samsapti.dev/content/posts/why-i-switched-from-proton-mail.md

+++ 
draft = false
date = 2022-05-29T16:10:46+02:00
title = "Why I Switched From Proton Mail"
description = "This blog post explains why I chose to switch away from Proton Mail."
authors = ["Sam Al-Sapti"]
tags = ["cryptography", "decentralization", "email", "pgp"]
series = []
+++

I wanted to write this blog post (and by the way, this is my first) to
shed some light on my recent choice of email provider. You see, Proton
Mail is a great email service, and I've used them for years, but it just
doesn't fit my needs anymore. This is due to a number of reasons, but
it's primarily due to some issues with external PGP handling (I'll talk
more about this later on) and their recent change of direction.

## Centralization and Proton's new direction

One of the main reasons I chose to switch, is the new direction Proton
is going in. Recently, they've revamped all of their products and their
website, to make it more clear that both Proton Mail, Proton VPN, Proton
Calendar and Proton Drive is under the same family/suite (notice how
there's a space now in their product names, that's one of the changes).
All of this is great for many reasons, now it actually feels like an
alternative all-in-one solution to something like Google's, and I'm sure
this will benefit them in the long run and appeal to more people. A lot
of people like these kinds of ecosystems, because it usually increases
ease of use and convenience. In fact, this change now allows Proton to
better integrate their products together. For example, you can now
easily send large attachments via email, by letting Proton Mail
automatically upload the file to Proton Drive and send a share link in
the email, instead of attaching it in the email itself. All of the
changes are outlined in
[this article](https://proton.me/news/updated-proton) by Proton's CEO,
Andy Yen.

Personally though, this does not appeal to me. I'm not a fan of
ecosystems and having all my eggs in one basket, and I'm a huge fan of
self-hosting. You see, I'm a big proponent of decentralization. One
aspect of decentralization is to not have everything in one place, when
you don't control that place. For example, I wouldn't have both my
email, calendar, contacts and cloud storage with Google, and neither
would I with Proton. Instead, I self-host my cloud storage, calendar,
contacts, to-do lists, and notes with the help of
[Nextcloud](https://nextcloud.com) at home on a Raspberry Pi. This way,
even though it's all in one place, I'm the one in control of the server
hosting it and what happens with it.

I can definitely see why Proton chose to go in this direction, and I
fully support them. But they should also expect, and I'm sure they did,
that some of their customers wouldn't want this change of direction. I
have nothing against Proton as a company, but having my digital life
centralized with one company is just not my cup of tea.

## The way Proton Mail handles PGP

Proton Mail offers zero-access encryption of your inbox, meaning all of
your emails are encrypted, and only you have access to read them after
unlocking them with your password. Behind the scenes, this works by each
customer having a PGP key pair stored on their servers, with the private
key being encrypted by the customer's password. This means that not even
Proton themselves can read your emails, and this is great for privacy.

PGP has been a standard for email encryption for many years, and it's
widely used for sensitive communication via email. Proton has taken PGP
and integrated it into their email service, automatically providing
end-to-end encrypted emails between Proton Mail users (it also works
with other email providers, but it requires some setup by the
communicating parties). The thing is though, that you're not in control
of the private PGP key when using Proton Mail's PGP integration. Even
though it is encrypted on their servers, and only I can decrypt it, I
want to be in control of my private key myself. This also relates to the
centralization problem I described above. By using Proton Mail, I
entrust my email security with a central entity.

This one is more on the technical side of things. I've had some not so
great experiences when trying to use my own PGP key on top of Proton
Mail's encryption. For example, my signatures wouldn't be recognized by
the recipient's email client, due to the second layer of encryption that
is Proton Mail's PGP integration. Because I want to use my own PGP key,
that I'm in control of myself, this doesn't work for me.

## Conclusion

With all that said, I want to end this blog post by saying this: Don't
go ahead and delete your Proton account solely based on what I'm saying.
This is my own personal opinion. If you're someone who's not very
technical and/or are satisfied with what Proton is offering, then stay.
I'm not here to trash talk Proton and tell everyone to abandon them. I
think Proton offers some great privacy preserving services and their
line of products is perfectly suitable for a lot of people, and their
work is important in the privacy world. I'm just someone who's a bit
more technical than the average person, and because of that, Proton Mail
is just not a fit for me personally. For the average person, Proton is
fantastic, and I can only recommend them if you're wondering which
email, VPN, calendar or cloud storage provider to use.

You might be asking, what am I using now then? I'm now a happy customer
over at [mailbox.org](https://mailbox.org), and if you're like me, you
should totally check them out. If not, go ahead and keep your Proton
account (you have one, right?).