using STARTTLS protocol???

[@ernstdieter784]

EVERY professional email-service uses STARTTLS on Port 25. We are in 2021.

[@ChimeraX0401]

@@ernstdieter784 that's why I'm kinda baffled about his claims of protonmail not using end-to-end encryption when protonmail itself uses STARTTLS if possible....

[@gigigigi9479]

Strongly believe it is a honeypot. I have found proton mail employees to be uninterested, and the addition of sessions is totally insecure. I see sessions I did not start- no available fix for it. Waste of money and time.

[@AshishKumar-tg6zh]

I am proud of you because the only person who can guide us in the right direction is you.

[@andalinta]

What?? Noo, do your own research. I only agree to half the stuff he says in this video and that is because I'm informed and I understand MY needs aro not those of everyone. You should strive for the same.

[@SoopCanSam-EthoPlaylists]

Yeah email isn't secure, but isn't protonmail better than gmail, yahoo, outlook, etc? Like, even if it's a "honeypot" or whatever, the feds already have access to all your emails anyway.

[@Flat_Earth_Sophia]

"We cannot read your emails" is completely FALSE! They gave all my emails to someone I had an argument with on KZbin! I offended him by saying his country was dangerous. I could tell by what he said to me that he read my emails! Lots of us are out there with the same message, but many of our complaints are getting deleted.

[@victorkorir18]

What course should I purse to get a better understanding of snipping emails and meta data on a mail?

[@greyjay9202]

Bottom line: If you want more secure communication, send a letter through the mail, or use land line telephones. They are protected by Federal law, from eavesdropping or tampering. Land line phone intercepts require a warrant, and the mails are protected by the Postal Inspection Service, a Federal law enforcement agency. You don't want them after you. "Secure" email providers are just lying, in order to drum up business, or troll for information.

[@spud1907]

Out of curiosity.... How much resources do you think law enforcement will use to track down someone reading postal office mail? Full CSI? Doubtful. Mail goes through scanner, and people can see through envelopes when held to the right light. There was a news story not long ago about a mail carrier writing down bank account numbers, addresses, health information...etc....from the letters he was handling, and selling them on the black market. Not to mention, people just leave letters and sensitive infor on table all the time...or even in the car...where every stranger inside your home or cleaning out your car just writes down everything. I don't trust any senstive info through snail mail. I also don't trust it through email.

[@DragonRider-cx7br]

@@spud1907 time to go back to pigeons and encrypted smoke signals i guess

[@spud1907]

@@DragonRider-cx7br Pigeons are easily shot down and intercepted. Smoke singnals used substitution cryptography which is easily cracked.

[@DragonRider-cx7br]

@@spud1907 darn it, i guess we must go back to **shudder** speaking to people (i was joking btw lol)

[@spud1907]

@@DragonRider-cx7br only if you do it quietly in a secure room. Audible speaking is susceptible to interception by third parties.

[@throwaway9911]

Also, I would like to point out that feds buy for something like 60% of TOR networks development. Kenny you should make a video on that...

[@botowner8623]

yes but its 10000% still better than gmail

[@Flat_Earth_Sophia]

"We don't keep your IP address". The guy they gave my account to knew my IP geolocation! My current location, and past locations in other countries I have lived in.

[@w3w3w3]

this video was before its time =D they handed someones data over to the feds couple days agoooooooo =D

[@Cookiekeks]

What did you say on 12:05? "arpin net" or something like that

[@kyu9649]

en.wikipedia.org/wiki/ARPANET

[@ItsDrike]

ARPANET look it up, it was one of the first attempts at making a network protocol

[@hkhjg1734]

what about hosting your own email server? is it safe and practicable?

[@MentalOutlaw]

depends on how you define "safe" if you're trying to be safe against nation states you'll always be vulnerable to wrench attacks. As far as practical sure, its pretty cheap and easy to host your own email.

[@eccoakadicco]

@@MentalOutlaw Tutorial for us retards when?

[@stater3]

I believe email is subject to the same laws as regular postal mail, it can be intercepted by the Government. It's these false claims that companies make that get people rattled up.

[@AcidiFy574]

What about Tutanota or DisRoot??

[@ovhx]

TLDR : don't use an email for illegal activities

[@helloofthebeach]

There's plenty of legal things governments don't want you doing either, and they don't mind breaking their own laws to make sure you don't do them.

[@TheUnarch]

Yep... Let's not even start on civil rights.. they trample on those like the flag...