ProtonBlog(new window)

2016 Email Security Roadmap

Share this page

For 2016, we are looking forward to another year of progress towards building easy-to-use secure email. Today, we are publishing our first security roadmap.

Over the course of 2015, we have taken several big steps towards making Proton Mail the easiest to use secure email service.(new window) Some highlights of 2015 include the release of Proton Mail 2.0, which is fully open source(new window), and the beta release of the Proton Mail iOS and Android secure email mobile apps(new window). Thousands of users have been testing these apps for over 4 months now and given very positive feedback. Therefore, we will finally be releasing the apps in the App and Play stores in 2016.

During the second half of 2015, our team focused almost exclusively on Proton Mail 3.0 which will launch at the end of this month, bringing many new features to Proton Mail including support for custom domains(new window). In 2015, we also made numerous security enhancements including adding support for encrypted attachments and adding the ability for non-Proton Mail users to send encrypted replies to encrypted Proton Mail messages. Now, all messages in Proton Mail, including attachments and emails sent by non-Proton Mail users, are stored with zero-access encryption.

For 2016, we will continue on this trend of increased email privacy. As our primary focus is on secure email, it is fitting that our first published roadmap is focused entirely on security. Building a privacy focused email service is difficult as security is a moving target that requires constant innovation. These are the steps we will be taking in 2016 to protect your email privacy.

We have broken down our security roadmap into four broad categories.

Authentication

  • Challenge/Response login password improvement so that every login uses a different one-time hash.
  • Store mailbox password in memory only, not session storage. This means the user will have to re-enter the mailbox password if the page is refreshed, but will avoid the mailbox password ever touching the disk if the browser caches session storage.
  • Two factor authentication

Server

  • Public Key Pinning (HPKP): This pins our certificate such that we can’t be impersonated if a root CA or intermediate CA is compromised.
  • Content Security Policy (CSP): An extra layer of XSS protection which disables all inline scripting and whitelists only our domain for loading Javascript.
  • Migration to Certificate Transparency (CT) for EV Certificates
  • DNS-based Authentication of Named Entities (DANE)

Full PGP Support

  • Support importing PGP public keys of contacts so PGP emails can be sent automatically through Proton Mail
  • Support keychain functionality so users can import their own public/private keys
  • Allow the export of Proton Mail user private keys

Application Security

  • Add Proton Mail SSL certificates to the HSTS browser preload list(s). This needs to wait until we have stabilized our certificates.
  • Client-side public key verification mechanism for recipients. This allows you to automatically check the fingerprints of recipient public keys to ensure that there is no key spoofing.
  • Browser extensions or desktop applications so client side code does not need to be loaded each time Proton Mail is accessed.
  • Splitting the Proton Mail webmail into a separate subdomain isolated from other services
  • Adding a Web Application Firewall (WAF)

With limited resources, there is always a trade-off between improving security and adding features, so as much as we would like to, these security improvements cannot be done overnight. If you would like to support our efforts on this, feel free to either join our open source project(new window)! As always, we welcome any feedback on this roadmap either in the comments or by emailing us at security@proton.me.

Over the past year, we have meticulously built up our infrastructure, technology and team in order to support the largest encrypted email service in the world. Looking forward to 2016, we hope to leave Beta and open the gates so that private and secure email can be enjoyed by all. Join us on this exciting journey to change the Internet!

Secure your emails, protect your privacy
Get Proton Mail free

Share this page

Proton Team(new window)

We are scientists, engineers, and specialists from around the world drawn together by a shared vision of protecting freedom and privacy online. Proton was born out of a desire to build an internet that puts people before profits, and we're working to create a world where everyone is in control of their digital lives.

Related articles

Can you password-protect a folder in Google Drive?
Protecting a folder with a password is a simple yet effective way of securing files. You may wonder whether you can password-protect a folder in Google Drive. We explain what access controls Google Drive offers and what you can do to improve your sec
Proton Pass now supports passkeys on all devices and plans
We’re excited to announce that Proton Pass supports passkeys for everyone, allowing you to manage and use passkeys across all devices seamlessly. Passkeys are an easy and secure alternative to traditional passwords that can help prevent phishing atta
what is a passkey?
Passkeys are a new way to secure your online accounts using cryptographic keys instead of passwords. They offer a high level of convenience and security, and are a real game-changer in the way we access and secure sites. What is a passkey, though, an
Apple’s marketing team has built a powerful association between the iPhone and privacy. The company’s ad campaigns claim that “what happens on your iPhone, stays on your iPhone.” And, “Privacy. That’s iPhone.” But Apple’s lawyers are telling a diffe
A cyberattack on national public employment service France Travail has exposed the personal data of as many as 43 million people.  The latest breach is the second major cybersecurity attack to happen in France in the past month, raising concerns abo
If I share a folder in Google Drive, can anybody see my other folders
Google Drive makes it easy to share files and folders, but you may have wondered at some point whether the people you’ve shared a folder with can see your other folders. We answer this question below and also share some tips for truly secure link sha
In 2014, Proton Mail was introduced as a web app, revolutionizing how we think about email privacy. Today, we’re excited to broaden the horizons of secure communication by launching the Proton Mail desktop app. Anyone can now use the new Proton Mail