We need to talk about encrypted email providers (protonmail, tutanota, etc)
I will not be going into much detail about the recent controversy about Protonmail, as that has already been discussed in detail. If you are interested, I'd recommend this article or this video. Instead I will be covering a more general view of all encrypted email providers.
Firstly, in case you don't know, there are several encrypted email providers (protonmail, tutanota, etc). These claim to be a way to access email privately thanks to encryption. Whilst most regular email providers (gmail, yahoo, etc) can read all your emails stored on their servers (which they do, so they can sell your data to advertisers), encrypted email providers claim to not have this capability. This claim of how all emails are encrypted and unaccessable by the providers has lead some (as happened in this case) to believe they are a good method of conversing privately and anonymously. This is a dangerous misconception.
Email is an inherantly non-private and non-anonymous method of communication. Email requires IP addresses (which can possibly be traced back to you unless you're using tor or a vpn). Also, whilst the contents and attachments can be encrypted, the subject line, data, IPs, etc, cannot. This means whilst you may think you are safe and everything's encrypted, if your subject line is something like "[X corporation] whistleblower documents" it makes it pretty easy to figure out what the contents might be. Email was never meant to be secure or private, and as much as some providers may try to change that, there will always be issues with making it 100% secure.
However, that is not to say don't use encrypted email providers. There are legitimate uses, but first you must assess your threat model. If you're like most people, you won't be worried about governments or large corporations coming after you. Instead, perhaps you want to just use encrypted email because you don't like Google looking through all your messages, or don't like the amount of info required to create an email address, or want to make new accounts privately without a domestic abuser or the like seeing. All these are perfectly reasonable examples of use cases for using encrypted email providers, and I'd even recommend doing so. For the average person, an encrypted email will work fine and helps with some basic privacy concerns (make sure you do know exactly what encrypted email can and cannot do though).
However, if you are a whistleblower, or activist, or criminal, or anything where either the government or powerful corporations may be after you - encrypted mail will not be good enough. Because of the forementioned in-built email privacy problems, no matter how much they try, your provider will be much likely to either fuck up and leave a security flaw in, or simply hand your information over to the government upon request. If you wish to communicate anonymously I'd recommend either signal, pidgin, or dino, as well as using Tor and Tails. These platforms actually provide the encryption and privacy that email cannot. However, always do your research when your threat level is this high. Make sure you understand the limits of this kind of software. It is possible that there are security flaws that will be uncovered after the time of writing or ones I have simply not heard about. Always do proper research. Do not throw caution to the wind.
So to summarise - as with any software, be clear about the limitations, and your own threat model. Once you know your threat model you can know which limitations are and are not acceptable. Stay safe and take care.
