all-in-one privacy solution":["Proton Unlimited è una soluzione completa per la privacy"],"Black Friday":["Black Friday"],"No ads. Privacy by default.":["Niente pubblicità. La prima regola è la privacy."],"People before profits":["Le persone prima dei profitti"],"Security through transparency":["Più sicurezza grazie alla trasparenza"],"The best Proton Mail ${ BLACK_FRIDAY } deals":["Le migliori offerte di Proton Mail per il ${ BLACK_FRIDAY }"],"The world’s only community- supported email service":["L'unico servizio di posta elettronica al mondo supportato dalla community"]},"specialoffer:limited":{"${ hours } hour":["${ hours } ora","${ hours } ore"],"${ hoursLeft }, ${ minutesLeft } and ${ secondsLeft } left":["Restano ${ hoursLeft }, ${ minutesLeft } e ${ secondsLeft }"],"${ minutes } minute":["${ minutes } minuto","${ minutes } minuti"],"${ seconds } second":["${ seconds } secondo","${ seconds } secondi"],"Limited time offer":["Offerta a tempo limitato"]},"specialoffer:listitem":{"Create multiple addresses":["Crea indirizzi multipli"],"Hide-my-email aliases":["Alias hide-my-email"],"Quickly unsubscribe from newsletters":["Annulla rapidamente l'iscrizione alle newsletter"],"Use your own domain name":["Utilizza il tuo nome di dominio"]},"specialoffer:logos":{"As featured in":["Ne hanno parlato"]},"specialoffer:metadescription":{"Get an encrypted email that protects your privacy":["Scegli un'email cifrata per proteggere la tua privacy"]},"specialoffer:metatitle":{"Proton Mail Black Friday Sale - Up to 40% off":["Offerta Black Friday di Proton Mail - sconti fino al 40%"]},"specialoffer:newmetadescription":{"Get up to 40% off Proton Mail subscriptions this Black Friday. Find great deals on our secure end-to-end encrypted email plans.":["Per questo Black Friday ti offriamo fino al 40% di sconto sugli abbonamenti a Proton Mail. Scopri le straordinarie offerte sui piani di abbonamento alla nostra email dotata di crittografia end-to-end."]},"specialoffer:newmetatitle":{"Proton Mail Black Friday sale | Up to 40% off secure email":["Offerta di Proton Mail per il Black Friday | Fino al 40% di sconto sulla nostra email sicura"]},"specialoffer:note":{"* Billed at ${ TOTAL_SUM } for the first year":["* Addebito di ${ TOTAL_SUM } per il primo anno"],"*Billed at ${ TOTAL_SUM } for the first 2 years":["*Addebito di ${ TOTAL_SUM } per i primi 2 anni"],"30-day money-back guarantee":["Garanzia soddisfatti o rimborsati di 30 giorni"],"Billed at ${ TOTAL_SUM } for the first 2 years":["Addebito di ${ TOTAL_SUM } per i primi 2 anni"],"Billed at ${ TOTAL_SUM } for the first year":["Addebito di ${ TOTAL_SUM } per il primo anno"],"You save ${ SAVE_SUM }":["Risparmi ${ SAVE_SUM }"]},"specialoffer:off":{"${ DISCOUNT } off":["−${ DISCOUNT }"],"${ PERCENT_OFF } off":["−${ PERCENT_OFF }"]},"specialoffer:testimonial":{"I love my ProtonMail":["Adoro ProtonMail"],"My favorite email service":["Il mio servizio email preferito"],"Thanks Proton for keeping us all safe in the complicated internet universe.":["Grazie Proton perché ci proteggi nell'universo complicato di internet."],"You get what you pay for. In the case of big tech, if you pay nothing, you get used. I quit using Gmail and switched to @ProtonMail":["Ottieni quello per cui hai pagato. Nel caso di big tech, se non paghi niente, vieni usato. Ho smesso di usare Gmail e sono passata a @ProtonMail"]},"specialoffer:time":{"Days":["Giorni"],"Hours":["Ore"],"Min":["Min"]},"specialoffer:title":{"And much more":["E molto altro"],"Make your inbox yours":["Personalizza la tua casella di posta"],"Safe from trackers":["Protezione dai tracker"],"Stay organized":["Mantieni tutto organizzato"],"Black Friday email deals":["Offerte email del Black Friday"],"Don’t just take our word for it":["Non lo diciamo solo noi"],"Our story":["La nostra storia"],"Transfer your data from Google in one click":["Trasferisci i tuoi dati da Google con un solo clic"]},"specialoffer:tooltip":{"Access blocked content and browse