Tutanota is the secure email service, built in Germany. Use encrypted emails on all devices with our open source email client, mobile apps & desktop clients.
it is a shitty E2EE implementation in JS incompatible with the email standard OpenPGP.
but I like that they wrote this post, even if it is for marketing purposes, because Tutanota is based on the EU and hopefully the EU Parliament will listen if enough people tells them.
They have a JavaScript version, it’s true. But they also have apps. Meaning you don’t have to rely on JavaScript security. If you want to lock it down.
Encrypted email, should never be considered end to end encrypted. This includes protonmail which does implement PGP. Email is a clear text protocol. Encrypted email providers provide encryption at rest for the email.
The issue with protonmail, and PGP in general, is the metadata is unencrypted, to from subject. Metadata gets people killed. Metadata is valuable data.
So you have to choose for your data at rest do you want everything encrypted, then you go with Tutanota, if you only want the body of the email encrypted then proton mail/ PGP.
Since most email is clear text anyway, and if you want end to end encrypted you should use signal or simplex, I think full encryption at rest is the better option here.
All of that’s to say it’s not a shitty implementation, it’s an implementation with different trade-offs than what you value
their clients use the same JS implementation, they are the web version wrapped in electron.
The major problem with these JS implementations (including Proton and any other program that uses JS for encryption) is that it would be trivial for them to grab your private key from your browser and send it to their servers. And yes, we have the code. But it’s virtually impossible to verify that the code they are sending to your browser each time is exactly the same one that they publish on github, after JS minimizers and all that.
A third party that found a vulnerability in a browser could also inject their own JS and steal your private keys.
You’re obviously right about everything else and email’s inherent insecure nature.
I still find it useful because it’s the only online communication channel that is widely adopted, that can be self-hosted without depending on third party servers or you can simply choose a provider you trust. I’d love to have that with XMPP or SimpleX or something like that, but currently we’re stuck with email.
The point of a fully embodied app, is you don’t have to pull the JavaScript from the website. It’s distributed via the app system. Fdroid in many cases
yes, the clients should be good in most cases, as long as builds are reproducible or you compile yourself from the public code (which is not most cases).
Still, I’d rather do OpenPGP encryption on my client of choice with my implementation of choice that is provider agnostic.
I personally don’t like Tutanota for a lot of reasons. The other day I recommended Tutanota to someone that needed a new email account and they weren’t able to create the Tutanota account using Tor. They tried using a VPN and they weren’t able. Tutanota said their IP address was being used for abuse.
What’s the point of a private email if you block anonymizers?
Some people might find a use case for it, of course. And their post advocating against anti-encryption laws is good. But I don’t think it’s a good email provider and I won’t be recommending them again.
For people willing to give up their identity, I’ve had no issues with them. Since I have a domain tied to them and the domains tied to an identity it’s fine for me.
So I agree they’re not an anonymous email provider.
They are however in encrypted at rest email provider. And and I’m happy to recommend them to anybody who doesn’t need anonymity in their email.
it is a shitty E2EE implementation in JS incompatible with the email standard OpenPGP.
but I like that they wrote this post, even if it is for marketing purposes, because Tutanota is based on the EU and hopefully the EU Parliament will listen if enough people tells them.
They have a JavaScript version, it’s true. But they also have apps. Meaning you don’t have to rely on JavaScript security. If you want to lock it down.
Encrypted email, should never be considered end to end encrypted. This includes protonmail which does implement PGP. Email is a clear text protocol. Encrypted email providers provide encryption at rest for the email.
The issue with protonmail, and PGP in general, is the metadata is unencrypted, to from subject. Metadata gets people killed. Metadata is valuable data.
So you have to choose for your data at rest do you want everything encrypted, then you go with Tutanota, if you only want the body of the email encrypted then proton mail/ PGP.
Since most email is clear text anyway, and if you want end to end encrypted you should use signal or simplex, I think full encryption at rest is the better option here.
All of that’s to say it’s not a shitty implementation, it’s an implementation with different trade-offs than what you value
their clients use the same JS implementation, they are the web version wrapped in electron.
The major problem with these JS implementations (including Proton and any other program that uses JS for encryption) is that it would be trivial for them to grab your private key from your browser and send it to their servers. And yes, we have the code. But it’s virtually impossible to verify that the code they are sending to your browser each time is exactly the same one that they publish on github, after JS minimizers and all that.
A third party that found a vulnerability in a browser could also inject their own JS and steal your private keys.
You’re obviously right about everything else and email’s inherent insecure nature.
I still find it useful because it’s the only online communication channel that is widely adopted, that can be self-hosted without depending on third party servers or you can simply choose a provider you trust. I’d love to have that with XMPP or SimpleX or something like that, but currently we’re stuck with email.
The point of a fully embodied app, is you don’t have to pull the JavaScript from the website. It’s distributed via the app system. Fdroid in many cases
yes, the clients should be good in most cases, as long as builds are reproducible or you compile yourself from the public code (which is not most cases).
Still, I’d rather do OpenPGP encryption on my client of choice with my implementation of choice that is provider agnostic.
Fair. Glad you found an email system that works for you, PGP is great.
They are in the f Droid repo, which means fdroid does build them from the source code.
I just don’t think tutanota is shitty, they’ve just made different trade-offs.
I personally don’t like Tutanota for a lot of reasons. The other day I recommended Tutanota to someone that needed a new email account and they weren’t able to create the Tutanota account using Tor. They tried using a VPN and they weren’t able. Tutanota said their IP address was being used for abuse.
What’s the point of a private email if you block anonymizers?
Some people might find a use case for it, of course. And their post advocating against anti-encryption laws is good. But I don’t think it’s a good email provider and I won’t be recommending them again.
For people willing to give up their identity, I’ve had no issues with them. Since I have a domain tied to them and the domains tied to an identity it’s fine for me.
So I agree they’re not an anonymous email provider.
They are however in encrypted at rest email provider. And and I’m happy to recommend them to anybody who doesn’t need anonymity in their email.