all-in-one privacy solution":["Proton Unlimited es solución de privacidad más completa"],"Black Friday":["Black Friday"],"No ads. Privacy by default.":["Sin publicidad. La privacidad por bandera."],"People before profits":["Nos importan las personas, no los beneficios"],"Security through transparency":["Seguridad con transparencia"],"The best Proton Mail ${ BLACK_FRIDAY } deals":["Las mejores ofertas del ${ BLACK_FRIDAY } de Proton Mail"],"The world’s only community- supported email service":["El único servicio de correo electrónico con apoyo de la comunidad"]},"specialoffer:limited":{"${ hours } hour":["${ hours } hora","${ hours } horas"],"${ hoursLeft }, ${ minutesLeft } and ${ secondsLeft } left":["Tiempo restante: ${ hoursLeft }, ${ minutesLeft } y ${ secondsLeft }"],"${ minutes } minute":["${ minutes } minuto","${ minutes } minutos"],"${ seconds } second":["${ seconds } segundo","${ seconds } segundos"],"Limited time offer":["Oferta por tiempo limitado"]},"specialoffer:listitem":{"Create multiple addresses":["Crea varias direcciones"],"Hide-my-email aliases":["Alias de hide-my-email"],"Quickly unsubscribe from newsletters":["Date de baja rápidamente de boletines"],"Use your own domain name":["Usa tu propio nombre de dominio"]},"specialoffer:logos":{"As featured in":["Hablan de nosotros"]},"specialoffer:metadescription":{"Get an encrypted email that protects your privacy":["Apuesta por un servicio de correo electrónico cifrado que protege tu privacidad"]},"specialoffer:metatitle":{"Proton Mail Black Friday Sale - Up to 40% off":["Rebajas de Black Friday de Proton: hasta un 40 % de descuento"]},"specialoffer:newmetadescription":{"Get up to 40% off Proton Mail subscriptions this Black Friday. Find great deals on our secure end-to-end encrypted email plans.":["Contrata Proton Mail con hasta un 40 % de descuento en las rebajas de Black Friday. Encontrarás nuestros planes de correo electrónico cifrado de extremo a extremo al mejor precio."]},"specialoffer:newmetatitle":{"Proton Mail Black Friday sale | Up to 40% off secure email":["Rebajas de Black Friday en Proton Mail | Correo electrónico seguro con hasta un 40 % de descuento"]},"specialoffer:note":{"* Billed at ${ TOTAL_SUM } for the first year":["* A un precio de ${ TOTAL_SUM } durante el primer año"],"*Billed at ${ TOTAL_SUM } for the first 2 years":["*A un precio de ${ TOTAL_SUM } durante los 2 primeros años"],"30-day money-back guarantee":["Garantía de devolución de 30 días"],"Billed at ${ TOTAL_SUM } for the first 2 years":["A un precio de ${ TOTAL_SUM } durante los 2 primeros años"],"Billed at ${ TOTAL_SUM } for the first year":["A un precio de ${ TOTAL_SUM } durante el primer año"],"You save ${ SAVE_SUM }":["Ahorras ${ SAVE_SUM }"]},"specialoffer:off":{"${ DISCOUNT } off":["−${ DISCOUNT }"],"${ PERCENT_OFF } off":["−${ PERCENT_OFF }"]},"specialoffer:testimonial":{"I love my ProtonMail":["Adoro ProtonMail"],"My favorite email service":["Mi servicio de correo electrónico favorito"],"Thanks Proton for keeping us all safe in the complicated internet universe.":["Gracias, Proton, por brindarnos protección en este mundo salvaje de Internet."],"You get what you pay for. In the case of big tech, if you pay nothing, you get used. I quit using Gmail and switched to @ProtonMail":["Dan justo lo que prometen. Si las grandes tecnológicas te ofrecen algo gratis, se aprovechan de ti, por eso dejé de usar Gmail y me pasé a @ProtonMail"]},"specialoffer:time":{"Days":["días"],"Hours":["horas"],"Min":["min"]},"specialoffer:title":{"And much more":["Y mucho más"],"Make your inbox yours":["Personaliza tu bandeja de entrada"],"Safe from trackers":["Evita los rastreadores"],"Stay organized":["Mantenlo todo en orden"],"Black Friday email deals":["Ofertas en correo electrónico del Black Friday"],"Don’t just take our word for it":["Lee testimonios de otras personas"],"Our story":["Nuestra historia"],"Transfer your data from Google in one click":["Transfiere tus datos de Google con un clic"]},"specialoffer:tooltip":{"Access blocked content and browse privately. Includes ${ TOTAL_SERVERS }+ servers in ${ TOTAL_COUNTRIES }+ countries, connect up to 10 devices, access worldwide streaming services, malware and ad-blocker, and