privately. Includes ${ TOTAL_SERVERS }+ servers in ${ TOTAL_COUNTRIES }+ countries, connect up to 10 devices, access worldwide streaming services, malware and ad-blocker, and more.":["Accedi a contenuti bloccati e naviga in modalità privata. Include ${ TOTAL_SERVERS } server in più di ${ TOTAL_COUNTRIES } Paesi, possibilità di connettere fino a 10 dispositivi, accesso a servizi di streaming in tutto il mondo, blocco di malware e adblocker, e altro ancora."],"Easily share your calendar with your family, friends or colleagues, and view external calendars.":["Condividi facilmente il tuo calendario con familiari, amici o colleghi e visualizza calendari esterni."],"Includes support for 1 custom email domain, 10 email addresses, 10 hide-my-email aliases, calendar sharing, and more.":["Include il supporto per 1 dominio email personalizzato, 10 indirizzi email, 10 alias hide-my-email, condivisione del calendario e altro ancora."],"Includes support for 3 custom email domains, 15 email addresses, unlimited hide-my-email aliases, calendar sharing, and more.":["Include il supporto per 3 domini email personalizzati, 15 indirizzi email, alias hide-my-email illimitati, condivisione del calendario e altro ancora."],"Manage up to 25 calendars, mobile apps, secured with end-to-end encryption, 1-click calendar import from Google, and more.":["Gestisci fino a 25 calendari, app per dispositivi mobili, protezione con la crittografia end-to-end, importazione del calendario da Google in un solo clic e altro ancora."]},"Status Banner":{"At the moment we are experiencing issues with the Proton VPN service":["Al momento abbiamo dei problemi con il servizio di Proton VPN"],"Learn more":["Scopri di più"]},"Status banner":{"Learn more":["Scopri di più"],"Please note that at the moment we are experiencing issues with the ${ issues[0] } service.":["Attenzione: stiamo riscontrando dei problemi con il servizio di ${ issues[0] }"],"We are experiencing issues with one or more services at the moment.":["Stiamo riscontrando dei problemi con uno o più servizi."]},"suggestions":{"Suggestions":["Suggerimenti"]},"Support":{"Sub category":["Sottocategoria","Sottocategorie"]},"Support article":{"${ readingTime } min":["${ readingTime } minuto","${ readingTime } minuti"],"Category":["Categoria","Categorie"],"Didn’t find what you were looking for?":["Non hai trovato quello che cercavi?"],"General contact":["Contatti generali"],"Get help":["Ottieni supporto"],"Legal contact":["Contatti legali"],"Media contact":["Contatti per la stampa"],"Partnerships contact":["Contatti per collaborazioni"],"Reading":["Lettura"]},"Support categories":{"Browse Proton product support":["Consulta l'assistenza sui prodotti Proton"]},"Support category":{"There is no article in this category yet.":["Per ora non ci sono articoli in questa categoria."]},"Support troubleshooting":{"--- Select ---":["--- Seleziona ---"],"App version":["Versione dell'app"],"Browser":["Browser"],"Check if this helps":["Verifica se questo ti è utile"],"Choose a category for your question":["Scegli una categoria per la tua domanda"],"Choose a product":["Scegli un prodotto"],"Did this solve your issue ?":["Ti ha risolto il problema?"],"Faster assistance is just a few clicks away — please make your selections":["Ottieni assistenza più velocemente con pochi clic. Fai la tua selezione"],"No, contact support":["No, contatta il supporto"],"Proton account":["Account Proton"],"Proton Bridge":["Proton Bridge"],"Proton Calendar":["Proton Calendar"],"Proton Drive":["Proton Drive"],"Proton for Business":["Proton for Business"],"Proton Mail":["Proton Mail"],"Proton Pass":["Proton Pass"],"Proton VPN":["Proton VPN"],"Thank you for your feedback":["Grazie per il feedback"],"Troubleshooting":["Risoluzione dei problemi"],"What can we help with ?":["In cosa possiamo esserti di aiuto?"],"Yes":["Sì"]},"support_modal_search_query":{"Search query":["Query di ricerca"]},"support_search_button":{"Search":["Cerca"]},"support_search_i_am_looking_for":{"I'm