Add option to connect more securely
nil0x42 opened this issue · 4 comments
Protonmail has a Tor Hidden Service since early 2017 (https://protonirockerxow.onion/, as described here: https://protonmail.com/tor).
It would be nice if protonmail-desktop-app had an option to connect through onion address instead of mail.protonmail.com for extra privacy for TOR users (no need for stream isolation, no exit node)
Also, as .com TLD is owned by USA, i'd recommend to use "app.protonmail.ch" instead of "mail.protonmail.com" as default domain. this is the original hostname for protonmail service, and it is owned by switzerland as are they server, so we keep theorical attack surface smaller (read this: https://protonmail.com/support/knowledge-base/what-is-the-difference-between-protonmail-com-and-protonmail-ch/).
I am used to submit pull requests, but i took a look in the code and have been scared as i never wrote a single line of typescript :/
Anyway, your tool is one of the rare tools that allows automatic connection to protonmail, and it is super nice. Thank you for the awesome work.
These are good points and I'm of course opened to mitigating security concerns.
Right now I'm considering to fork this project into a new app in order to add multiple encrypted mail services support, like protonmail + tutanota at least (are there more alike services?). Should not be a hard thing to do, but would involve some refactoring happening. Having decided to do such fork I'd prefer to finish that task first, and then handle this issue. Otherwise, this issue is going to be a next thing to handle.
Going to publish new project with added Tutanota and domain entry point selection support soon, I think withing a week.
i will be happy to try it !
Domain selection is now supported with recent release https://github.com/vladimiry/email-securely-app/releases/tag/v1.0.0
All the available domains are now centralized in single place.
Closing as resolved, feel free to reach out if something is still missing.