more.":["Accede a contenido bloqueado y navega con privacidad. Incluye ${ TOTAL_SERVERS } servidores en más de ${ TOTAL_COUNTRIES } países. Conecta hasta 10 dispositivos, acceder a servicios de streaming de todo el mundo, dispón de la protección de bloqueadores de malware y anuncios, etc."],"Easily share your calendar with your family, friends or colleagues, and view external calendars.":["Comparte tu calendario con familiares, amigos y compañeros fácilmente y consulta calendarios externos."],"Includes support for 1 custom email domain, 10 email addresses, 10 hide-my-email aliases, calendar sharing, and more.":["Incluye compatibilidad con 1 dominio de correo electrónico personalizado, 10 direcciones de correo electrónico, 10 alias de hide-my-email, posibilidad de compartir calendario, etc."],"Includes support for 3 custom email domains, 15 email addresses, unlimited hide-my-email aliases, calendar sharing, and more.":["Incluye compatibilidad con 3 dominios de correo electrónico personalizado, 15 direcciones de correo electrónico, alias ilimitados de hide-my-email, posibilidad de compartir calendario, etc."],"Manage up to 25 calendars, mobile apps, secured with end-to-end encryption, 1-click calendar import from Google, and more.":["Gestiona hasta 25 calendarios protegidos con cifrado de extremo a extremo y con opción, por ejemplo, de importar los de Google con un solo clic."]},"Status Banner":{"At the moment we are experiencing issues with the Proton VPN service":["Hay problemas con el servicio de Proton VPN en estos momentos"],"Learn more":["Más información"]},"Status banner":{"Learn more":["Más información"],"Please note that at the moment we are experiencing issues with the ${ issues[0] } service.":["Ten presente que, en estos momentos, el servicio de ${ issues[0] } está dando problemas de funcionamiento."],"We are experiencing issues with one or more services at the moment.":["Uno o varios servicios están dando problemas de funcionamiento en estos momentos."]},"suggestions":{"Suggestions":["Sugerencias"]},"Support":{"Sub category":["Subcategoría","Subcategorías"]},"Support article":{"${ readingTime } min":["${ readingTime } min","${ readingTime } min"],"Category":["Categoría","Categorías"],"Didn’t find what you were looking for?":["¿No has encontrado lo que buscabas?"],"General contact":["Contacto para consultas generales"],"Get help":["Obtener ayuda"],"Legal contact":["Contacto para cuestiones legales"],"Media contact":["Contacto para prensa y medios de comunicación"],"Partnerships contact":["Contacto para colaboraciones"],"Reading":["Lectura"]},"Support categories":{"Browse Proton product support":["Consulta la página de asistencia para productos de Proton"]},"Support category":{"There is no article in this category yet.":["No hay ningún artículo aún en esta categoría."]},"Support troubleshooting":{"--- Select ---":["--- Selecciona ---"],"App version":["Versión de la aplicación"],"Browser":["Navegador"],"Check if this helps":["Comprueba a ver si te sirve"],"Choose a category for your question":["Elige la categoría de tu consulta"],"Choose a product":["Elegir producto"],"Did this solve your issue ?":["¿Te ha resultado útil para resolver el problema?"],"Faster assistance is just a few clicks away — please make your selections":["Haz unos cuantos clics para obtener ayuda más rápidamente. Haz tu selección."],"No, contact support":["No, contactar con el equipo de asistencia"],"Proton account":["Cuenta de Proton"],"Proton Bridge":["Proton Bridge"],"Proton Calendar":["Proton Calendar"],"Proton Drive":["Proton Drive"],"Proton for Business":["Proton for Business"],"Proton Mail":["Proton Mail"],"Proton Pass":["Proton Pass"],"Proton VPN":["Proton VPN"],"Thank you for your feedback":["Gracias por tus comentarios"],"Troubleshooting":["Solución de problemas"],"What can we help with ?":["¿Cómo podemos ayudarte?"],"Yes":["Sí"]},"support_modal_search_query":{"Search query":["Consulta de búsqueda"]},"support_search_button":{"Search":["Buscar"]},"support_search_i_am_looking_for":{"I'm looking for":["Busco"]},"SupportForm":{"For a faster resolution, please report the issue from the Bridge app: Help > Report a problem.":["Para una resolución más rápida, informa