all-in-one privacy solution":["Proton Unlimited è una soluzione completa per la privacy"],"Black Friday":["Black Friday"],"No ads. Privacy by default.":["Niente pubblicità. La prima regola è la privacy."],"People before profits":["Le persone prima dei profitti"],"Security through transparency":["Più sicurezza grazie alla trasparenza"],"The best Proton Mail ${ BLACK_FRIDAY } deals":["Le migliori offerte di Proton Mail per il ${ BLACK_FRIDAY }"],"The world’s only community- supported email service":["L'unico servizio di email al mondo supportato dalla community"]},"specialoffer:limited":{"${ hours } hour":["${ hours } ora","${ hours } ore"],"${ hoursLeft }, ${ minutesLeft } and ${ secondsLeft } left":["Restano ${ hoursLeft }, ${ minutesLeft } e ${ secondsLeft }"],"${ minutes } minute":["${ minutes } minuto","${ minutes } minuti"],"${ seconds } second":["${ seconds } secondo","${ seconds } secondi"],"Limited time offer":["Offerta a tempo limitato"]},"specialoffer:listitem":{"Create multiple addresses":["Crea indirizzi multipli"],"Hide-my-email aliases":["Alias hide-my-email"],"Quickly unsubscribe from newsletters":["Annulla rapidamente l'iscrizione alle newsletter"],"Use your own domain name":["Utilizza il tuo nome di dominio"]},"specialoffer:logos":{"As featured in":["Ne hanno parlato"]},"specialoffer:metadescription":{"Get an encrypted email that protects your privacy":["Scegli un'email cifrata per proteggere la tua privacy"]},"specialoffer:metatitle":{"Proton Mail Black Friday Sale - Up to 40% off":["Offerta Black Friday di Proton Mail - sconti fino al 40%"]},"specialoffer:newmetadescription":{"Get up to 40% off Proton Mail subscriptions this Black Friday. Find great deals on our secure end-to-end encrypted email plans.":["Per questo Black Friday ti offriamo fino al 40% di sconto sugli abbonamenti a Proton Mail. Scopri le straordinarie offerte sui piani di abbonamento alla nostra email dotata di crittografia end-to-end."]},"specialoffer:newmetatitle":{"Proton Mail Black Friday sale | Up to 40% off secure email":["Offerta di Proton Mail per il Black Friday | Fino al 40% di sconto sulla nostra email sicura"]},"specialoffer:note":{"* Billed at ${ TOTAL_SUM } for the first year":["* Addebito di ${ TOTAL_SUM } per il primo anno"],"*Billed at ${ TOTAL_SUM } for the first 2 years":["*Addebito di ${ TOTAL_SUM } per i primi 2 anni"],"30-day money-back guarantee":["Garanzia soddisfatti o rimborsati di 30 giorni"],"Billed at ${ TOTAL_SUM } for the first 2 years":["Addebito di ${ TOTAL_SUM } per i primi 2 anni"],"Billed at ${ TOTAL_SUM } for the first year":["Addebito di ${ TOTAL_SUM } per il primo anno"],"You save ${ SAVE_SUM }":["Risparmi ${ SAVE_SUM }"]},"specialoffer:off":{"${ PERCENT_OFF } off":["−${ PERCENT_OFF }"]},"specialoffer:testimonial":{"I love my ProtonMail":["Adoro ProtonMail"],"My favorite email service":["Il mio servizio email preferito"],"Thanks Proton for keeping us all safe in the complicated internet universe.":["Grazie Proton perché ci proteggi nell'universo complicato di internet."],"You get what you pay for. In the case of big tech, if you pay nothing, you get used. I quit using Gmail and switched to @ProtonMail":["Ottieni quello per cui hai pagato. Nel caso di big tech, se non paghi niente, vieni usato. Ho smesso di usare Gmail e sono passata a @ProtonMail"]},"specialoffer:time":{"Days":["Giorni"],"Hours":["Ore"],"Min":["Min"]},"specialoffer:title":{"And much more":["E altro ancora"],"Safe from trackers":["Protezione dai tracker"],"Stay organized":["Tieni tutto in ordine"],"Black Friday email deals":["Offerte email del Black Friday"],"Don’t just take our word for it":["Non lo diciamo solo noi"],"Make your inbox yours":["Rendi la tua posta in arrivo davvero tua"],"Our story":["La nostra storia"],"Transfer your data from Google in one click":["Trasferisci i tuoi dati da Google con un solo clic"]},"specialoffer:tooltip":{"Access blocked content and browse privately. Includes ${ TOTAL_VPN_SERVERS }+ servers in ${ TOTAL_VPN_COUNTRIES }+ countries, connect up to 10 devices, access worldwide streaming services, malware