2016 Email Security Roadmap

Proton Team

Share this page

For 2016, we are looking forward to another year of progress towards building easy-to-use secure email. Today, we are publishing our first security roadmap.

Over the course of 2015, we have taken several big steps towards making Proton Mail the easiest to use secure email service.(new window) Some highlights of 2015 include the release of Proton Mail 2.0, which is fully open source(new window), and the beta release of the Proton Mail iOS and Android secure email mobile apps(new window). Thousands of users have been testing these apps for over 4 months now and given very positive feedback. Therefore, we will finally be releasing the apps in the App and Play stores in 2016.

During the second half of 2015, our team focused almost exclusively on Proton Mail 3.0 which will launch at the end of this month, bringing many new features to Proton Mail including support for custom domains(new window). In 2015, we also made numerous security enhancements including adding support for encrypted attachments and adding the ability for non-Proton Mail users to send encrypted replies to encrypted Proton Mail messages. Now, all messages in Proton Mail, including attachments and emails sent by non-Proton Mail users, are stored with zero-access encryption.

For 2016, we will continue on this trend of increased email privacy. As our primary focus is on secure email, it is fitting that our first published roadmap is focused entirely on security. Building a privacy focused email service is difficult as security is a moving target that requires constant innovation. These are the steps we will be taking in 2016 to protect your email privacy.

We have broken down our security roadmap into four broad categories.

Authentication

  • Challenge/Response login password improvement so that every login uses a different one-time hash.
  • Store mailbox password in memory only, not session storage. This means the user will have to re-enter the mailbox password if the page is refreshed, but will avoid the mailbox password ever touching the disk if the browser caches session storage.
  • Two factor authentication

Server

  • Public Key Pinning (HPKP): This pins our certificate such that we can’t be impersonated if a root CA or intermediate CA is compromised.
  • Content Security Policy (CSP): An extra layer of XSS protection which disables all inline scripting and whitelists only our domain for loading Javascript.
  • Migration to Certificate Transparency (CT) for EV Certificates
  • DNS-based Authentication of Named Entities (DANE)

Full PGP Support

  • Support importing PGP public keys of contacts so PGP emails can be sent automatically through Proton Mail
  • Support keychain functionality so users can import their own public/private keys
  • Allow the export of Proton Mail user private keys

Application Security

  • Add Proton Mail SSL certificates to the HSTS browser preload list(s). This needs to wait until we have stabilized our certificates.
  • Client-side public key verification mechanism for recipients. This allows you to automatically check the fingerprints of recipient public keys to ensure that there is no key spoofing.
  • Browser extensions or desktop applications so client side code does not need to be loaded each time Proton Mail is accessed.
  • Splitting the Proton Mail webmail into a separate subdomain isolated from other services
  • Adding a Web Application Firewall (WAF)

With limited resources, there is always a trade-off between improving security and adding features, so as much as we would like to, these security improvements cannot be done overnight. If you would like to support our efforts on this, feel free to either join our open source project(new window)! As always, we welcome any feedback on this roadmap either in the comments or by emailing us at security@proton.me.

Over the past year, we have meticulously built up our infrastructure, technology and team in order to support the largest encrypted email service in the world. Looking forward to 2016, we hope to leave Beta and open the gates so that private and secure email can be enjoyed by all. Join us on this exciting journey to change the Internet!

Protect your privacy with Proton
Get a free account

Share this page

Proton Team

We are scientists, engineers, and specialists from around the world drawn together by a shared vision of protecting freedom and privacy online. Proton was born out of a desire to build an internet that puts people before profits, and we're working to create a world where everyone is in control of their digital lives.

Related articles

From having too many inboxes to manage to switching to a new email provider, there are many reasons why you’d want to delete your Gmail account. You might even be concerned that Google is abusing your privacy. Thankfully, you can delete your Gmail a
The first month of 2023 has brought brutal layoffs from Big Tech, a potential ban of TikTok in the US, and another Twitter breach. But the biggest development of this new year has to be the ascent of ChatGPT.  The chatbot can produce remarkably huma
Hackers were able to steal account details from over 200 million Twitter users and posted the database on a hacking forum in early January 2023. These details include users’ email addresses and Twitter handles, allowing people to potentially identify
From your online shopping receipts to financial statements, your emails contain a great deal of sensitive information about your life, interests, and daily schedule. If you’re concerned about your online privacy, it’s therefore vital to keep your inb
At Proton, we’re committed to building privacy-focused products that are convenient to use and improve your productivity. Last year, we released the new mobile apps for Proton Calendar and Proton Drive, letting you manage your schedule and upload imp
Most email services aren’t secure and limit attachment file sizes, but there are ways to send large files securely. If you’ve ever tried attaching multiple images or video files to an email, you’ll know that it doesn’t always work. We explain ways t