del problema desde la aplicación Bridge: Ayuda > Notificar un problema."],"Information":["Información"]},"SupportForm:option":{"Account Security":["Seguridad de la cuenta"],"Contacts":["Contactos"],"Custom email domain":["Dominio de correo electrónico personalizado"],"Email delivery and Spam":["Envío de correos electrónico y spam"],"Encryption":["Cifrado"],"Login and password":["Inicio de sesión y contraseña"],"Merge aliases and accounts":["Fusionar seudónimos y cuentas"],"Migrate to Proton":["Migrar a Proton"],"Notifications":["Notificaciones"],"Other":["Otro"],"Plans and billing":["Planes y facturación"],"Proton for Business":["Proton for Business"],"Sign up":["Regístrate"],"Storage":["Almacenamiento"],"Users, addresses, and identities":["Usuarios, direcciones e identidades"]},"SupportForm:optionIntro":{"Select a topic":["Selecciona un tema"]},"swiss_baseed_feature":{"Swiss based":["Con sede en Suiza"]},"Testimonial":{"Awards":["Premios"],"Customers":["Clientes"],"Featured":["Destacado"],"Go to testimonial source":["Ir a la fuente del testimonio"],"Reviews":["Opiniones"],"Videos":["Vídeos"]},"Text":{"Find the plan that's right for you":["Encuentra el plan más adecuado para tus necesidades"],"If you need help, check out our ${ supportLink }.":["Si necesitas ayuda, consulta nuestra ${ supportLink }."],"The page you’re looking for might have been removed, or it could be an\nold link.":["Es posible que la página que buscas haya sido eliminada o que sea un\nenlace antiguo."]},"Title":{"On this page":["En esta página"],"Related articles":["Artículos relacionados"],"Share ${ thisPage }":["Compartir ${ thisPage }"],"Thank you!":["¡Gracias!"],"this page":["esta página"]},"Tooltip":{"More information":["Más información"]},"tooltip_calendar":{"Create up to 20 custom & shareable encrypted calendars. On top of that, add up to 5 calendars from friends, family, colleagues, and organizations.":["Crea hasta 20 calendarios personalizados y cifrados que puedes compartir con otras personas, y añade además hasta 5 calendarios de amigos, familiares, compañeros y organizaciones."]},"tooltip_vpn":{"Access blocked content and browse privately. Includes ${ TOTAL_SERVERS }+ servers in ${ TOTAL_COUNTRIES }+ countries, highest VPN speed, ${ TOTAL_VPN_CONNECTIONS } VPN connections, worldwide streaming services, malware and ad-blocker, and more.":["Accede a contenido bloqueado y navega en privado. Tendrás a tu disposición más de ${ TOTAL_SERVERS } servidores en más de ${ TOTAL_COUNTRIES } países, VPN de máxima velocidad, ${ TOTAL_VPN_CONNECTIONS } conexiones VPN, servicios de streaming en todo el mundo, bloqueadores de malware y de anuncios, y mucho más."],"Access blocked content and browse privately. Includes ${ TOTAL_SERVERS }+ servers in ${ TOTAL_COUNTRIES }+ countries, highest VPN speed, 10 VPN connections, worldwide streaming services, malware and ad-blocker, and more.":["Accede a contenido bloqueado y navega en privado. Tendrás a tu disposición más de ${ TOTAL_SERVERS } servidores en más de ${ TOTAL_COUNTRIES } países, VPN de máxima velocidad, 10 conexiones VPN, servicios de streaming en todo el mundo, bloqueadores de malware y de anuncios, y mucho más."]},"version_history_label":{"Version history":["Historial de versiones"]},"version_history_tooltip":{"Store up to ${ versionHistoryNumber } versions of each file for up to ${ years } years":["Almacena hasta ${ versionHistoryNumber } versiones de cada archivo durante ${ years } años como máximo"]},"vpn_features_link":{"View VPN plans":["Ver planes de VPN"]},"vpn_features_useCase":{"Access blocked content and browse privately":["Accede a contenido bloqueado y navega con privacidad"]}}},"unleashApi":"https://account.proton.me/api"};
// We need to import data (the framework context) from the server
// This Astro feature with define:vars works well but creates an inline script
// So we can't directly import the initFramework helper, we have to store the context
window.frameworkContext = frameworkContext;
})();
Improved Authentication for Email Encryption and Security | Proton
Today, we are happy to announce the launch of a brand new authentication system for Proton Mail’s secure email service using just a single password.
