Proton Mail is an encrypted email service that takes a radically different approach to email security. Find out how Proton Mail security compares to Gmail security.
In 2014, Proton Mail became the world’s first email service to protect data with end-to-end encryption, and today is the world’s most popular secure email service with millions of users worldwide. Proton Mail’s technology is often misunderstood by tech writers (and sometimes incorrectly represented in the press), so this article aims to provide a clear description of how Proton Mail’s technology is different from Gmail, and what makes Proton Mail more secure.
Only you can read your emails
Proton Mail’s encryption means that nobody but you can read the messages in your mailbox. In fact, not even Proton Mail has the ability to read your messages. We believe that your private communications should be exactly that: private. On the other hand, Gmail can and does read every single one of your emails(nouvelle fenêtre). If you are not comfortable giving Google unlimited access to all of your intimate communications, then Proton Mail’s approach to data privacy provides more security.
Your data belongs to you
When you sign up for Facebook or Google, you give them control over your sensitive personal information. The recent Cambridge Analytica scandal brought to light just how little Facebook users know about who has access to their data and how it is being used. Unless these companies fundamentally change their business models, they will continue to read, analyze, and sell your data in ways you cannot control.
You won’t have this kind of problem at Proton Mail — one more benefit of the end-to-end and zero-access encryption we use. Our encryption ensures that our users have complete ownership of their data. We don’t have the ability to read it or sell it, even if we wanted to.
Improved security in the event of a data breach
Proton Mail uses zero-access encryption, which means it is technically impossible for us to decrypt user messages. Zero-Access Encryption applies to all messages in your mailbox, even messages which did not come from other Proton Mail users.
This provides stronger security compared to Gmail because even if Proton Mail were somehow breached, user messages remain secure because Proton Mail only stores encrypted messages. In other words, if an attacker steals emails from Proton Mail, the attacker would not have the ability to decrypt them, as even Proton Mail cannot decrypt them. The use of Zero-Access Encryption, therefore, adds a strong layer of resiliency against catastrophic data breaches.
No tracking and logging
Google records literally every action done by its users(nouvelle fenêtre). This includes your IP address(nouvelle fenêtre), every search that you do, which emails you open, which websites you visit, and much more. Proton Mail takes the opposite approach and by default, does not monitor or record user activity, not even IP addresses.
Encryption for messages in transit
In addition to the security of emails at rest, one also needs to consider the security of emails in transit. Both Proton Mail and Gmail provide extra protection by using TLS encryption whenever possible when communicating with external email providers. However, Proton Mail goes one step further by also supporting end-to-end encryption.
In simple terms, end-to-end encryption means that messages are encrypted on the sender’s device (before it even leaves their computer or mobile phone), and can only be decrypted by the recipient on their device. This means that no third party which transmits or intercepts the email between the sender and recipient (i.e. internet service providers, the NSA, or even Proton Mail as the mail server operator) can decrypt and view the message.
This powerful protection is possible because Proton Mail has PGP email encryption built-in. End-to-end encryption is done automatically without user interaction whenever messages are exchanged between Proton Mail users. For an enterprise using Proton Mail(nouvelle fenêtre) for their email hosting, this means all communications between employees are automatically protected with end-to-end encryption. Proton Mail can also support sending(nouvelle fenêtre)/receiving(nouvelle fenêtre) end-to-end encrypted messages with recipients who are not using Proton Mail. The use of end-to-end encryption makes Proton Mail a better choice for security conscious individuals and organizations.
Smaller attack surface
Proton Mail only provides email and VPN services(nouvelle fenêtre), so your Proton account is not connected to hundreds of other services. Compared to Google, Proton Mail is a much smaller target, and there is less risk that a vulnerability in another service breaches your email account.
One might argue that Gmail is more secure because it is a gigantic company with more engineers. However, there is ample evidence that demonstrates that security is not correlated to company size. In fact, large companies often are the most vulnerable due to larger attack surfaces, Yahoo(nouvelle fenêtre) and Equifax(nouvelle fenêtre) being two recent examples. There is no such thing as 100% security and history has shown that any system can be breached. Proton Mail’s unique ability to protect user data even in the event of a breach is a valuable benefit.
Strong authentication
Proton Mail uses Secure Remote Password(nouvelle fenêtre) in order to protect user credentials. This makes it difficult to conduct a brute force attack to obtain user credentials, even if the attacker has control over the victim’s network. Both Gmail and Proton Mail support two-factor authentication (2FA), which provides an additional layer of security by requiring that an unique code be entered on each login (the code is usually generated on a separate hardware device). However, Proton Mail goes a step further by only using strong 2FA methods and disallowing weaker methods such as 2FA over SMS(nouvelle fenêtre).
Protected by Swiss and European privacy laws
Proton Mail stores user data exclusively in European countries with strong privacy protections such as Switzerland. This means that unlike Gmail, Proton Mail does not fall under the jurisdiction of intrusive US laws (such as the Foreign Intelligence Surveillance Act(nouvelle fenêtre)), and cannot be coerced into working for the NSA(nouvelle fenêtre). With Proton Mail, you can be certain that your data always remains in Europe, in full compliance with EU privacy regulations. Proton Mail’s approach makes us compliant with Article 25 of the EU General Data Protection Regulation (GDPR)(nouvelle fenêtre) which mandates that services adhere to the principle of privacy by design(nouvelle fenêtre).
Zero-access encryption means that even if a complaint is brought in a Swiss court that meet the high requirements for data disclosure, only encrypted emails could be handed over. As a Swiss company, Proton Mail cannot be forced to hand over data in cases of US or EU civil litigation. Thus, even if you don’t care about privacy, Proton Mail is still the ideal choice for businesses, journalists, activists, and individuals who are worried about the overreach of US government agencies or courts(nouvelle fenêtre).
No conflict of interest
In addition to the technological and legal differences, Proton Mail and Gmail also have very different business practices. Whereas Gmail was created to lock users into the world’s largest and most invasive advertising platform(nouvelle fenêtre), Proton Mail was created with the goal of protecting privacy rights and democracy in the digital age.
Google makes money by providing Gmail and other services for free in order to acquire personal data, which it then sells to advertisers. On the other hand, Proton Mail first priority is always user privacy, because our only customers are our users – not advertisers. Thus, choosing between Gmail and Proton Mail is also a personal choice: Do you want to sacrifice your privacy or instead use a service that respects privacy?
Conclusion
Both Gmail and Proton Mail provide email accounts, but that’s where the similarities end. In terms of technology, legal protection, and position on privacy rights, the two services diverge widely. If you just want an email account, either service will meet your needs. If email security, and in particular privacy is important to you, then you should consider Proton Mail as a Gmail alternative.
You can get a free secure email account from Proton Mail here(nouvelle fenêtre).
We also provide a free VPN service(nouvelle fenêtre) to protect your privacy.
Proton Mail and Proton VPN are funded by community contributions. If you would like to support our development efforts, you can upgrade to a paid plan. Thank you for your support!
