Which service offers the best security for email

12/21/2015 Tutanota private email review (+ vs ProtonMail) BestVPN.com

https://www.bestvpn.com/blog/16671/tutanotaprivateemailreviewvsprotonmail/ 1/15

Review

Tutanota private email review (+ vsProtonMail)

Following Edward Snowden’s revelations that everything we do online is spied on all the time by

secretive and vastly powerful government organizations, there is a growing demand for more

private internet services. This is never more true than with the outdated and highly insecure, yet

still essential for most our day-to-day lives, communication system that is email.

Even more than the likes of the NSA, the advent of web based email that is easy to use, can be

readily accessed from any internet enabled device, and which is ‘free’ (but which we pay for by

allowing the likes of Google to scan every email and use the information it gleans from this to

deliver ever more targeted advertising) presents the single greatest threat to our privacy yet

seen.

Although by far the most secure and private way to access email is using a stand-alone email

client with PGP encryption (see our tutorial on using Gpg4win

(https://www.bestvpn.com/blog/7063/secure-your-email-with-gpg4win-part-1-introduction-

and-installation/) as an example of this), preferably using a self-hosted email server, this is a

fiddly, inelegant solution that involves a sophisticated understanding of using asymmetric key

pairs (https://en.wikipedia.org/wiki/Public-key_cryptography), something which the vast

majority of internet users’ have no ability or desire to master. OpenPGP browser plugins such as

Mailvelope (https://www.bestvpn.com/blog/8950/mailvelope-secure-openpgp-webmail/?

nabe=6412130213429248:1) are easier (if less secure) to use, but are still too complex for most

users.

There is therefore an urgent need for a Gmail-like webmail service that provides all the

functionality of something like Gmail, but is both more secure, and which will not spy on its

users and then monetize that very personal data (it should be understood, however, that no

webmail service can protect against targeted NSA-style surveillance, and that simply by virtue

of being a privacy-based encrypted service, users will automatically be of interest to

government spying organizations.)

In our article on Free privacy conscious webmail options

(https://www.bestvpn.com/blog/10876/free-privacy-conscious-webmail-options/) we examine

some good privacy oriented alternatives to Gmail (etc.), but the two new services that are

getting the most attention from the security community are ProtonMail (https://protonmail.ch/)

and Tutanota (https://tutanota.de/), both of which have gone to great efforts to make their

services attractive to casual users looking for a more secure email solution but without losing all

the aesthetics and functionality offered by their current provider.

We reviewed (https://www.bestvpn.com/blog/12353/protonmail-secure-webmail-early-beta-

review/?nabe=6412130213429248:1) ProtonMail (which is still in beta) earlier this year, and were

broadly impressed with. It is a long way from perfect, but ‘is a very easy to use webmail service

https://www.bestvpn.com/blog/7063/secure-your-email-with-gpg4win-part-1-introduction-and-installation/

https://en.wikipedia.org/wiki/Public-key_cryptography

https://www.bestvpn.com/blog/8950/mailvelope-secure-openpgp-webmail/?nabe=6412130213429248:1

https://www.bestvpn.com/blog/10876/free-privacy-conscious-webmail-options/

https://protonmail.ch/

https://tutanota.de/

https://www.bestvpn.com/blog/12353/protonmail-secure-webmail-early-beta-review/?nabe=6412130213429248:1



(on par with Gmail and suchlike) that is much more secure than most such webmail services,

and which will not (cannot) spy on all your correspondence in order to deliver targeted

advertising.’

As the two services are in fairly direct competition, we think it will be useful in this review of

Tutanova (the ‘name derived from Latin and contains the words “tuta” and “nota” which mean

“secure message”’) to compare and contrast them, which will hopefully help to highlight the

pros and cons of each.