Proton Mail launched with a two-password system—one to authenticate the user to Proton Mail, and one to decrypt the mail. The security benefit provided by this separation is easy to understand, but it has multiple usability issues.
First, two passwords are more difficult to remember than one, and it contributes to users losing access to their accounts and mail. Second, it tends to confuse password managers, one of the best ways to organize and secure passwords. Third, it makes two-factor authentication (a best-practice method to securing online accounts) a very onerous process, as the user has to enter both passwords and a two-factor code to log in.
At Proton Mail, our mission to is make secure communication easy-to-use and secure. In pursuit of these goals, we are happy to introduce both one-password and two-factor authentication support with Proton Mail 3.6.0. While Proton Mail’s authentication system has been completely redesigned, these changes are transparent to end users, and we will continue to support the legacy two-password mode.
Design Philosophy
Our basic assumption is that all servers can be compromised, and that sooner or later, Proton Mail will also be compromised. Incidents like the Yahoo breach(new window) are not isolated, and will gradually become the norm over the next decade. This is the fundamental philosophy behind our Zero Knowledge Architecture. By utilizing client side end-to-end encryption, we ensure that we do not have the ability to decrypt your emails, and thus, your communications would also be inaccessible to any attacker who does manage to breach our systems. This same philosophy was also applied when we redesigned our authentication system.
How does One-Password Mode work?
In two-password mode, there is a login password and a mailbox password. The login password authenticates the user to Proton Mail and is not stored by the client. The server will occasionally ask the user for the login password to confirm sensitive settings changes, such as password changes. The mailbox password, however is cached on the client, as it is only used to decrypt mail. Simply making the login password the same as the mailbox password is a problem, because then there is no barrier to account takeover for someone with physical possession of your device and some technical know-how.
In Proton Mail’s one-password mode, the mailbox password is derived from the login password via a one-way cryptographic password hash. The input to this hash includes a salt provided by the server on login but not stored in the client. In this way, compromise of the mailbox password does not automatically lead to compromise of the login password.
In this scheme, however, the login password cannot be sent to Proton Mail directly, as it can be used to calculate the mailbox password and thus decrypt mail. To solve this problem, we have re-engineered our entire login process to never send the login password to our server, which has the added benefit of helping protect against MITM (man-in-the-middle) attacks.
Secure Remote Password (SRP) Protocol
The Secure Remote Password (SRP) protocol(new window) is widely-tested and widely-deployed password-authenticated key agreement (PAKE) protocol which mutually authenticates both the user and server while never sending any password-equivalent data over the network. Authentication attempts cannot be replayed, and the protocol remains secure even in the presence of active tampering by a third party. More information about SRP can be found here(new window) and here(new window).
SRP 6a (the latest revision) has been protecting all Proton Mail logins for more than two months now, and with this improvement, we are now able to safely offer one-password mode to our users with no reduction in our security guarantee. When using SRP, even an attacker who can arbitrarily read, modify, delay, destroy, repeat, or fabricate messages between Proton Mail and a user in an undetectable fashion is limited to checking only a single password guess per login attempt, which is equivalent to just trying to log in directly. Even if Proton Mail is compromised and acts maliciously, password equivalent information is never revealed. Thus, with SRP, Proton Mail’s security is greatly strengthened against MITM attacks (particularly for the native clients).
Technical Implementation Details
This section may be difficult to follow without appropriate mathematical and security background and can be skipped.
The security of SRP, like that of Diffie-Hellman, is based on the difficulty of the discrete logarithm problem. One potential issue with this is heavy precomputation via a number field sieve done for a particular modulus to enable faster breaking of the protocol.
