For 2016, we are looking forward to another year of progress towards building easy-to-use secure email. Today, we are publishing our first security roadmap.
Over the course of 2015, we have taken several big steps towards making ProtonMail the easiest to use secure email service. Some highlights of 2015 include the release of ProtonMail 2.0, which is fully open source, and the beta release of the ProtonMail iOS and Android secure email mobile apps. Thousands of users have been testing these apps for over 4 months now and given very positive feedback. Therefore, we will finally be releasing the apps in the App and Play stores in 2016.
During the second half of 2015, our team focused almost exclusively on ProtonMail 3.0 which will launch at the end of this month, bringing many new features to ProtonMail including support for custom domains. In 2015, we also made numerous security enhancements including adding support for encrypted attachments and adding the ability for non-ProtonMail users to send encrypted replies to encrypted ProtonMail messages. Now, all messages in ProtonMail, including attachments and emails sent by non-ProtonMail users, are stored with zero-access encryption.
For 2016, we will continue on this trend of increased email privacy. As our primary focus is on secure email, it is fitting that our first published roadmap is focused entirely on security. Building a privacy focused email service is difficult as security is a moving target that requires constant innovation. These are the steps we will be taking in 2016 to protect your email privacy.
We have broken down our security roadmap into four broad categories.
- Challenge/Response login password improvement so that every login uses a different one-time hash.
- Store mailbox password in memory only, not session storage. This means the user will have to re-enter the mailbox password if the page is refreshed, but will avoid the mailbox password ever touching the disk if the browser caches session storage.
- Two factor authentication
- Public Key Pinning (HPKP): This pins our certificate such that we can’t be impersonated if a root CA or intermediate CA is compromised.
- Migration to Certificate Transparency (CT) for EV Certificates
- DNS-based Authentication of Named Entities (DANE)
Full PGP Support
- Support importing PGP public keys of contacts so PGP emails can be sent automatically through ProtonMail
- Support keychain functionality so users can import their own public/private keys
- Allow the export of ProtonMail user private keys
- Add ProtonMail SSL certificates to the HSTS browser preload list(s). This needs to wait until we have stabilized our certificates.
- Client-side public key verification mechanism for recipients. This allows you to automatically check the fingerprints of recipient public keys to ensure that there is no key spoofing.
- Browser extensions or desktop applications so client side code does not need to be loaded each time ProtonMail is accessed.
- Splitting the ProtonMail webmail into a separate subdomain isolated from other services
- Adding a Web Application Firewall (WAF)
With limited resources, there is always a trade-off between improving security and adding features, so as much as we would like to, these security improvements cannot be done overnight. If you would like to support our efforts on this, feel free to either join our open source project or send us a donation! As always, we welcome any feedback on this roadmap either in the comments or by emailing us at firstname.lastname@example.org.
Over the past year, we have meticulously built up our infrastructure, technology and team in order to support the largest encrypted email service in the world. Looking forward to 2016, we hope to leave Beta and open the gates so that private and secure email can be enjoyed by all. Join us on this exciting journey to change the Internet!