Features

As with ProtonMail, all Tutanota (https://tutanota.de/)accounts are currently free, but a

premium service will be offered soon (Tutanova also accepts donations). It currently offers the

following features:

1GB storage (forever free)

Attachments limited to 25MB (for now)

1 free alias is permitted (i.e. 2 email addresses). More will be available to premium users

Everything is encrypted – subject, body, and attachment (ProtonMail currently only

encrypts the body)

Completely open source (code available here (https://github.com/tutao/tutanota/))

Android and iOS apps

Can not only send encrypted emails to users of regular email (as ProtonMail can), but can

receive an encrypted reply from them

Outlook addon (for premium business users – we did not test this)

(Upcoming – use webmail services with own domain name)

The killer feature here is clearly the ability for non-Tutanota users to securely respond to

encrypted emails (please see update at end of this article). The fact that Tutanota is open

source while ProtonMail is not should in theory give it an edge, but Tutanota’s source code has

not been independently audited by reputable researchers, while ProtonMail’s, although closed

source, has…

Privacy

Much is made of the fact that ProtonMail is based in Switzerland (or at least its servers are, the

team hails from Harvard University in the US), which because of its strict privacy laws is widely

regarded as privacy-friendly. This is, however, to a large extent an illusion

(https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-

8&u=http%3A%2F%2Fwww.heise.de%2Fnewsticker%2Fmeldung%2FSchweizer-Geheimdienst-

soll-als-Mini-NSA-den-Finanzplatz-schuetzen-2577997.html&edit-text=) (Google Translate), as

data retention laws and NSA-style surveillance are alive and well there.

Tutanota is based in Germany, which also has strict privacy laws, but which also practices

widespread surveillance (https://www.bestvpn.com/blog/6571/germany-to-spend-100-million-

euros-on-increasing-internet-surveillance/?nabe=6412130213429248:1) of its own, and is

https://tutanota.de/

https://github.com/tutao/tutanota/

https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.heise.de%2Fnewsticker%2Fmeldung%2FSchweizer-Geheimdienst-soll-als-Mini-NSA-den-Finanzplatz-schuetzen-2577997.html&edit-text=

https://www.bestvpn.com/blog/6571/germany-to-spend-100-million-euros-on-increasing-internet-surveillance/?nabe=6412130213429248:1



provides the base for the NSA (https://www.bestvpn.com/blog/10414/nsa-bases-massive-

spying-operation-in-germany/)’s extensive European operations. You pays your money and

takes your chances…

Tutanota does not use two-factor authentication (although his feature is planned at some

stage), but then neither does ProtonMail (which does require two passwords, but as these are

each ‘something you know’ rather than ‘something you know and something you have’, does not

count as 2FA).

Tutanota provides end-to-end encryption, so email stored on Tutanota’s servers is encrypted an

cannot be accessed or decrypted by staff members. When asked how Tutanota would respond

if asked ask by the police to identify a user, a Tutanota staff member said

(https://www.reddit.com/r/privacy/comments/2zq1v3/tutanota_questions_beyond_encryption/),

‘We would refuse requests. Only if a German court issues a warrant, we can be forced to hand

over data. However all data on our servers is encrypted and we do not have access to the

encryption keys. So the only thing we could hand out is the metadata (from, to, when), we are

working on how to conceal these. We do not log IP addresses and anonymous sign up it

possible. We strip IP addresses from mails sent and received to guarantee your anonymity.’

This sounds all very reassuring, although the website FAQ does note that IP addresses will be

logged if ‘we find out that an account is misusing the system.’ As alluded to in the above

statement, Tutanova permits users to sign-up anonymously over Tor, which is good news.

Security

As noted above, Tutanota uses end-to-end encryption, and does not know users’ passwords,

which are ‘salted (https://en.wikipedia.org/wiki/Salt_%28cryptography%29) and hashed

(https://en.wikipedia.org/wiki/Cryptographic_hash_function) with Bcrypt

(https://en.wikipedia.org/wiki/Bcrypt) on your device before being transmitted’ for login. You

should beware that because Tutanota does not store any passwords, if you lose yours then it

will not be recoverable!

Emails between Tutanota users are encrypted using ‘a standardized, hybrid method consisting

of a symmetrical and an asymmetrical algorithm’, using 128-bit AES with 2048-bit RSA

handshake encryption. Emails to non-Tutanota users are encrypted using AES-128. This sounds

pretty secure to us, although we do wonder why the industry-standard 256-bit AES encryption

was not chosen.

