As part of our efforts to continue protecting user privacy, we are launching a Tor hidden service to combat censorship and surveillance of Proton Mail users.
UPDATE October 2021: New TLS certificate. See below.
In the past two years, Proton Mail has grown enormously, especially after the recent US election(new window), and today we are the world’s largest encrypted email service with over 2 million users. We have come a long way since our user community initially crowdfunded the project(new window). Proton Mail today is much larger in scope than what was originally envisioned when our founding team met at CERN(new window) in 2013.
As Proton Mail has evolved, the world has also been changing around us. Civil liberties have been increasingly restricted in all corners of the globe. Even Western democracies such as the US have not been immune to this trend, which is most starkly illustrated by the forced enlistment of US tech companies into the US surveillance apparatus(new window). In fact, we have reached the point where it simply not possible to run a privacy and security focused service in the US(new window) or in the UK(new window).
At the same time, the stakes are also higher than ever before. As Proton Mail has grown, we have become increasingly aware of our role as a tool for freedom of speech, and in particular for investigative journalism. Last fall, we were invited to the 2nd Asian Investigative Journalism Conference(new window) and were able to get a firsthand look at the importance of tools like Proton Mail in the field.
Recently, more and more countries have begun to take active measures to surveil or restrict access to privacy services(new window), cutting off access to these vital tools. We realize that censorship of Proton Mail in certain countries is not a matter of if, but a matter of when. That’s why we have created a Tor hidden service (also known as an onion site) for Proton Mail to provide an alternative access to Proton Mail that is more secure, private, and resistant to censorship.
Tor Hidden Service for Encrypted Email
Starting today, it is also possible to connect to Proton Mail directly through the Tor network using our new onion site. In order to use our onion site, you need to first set up Tor on your computer. Instructions for using Proton Mail encrypted email with Tor can be found here(new window). After Tor is properly set up, Proton Mail’s onion site can be visited at the following URL:
https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion(new window)
We would like to give a special thanks to Roger Dingledine and the Tor Project(new window) for creating the Tor software and also providing insightful comments and suggestions regarding Proton Mail’s onion site implementation.
Tor Email Privacy
There are several reasons why you might want to use Proton Mail over Tor. First, routing your traffic to Proton Mail through the Tor network makes it difficult for an adversary wiretapping your internet connection to know that you are using Proton Mail. Tor applies extra encryption layers on top of your connection, making it more difficult for an advanced attacker to perform a man-in-the-middle attack on your connection to us. Tor also makes your connections to Proton Mail anonymous as we will not be able to see the true IP address of your connection to Proton Mail.
Tor can also help with Proton Mail accessibility. If Proton Mail becomes blocked in your country, it may be possible to reach Proton Mail by going to our onion site. Furthermore, onion sites are “hidden” services in the sense that an adversary cannot easily determine their physical location(new window). Thus, while proton.me could be attacked by DDoS attacks, protonirockerxow.onion cannot be attacked in the same way because an attacker will not be able to find a public IP address(new window).
Note, it is also possible to visit Proton Mail via Tor at our regular site, https://proton.me(new window), but there are several advantages to using the onion site. First, onion site connections provide true end-to-end encryption on the Tor level, meaning that the extra encryption that Tor applies is present until your connection reaches our infrastructure, whereas a non-onion Tor connection does not have Tor encryption beyond the last node. Secondly, Tor also provides end-to-end authentication, with helps to mitigate some of the weaknesses with the existing Certificate Authority system(new window) that is used to secure most of the Internet (more about this later).
Using Tor does come with some downsides however. Tor connections typically are much slower than a standard internet connection, so performance will suffer as a result. Proton Mail’s onion site is still considered to be experimental, so its reliability may not be as high as our standard site.
Since our onion site is still experimental, we are not making any recommendations yet regarding the use of Proton Mail’s onion site. Even without using Tor, your Proton Mail inbox is still strongly protected with PGP end-to-end encryption(new window), secure authentication(new window) (SRP), and optional two-factor authentication(new window). However, Proton Mail definitely has users in sensitive situations where the extra security and anonymity provided by Tor could literally save lives.
Proton Mail’s Onion Site – Technical Details
In implementing Proton Mail’s onion site, we took a few additional precautions to ensure the highest level of security to protect against advanced threats.
HTTPS with Tor
As an added security feature, we have decided to offer our onion site with HTTPS only. To accomplish this, we partnered with SSL Certificate provider Digicert(new window) to provide a valid certificate for our .onion website. Previously, Digicert issued the first-ever onion SSL certificate to Facebook(new window) and we’re glad that Digicert was able to do the same for Proton Mail.
Proton Mail’s .onion SSL certificate has Extended Validation, which provides an additional layer of protection against phishing because you can be certain that the onion site you are connecting to belongs to us. For extra security, you can also manually verify the SSL certificate for https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/ with the following SHA hashes.
Fingerprints
SHA-256
ED:01:49:07:E7:09:0A:32:FE:DC:86:23:64:5B:35:DA:C3:A8:62:DF:35:BF:C6:87:0A:CA:04:6D:77:F6:38:2F
SHA-1
D6:DD:25:3D:91:56:85:19:FF:5F:0E:E0:06:64:01:14:3E:29:18:1A
While HTTPS is not strictly necessary for onion sites, we decided to make it mandatory for Proton Mail for several reasons:
First, we will likely take advantage of the ability to keep the location of onion sites secret by hosting our .onion website far away from our current infrastructure in an undisclosed location and country. In this situation, HTTPS adds an additional encryption layer to protect the traffic between the onion front end and our core infrastucture. HTTPS also allows us to continue enforcing the usage of secure cookies, which improves user security.
Secondly, we believe in security in depth. For this reason, we don’t believe HTTPS is entirely redundant for onion sites. If someday Tor were to be compromised, enforcing HTTPS adds another layer of security for the end user. Similarly, Tor also provides security in case HTTPS is compromised. The notion of HTTPS being compromised(new window) is one that we take seriously, considering that there are hundreds of CAs (Certificate Authorities) that are trusted by default, with many of them under direct government control in high risk countries.
Thus, by using our onion site, your emails are protected by three layers of end-to-end encryption, there’s Tor’s encryption on the outer layer, HTTPS in the middle layer, and PGP as the final layer of defense for the emails themselves.
What’s Next?
You can find a more simplified and condensed version of all of this on the following webpage we have created to give the 30-second summary of Proton Mail’s Tor support:
https://proton.me/tor(new window)
In the coming months, we will be hard at work making additional security and privacy enhancements to Proton Mail, including finishing some of the leftover items from our 2016 Security Roadmap(new window). Moving forward in 2017, we will be putting added focus on making Proton Mail more censorship resistant, and providing our user community with the tools required to connect securely to Proton Mail, even from compromised locations.
A statement from the Tor Project can be found in the joint press release(new window).
For questions and comment, you can reach us at [email protected].
Proton Mail is funded by community contributions. If you would like to support our development efforts, you can upgrade to a paid plan(new window). Thank you for your support!
You can get a free secure email account from Proton Mail here(new window).
