Security yes, privacy not especially.

PGP lets you encrypt the messages and sign them to digitally prove you sent them.

It doesn't help with the problem here which is that the metadata of who you are (the IP used to log into the webmail and the email address of the sender) and who you're talking to (the email of the recipient) and when (timestamps etc.) were able to be leaked.

In fact, depending on the implementation, PGP could be considered slightly worse for privacy because you'd have the added identity proof of the message having a signature that only you could create with your private key (although that's encrypted, it's a stronger identity proof than the sender email address). It also generally leaks the recipients' key IDs too (although that's configurable) PGP is great for accountability, message confidentiality and non-repudiation. Not so much for privacy. For that you'd need other systems.

The bird surveillance system is always watching. Remember birds aren't real!

Well I'd suggest a forest instead but anyway depends how you get there :

• look up online how? there might be now a path on a server to your target destination
• disconnect phone in a pattern that's usually not how you use it? more surveillance
• public transport tracking, plate tracking until you leave the city
• rough estimation on your direction then follow up with drones tracking you, if it's 100m high it's hard to notice

... anyway, ending the paranoia comment ;)

The main issue is that in reality, 95%+ of people aren’t using an encrypted service. So it’s proton to Gmail usually

The FBI did not serve the subpoena directly to Proton Mail.

"We want to first clarify that Proton did not provide any information to the FBI, the information was obtained from the Swiss justice department via MLAT," said Proton AG's head of communications, Edward Shone. "Proton only provides the limited information that we have when issued with a legally binding order from Swiss authorities, which can only happen after all Swiss legal checks are passed. This is an important distinction because Proton operates exclusively under Swiss law."

https://www.msn.com/en-us/travel/news/privacy-focused-proton-mail-handed-protester-data-to-police/ar-AA1XH3R5

Use of meta data rich protocols like standard email, instead of, e.g., the signal protocol

Brother...its an email product though...if you can use Signal, use Signal. But it's a different product entirely.

When my bank sends me verification info and banking statements over Signal I'll be elated. Until then, we unfortunately have to continue dealing with email.

As is choosing operate from a jurisdiction that can comple them to collect IP addresses.

There is no such requirement. They collect them necessarily in order to function.

They are a Mail provider. You can't blame a mail provider for providing a mail service.

You are basically asking for them to make it seem like you send mail, but in reality you send the message via some other protocol when it's send to Proton users. At that point you might as well not send mail at all.

As for their jurisdiction: The data protection laws changed after they were founded. They are also lobbying against them and have in fact threatened to stop investing in or even leave Switzerland.

Which jurisdictions can't compel an email provider to log IP addresses? I've never heard of this

The annoying part is them marketing themselves as like operating from Swiss “privacy haven” when swiss privacy laws aren’t that good and the parliament is actively destroying them as we speak.

Signal demonstrated that you can decouple payment info from account info

How did Signal demonstrate this? Signal is not a paid subscription service

Proton even allows you to send them cash money for the service.

The least Proton coulda done is mimic that tech.

Proton even allows you to send them cash money for the service.

That is not really the same, Signal is a donation and Proton is a subscription where a monthly (or yearly) request has to go to the payment provider for your fee, for this you need to keep the payment information on file and linked to the account. Signal can say I got donated by someone but they do not need to keep this information linked to a specific user, just the payment record (that still has your cc/bank details on it) for tax purposes.

I have pointed this out to protards many times. The fact is there are solutions to not keeping this data on their servers. Then they have the audacity to blame the user.

A company that was concerned about privacy and not money would have already moved this data off their servers. Proton is a garbage company.

• I have never been asked to verify my recovery key.
• It asks to verify pin once a month. Which I think is fair, since it can help you recover from a lockout / transfer your device.
• backups are important, but they can also be disabled
• Donating to open source projects is important, as it's a large portion of their funding.

I've never had a single one of those prompts or notifications... Now I'm worried I've done it wrong.

Does that person allow searching by phone number? That is a setting you can disable.

Yes this is a problem. They use to have it so that you could see all your contacts and you could use it as your normal messenger app and if they also had signal then you get encryption. At least now you can use a username instead of a phone number. Problem with that is you can only have one username. You can change it but that gets messy.

Do you have to find a person in search to be able to send them a message?

Proton let me delete the payment information between charges, but they certainly made it a painful process. I had to email support

Interesting system! Correct me if I'm wrong though, but buying credits does look like it's not an automatically recurring payment (to buy credits), so that makes sense (they do keep the receipts though according to their privacy policy. Decoupled from the account, but they do keep data).

That's a bit different from Proton's credit card payment method (which is the case here) that automatically recurs. If Posteo offered automatically recurring payments, they'd have to save payment data as well (which they also explain in the privacy policy).

To be clear, Proton does also offer more private ways of paying. Paying by credit card is not the only option. Bitcoin or cash is also possible. I just found out that Proton does also actually offer a credit system as well, but it's unclear to me if that's decoupled or not. Definitely a place where they could do better.

Not sure, they do seem to store something (pretty unclear what though), but I'm guessing that can be fully decoupled from a user's account, since it's unrelated to the actual service.

What if I buy Signal Nitro

We're not a monolith any more than your country is. Which one is that, BTW?

Tuta and fastmail

I don't know the depths of mailbox.org's politics (located in Germany), but I use them with PGP + Thunderbird and it's very affordable, at €12/$14 (2GB) and €30/$35 (10GB + features) anually. I need to reup my subscription soon actually.