looking for":["Sto cercando"]},"SupportForm":{"For a faster resolution, please report the issue from the Bridge app: Help > Report a problem.":["Per una risoluzione più rapida, segnala il problema dall'app Bridge: Aiuto > Segnala un problema."],"Information":["Informazioni"]},"SupportForm:option":{"Account Security":["Sicurezza dell'account"],"Contacts":["Contatti"],"Custom email domain":["Dominio email personalizzato"],"Email delivery and Spam":["Consegna delle email e spam"],"Encryption":["Crittografia"],"Login and password":["Login e password"],"Merge aliases and accounts":["Unione di alias e account"],"Migrate to Proton":["Migrazione a Proton"],"Notifications":["Notifiche"],"Other":["Altro"],"Plans and billing":["Piani e fatturazione"],"Proton for Business":["Proton for Business"],"Sign up":["Iscrizione"],"Storage":["Archiviazione"],"Users, addresses, and identities":["Utenti, indirizzi e identità"]},"SupportForm:optionIntro":{"Select a topic":["Seleziona un argomento"]},"swiss_baseed_feature":{"Swiss based":["Con sede in Svizzera"]},"Testimonial":{"Awards":["Premi"],"Customers":["Clienti"],"Featured":["In evidenza"],"Go to testimonial source":["Vai alle testimonianze"],"Reviews":["Recensioni"],"Videos":["Video"]},"Text":{"Find the plan that's right for you":["Trova il piano che fa per te"],"If you need help, check out our ${ supportLink }.":["Se ti serve assistenza dai un’occhiata alla nostra ${ supportLink }."],"The page you’re looking for might have been removed, or it could be an\nold link.":["La pagina che stai cercando potrebbe essere stata rimossa, o il link potrebbe essere vecchio."]},"Title":{"On this page":["In questa pagina"],"Related articles":["Articoli correlati"],"Share ${ thisPage }":["Condividi ${ thisPage }"],"Thank you!":["Grazie"],"this page":["questa pagina"]},"Tooltip":{"More information":["Ulteriori informazioni"]},"tooltip_calendar":{"Create up to 20 custom & shareable encrypted calendars. On top of that, add up to 5 calendars from friends, family, colleagues, and organizations.":["Puoi creare fino a 20 calendari cifrati personalizzati e condivisibili. Puoi inoltre aggiungere fino a 5 calendari di amici, familiari, colleghi e organizzazioni."]},"tooltip_vpn":{"Access blocked content and browse privately. Includes ${ TOTAL_SERVERS }+ servers in ${ TOTAL_COUNTRIES }+ countries, highest VPN speed, ${ TOTAL_VPN_CONNECTIONS } VPN connections, worldwide streaming services, malware and ad-blocker, and more.":["Accedi a contenuti bloccati e naviga in modalità privata. Il piano include più di ${ TOTAL_SERVERS } server in oltre ${ TOTAL_COUNTRIES } Paesi, massima velocità della VPN, ${ TOTAL_VPN_CONNECTIONS } connessioni alla VPN, servizi di streaming in tutto il mondo, anti-malware, ad-blocker e altro ancora."],"Access blocked content and browse privately. Includes ${ TOTAL_SERVERS }+ servers in ${ TOTAL_COUNTRIES }+ countries, highest VPN speed, 10 VPN connections, worldwide streaming services, malware and ad-blocker, and more.":["Accedi a contenuti bloccati e naviga in modalità privata. Il piano include più di ${ TOTAL_SERVERS } server in oltre ${ TOTAL_COUNTRIES } Paesi, massima velocità della VPN, 10 connessioni alla VPN, servizi di streaming in tutto il mondo, anti-malware, ad-blocker e altro ancora."]},"version_history_label":{"Version history":["Cronologia delle versioni"]},"version_history_tooltip":{"Store up to ${ versionHistoryNumber } versions of each file for up to ${ years } years":["Conserva fino a ${ versionHistoryNumber } versioni di ciascun file fino a un massimo di ${ years } anni"]},"vpn_features_link":{"View VPN plans":["Visualizza i piani VPN"]},"vpn_features_useCase":{"Access blocked content and browse privately":["Accedi ai contenuti bloccati e naviga in modalità privata"]}}},"unleashApi":"https://account.proton.me/api"};
// We need to import data (the framework context) from the server
// This Astro feature with define:vars works well but creates an inline script
