You are not unaware of ProtonMail [1]. Why are you putting its name in sneer quotes to imply unfamiliarity and insignificance?

[1]: https://news.ycombinator.com/item?id=11305228

I'm not sure what this is supposed to demonstrate. This is a thread that seems mostly to consist of me debating with the Cyph people.

It shows that ProtonMail should be familiar to you, since that's what the thread is about. Please don't answer with a question or we'll be caught in an infinite loop.

I answered your question: it shows no such thing. I am not, nor am I likely to be a week after this thread, which is about ProtonMail.

ProtonMail focus on security and paid services, free tier is almost useless. Gmail is free service that make money on pushing adds and selling your privacy but provide excellent service. There is no conflict of interest.

SEO it is hard to say. They want to compete on "email" and "secure email" keywords it is not going be easy.

Can you elaborate how free tier is almost useless? I'm using ProtonMail as my secondary e-mail and I'm on free tier, and it is pretty useful. Much more useful than FastMail which pretty much forced me to switch to paid plan right away or else I will be unable to send e-mail - all this to combat spammers.

> Gmail is free service that make money on pushing adds and selling your privacy but provide excellent service.

G Suite Email is a paid service that doesn't sell your privacy, doesn't serve ads, and has extremely good service.

> G Suite Email is a paid service that doesn't sell your privacy

G Suite is an american service and will give away your privacy without a proper/open court case when receiving a gag order. This is very much in contrary to PM.

When you talk about search, you have to talk about search keywords to put things in context. "How high do you rank on Google?" is a meaningless question, for instance.

ProtonMail said they weren't ranking for "encrypted email" and "secure email" [1] for a year, not just "email". How many "much more popular" than ProtonMail "encrypted email" services do you know?

And no, using StartTLS doesn't count. I'm talking about email services that have promoted themselves and in the media as encrypted or end-to-end encrypted email services, and would therefore get the ranking for those search queries.

ProtonMail wasn't talking about ranking high for the word "email". Obviously that would be quite difficult to impossible for a year old company.

[1] https://protonmail.com/blog/search-risk-google/

They are now the top result for [encrypted email]. That seems to say that google does indeed think they are more than just a random provider.

Assuming the blog isn't blatantly lying about their position being lower just recently, it's proven that google did penalize them for a while.

As to the reasons, I tend to assume bugs or coincidences. I just can't see Google doing something like that on purpose, when they'd gain a minor edge in the webmail business at a huge risk to their reputation, a smoking gun for all those regulators poised to hit them with charges of anticompetitive behavior at the first opportunity.

Google results are not like, hand-curated. Why would the google ranking of a site on a given search term be reflective of whether or not they consider ProtonMail a serious competitor?

Wouldn't it be simpler explanation that they just rank down everything with mail in the name?

The even simpler explanation is that Google's Algo changed and that there's a lot of websites about encrypted email.

This is the likely result.

Google probably dampened the authority of many of the sites linking to ProtonMail, for one reason or another.

This most likely brought Protons rank down without them doing anything wrong.

As a person that's actually running a hobby search engine: It's simpler to apply a coefficient on a hostname string than process associated data; may it be during a fetch, a processing or a search phase.

Is that happening to FastMail?

Nah, we come up number 2 for a search for "reliable email" when I'm logged in and number 5 when I'm logged out - which sounds bad, but the stuff about it is all questions about how reliable email delivery is. Fair enough.

We don't even rate a mention for "professional email" because it's all about how to not come across like a n00b when writing emails.

(interestingly, bing search for professional email has an ad for Google's email above the search results)

FastMail, unlike ProtonMail, actually has traction. Why is Google supposedly penalizing ProtonMail, but not FastMail?

Eh, we are entering an area of speculation. The right answer is 'only google knows', but since you are asking twice this question, let me try to take a wild guess:

- Google, an advertising company, benefits from having access to the plaintext of people's messages. They can advertise this as 'secure' but only for the comm channel. - Proton mail, advertises itself as: "ProtonMail is the world's largest secure email service, developed by CERN and MIT scientists. We are open source and protected by Swiss privacy law.", featuring end to end encryption, anonymous email, mobile clients etc. - Fastmail: "Secure, reliable email hosting for businesses, families and professionals. Premium email with no ads, excellent spam protection and rapid personal support."