and ad-blocker, and more.":["Accedi a contenuti bloccati e naviga in modalità privata. Include oltre ${ TOTAL_VPN_SERVERS } server in più di ${ TOTAL_VPN_COUNTRIES } Paesi, possibilità di connettere fino a 10 dispositivi, accesso a servizi di streaming in tutto il mondo, anti-malware, ad-blocker e altro ancora."],"Easily share your calendar with your family, friends or colleagues, and view external calendars.":["Condividi facilmente il tuo calendario con familiari, amici o colleghi e visualizza calendari esterni."],"Includes support for 1 custom email domain, 10 email addresses, 10 hide-my-email aliases, calendar sharing, and more.":["Include il supporto per 1 dominio email personalizzato, 10 indirizzi email, 10 alias hide-my-email, condivisione del calendario e altro ancora."],"Includes support for 3 custom email domains, 15 email addresses, unlimited hide-my-email aliases, calendar sharing, and more.":["Include il supporto per 3 domini email personalizzati, 15 indirizzi email, alias hide-my-email illimitati, condivisione del calendario e altro ancora."],"Manage up to 25 calendars, mobile apps, secured with end-to-end encryption, 1-click calendar import from Google, and more.":["Gestisci fino a 25 calendari, app per dispositivi mobili, protezione con la crittografia end-to-end, importazione del calendario da Google in un solo clic e altro ancora."]},"Status Banner":{"At the moment we are experiencing issues with the Proton VPN service":["Al momento abbiamo dei problemi con il servizio di Proton VPN"]},"Status banner":{"Learn more":["Scopri di più"],"Please note that at the moment we are experiencing issues with the ${ issues[0] } service.":["Attenzione: stiamo riscontrando dei problemi con il servizio di ${ issues[0] }"],"We are experiencing issues with one or more services at the moment.":["Stiamo riscontrando dei problemi con uno o più servizi."]},"steps":{"Step":["Passaggio"]},"suggestions":{"Suggestions":["Suggerimenti"]},"Support":{"Sub category":["Sottocategoria","Sottocategorie"]},"Support article":{"${ readingTime } min":["${ readingTime } minuto","${ readingTime } minuti"],"Category":["Categoria","Categorie"],"Didn’t find what you were looking for?":["Non hai trovato quello che cercavi?"],"General contact":["Contatti generali"],"Get help":["Ottieni supporto"],"Legal contact":["Contatti legali"],"Media contact":["Contatti per la stampa"],"Partnerships contact":["Contatti per collaborazioni"],"Reading":["Lettura"]},"Support Form Platform option":{"VPN for Android TV":["VPN per Android TV"],"VPN for Apple TV":["VPN per Apple TV"],"VPN for Chromebook":["VPN per Chromebook"]},"Support troubleshooting":{"App version":["Versione dell'app"],"Browser":["Browser"],"Check if this helps":["Verifica se questo ti è utile"],"Choose a product":["Scegli un prodotto"],"Did this solve your issue?":["Ha risolto il tuo problema?"],"Faster assistance is just a few clicks away":["Ottieni assistenza più velocemente con pochi clic"],"How can we help?":["Come possiamo aiutarti?"],"No, contact support":["No, contatta il supporto"],"Please fill out one field after another":["Compila un campo dopo l'altro"],"Please make your selections":["Fai la tua selezione"],"Proton account":["Account Proton"],"Proton for Business":["Proton for Business"],"Thank you for your feedback":["Grazie per il feedback"],"What can we help with?":["In cosa possiamo esserti di aiuto?"],"Yes":["Sì"]},"support_modal_search_query":{"Search query":["Query di ricerca"]},"support_search_button":{"Search":["Cerca"]},"support_search_i_am_looking_for":{"I'm looking for":["Sto cercando"]},"SupportForm":{"For a faster resolution, please report the issue from the Bridge app: Help > Report a problem.":["Per una risoluzione più rapida, segnala il problema dall'app Bridge: Aiuto > Segnala un problema."],"Information":["Informazioni"]},"SupportForm:option":{"Account Security":["Sicurezza dell'account"],"Contacts":["Contatti"],"Custom email domain":["Dominio email personalizzato"],"Email delivery and Spam":["Consegna delle email e spam"],"Encryption":["Crittografia"],"Login and