proton-bridge

ProtonMail mangles emails in a way that they are impossible to download as they were delivered to their servers, meaning MIME signatures cannot be verified, because the emails are altered. Old issue, affects also web UI not only bridge: https://web.archive.org/web/20240221213617/https://github.co... Would you use a secure email service that breaks signature verification on received emails? There were a lot of smaller and bigger things along the years, but realizing I could not verify authenticity of signed emails for apparently no reason pushed me over threshold to leave them.

I want to emphasize just how bad bridge is. It's so bad that they nuked the issues section on the repo. They didn't lock it, they removed all record of issues. I found out when trying to click on a useful/familiar issue that was cached by a search engine. Proton says to talk to their support directly, but that is a totally different solution for a totally different problem. The fact that they deleted public history of comments really flares my unsubscribe feelings. https://github.com/ProtonMail/proton-bridge As for the "why is bridge bad / why were you searching for issues": keeping it logged in on a headless server is an exercise in pain. It will latch onto whatever keyring it feels like then fail to integrate. Okay, capitulate and do it through the GUI. That works until the token expires. So you're expected to log in every few

Using an email client requires a Proton Bridge thing that acts as a local IMAP/SMTP proxy: https://github.com/ProtonMail/proton-bridge As if disabling the issue tracker and stonewalling pull requests wasn't bad enough, seeing how it is built out of multiple layers that communicate via gRPC was what made me instantly lose all trust in Proton. I don't know who's been doing their hiring but just from one look at that kludge it's evident they've lost the plot altogether. (There's a third-party alternative called Hydroxide, but it's experimental. Haven't been able to send emails through it from Thunderbird yet, though I've only looked into this for a few hours recently.)

Have you seen this thing? https://github.com/ProtonMail/proton-bridge I'm not too familiar with it, but we're building Marco (https://marcoapp.io) and a customer just showed it to me recently.

That isn't really fair. If you read the article, protonmail essentially supplied the FBI the recovery email of the account. This is metadata that protonmail must have that isn't encrypted by the user for obvious reasons. Regarding the "MITM" for every email sent, this is related to their "bridge" software which allows regular IMAP/SMTP software to use Proton Mail. This software must edit the emails to encrypt them in their scheme. This software is open source and can be inspected and/or built locally. https://github.com/ProtonMail/proton-bridge

> This appears to be related to a behaviour that ProtonMail has of dropping all plaintext email if any mime-encoded parts exist. https://github.com/ProtonMail/proton-bridge/issues/26#issuec... I'm actually more shocked knowing that they drop plain text if there is a mime-encoded part (e.g. HTML). Just verified that all mails imported from GMail and all newer mails I received in PM only have the HTML part now, while GMail shows both HTML and plain text parts in message source. Great, now if I want to use a text-only client to read those mails in the future, I won't be able to. Now I honestly wonder, how did they think this is something okay to mess up? Is there just no usable email hosting service for someone that want their mails not touched and also stored securely? Like, this is not even going to save storage space for PM - I'm paying f

Before anyone jumps ship on ProtonMail because they didn't read past the headline, by "Rewrites Your Emails, the author means that ProtonMail doesn't support user-applied PGP signatures because of the way they've decided to architect their automatic signing and encryption system. ProtonMail isn't rewriting outbound emails in the sense that the average person is probably thinking. If you're part of the 99.9% who doesn't sign their emails or verify signatures, this issue is unlikely to actually matter to you. That said, Proton's response to this issue is joke. https://github.com/ProtonMail/proton-bridge/issues/26

There is also a 2-year old issues: https://github.com/ProtonMail/proton-bridge/issues/180 Proton makes it hard for open-source software developer to send patches and they don't care. https://git-send-email.io/#step-2 Some quote from it. > Be advised that Protonmail is generally known to be a pretty bad email host. They will munge up your outgoing emails and your patches may fail to apply when received by the other end. Not to mention their mistreatment of open source and false promises of security! You should consider a different mail provider. Glad that I jumped out the ship only after one week so I can get full refund lol

The repository for Proton Mail Bridge (which is open source) claims to also host the source for the Import Export app. Here: https://github.com/ProtonMail/proton-bridge Briefly looking at the files and code it's hard to tell whether that is still the case, but it's fair to assume Import-Export would reuse most of the machinery behind Bridge.

Also avoid using ProtonMail Bridge if you value your emails. It's been silently corrupting/deleting your emails for years now. And Proton hasn't done a single thing to warn users about it. Instead they've been working on a complete rewrite which is far from completion. Meanwhile people are still discovering that their emails are disappearing. https://github.com/ProtonMail/proton-bridge/issues/29 https://github.com/ProtonMail/proton-bridge/issues/220