privacytools.io VS ProtonMail Web Client

FYI, Privacy Guides is a shitshow. It was formerly privacytools.io[1], and in 2019, the creator[2] of privacytools.io stopped contributing[3] and a new contributor[4] immediately focused on donations[5], became the admin[6] and took control[7] of most assets, including donations but excluding the domain and Twitter account[8]. In 2021, the creator of privacytools.io launched a new privacytools.io[9] and added affiliate links[10], and the Privacy Guides team shut down r/privacytoolsIO rather than return it[11] to the creator. Like I said, a shitshow.

[1] https://github.com/privacytools/privacytools.io

[2] https://www.reddit.com/user/BurungHantu

[3] https://github.com/privacytools/privacytools.io/commits?auth...

[4] https://github.com/jonaharagon

[5] https://github.com/privacytools/privacytools.io/commits?afte...

[6] https://github.com/privacytools/privacytools.io/commit/4b60a...

[7] https://redd.it/tuo7mm

[8] https://twitter.com/privacytoolsIO

[9] https://redd.it/pxtw2y

[10] https://www.reddit.com/r/VPNTorrents/comments/raftz6/i_made_...

[11] https://redd.it/qk7vn0

Yes, we know you're still mad we won't add Threema. It was thoroughly discussed in our old organization.

en 2019: Signal has copious privacy issues making it unfit for privacytools.io endorsement.

Signal is just another walled garden and has a lot of other problems too: https://github.com/privacytools/privacytools.io/issues/779

Or the fork which is much more active these days https://docs.searxng.org/

In the past it Lukol served Google Ads: https://github.com/privacytools/privacytools.io/issues/1557#...

Never heard of it. Fastmail apparently never made it on to the privacytools.io list for its geographical location. See here for some other recommendations. There are also malifence and posteo. I use posteo and mailbox.org. The main two weird things about posteo is that there is no spam folder (detected spam is rejected with no option to change this), and you can't use a custom domain (because they don't want to have any information on you/your name). Mailbox.org can optionally reject spam and lets you use your custom domain. I like it a lot so far.

The correct link is https://github.com/privacytools/privacytools.io/pull/657

Worth noting the "admins" of that site wrote the content for it, check for yourself https://github.com/privacytools/privacytools.io/commits/master BurungHantu hadn't written anything really since 2016.

The source code is here https://github.com/ProtonMail/WebClients

> Finally, in keeping with our long track record of transparency, Proton Pass is open source so anyone can review and verify our security architecture

They sure do enjoy writing that sentence without including any hyperlinks. This (https://github.com/ProtonMail/WebClients/tree/main/applicati...) appears to be the browser extension and https://github.com/ProtonMail/WebClients/tree/main/packages/... appears to look like the backend referenced in the extension's readme, but that directory's readme is zero bytes so (shrug)

Fork the frontend and make your own lightweight option

PS: I hope that we selfhosters will have a modern, efficient, easy to use mail suite one day with modern features like JMAP, good self-learning spam integration, automated checks and validations for SPF/DMARC/DKIM or whether the IP/host suddenly appears in a blocklist and integrated encryption at rest for emails. Something that isn't 30 services in a container image, with 30 different configuration styles. Maybe even with an API integrated that's compatible to the ProtonMail frontend (like the neutron server once intended to be). Anyway, I'm sorry for dreaming. ;)

And if you want to customize it further you can use Stylus to add custom CSS, Tampermonkey to add JS, or even modify the whole thing yourself from source (if you run it locally it syncs with your actual account).

There are lots of useful End to end encrypted webapps such as Protonmail, cryptpad, cryptee and many others. And part of why we trust them is that the client side code is open source, so we can see that end to end encryption is really going on and is really secure. Its impossible to verify what code they are running in their server, but if the data we send them is already encrypted we can rest easy.