password":["Login e password"],"Merge aliases and accounts":["Unione di alias e account"],"Migrate to Proton":["Migrazione a Proton"],"Notifications":["Notifiche"],"Other":["Altro"],"Plans and billing":["Piani e fatturazione"],"Proton for Business":["Proton for Business"],"Sign up":["Iscrizione"],"Storage":["Archiviazione"],"Users, addresses, and identities":["Utenti, indirizzi e identità"]},"SupportForm:optionIntro":{"Select a topic":["Seleziona un argomento"]},"Testimonial":{"Awards":["Premi"],"Customers":["Clienti"],"Featured":["In evidenza"],"Go to testimonial source":["Vai alle testimonianze"],"Open source of award":["Apri la fonte del premio"],"Open source of quote":["Apri la fonte della citazione"],"Reviews":["Recensioni"],"Videos":["Video"],"Watch on TikTok":["Guarda su TikTok"],"Watch on YouTube":["Guarda su YouTube"]},"TestimonialCategory":{"Awards":["Premi"],"Customers":["Clienti"],"Featured":["In evidenza"],"Media":["Media"],"Reviews":["Recensioni"],"Videos":["Video"]},"Text":{"If you need help, check out our ${ supportLink }.":["Se ti serve assistenza dai un’occhiata alla nostra ${ supportLink }."],"The page you’re looking for might have been removed, or it could be an\nold link.":["La pagina che stai cercando potrebbe essere stata rimossa, o il link potrebbe essere vecchio."],"Your question may already have an answer in our knowledge base:":["La risposta alla tua domanda potrebbe essere già disponibile nella nostra base di conoscenza:"]},"Title":{"On this page":["In questa pagina"],"Page not found":["Pagina non trovata"],"Related articles":["Articoli correlati"],"Share ${ thisPage }":["Condividi ${ thisPage }"],"Switch to Proton Pass - Contact us":["Passa a Proton Pass - Contattaci"],"Thank you!":["Grazie"],"this page":["questa pagina"]},"tooltip_vpn":{"Access blocked content and browse privately. Includes ${ TOTAL_VPN_SERVERS }+ servers in ${ TOTAL_VPN_COUNTRIES }+ countries, highest VPN speed, ${ TOTAL_VPN_CONNECTIONS } VPN connections, worldwide streaming services, malware and ad-blocker, and more.":["Accedi a contenuti bloccati e naviga in modalità privata. Include oltre ${ TOTAL_VPN_SERVERS } server in più di ${ TOTAL_VPN_COUNTRIES } Paesi, VPN ad altissima velocità, ${ TOTAL_VPN_CONNECTIONS } connessioni VPN, servizi di streaming in tutto il mondo, anti-malware, ad-blocker e altro ancora."]},"vpn_servers":{"Get Proton VPN Plus":["Scegli Proton VPN Plus"]},"wallet_signup_2024:Action":{"Get Proton Wallet":["Ottieni Proton Wallet"]},"wallet_signup_2024:Homepage hero product link title":{"Wallet":["Wallet"]},"wallet_signup_2024:Homepage product navigation bar":{"Wallet":["Wallet"]},"wallet_signup_2024:menu item":{"Bitcoin guide":["Guida Bitcoin"],"Proton Wallet news":["Novità di Proton Wallet"],"Proton Wallet support":["Supporto di Proton Wallet"]},"wallet_signup_2024:Pricing":{"Includes everything in Proton Unlimited and":["Include tutte le funzionalità di Proton Unlimited e"],"Limited availability":["Disponibilità limitata"],"The easiest way to securely own, send, and receive Bitcoin":["Il modo più semplice di possedere, inviare e ricevere Bitcoin in modo sicuro"]},"wallet_signup_2024:ProductRange":{"Discover Proton Wallet":["Scopri Proton Wallet"],"Store and transact Bitcoin privately with an encrypted self-custody wallet.":["Conserva ed esegui transazioni in Bitcoin in modo privato con un portafoglio a custodia autonoma crittografato."]},"wallet_signup_2024:wallet bitcoin":{"Learn about Bitcoin, the Internet's value network.":["Scopri il Bitcoin, la rete di valore di Internet."]},"wallet_signup_2024:wallet overview":{"Ensure you're always in control of your Bitcoin.":["Assicurati di avere sempre il controllo dei tuoi Bitcoin."]},"wallet_signup_2024:wallet security":{"The encrypted, open-source wallet that puts you in control.":["Il portafoglio crittografato e open source che ti dà il controllo."]}}},"base":"blog","cdn":{"enabledForAssets":true,"enabledForImages":true,"url":"https://pmecdn.protonweb.com/"},"unleashApi":"https://account.proton.me/api"};
window.frameworkContext = frameworkContext;