Although ProtonMail’s use of PGP encryption is arguably stronger than that used by Tutanota,

Tutanota’s method allows it to encrypt not just the body of the message, but the subject line

and attachments as well, which is a definite feather in its cap. Regular messages sent to non-

Tutanota recipients are not encrypted in transit, but are stored encrypted on Tutanota’s servers,

as are messages and attachments received that arrive in plaintext.

Unfortunately, all encryption is performed in JavaScript by your browser, so as with ProtonMail,

this cannot (http://matasano.com/articles/javascript-cryptography/) be considered completely

secure against a determined attacker.

Tutanota in use

https://www.bestvpn.com/blog/10414/nsa-bases-massive-spying-operation-in-germany/

https://www.reddit.com/r/privacy/comments/2zq1v3/tutanota_questions_beyond_encryption/

https://en.wikipedia.org/wiki/Salt_%28cryptography%29

https://en.wikipedia.org/wiki/Cryptographic_hash_function

https://en.wikipedia.org/wiki/Bcrypt

http://matasano.com/articles/javascript-cryptography/



Tutanota in use

Unlike ProtonMail, signing-in to Tutanota requires entering a single password, which takes you

to the main interface.

(https://www.bestvpn.com/wp-content/uploads/2015/04/test-mail-1.png)

The basic interface is cleanly laid out and easy to use, but lacks many of the bells and whistles

we have come to expect from a webmail service (the most notable of which is the ability to save

drafts).

By default, all emails are sent confidentially i.e. encrypted (this can be changed in the settings),

which requires entering an agreed upon shared passphrase that the recipient will know (if this is

too short then you will receive an alert, but you can choose to override this). Unlike ProtonMail,

there is no hint option, so you will have to agree on a password in advance (preferably in person

or using secure IM chat (https://www.bestvpn.com/blog/8854/secure-alternatives-whatsapp/?

nabe=6412130213429248:1)).

(https://www.bestvpn.com/wp-content/uploads/2015/04/enencrypted-msg.png)

If a recipient uses regular email, they will receive an invitation to view your message securely.

Note that while the senders name is shown, the subject, body, and attachments are not.

https://www.bestvpn.com/wp-content/uploads/2015/04/test-mail-1.png

https://www.bestvpn.com/blog/8854/secure-alternatives-whatsapp/?nabe=6412130213429248:1

https://www.bestvpn.com/wp-content/uploads/2015/04/enencrypted-msg.png



(https://www.bestvpn.com/wp-content/uploads/2015/04/enencrypted-2.png)

To view your message the recipient follows the supplied link, and enters the agreed upon

password.

(https://www.bestvpn.com/wp-content/uploads/2015/04/encrypted-3.png)

This where Tutanota really shines, because non-Tutanota using recipients of secure email are

assigned a special ‘personal’ account that allows them to respond to the message securely. All

messages sent from a specific Tutanota account are also available through this special account.

https://www.bestvpn.com/wp-content/uploads/2015/04/enencrypted-2.png

https://www.bestvpn.com/wp-content/uploads/2015/04/encrypted-3.png



(https://www.bestvpn.com/wp-content/uploads/2015/04/contacts.png)

Early users complained about the basic Contacts manager, but this has now been fixed and

seems to be fully featured. Hopefully the ability to save draft messages will also come soon!

The mobile app

A Tutanota app is available for iOS and Android. We tested the Android version.

https://www.bestvpn.com/wp-content/uploads/2015/04/contacts.png



(https://www.bestvpn.com/wp-

content/uploads/2015/04/Android.png)

The app is simple, but is well laid out and works well. As with the web client, emails are

encrypted by default

Email Privacy Tester results

We tested both ProtonMail and Tutanota using the Email Privacy Tester

(https://emailprivacytester.com/) tool developed by Mike Cardwell (https://grepular.com/me/).

