Doghouse: Protonmail

At one of my jobs, corporate email has been hosted with Google. I've never been happy with this, but not so unhappy as to abandon that job. Since Google refused to let me use my mail-fetcher (they called it insufficiently secure, without specifying what sort of insecurity they were concerned about or what hoops they wanted it to jump through, never mind that it really should be up to me what I risks I choose to expose my mail to), I've been using their webmail interface with lynx. (On a work machine, to be sure.) Ugly, but lynx at least runs in a terminal emulator window and lets me use a real editor to compose mail bodies.

Recently, they decided to break that, saying they would soon be requiring JavaScript support in the browser. (They tried to spin it as a positive thing, but it's hard to conceal the basic fact that they're cutting service. They called it something like protecting users before they even log in, without, of course, explaining how requiring the huge additional exposed attack surface of not just JavaScript but a browser bloated enough to support JavaScript can be considered protecting anyone from anything.)

So we've been casting around for alternatives. One of the first ones (well, one of the first ones I heard of; I wasn't the one doing initial investigations) was something called Protonmail, protonmail.com, out of Switzerland.

They looked promising and they offered free individual accounts. (Slightly crippled, but the documented cripplings did not strike me as unreasonable.) So I signed up for one. One of the test messages I sent was to my own home address.

It did not arrive. Checking my logs, it turns out their outgoing SMTP code was, and is last I checked my logs, dropping the connection 60 seconds into my banner delay, a point at which the SMTP specs all agree that any client-side timeout should be at least five minutes.

So I opened a ticket with them for it. I also sent mail from my home address to their postmaster@ address, the latter mail including the relevant logs from my SMTP server (because I was using their webmail interface, there was no good way to get my logs into my trouble ticket).

They responded to the ticket; the response made it look as though the person responding either hadn't really read my message or didn't know enough about SMTP to understand the issue. So I replied, trying to explain (as best I could in a mail composed on a phone with about 40% of the screen taken up by the keyboard and about 80% of the rest taken up by useless-for-the-task decorations and controls, leaving about three (short) lines displayed).

This morning, they got back to me, saying they had looked into it with "our deliverability", saying they "had no similar cases and at this point, we are not planning to increase the waiting time as it will use more resources on our side". It seems to have escaped them that, if they have had no similar cases, increasing that waiting time would affect a vanishingly small fraction of their outgoing mail and thus would not use significantly more resources.

It also, and far more importantly in my opinion, means that they consider under-provisioning their outgoing mail path more important than conforming to the spec, a spec which is, after all, the only basis the net has for interoperable email.

I also have not seen anything that makes me think they've even read my mail to their postmaster@ address, despite my mentioning it in my response to their first response to my trouble ticket.

So, I really cannot recommend Protonmail.

Main