If I'm a product manager of GMail, I'd be more scared from Proton mail than FastMail. In fact, anything featuring end-to-end encryption will be approached with negativity, because then GMail can't target ads, which are the main cash cow for google.

Protonmail is another crappy provider filling the void left by Lavabit.

It doesn't have any additional security benefits beyond regular webmail providers that provide TLS:

- Encryption is performed inside the browser. By delivering a modified JavaScript payload, it can steal encryption keys.

- No support for POP, IMAP, or SMTP. If you want to use GPG, you can't.

To see it being compared to Fastmail and Gmail, which don't engage in parlor tricks, is a travesty.

May be unpopular opinion, but I think that's the correct criticism here. When I decided to move off Gmail,I had the paranoia hat on, and looked for something rock-solid. ProtonMail sounding so good on paper, fails to live up to sone common sense questions. If the encrypting infrastructure is closed and under their control, it boils down to trusting them on their pinky promise. False pretense of privacy and security is worse than being paranoid and defensive.

I chose Fastmail. I pay for my email service and don't expect them to sell me out. Get to use a functional email system that lets me search my emails(ProtonMail lacks this ability).[0]

Being aware that my emails could be snooped on by some government somewhere.. so nothing sensitive goes in there. That's what OTR or other personal encryption systems are for. [0] - https://protonmail.com/support/knowledge-base/search/

I can see all sorts of criticism leveled at ProtonMail, but this seems a bit disingenuous. They're trying something different than GPG, which had 20 years to prove itself and failed to gain any traction.

Sure, you have to trust their software, but is that fundamentally different than trusting the GPG software, or did you do a full audit of that?

GPG, when used correctly, is theoretically secure. Protonmail, like Lavabit, is insecure by design. They make no mention of this; they claim the inability to read your messages, which is trivially false.

GPG has a track record of being secure against many adversaries, including the NSA. It's used by most Linux distributions for package signing, so you probably already depend on it -- even if indirectly.

I don't expect GPG to be completely secure. But it's not based on deception.

The trivial attack is based on them sending you compromised code, right? Because that seems to comparable to an attack on GPG where their downloads are compromised.

I get that there's a difference in degree, i. e. GPG binaries being checked against hashes and having a long track record as an organization, but is that fundamentally different?

I could see ProtonMail evolving to, for example, using a browser extension that allows you to use a known-good version of the crypto library, and informing you of changes.

Point being: it isn't perfect and I'd prefer something based on standards. But e-mail encryption has failed, even though it is often more personal than websites where TLS has been successful. ProtonMail is a legitimate attempt in a space that seems to need a new approach.

I think it's different, because Protonmail can target you, individually, at any time. Like, for example, upon receipt of a NSL.

GPG is used asynchronously. In many cases, everyone would need to be compromised to go after one person. That raises the chance of discovery.

A browser extension is a fantastically better idea. Google previously prototyped most of the work for this: https://github.com/google/end-to-end

The difference is that, any time you check your email, a basic TLS MitM could exfiltrate your entire inbox without your or ProtonMail's knowledge — exactly the same threat model as Gmail or any other webmail provider.

Further to that, I'd trust Google's infrastructure to withstand compromise much more than I'd trust a datacenter run by a small company that I know much less about. (Tinfoil hat: sure, I have to assume that the NSA has a copy of my Gmail inbox, but god knows who else may have owned ProtonMail.)

When's the last time you downloaded GPG? For me: years ago.

How often do you download ProtonMail's Javascript code? Several times per second, as long as you're using it.

And a product manager for Gmail can affect ranking of a random website exactly how?

They just pop over to the search fixer dashboard and drag protonmail into the penalty box. Two clicks, boom, boom.

I would suggest that Gmail has little to gain by silencing Yahoo Mail or Outlook.com (that many have heard of anyways), but has a lot of reason to silence companies which are pointing out the privacy issues with using Gmail.

Ok sure, let's play "guess the name of the competitor that tptacek is referring to" because he wants to be as vague as possible so as to not be rebutted

Wow, that was an aggressive response. As I've mentioned elsewhere in the thread, I'm talking about independent providers like FastMail.

Which brings us to ocdtrekkie's point. FastMail a great niche product, but as paid product and one that doesn't sell itself on the privacy improvements over something like gmail, Google has absolutely nothing to worry about.

ProtonMail on the other hand, while not at the moment a threat to gmail does do a lot of brand damage to it, as it highlights the privacy problems people have with it.