https://www.bestvpn.com/wp-content/uploads/2015/04/Android.png

https://emailprivacytester.com/

https://grepular.com/me/



(https://www.bestvpn.com/wp-content/uploads/2015/04/ProtonMail-test-results.png)

ProtonMail results

(https://www.bestvpn.com/wp-content/uploads/2015/04/Tutanota-test-results.png)

Tutanota results

https://www.bestvpn.com/wp-content/uploads/2015/04/ProtonMail-test-results.png

https://www.bestvpn.com/wp-content/uploads/2015/04/Tutanota-test-results.png



A Tutanota spokesperson has made the flowing statement:

‘We know about the failures from https://emailprivacytester.com

(https://emailprivacytester.com) They are not crucial and we will fix them within the coming

months.’

Interestingly, when we performed this test on a Gmail account, it passed with flying colors.

Conclusion

We really like Tutanota. As with ProtonMail, it is certainly not perfect, and should not be

considered secure against the NSA – encryption using JavaScript within the browser is not very

secure, and Germany is not the ideal location for a privacy service (but then where is?). It is,

however, vastly more secure and private than most webmail services, and it has a nice mobile

app.

Whether you prefer ProtonMail or Tutanota really depends on what features are important to

you – ProtonMail has a much more fully featured interface (Tutanota’s complete lack of a draft

function is a total bummer), but Tutanota allows even non-user recipients to reply securely to

encrypted emails*, and encrypts the subject line and attachments, in addition to an email’s body.

Both services are currently free (and will continue to offer basic functionality for free), so there

is no reason not to try both and see which you prefer (although the waiting list for ProtonMail

accounts is quite long). Both services are still under heavy development, so we look forward to

seeing how they progress.

*Update 10 March 2015: The ProtonMail team has contacted BestVPN to let us know that its

latest update (ProtonMail BETA v1.15 ) allows outside users to reply to encrypted messages

securely. Please see here (https://blog.protonmail.ch/protonmail-beta-v1-15-release-notes/)for

more details. This is great news, and makes choosing between two services even more than ever

a matter of personal choice, with ProtonMail having a much more advanced interface, while

Tutanota encrypts headers and attachments. As already noted, both services are under heavy

development and are adding new features all the time, which can only be a good thing for users

of either one.

Published 2015-04-09

Written by Douglas Crawford

I am a freelance writer, technology enthusiast, and lover of life who enjoys spinning words and

sharing knowledge for a living. Find me on Google+

(https://plus.google.com/u/2/115695913224775068128?rel=author)

22 responses to “Tutanota private email

https://emailprivacytester.com/

https://blog.protonmail.ch/protonmail-beta-v1-15-release-notes/

https://plus.google.com/u/2/115695913224775068128?rel=author



April 10, 2015 at 4:39 pm (/blog/16671/tutanota-private-email-review-vs-protonmail/#comment-134557)

April 13, 2015 at 8:26 am (/blog/16671/tutanota-private-email-review-vs-protonmail/#comment-134825)



22 responses to “Tutanota private emailreview (+ vs ProtonMail)”

ben

Great article. what do u think about hushmail.com? better? worse?

Reply (/blog/16671/tutanota-private-email-review-vs-protonmail/?replytocom=134557#respond)

Douglas Crawford VERIFIED

Hi ben,

Thanks.Please see my reply to Duaa.


Duaa

Hi Douglas,

Great article, I never heard of tutanota before,

But I use hushmail, do you anything about it ? Is it any good ? Because you never

mentioned it

Thanks a lot



Hi Ben and Duaa,

I’m glad you like the article. HushMail is does not spy on or exploit its users data for

commercial gain, but I noted in our Ultimate Privacy Guide

(https://bestvpncom.wpengine.com/the-ultimate-privacy-guide/?

nabe=6412130213429248:1&utm_referrer#encrywebmail),

‘For a while, Hushmail was considered the go-to service for secure webmail, as it

offered PGP encryption in a web based service. However, in 2007 a backdoor

(https://en.wikipedia.org/wiki/Backdoor_(computing))was used by the owners to

capture emails of three accounts, which were then handed over to the Canadian

Courts. As Hushmail CTO Brian Smith said in refreshingly honest blog post

(http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/),

“[Hushmail] is useful for avoiding general Carnivore-type government surveillance, and

protecting your data from hackers, but definitely not suitable for protecting your data

if you are engaging in illegal activity that could result in a Canadian court order.”