For Proton Mail’s implementation we use multiple moduli, randomly chosen every time a user’s password is changed. This offers a number of advantages, notably the possibility of rotating out old moduli with time and limiting the motivation for precomputation, as any modulus would only apply to a subset of users.
To further protect against precomputation, we choose our own primes rather than those recommended by the TLS specification or otherwise commonly used, as these are large targets and almost certainly have been worked on by the world’s security services. We do this by choosing a random 2048-bit integer, setting the top bit to ensure it is large, and picking the first safe prime greater than or equal which has 2 as a generator of the whole group. By using safe primes, we are not vulnerable to backdoored primes(new window). The native (mobile) clients verify the safety of the primes before use, and we also cryptographically sign the moduli to prevent tampering.
2048-bit moduli are used because that proved to be the upper limit that existing web and mobile clients can handle with acceptable performance. This size should be beyond sufficient from a security perspective for the near- and medium-term future and can be increased by rotating in new moduli.
The most widely-used implementation of SRP is TLS-SRP as described in RFC 5054(new window). Our implementation differs from it in several ways, none of which decrease security. First, SHA-1 is a poor password hash function, and in order to migrate our existing password database, we were locked into using bcrypt for this purpose anyway. We do use semi-random password salts (one random part, one non-random part) but do not use the username as the non-random part to enable login with both email addresses and usernames. With bcrypt, password inputs are truncated after 72 characters. For practical purposes, this has no impact on security. As noted above, we also choose our own moduli, and the entire transaction is embedded inside certificate-based TLS for added security.
There exist other PAKE schemes in addition to SRP. We chose SRP because it has been battle-tested, is well known, has many existing implementations, has thorough documentation about pitfalls to avoid, and no patent issues. A promising alternative scheme in the future may be AugPAKE(new window), which benefits from the existence of a security proof(new window) (Edit on April 11th, 2017: this proof may be flawed, so any transition is on-hold indefinitely until the situation is clarified). We should be able to seamlessly switch to AugPAKE in the future if necessary.
One-password mode is the culmination of many months of behind-the-scenes work to make Proton Mail more secure and easy-to-use than ever. While we will always support two-password mode, one-password mode will be the default for the future and we recommend that existing users consider switching for increased ease-of-use. A step-by-step guide for switching can be found here(new window).
At Proton Mail, we appreciate more deeply than most that security is a rapidly moving target. Threats are constantly evolving, and every month, we see more and more complex attacks launched against Proton Mail. Because of this, we invest a considerable amount of resources on research and development to stay ahead of current and future threats. Most of this work happens behind the scenes, and is not as visible as new features or UI improvements, but nevertheless, they are a critical part of creating a solid secure email service.
If you would like to support these efforts, upgrading to a paid Proton Mail account is a great way to do so. On the security side, our work is never done, so in the coming months, we will be releasing additional security features to make Proton Mail even more secure.
2016-12-04: Some minor corrections and clarifications.
Proton Mail is supported by community contributions. We don’t serve ads or abuse your privacy. You can support our mission by upgrading to a paid plan.
Protege tus correos electrónicos y también tu privacidad
Secure, seamless communication is the foundation of every business. As more
organizations secure their data with Proton, we’ve dramatically expanded our
ecosystem with new products and services, from our password manager to Dark Web
Monitoring for cr
On the subject of cybersecurity, one term that often comes up is brute force
attack. A brute force attack is any attack that doesn’t rely on finesse, but
instead uses raw computing power to crack security or even the underlying
encryption.
In this a
Section 702 of the Foreign Intelligence Surveillance Act has become notorious as
the legal justification allowing federal agencies like the NSA, CIA, and FBI to
perform warrantless wiretaps, which sweep up the data of hundreds of thousands
of US citi
In response to the growing number of data breaches, Proton Mail offers a feature
to paid subscribers called Dark Web Monitoring. Our system checks if your
credentials or other data have been leaked to illegal marketplaces and alerts
you if so. Often
Your email address is your online identity, and you share it whenever you create
a new account for an online service. While this offers convenience, it also
leaves your identity exposed if hackers manage to breach the services you use.
Data breaches
Our mission at Proton is to help usher in an internet that protects your privacy
by default, secures your data, and gives you the freedom of choice.
Today we’re taking another step in this direction with the launch of our open
source password manage