ProtonBlog(new window)

A brief intro to Proton Mail’s design philosophy

Share this page

A couple days ago, one of the first reviews of Proton Mail showed up on the web, the review I’m referring to can be found here:

http://www.hacker10.com/other-computing/review-encrypted-email-service-protonmail-ch/(new window)

We were actually a bit surprised to see this since Proton Mail is still in a very limited beta. At the moment, Proton Mail accounts are still relatively exclusive since we haven’t fully opened up a public beta yet.

Anyways, returning to the review, we found it to be fair but at the same time a bit troubling because a number of the characteristics of Proton Mail we were faulted for were actually things we had intentionally built in. It was almost as if the reviewer had missed the point of Proton Mail.

Upon reflection, this is not the fault of the reviewer, it seems we have never fully explained the design philosophy behind Proton Mail. So briefly below, I will lay out our main objectives while responding to some criticism made by our very first reviewer.

1. Make encryption easy to use.

In truth, there is not a whole lot that Proton Mail does that is not already accomplished by PGP, at least from a security standpoint. But, to quote what Bruce Schneier(new window) said to us when he visited MIT, “all PGP has demonstrated is that even one click is too much”.

Basically, security is not useful if it is not easy enough for mass adoption. It is simply difficult to convince people to adopt a higher standard of security if it forces them to do more work. So from day one, the principle guiding our architecture was that the end product cannot be more complex than Gmail.

And in the end, I think we have accomplished that. Encryption in Proton Mail is end-to-end, like PGP, but at the same time, completely invisible to both recipient and sender. What we gave up to accomplish that however, and what the reviewer faulted us for, is compatibility with PGP. In effect, we cannot easily abstract away the complexity of a system like PGP while maintaining backwards compatibility with it.

The keyword in the above sentence actually is ‘easily’. It is actually possible in our architecture to support PGP, but in the end, we decided this was less of a priority because our end goal is a more secure internet. The current users of PGP already benefit from end-to-end encryption and don’t need our help. What we really want to provide is privacy for the much larger segment of the population that isn’t sophisticated enough to use PGP.

2. Trust the user not to be stupid.

Our reviewer pointed out that we don’t have a password length requirement, and we don’t have an auto logout. I think it is common knowledge nowadays that you using a password like ‘1234’ or ‘1111’ is NOT a good idea. But it is also NOT a good idea to force a user to use a password like ‘yYbkza#NGMeAW_kE21fxeQbB’. At that point, a user would simply find Proton Mail too much of a hassle to use. What we try to do is take the middle road. When you go to set your password when creating your Proton Mail account, we will tell you whether your password is strong or weak, and then let the user make the final decision. Our philosophy here is simple, we trust that our users are not stupid, but we’re not going to turn you away either if you are stupid.

As for the auto logout….early Alpha builds of Proton Mail had a 10 minute auto logout. As somebody who was using it day in and day out for all of my email communications, you should trust me when I say a 10 minute logout is incredibly annoying and does NOT enhance the product.

3. Give the user control

The reviewer pointed out that encrypted messages to outside users do not instantly destruct. This again, is intentional. Instead of instant destruction, we give the sender control over when they want the message to destruct (or if they want it to destruct at all). So you can fine tune the time for each email. Right now, the minimum is 1 hour from the time the message is sent, but in the future, we will also be adding the option for instant destruction once the message is read.

And, one final loose end…

The reviewer pointed out that we are not audited by third parties. Actually, we have been audited by the computer security staff at CERN (European Center for Nuclear Research), that’s actually where half of our developers work. But better yet, you can audit Proton Mail yourself. Our front-end JavaScript encryption/decryption codes are sent to browsers uncompressed, a simple view source and you can see our source code!

We look forward to continuing to improve Proton Mail so don’t hesitate to send us comments or suggestions!

Protect your privacy with Proton
Create a free account

Share this page

Andy Yen(new window)

Andy is the founder and CEO of Proton. He is a long-time advocate for privacy rights and has spoken at TED, Web Summit, and the United Nations about online privacy issues. Previously, Andy was a research scientist at CERN and has a PhD in particle physics from Harvard University.

Related articles

Can you password-protect a folder in Google Drive?
Protecting a folder with a password is a simple yet effective way of securing files. You may wonder whether you can password-protect a folder in Google Drive. We explain what access controls Google Drive offers and what you can do to improve your sec
Proton Pass now supports passkeys on all devices and plans
We’re excited to announce that Proton Pass supports passkeys for everyone, allowing you to manage and use passkeys across all devices seamlessly. Passkeys are an easy and secure alternative to traditional passwords that can help prevent phishing atta
what is a passkey?
Passkeys are a new way to secure your online accounts using cryptographic keys instead of passwords. They offer a high level of convenience and security, and are a real game-changer in the way we access and secure sites. What is a passkey, though, an
Apple’s marketing team has built a powerful association between the iPhone and privacy. The company’s ad campaigns claim that “what happens on your iPhone, stays on your iPhone.” And, “Privacy. That’s iPhone.” But Apple’s lawyers are telling a diffe
A cyberattack on national public employment service France Travail has exposed the personal data of as many as 43 million people.  The latest breach is the second major cybersecurity attack to happen in France in the past month, raising concerns abo
If I share a folder in Google Drive, can anybody see my other folders
Google Drive makes it easy to share files and folders, but you may have wondered at some point whether the people you’ve shared a folder with can see your other folders. We answer this question below and also share some tips for truly secure link sha
In 2014, Proton Mail was introduced as a web app, revolutionizing how we think about email privacy. Today, we’re excited to broaden the horizons of secure communication by launching the Proton Mail desktop app. Anyone can now use the new Proton Mail