It should be noted that any web-based service can in theory be compelled to modify

their system to capture users’ decryption keys (as Hushmail did), and Hushmail itself

recommends using non web-based services such as GnuPG or PGP Desktop if stronger

https://www.bestvpn.com/blog/16671/tutanota-private-email-review-vs-protonmail/?replytocom=134557#respond



https://bestvpncom.wpengine.com/the-ultimate-privacy-guide/?nabe=6412130213429248:1&utm_referrer#encrywebmail

https://en.wikipedia.org/wiki/Backdoor_(computing)

http://www.wired.com/threatlevel/2007/11/encrypted-e-mai/



August 3, 2015 at 7:17 pm (/blog/16671/tutanota-private-email-review-vs-protonmail/#comment-144094)



July 15, 2015 at 3:29 pm (/blog/16671/tutanota-private-email-review-vs-protonmail/#comment-142276)

security is needed.’

Services such as ProtonMail and Tutanota are a new generation of webmail that use

end-to-end encryption to overcome (as much as possible) these problems and

provide webmail that is genuinely secure (although as we note in thier respective

reviews, they are not perfect solutions).


Denis

Hushmail was compromised not long ago. They willingly handed over information

about their users to the US government, the level of privacy is absolutely zero. If you

want to use one of these anonymous E-mail services, hush mail is one of the worst

ones ever.


Rags

We cannot trust traditional email anymore. Binfer is a great way to send secure email. It

does not store emails anywhere so is very secure. Check it out: http://www.binfer.com

(http://www.binfer.com).



Hi Rags,

He have clocked Binfer before, and will take a detailed look at it in a future article (in

particular its security implications). Thanks for reminding us!


billy

Using protonmail today Douglas I used the “encrypt for outside users” function for the first

time as a test. As directed I created a password and a password hint, then sent the email to

my destination (my default email). In the email it offers a link below to decrypt the email,

however what I cannot get my head around is how can I communicate the password with

the recipient in order to decrypt the message, doesn’t this defeat the whole purpose of

security, I might as well have sent the email without decrypting? Protonmail do actually say

that

“It is up to the ProtonMail user to find the most secure manner to communicate the

password they have chosen to protect the encrypted message, to the recipient”.

My question is if so then how can this be achieved and what is the whole point of this

function?




http://www.binfer.com/






July 16, 2015 at 8:10 am (/blog/16671/tutanota-private-email-review-vs-protonmail/#comment-142334)

July 23, 2015 at 1:07 pm (/blog/16671/tutanota-private-email-review-vs-protonmail/#comment-143039)


July 17, 2015 at 8:11 am (/blog/16671/tutanota-private-email-review-vs-protonmail/#comment-142409)



Hi billy,

Well, assuming that you cannot meet face-to-face (the best method), the best way to

communicate securely is via encrypted chat (e.g. TextSecure

(https://www.bestvpn.com/blog/20330/textsecure-and-redphone-review/)or Pigin +

OTR (https://www.bestvpn.com/blog/7188/secure-instant-messaging-with-pidgin-

plus-otr/)), or via encrypted VoIP (e.g. Redphone

(https://www.bestvpn.com/blog/20330/textsecure-and-redphone-review/)).


billy

Thanks Douglas. I meant to say if I was sending to someone I don’t know like a

general email/enquiry email?

How could I communicate with them that password for them to be able to

retrieve the email I sent?



Hi billy,

If you cannot communicate a shared secret either in person or via secure

chat, then you are probably out of luck. If you really need to communicate

securely with a stranger then you should contact them through regular

means to arrange a physical meetup or secure chat session, during which you

can exchange passwords (assuming you can convince them of the need to do

this!)