// So we can't directly import the initFramework helper, we have to store the context
window.frameworkContext = frameworkContext;
})();
The following article presents a high-level overview of Proton Mail’s Android security model and explains how the app protects your sensitive data. You can view our Android app’s open-source code on GitHub(new window).
Read our threat model(new window) for more information on what threats Proton Mail is designed to counter.
Although this article covers technical subject matter, we wrote it to be as accessible as possible to the general audience.
Overview
The Proton Mail Android app stores as little data as possible on your device. This approach allows the app to provide higher data security and more efficiently use the device’s storage space. However, it does need to store some data locally. This data includes:
Encrypted messages (only messages opened since the last login are stored), attachments (only attachments viewed since the last login), and metadata
Public and private keys for encrypting and decrypting messages
Access tokens for communication with the Proton Mail API
User account details (e.g., username, time of last message, etc.)
Application and account settings
Miscellaneous preferences
The app keeps some of this data in secured (encrypted) key-value pairs or inside a local database. Almost all of this data is encrypted at rest.
Protection of application assets
User credentials
Although the username persists in the application, your password is neither persistent nor cached. After your enter your password, it is immediately delegated to the app’s internal Secure Remote Password (SRP) Protocol logic.
The application keeps databases in its private storage space where they are inaccessible to other applications, and all sensitive data is encrypted.
Secure shared preferences
One of Android’s mechanisms for storing application data is Shared Preferences, which, in a nutshell, stores data in key-value pairs. Because this data is kept in plaintext, we have added a custom encryption wrapper around it. This wrapper keeps all persistent data contained in our application’s preferences private and encrypted. Additionally, the keys used for the custom encryption wrapper are protected by the Android Keystore.
Require user approval to load embedded images and remote content
By default, the app blocks embedded images and remote content. You have to manually load them or disable this block in the app’s settings.
Attachments
Our app downloads regular attachments into the primary storage folder of the device (i.e., the Downloads folder). However, we handle other types of embedded and remote content somewhat differently:
Remote content (e.g., linked images) is never downloaded to persistent storage.
Embedded images are downloaded similarly to regular attachments, but they are kept in the application’s private storage (instead of a public directory).
Push notification encryption
Proton Mail’s push notification servers always encrypt the notifications they send, and the Proton Mail client decrypts these notifications locally. These notifications are never stored on the device.
Application auto-locking and biometrics
We have implemented a straightforward, PIN-based feature to automatically lock the application after a period of inactivity. Once the app is locked, it prompts the user to enter their PIN to unlock it. (You can activate this PIN protection in the settings.) If you choose this option, you can also open the app using the device’s own biometric authentication (you will have to have already registered your biometric data before your can override the PIN). This lets you benefit from the convenience of your device’s biometric scanners without lowering the security level of the app.
Updates
There are two ways to download and update the Proton Mail Android app. One is via the Google Play Store, which lets you take advantage of the update mechanism in Google Play to retrieve and apply app updates.
