ProtonMail's encrypted email is now available to all
Some bad signs:<p>1. Hosted in Switzerland is advertised as a security feature. The point of e2e is that the servers are untrusted.  If you need a &quot;good jurisdiction&quot; for your servers, it means they must be trusted.  That&#x27;s a problem, because sadly there are no good jurisdictions in today&#x27;s world, and your jurisdiction doesn&#x27;t help you if your servers are hacked.<p>2. It&#x27;s webmail.  That means the security of whatever e2e they&#x27;re doing is based on the security of SSL.  If you break SSL, you can break whatever e2e they&#x27;re doing, and that means your e2e security is only as secure as the CA system.<p>3. Their &#x27;threat model&#x27; documentation leads with: &quot;From a high level, our premise is that a service like the now-defunct Lavabit does add value, despite some inherent weaknesses. We designed ProtonMail around many of the same principles...&quot;  Given what happened with Lavabit (the eventual compromise of everyone&#x27;s email despite shutting down the service), considering it to have been &quot;valuable&quot; should really be off the table at this point: <a href="http:&#x2F;&#x2F;www.thoughtcrime.org&#x2F;blog&#x2F;lavabit-critique&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.thoughtcrime.org&#x2F;blog&#x2F;lavabit-critique&#x2F;</a><p>I can&#x27;t find much in the way of technical documentation for ProtonMail, but from what little is available, it does seem that (much like Lavabit), the service is built on the premise of &quot;won&#x27;t&quot; read your mail rather than &quot;can&#x27;t&quot; read your mail.