const context = frameworkContext.base === '' ? '' : `${frameworkContext.base}/`;
window.__toAssetUrl = (filename) => {
if (frameworkContext.cdn !== undefined && frameworkContext.cdn.enabledForAssets === true) {
return `${frameworkContext.cdn.url}${context}${filename}`;
} else {
return `/${context}${filename}`;
}
};
})();
Improved Authentication for Email Encryption and Security | Proton
Today, we are happy to announce the launch of a brand new authentication system for Proton Mail’s secure email service using just a single password.
Proton Mail launched with a two-password system—one to authenticate the user to Proton Mail, and one to decrypt the mail. The security benefit provided by this separation is easy to understand, but it has multiple usability issues.
First, two passwords are more difficult to remember than one, and it contributes to users losing access to their accounts and mail. Second, it tends to confuse password managers, one of the best ways to organize and secure passwords. Third, it makes two-factor authentication (a best-practice method to securing online accounts) a very onerous process, as the user has to enter both passwords and a two-factor code to log in.
At Proton Mail, our mission to is make secure communication easy-to-use and secure. In pursuit of these goals, we are happy to introduce both one-password and two-factor authentication support with Proton Mail 3.6.0. While Proton Mail’s authentication system has been completely redesigned, these changes are transparent to end users, and we will continue to support the legacy two-password mode.
Design Philosophy
Our basic assumption is that all servers can be compromised, and that sooner or later, Proton Mail will also be compromised. Incidents like the Yahoo breach(nuova finestra) are not isolated, and will gradually become the norm over the next decade. This is the fundamental philosophy behind our Zero Knowledge Architecture. By utilizing client side end-to-end encryption, we ensure that we do not have the ability to decrypt your emails, and thus, your communications would also be inaccessible to any attacker who does manage to breach our systems. This same philosophy was also applied when we redesigned our authentication system.
How does One-Password Mode work?
In two-password mode, there is a login password and a mailbox password. The login password authenticates the user to Proton Mail and is not stored by the client. The server will occasionally ask the user for the login password to confirm sensitive settings changes, such as password changes. The mailbox password, however is cached on the client, as it is only used to decrypt mail. Simply making the login password the same as the mailbox password is a problem, because then there is no barrier to account takeover for someone with physical possession of your device and some technical know-how.
In Proton Mail’s one-password mode, the mailbox password is derived from the login password via a one-way cryptographic password hash. The input to this hash includes a salt provided by the server on login but not stored in the client. In this way, compromise of the mailbox password does not automatically lead to compromise of the login password.
In this scheme, however, the login password cannot be sent to Proton Mail directly, as it can be used to calculate the mailbox password and thus decrypt mail. To solve this problem, we have re-engineered our entire login process to never send the login password to our server, which has the added benefit of helping protect against MITM (man-in-the-middle) attacks.
Secure Remote Password (SRP) Protocol
The Secure Remote Password (SRP) protocol(nuova finestra) is widely-tested and widely-deployed password-authenticated key agreement (PAKE) protocol which mutually authenticates both the user and server while never sending any password-equivalent data over the network. Authentication attempts cannot be replayed, and the protocol remains secure even in the presence of active tampering by a third party. More information about SRP can be found here(nuova finestra) and here(nuova finestra).