You can also download our app directly from our website as an APK file(new window). Alongside the download link, you can find the SHA-256 checksum they need to verify the APK file’s integrity.
Attack mitigation
Here we describe the potential attack vectors of the Android client and how we mitigate these attacks.
Web-based attacks
All emails are treated as HTML emails and are rendered by the WebView (android.webkit) component. Since all incoming messages could potentially contain malware, we have disabled JavaScript execution in the WebView configuration for incoming messages. On top of this, we do preprocessing and HTML sanitization to strip out any suspicious content.
Note: Like other mobile email apps, JavaScript execution is allowed in certain WebViews used by the app (e.g., a human verification CAPTCHA dialog) but never in the email content WebView.
Man-in-the-middle attacks
Man-in-the-middle (MITM) attacks are more difficult to accomplish against Proton Mail because of our use of end-to-end encryption(new window) and zero-access encryption(new window). We have implemented several safeguards in our overall security architecture, like Address Verification(new window), which prevents MITM via a fake public key. We have also put in place protection against network-level MITM attacks.
Certificate pinning
We use the TrustKit-Android(new window) open-source library for certificate pinning to prevent an imposter server, even one equipped with an otherwise valid TLS certificate, from being able to pose as Proton Mail and intercept network traffic.
Attacks from a malicious app (sandboxed)
Android Lollipop 5.0, which included SELinux, was the first Android version to feature a strengthened Application Sandbox. Each subsequent major Android OS release came with improved application sandboxing, meaning a malicious application (assuming it does not have root privileges) poses very little threat to the Proton Mail Android app.
Android security model scope
No application can protect its users against every potential threat 100% of the time. Proton Mail Android provides additional protection for your data. However, certain conditions are outside of the scope of this security model.
User device security
We assume that users keep their Android devices secure. For instance, if an you root your device, we expect you to understand that this makes it much easier for malicious applications to bypass the restrictions of the Android application sandbox.
We also expect your device to be free of any malicious software (keyloggers, screen recorders, etc.) that could monitor your actions.
We do our best to protect your data even when your device is compromised. However, all security systems are more likely to fail if the device in question is already compromised.
Android protection
Our application attempts to leverage all of the most recent security improvements offered by the current Android operating system (OS). While our client supports a broad range of Android OS versions (all the way back to Android 5.0 Lollipop), we highly recommend you regularly update your Android OS so that you’re always using the most recent release.
Audits and open source
We released the Proton Mail Android client as free and open-source software under a GNU General Public License. The app has been audited by the respected security firm SEC Consult(new window). We have published the results of this audit(new window).
Proton Mail and Proton VPN are funded by community contributions. If you would like to support our development efforts, you can upgrade to a paid plan(new window). Thank you for your support.
Google is one of the biggest obstacles to privacy. The Big Tech giant may offer
quick access to information online, but it also controls vast amounts of your
personal or business data.
Recently, more people are becoming aware of the actual price you
If you’re a United States citizen or permanent resident, you have a Social
Security number (SSN). This number is the linchpin of much of your existence,
linked to everything from your tax records to your credit cards. Theft is a
massive problem, whic
Compromised passwords are a common issue and probably one of the biggest
cybersecurity threats for regular people. How do passwords get compromised, and
is there anything you can do to prevent it?
* What does compromised password mean?
* How do pa
WeTransfer is a popular service used by millions worldwide to send large files.
You may have wondered if it’s safe or whether you should use it to share
sensitive files. We answer these questions below and present a WeTransfer
alternative that may su
Dictionary attacks are a common method hackers use to try to crack passwords and
break into online accounts.
While these attacks may be effective against people with poor account security,
it’s extremely easy to protect yourself against them by usi
I furti di dati sono sempre più comuni. Ogni volta che ti registri a un servizio
online, fornisci informazioni personali preziose per gli hacker, come indirizzi
email, password, numeri di telefono e altro ancora. Purtroppo, molti servizi
online non p