I want something that is as secure as possible within the bounds of not inconveniencing me much. Second password? Fine, but at least let me click something to stay persistently logged in on my own computer so I only have to enter the passwords once a week or less. See, doing that, right there, would not be a huge sacrifice to convenience (I don't mind typing in a username and two passwords once a week), but would make it more secure than the average email provider (Assuming the average email provider has one password, no encryption, and persistent log-ins that last several weeks). But if I have to enter my username and both passwords, or even if it were just a username and password, every single time I check my mail, often a half dozen times an hour, they've just crossed the line into something that is too inconvenient to tolerate for me personally (Still waiting and seeing if they implement a "Remember Me" feature before totally bailing on my account, though. It's still in beta. They have persistent log-in for Android, it could be added for the web. But while I wait I am primarily sticking to my old address).Tharn wrote:You can't have both convenience and security. Meaningful security measures will usually introduce a stopgap into a workflow. UAC does this, Windows login password does this, Palemoon master password does this. If you're serious about wanting a secure service with encrypted e-mails that the service provider cannot decrypt, then you are going to need a password that is separate from your login credentials. So you suck it up and use two. If this becomes so inconvenient that you won't use their service, then I assume you didn't really need it in the first place.
And I'm talking about the hypothetical you here, not you personally CharmCityCrab. Because a lot of people think along those same lines. People want security but they don't want to invest anything to get it. That's not security, that's willfully and lazily placing your trust in someone else.
You're right when you say I don't really need their service in the first place. I like security and privacy, but I am not actually doing anything that requires it beyond basic stuff that everyone should be watching out for like avoidance of identity theft and the like. The key lures of Proton Mail for me are:
1) No advertisements (Which is key because Yahoo and another email provider I tried for about 5 minutes stopped playing nice with Android's email app for me and I am stuck using Yahoo Mail's app with ads)
2) Not a big corporation
3) Providing email and not constantly trying to siphon me off into signing up for other things (Which is itself a form of advertising)
4) Open-source
5) Yahoo Mail has been annoying me lately
6) I do feel good about the privacy and security stuff because I think they should be there on principle to some degree and it's my data and not some corporations to use to sell things to me and such. I am also against things like warrantless wiretaps. So, I'd like to see something like this take off on principle. But I am only willing to deal with security measures when they are not horribly inconvenient for me, because generally what I am doing is forwarding news and sports links around or having casual conversations with people and don't really *need* security or privacy beyond basic guards against identity theft.
If some email service just said we offer mail without ads with webmail and apps on all major platforms, without added privacy and security (But just as private and secure as the major providers), that might win my business- if it's a reliable company. But I've looked into all the major platforms, and none are a better fit for me than Yahoo, which I've had for like 17 years. Yet, Yahoo has some issues, increasingly (Not worth stretching out this post any longer to list them
).So, I'm sort of hoping to use Proton Mail "off-label", using it for reliability and lack of advertisements and constant upselling, instead of primarily using it for it's primary selling point of security and privacy (Though those are nice "extras" for me). I also like that it's open-source. And, hey, it's a cool domain name. But I'm not James Bond, like I said.
I don't need security that is going to make things a real hassle for me.Still, I think there is a middle ground between a lot of email services now, which are very insecure and openly take, use, and sell all your data; versus something so locked down that I have to fill out three fields when I log-in, and then do it again after reading an article or checking a forum elsewhere when I want to see if I got any new emails and then again, and again, and so on.
The question is ultimately is Proton Mail trying to be a *more* private and secure email service (Retaining most conveniences of other providers) or is it trying to be the most private and secure email service possible (Making using it a pain in the ass). If they are doing the former, they could be a good fit for me. If they are doing the latter, it's not for me. Their documentation goes back and forth on that point- but it seems like they are willing to make some concessions to useability over privacy and security at times (For example, they have an Android app. Also, their Android app runs on Google services. Also, you can send email in the clear to non-Proton Mail users, which is what I was doing while testing it- I don't want people to have to click a web link, I want to send it through as regular email even if it means less security.), which is a good sign that it might be something decent that is useable for the average Joe.
Actually, that users, myself included, are allowed to send email in the clear with no encryption by default to non-Proton Mail users and that Proton Mail users who want or desire more security at the expense of useability (In this case useability to recipients) can change the default for their personal account to send emails as web links to encrypted messages, is a good sign. That's a good compromise. Let users make the determination between privacy/security and convenience according to their own needs and desires on each thing. That's what I'm hoping for with a "remember me" log-in feature- let me and users like me use it on our home computers and stuff, and people who need or want more privacy/security than that can not use it and have their account set to never stay logged in. Making it optional would be consistent with their early approach to things- but I can't get a commitment out of them to include a "Remember Me" feature for users who want one, so I'm going to wait and see.
They recently switched from .ch to .com for their main website, which some view as a potential privacy hazard, but they wanted to rank higher on Google search results. If they can make that trade off, adding an optional "Remember Me" feature shouldn't be a problem, I wouldn't think- though indications so far are that they won't (Nothing definitive).
