#e2ee — Public Fediverse posts on home.social

Federation now works smoothly over #ActivityPub. The Nearby and Discover timelines work as intended, and push notifications are available. #E2EE still needs work to support several browsers or devices.

It is a good start. You can join this new fediverse software at https://fedihood.social

#fedihood #activitypub #e2ee

Fedilab Apps @[email protected] · 2026-08-14 · 20:26 UTC

#FediHood keeps growing, and many bugs have been fixed thanks to your feedback.

Federation now works smoothly over #ActivityPub. The Nearby and Discover timelines work as intended, and push notifications are available. #E2EE still needs work to support several browsers or devices.

It is a good start. You can join this new fediverse software at https://fedihood.social

#fedihood #activitypub #e2ee

SkypLabs @[email protected] · 2026-08-14 · 15:05 UTC

Today, @Tutanota published a new blog post titled "Proton Mail vs Gmail: Which Is Best in 2026?". We generally don't pay attention to these biased marketing posts which end up always the same way ("neither, because we are the best"), but given the number of inaccuracies we found in it, we decided to take the time to comment it.

https://tuta.com/blog/protonmail-vs-gmail

First of all, the post doesn't differentiate security from privacy. Even if the two notions are intertwined, it's still two different concepts.

End-to-end encryption (E2EE) brings mainly privacy, that Gmail lacks heavily because it goes against Google's business model, but saying that having E2EE always brings you security is taking a shortcut. For example, most people are more exposed to email phishing than state actors' eavesdropping, and both Gmail and @protonprivacy are better at phishing detection than Tuta. We know it due to a simple fact: we recently launched a phishing simulation service (not launched publicly yet, still exploring with a few clients for now) 🙃

> Like Tuta Mail, Proton Mail has become a popular email provider for individuals and organizations who prioritize privacy and security.

This sentence tends to be understood as if Tuta preceded Proton in terms of market shares and technical standards. Also, from our experience, people tend to know Proton and not Tuta.

> [...] introducing an AI email writer defies the purpose of a private, secure email service such as Proton Mail

Even though we are against the current AI trend given its social and environmental impacts to keep it short, this sentence is also inaccurate. Scribe, Proton's writing assistant, can run locally on your own device:

https://proton.me/support/proton-scribe-writing-assistant#local-or-server.

Besides, it's an opt-in feature, it is not enabled by default.

> Users [of Proton] on the free email plan are limited to sending 150 emails daily.

Well, at least Proton gives a straight answer regarding the daily limit on a free account. From Tuta's FAQ (https://tuta.com/support/howto#email-limits):

> If you receive the following message in your Tuta account "It looks like you exceeded the number of allowed emails. Please try again later.", the anti-spam protection method has stopped your account temporarily from sending new emails. Please wait a day or two to send new emails again.

It seems there is no way to know if you are about to reach the limit before not being able to send emails for up to 2 days...

> With the free Proton Mail account, users get 1 GB of storage space.

We don't get it. It's listed in "Proton Mail downsides" whereas you also get 1 GB of storage with a free Tuta account... And with Proton, you can easily unlock 5 GB of storage with a free account...

> [...] Tuta Mail, has decided not to build a bridge for third-party desktop clients but has instead focused on developing its own native email desktop clients for Windows, Apple and Linux - and these work like a charm and are completely free.

This is part of the "Limited integrations" bullet point which is also part of the "Proton Mail downsides". That doesn't make any sense. Tuta is saying that Proton has limited integrations with third-party email clients and services (which is true), whereas Tuta has none... And regarding their "and these work like a charm" claim, sorry, but being a Tuta client since our creation in 2021, we have encountered numerous serious bugs. Like having sent emails ending up in both "Draft" and "Sent" folders with no way to know if the emails have actually been sent, the impossibility to change the language of the spell checker, getting a empty calendar because of a slow internet connection in a train whereas it is supposed to be offline-first, lost all our contact notes...

> Proton is a good choice if you’re looking for an end-to-end encrypted email provider, but it is not worth it if you compare it to Tuta Mail, the most secure quantum-proof email provider.

And there comes the inevitable conclusion that we all saw coming: "we are the best". It is the part that annoys us the most, because we are security practitioners, and we don't like false claims.

First, after 5 years of professional activity, and 10+ years with a personal account for our CEO, the amount of E2EE'd emails we have sent and received must represent roughly 1% of our exchanges (we use emails mostly for external communications). This is because Tuta made the choice to use a home-brewed implementation that only works between Tuta users. You like it or not, but the only standard for email encryption remains OpenPGP, which is annoying to use with the Tuta client. When we report security vulnerabilities to third-parties for example, we need to write and encrypt our emails in a separate text editor, encrypt them (we use @QubesOS Split GPG implementation to keep our private keys in a separate, offline, environment), and paste the result in the Tuta client...

Also, Tuta keeps talking about being an "quantum-proof email provider", but guess what? Thanks to RFC 9980, OpenPGP is quantum-proof too, meaning anyone using OpenPGP can benefit from it, including Proton:

https://proton.me/blog/introducing-post-quantum-encryption

Besides, it is a nice thing to have a strong encryption on the paper, but the implementation needs to be regularly checked for bugs and vulnerabilities. As far as we know, Tuta has never published any audit report, unlike Proton (which also has a bug bounty program: https://proton.me/security/bug-bounty).

When you do E2EE, you also need to make sure you are talking to the intended recipient, which means you need a way to verify their cryptographic public key. It turns out it took Tuta 7 years to implement it after the issue was raised to them: https://github.com/tutao/tutanota/issues/768. It means that Tuta could read all the E2EE'd exchanges on their platform without anyone noticing. Additionally, their current implementation saves the verified fingerprints locally and per-device. And given that bugs in the Tuta client regularly require to erase all local data and log back in, key verification remains mostly a gadget.

If you wonder how Proton does it: https://proton.me/support/address-verification, and https://proton.me/support/key-transparency.

To conclude, are we saying that Tuta is a bad choice? No, we will still recommend actors like Tuta which are not part of surveillance capitalism. Are we recommending Proton over Tuta? Not necessarily, it depends on multiple factors and your threat model. But we urge Tuta to improve their communication by sticking to the facts, and stop acting as if they were doing everything better than others. Because they are not.

#Tuta #Proton #Security #Privacy #Email #E2EE #PostQuantum #FOSS #EU

#tuta #proton #security #privacy #email #e2ee