Security recommendation: enable FaceID or PIN protection on the ProtonMail iOS app

illustration of protonmail ios security recommendation

One of the unique innovations of the ProtonMail iOS app is the AppKey Protection System. This is an extra layer of encryption on top of Apple’s built-in local encryption that protects sensitive Proton data stored on your device.

When you have AppKey Protection System enabled, your ProtonMail data is more secure against malware from hackers and governments, stalkerware, and phone extraction tools used by authoritarian regimes and border agents without a warrant.

It is very easy to turn on AppKey. All you have to do is enable FaceID, TouchID, or PIN protection in your ProtonMail iOS app settings. 

For detailed instructions, see our Knowledge Base article: How to activate TouchID and PIN code lock on the ProtonMail iOS app. 

Why you should enable AppKey

Our end-to-end encryption secures your email contents as they travel over the Internet, blocking anyone who might try to intercept them: hackers, Internet service providers, governments, and even ProtonMail itself. Zero-access encryption locks up your data at rest on our servers so that we can’t access it, even for emails that came from a non-ProtonMail account.

But what about the “ends”? How is your data secured on your device?

As a general rule, mobile apps do not protect your data if your device is compromised. Instead, apps rely on the built-in security of the device. For iPhones and iPads, the Apple Keychain is responsible for securing the access tokens, passwords, and certificates that keep the data on your mobile apps safe. Usually that built-in security is enough — but sometimes it’s not.

There are many instances where Apple Keychain is insufficient to protect your data. Here are just a few real-world examples:

  • Poison Carp — In September, security researchers at The Citizen Lab discovered an apparent state-sponsored attack on prominent Tibetans and connected them to other spyware attacks on thousands of Uyghurs. They nicknamed the attacker “Poison Carp,” but it seems highly likely that the Chinese government is behind it because of the sophistication of the attacks and the fact that the victims belong to ethnic groups near the top of Beijing’s enemies list. Victims only needed to click on a phishing link sent via WhatsApp to trigger the exploit, which installs spyware on the device.
  • Stalkerware — Also called “spouseware,” stalkerware is commercially available spyware that enables people to spy on their partners. Usually this requires the attacker to have physical access to the device to install the malware, but in a domestic situation that may not be difficult. As noted in this analysis of stalkerware applications, it can be very difficult to know whether there is stalkerware installed on your device. (If you’re unsure, you should reboot your device and change your iCloud password.)

Recognizing these security challenges, we decided to go above and beyond the standard threat model of most apps. We now provide ProtonMail iOS users with even more security, even if their device is compromised.

How the AppKey Protection System works

If an attacker can penetrate your iOS device’s security system, they might be able to steal the key that unlocks your ProtonMail data. Our solution is an extra lock whose key is much more difficult to steal because it is not present on your device: your face, your fingerprint, or your secret PIN. 

When you enable FaceID, TouchID, or PIN protection in your ProtonMail iOS app settings, the ProtonMail app will not be able to decrypt data or pull data from our servers unless the AppKey is present in the device’s memory. The AppKey is directly correlated to your biometric information or your PIN.

Learn more: Read our iOS client security model for more technical details.

illustration of the ProtonMail AppKey Protection System
Your Proton data is protected inside the iOS system security. But as an added layer of encryption, we offer the AppKey Protection System, which can only be unlocked with your FaceID, TouchID, or PIN.

The AppKey protects the following information with an extra layer of encryption:

  • Authentication tokens (which allow you to stay logged in to your ProtonMail account in the app rather than having to enter your password each time)
  • Your ProtonMail username 
  • Encryption keys
  • Attachments
  • Message metadata (such as subject lines and email recipients)
  • Contacts
  • Account settings

If you don’t have FaceID, TouchID, or PIN protection enabled, the AppKey is stored in cleartext (but still protected by iOS Keychain) and your data is vulnerable if your device is compromised. (However, you might still be safe from attacks that exploit iTunes or cloud backup through device pairing.)

AppKey also enables some interesting features, such as the Wipe Local Data shortcut described in the tweet below. This works by simply destroying the AppKey, rendering local data impossible to decrypt and causing the account to log out.

Final thoughts

We’ve gone to great lengths to protect our users — from developing AppKey to releasing our iOS app open source, allowing other security researchers to test for vulnerabilities. But no system is 100% secure. There are always weaknesses that hackers will try to exploit. You can help improve the security of your iOS device by following these security tips:

  • Install all the latest software updates.
  • Set long, alphanumeric passcodes in your device settings.
  • Never click on links or download attachments in any app if you don’t know the sender.
  • Do not install untrusted configuration profiles or root certificates in your device settings.
  • Enable TouchID, FaceID, or PIN protection in your ProtonMail app settings, which is the only way to take advantage of the AppKey Protection System.
  • Use strong, unique passwords and two-factor authentication for your accounts.

Thank you for supporting ProtonMail and our mission to make secure Internet a reality for all.

Best Regards,
The ProtonMail Team

You can get a free secure email account from ProtonMail here.

We also provide a free VPN service to protect your privacy.

ProtonMail and ProtonVPN are funded by community contributions. If you would like to support our development efforts, you can upgrade to a paid plan or donate. Thank you for your support.

About the Author

Ben Wolford

Ben Wolford is a writer at Proton. A journalist for many years, Ben joined Proton to help lead the fight for data privacy.

Leave a Reply

Your email address will not be published.

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <s> <strike> <strong>

2 comments on “Security recommendation: enable FaceID or PIN protection on the ProtonMail iOS app

  • Hi there!

    So happy to see new state-of-the-art security features added!

    How does that compare to the PIN/fingerprint lock of the Android version? Is it similar in its effects, and does it offer the same overall protection level? Or is it just a simple “app lock”?

    Thanks!

    Reply
    • Thank you! To answer your question, the PIN/fingerprint lock on the ProtonMail Android app prevents someone other than you from accessing your account via physical inspection (e.g. device theft, border guards conducting a manual search, etc.). It does not protect against forensic searches, though this is something we’re interested in developing.

      Reply