Max Payne

Hi…Great and helpful article! I use ProtonMail and somehow was not aware that the subject

and attachment is not encrypted. I think the day they launch support for custom domains I

will switch my business mail to it…


billy

Hiya Douglas

are you familiar with jumble, its a free, integrated, end-to-end email encryption solution

that integrates with existing email systems. Gmail users can sign up and use Jumble They

assert that they never hold a copy of your email data and we don’t have access to your

https://www.bestvpn.com/blog/20330/textsecure-and-redphone-review/

https://www.bestvpn.com/blog/7188/secure-instant-messaging-with-pidgin-plus-otr/

https://www.bestvpn.com/blog/20330/textsecure-and-redphone-review/







August 27, 2015 at 10:50 am (/blog/16671/tutanota-private-email-review-vs-protonmail/#comment-146234)



September 10, 2015 at 12:33 am (/blog/16671/tutanota-private-email-review-vs-protonmail/#comment-146862)


encryption keys. This would be good to review. Heres the site https://www.jumble.io

(https://www.jumble.io)



Hi billy,

It’s the ‘They assert’ part that is the problem. As a general rule I do not trust any

service or software that is not open source (or at the least, like ProtonMail, has been

independently audited by respected experts in the field.) With closed source

platforms we simply have to trust the provider not to do the dirty, which is no security

at all…


Daniel C

What about GhostMail.com? Anyone?



Hi Daniel,

I have only looked into it briefly, but GhostMail appears to be neither open source nor

independently audited, so is unlikely to get a recommendation from us.


Cedar

I see Ghostmail recently went open source (https://blog.ghostmail.com/ghostmail-

goes-open-source/ (https://blog.ghostmail.com/ghostmail-goes-open-source/)). I’m

trying to determine the better encryption between Protonmail, Tutanota, and

GhostMail: they seems to be the cream of the crop in this category. I have accounts for

the latter two and Ghostmail appears to have most things I need. It has an impressive

list of features (as listed on their website https://www.ghostmail.com/

(https://www.ghostmail.com/))

Douglas, perhaps you could consider reviewing this article. I’d be certainly interested

to read your views. Please email me if you do I’ve very recently started to

comprehend the insidious trend of invasion from governments and organisations into

privacy and am switching over to encrypted services. It’s a learning curse, erm I mean

curve.



https://www.jumble.io/





https://blog.ghostmail.com/ghostmail-goes-open-source/

https://www.ghostmail.com/





September 13, 2015 at 8:00 pm (/blog/16671/tutanota-private-email-review-vs-protonmail/#comment-147090)

December 15, 2015 at 5:49 pm (/blog/16671/tutanota-private-email-review-vs-protonmail/#comment-152366)

December 16, 2015 at 9:17 am (/blog/16671/tutanota-private-email-review-vs-protonmail/#comment-152380)

Hi Cedar,

I will put looking at GhostMail to assess whether a review is justified on my to-do

list.


Cedar

Per my last comment, I was transferring some emails to my new account and wasn’t

receiving them.

A huge downside of Ghostmail is it only accepts emails from other Ghostmail accounts, so

I’ve put it to one side.


Privacylover

I have an account with GhostMail and I really like their simple interface and also the

encrypted chat and storage. I wrote their support regarding incoming emails, and they

replied this will be possible very soon. (They answered me within 1 hour, quite

impressive.) Just for your information. Cheers.


Robert

Have you any experience with Countermail?



Hi Robert,

I’m afraid not, but I have put it on our list things to look at.


Leave a Reply

Your email address will not be published. Required fields are marked *

Name *

Email *

Comment








Created by 4Choice Ltd (http://4choice.com/), a company in the UK.

Write for Us (/write-for-us/)

FAQs (/faqs/)

Advertise your company (/advertising/)

Privacy Policy (/privacy/)

Contact Us (/contact-us/)

Post Comment

http://4choice.com/

https://www.bestvpn.com/write-for-us/

https://www.bestvpn.com/faqs/

https://www.bestvpn.com/advertising/

https://www.bestvpn.com/privacy/

https://www.bestvpn.com/contact-us/

Technology

Which service offers the best security for email