SRP 6a (the latest revision) has been protecting all Proton Mail logins for more than two months now, and with this improvement, we are now able to safely offer one-password mode to our users with no reduction in our security guarantee. When using SRP, even an attacker who can arbitrarily read, modify, delay, destroy, repeat, or fabricate messages between Proton Mail and a user in an undetectable fashion is limited to checking only a single password guess per login attempt, which is equivalent to just trying to log in directly. Even if Proton Mail is compromised and acts maliciously, password equivalent information is never revealed. Thus, with SRP, Proton Mail’s security is greatly strengthened against MITM attacks (particularly for the native clients).
Technical Implementation Details
This section may be difficult to follow without appropriate mathematical and security background and can be skipped.
The security of SRP, like that of Diffie-Hellman, is based on the difficulty of the discrete logarithm problem. One potential issue with this is heavy precomputation via a number field sieve done for a particular modulus to enable faster breaking of the protocol.
For Proton Mail’s implementation we use multiple moduli, randomly chosen every time a user’s password is changed. This offers a number of advantages, notably the possibility of rotating out old moduli with time and limiting the motivation for precomputation, as any modulus would only apply to a subset of users.
To further protect against precomputation, we choose our own primes rather than those recommended by the TLS specification or otherwise commonly used, as these are large targets and almost certainly have been worked on by the world’s security services. We do this by choosing a random 2048-bit integer, setting the top bit to ensure it is large, and picking the first safe prime greater than or equal which has 2 as a generator of the whole group. By using safe primes, we are not vulnerable to backdoored primes(nuova finestra). The native (mobile) clients verify the safety of the primes before use, and we also cryptographically sign the moduli to prevent tampering.
2048-bit moduli are used because that proved to be the upper limit that existing web and mobile clients can handle with acceptable performance. This size should be beyond sufficient from a security perspective for the near- and medium-term future and can be increased by rotating in new moduli.
The most widely-used implementation of SRP is TLS-SRP as described in RFC 5054(nuova finestra). Our implementation differs from it in several ways, none of which decrease security. First, SHA-1 is a poor password hash function, and in order to migrate our existing password database, we were locked into using bcrypt for this purpose anyway. We do use semi-random password salts (one random part, one non-random part) but do not use the username as the non-random part to enable login with both email addresses and usernames. With bcrypt, password inputs are truncated after 72 characters. For practical purposes, this has no impact on security. As noted above, we also choose our own moduli, and the entire transaction is embedded inside certificate-based TLS for added security.
There exist other PAKE schemes in addition to SRP. We chose SRP because it has been battle-tested, is well known, has many existing implementations, has thorough documentation about pitfalls to avoid, and no patent issues. A promising alternative scheme in the future may be AugPAKE(nuova finestra), which benefits from the existence of a security proof(nuova finestra) (Edit on April 11th, 2017: this proof may be flawed, so any transition is on-hold indefinitely until the situation is clarified). We should be able to seamlessly switch to AugPAKE in the future if necessary.
One-password mode is the culmination of many months of behind-the-scenes work to make Proton Mail more secure and easy-to-use than ever. While we will always support two-password mode, one-password mode will be the default for the future and we recommend that existing users consider switching for increased ease-of-use. A step-by-step guide for switching can be found here(nuova finestra).
At Proton Mail, we appreciate more deeply than most that security is a rapidly moving target. Threats are constantly evolving, and every month, we see more and more complex attacks launched against Proton Mail. Because of this, we invest a considerable amount of resources on research and development to stay ahead of current and future threats. Most of this work happens behind the scenes, and is not as visible as new features or UI improvements, but nevertheless, they are a critical part of creating a solid secure email service.
If you would like to support these efforts, upgrading to a paid Proton Mail account is a great way to do so. On the security side, our work is never done, so in the coming months, we will be releasing additional security features to make Proton Mail even more secure.
2016-12-04: Some minor corrections and clarifications.
Proton Mail is supported by community contributions. We don’t serve ads or abuse your privacy. You can support our mission by upgrading to a paid plan.
Thousands of businesses of all sizes were impacted by cybercrime in 2024. Here
are the top cybersecurity threats we expect companies to face in 2025—and how
Proton Pass can protect your business.