In this article
Choosing a more private email service requires understanding what it protects and what remains exposed. A provider’s name, country and use of the word “encrypted” are not enough. Device security, account recovery and correspondents’ practices matter as much as the provider.
Distinguish three forms of protection
In-transit encryption protects a transmission when it is properly established. Encryption at rest protects stored data according to the service architecture. End-to-end encryption aims to keep the content at the intended ends. These mechanisms are not interchangeable and may vary depending on the recipient and the sending method.
The content of a message is not all the data: addresses, times and other metadata may remain accessible under certain conditions. A recipient can also copy, transfer or photograph a decrypted message. An expiration time does not allow to take back all the copies already created.
Proton Mail: check the recipient and sending mode
The Proton documentation distinguishes between messages between Proton accounts and exchanges with other providers. Sending to an external address is not automatically identical to an end-to-end exchange between users of the service. Options such as password-protected messages or OpenPGP require appropriate use.
Test an exchange with the people actually involved before migrating any important correspondence. Check how attachments, recovery and applications work in your use. No tariff, storage quota or absolute legal advantage is taken from the historical comparison, because these elements must be controlled at the time of choice.
Tuta: plan exchanges with external recipients
Tuta documents its own encryption and password-protected exchanges with external recipients. The shared secret must be communicated by a suitable means; sending it in the same conversation can weaken the desired goal. Also check for supported applications and recovery possibilities.
A solution may suit a group that accepts the same operation and be impractical for an occasional correspondent. Don’t confuse a difficulty with a security flaw, but don’t overlook this difficulty: a poorly understood tool can lead users to bypass protections.
Mailfence and CounterMail: understand OpenPGP
The Mailfence and CounterMail documentations present the use of OpenPGP. This standard allows encrypted exchanges with compatible correspondents, but in particular requires correct management of the keys and their authenticity. Signature and encryption serve separate purposes; the standard name does not guarantee that they are enabled for each message.
Check the features available in the chosen offer, compatible customers, export and support. Historical claims of complete anonymity, impossibility of seizure or absolute superiority are not retained. A supplier’s statements remain to be considered in the context of your need.
Prepare access and recovery
Use a unique password and appropriate additional authentication. Keep the codes and means of recovery safe and accessible only to authorized persons. Test the process with unimportant data. Strong protection can also make messages unrecoverable if the necessary means are lost.
Prepare for the absence or loss of the phone: alternative contact information, recovery procedure and offline access to essential documents. Do not concentrate the password, the second factor and all backup codes in the same device without a replacement solution.
Migrate gradually
Start with a trial account and a few correspondents. Check for the arrival of important messages, unwanted folders and export possibilities. Keep an organized transition for services that use the old address. Do not delete a box or its archives before you have the necessary copies.
Encryption does not protect against a compromised device, successful phishing, or a person being cheated on the recipient. The best solution is one whose limits are understood and whose procedures remain usable in the home.
Documentations: Proton · Tuta · Mailfence · CounterMail.