Hacker News new | ask | show | jobs
by danra 2618 days ago
Not sure why you were downvoted.

Protonmail stores all your emails encrypted, with the encryption dependent on your password, so something like this couldn't happen there.

2 comments

Seems like if ProtonMail can encrypt them automatically, then they can potentially be decrypted by someone at ProtonMail.

Reasoning:

Are emails automatically encrypted with a hash of the user password when they are received?

If the user forgets the password, how do password resets work?

Are the emails before the password reset "lost", or does ProtonMail keep a copy of the hashed password (which I suppose would be needed to log in with in the first place) to unencrypt the older emails, and re-encrypt with the newer password?

They are not encrypted using the user's password. They are encrypted using a standard PGP public key.
Yes, you lose your old emails if you reset password on ProtonMail.
Really? are there any docs I can read related to this?

It certainly is something that users should probably be aware of. At least I would...

If they really use your password to encrypt, they can also decrypt your emails. I doubt they would advertise this as encryption... I'm not sure what they do technically, but using the password doesnt sound like a good mechanism.