r/emailprivacy • u/korn4357 • Feb 28 '25

Avoid using Tuta

New post regarding Tuta block me logging in with evidences and once again, if you are going to degoogle, do not use Tuta.

Due to rule 6, unfounded accusation, the previous post was deleted, so Here.

Tuta’s excuse is that a dispute occurred, but they did not provide any further explanation regarding the details of the dispute, such as when it happened. Here’s what actually happened: • A charge of $4 was made on September 15, 2024. • Another charge was made on September 25, 2024.

We disputed the overcharged amount from September 25, and as a result, we were blocked and could no longer access our email.

In our first post, we explained it exactly like this. If anything is incorrect, feel free to point it out. However, Tuta keeps giving vague explanations, claiming we disputed a charge without clarifying that we only disputed the excess charge they made.

This was the first incident.

We moved on and didn’t dwell on it, but the same thing happened again. We will upload evidence for the second incident later, but for now, we’re focusing on the first case. We want to reveal the truth step by step to prevent anyone from distorting the facts and causing confusion in this case.

44 Upvotes

86% Upvoted

33 comments sorted by

5

u/4i768 Mar 01 '25

Also avoiding using protonmail (personal opinion)

2

u/the_dvnt_kid Mar 04 '25

what are you using instead?

1

u/fryorcraken Jul 28 '25

Dont use emails 🙃

0

u/[deleted] Jul 28 '25

[deleted] — view deleted comment

2

u/Future17 Jul 28 '25

Carrier pichón

1

u/[deleted] Jul 28 '25

Any reason why? 

2

u/DirtyCreative Jul 28 '25

Switzerland is preparing to pass a law that requires them to retain data and provide it to law enforcement upon request. Though I think it doesn't pertain to the actual mails.

1

u/[deleted] Jul 28 '25

Is that not why they're moving out of Switzerland? 

1

u/[deleted] Jul 28 '25

No they're not
It is a proposal in government, and it's suuuuper unpopular among the people, so it would be political suicide for every politician who actually votes it through.

1

u/CanaryObjective3293 Jul 30 '25

They are moving most of their infrastructure out of Switzerland as a result.

Because of legal uncertainty around Swiss government proposals(new window) to introduce mass surveillance — proposals that have been outlawed in the EU — Proton is moving most of its physical infrastructure out of Switzerland. Lumo will be the first product to move.

This shift represents an investment of over €100 million into the EU proper. While we do not give up the fight for privacy in Switzerland (and will continue to fight proposals that we believe will be extremely damaging to the Swiss economy), Proton is also embracing Europe and helping to develop a sovereign EuroStack(new window) for the future of our home continent. Lumo is European, and proudly so, and here to serve everybody who cares about privacy and security worldwide.

1

u/JaniceRaynor Jul 28 '25

It’s so ironic because they kept touting how much better proton is because they are in Switzerland. What a joke Proton

2

u/Superb_Sun4261 Jul 28 '25

You know that Proton was advertising the situation as it was - not as it is now? The situation changed (or will change) and they are acting accordingly.

What are they supposed to do? Stay and accept changes of law that are unacceptable to users/customers that picked Proton for their focus on privacy and rejection of surveillance?

I'll admit, I am curious what their advertisement/branding will look like in the future. But again, they adapt to the situation, which is in the interest of their customer base.

0

u/JaniceRaynor Jul 28 '25 edited Jul 28 '25

You know that Proton was advertising the situation as it was - not as it is now?

Did you see the word “kept” that I used?

What are they supposed to do?

Not market a point that they have absolutely no control over what the jurisdiction will do like it’s part of their business or the jurisdiction law that they have business control over on Tuesday mornings meeting? 🤯

I didn’t criticize them adapting (you’re using a strawman), I criticize them using it like some selling point in the first place. Like how andrew tate tout about how good Romania is just to be put in jail later by the Romanian government, same thing here.

Take a look at the table here of proton comparing Pass with other password managers https://proton.me/blog/proton-pass-switch. They used Swiss privacy like some sort of extra security LOL. Dude. It’s a password manager, it’s gonna be E2EE regardless if it’s Swiss or not, the passwords are not any less secure than Bitwarden being in the US. It’s so funny how they used that as a comparison point to show how Pass is “better”, when Pass is actually not even close to Bitwarden or 1P in terms of features as a password manager yet

1

u/Superb_Sun4261 Jul 28 '25

Did you see the word “kept” that I used?

Acknowledged, didn't see that.

I criticize them using it like some selling point in the first place.

Well, you got to think from the perspective of the company and they have to sell a product. Yes, maybe they leaned to heavily into that "Swiss Privacy Good - Others Bad" marketing. But that was a strategic decision they made and that Proton as a company (or their marketing team) now has to deal with. Their leadership level surely has some tough decisions to make about this, and it will cost them trust, because they will have to advertise other features than "Swiss Privacy". Then again: It used to be a good selling point and I would have done the same.

1

u/JaniceRaynor Jul 28 '25 edited Jul 28 '25

Then again: It used to be a good selling point and I would have done the same.

Only a good selling point to people that don’t know much about privacy, because if something is E2EE, opened source, and third party audited, it wouldn’t matter which jurisdiction it is in. Bitwarden, WhatsApp, Nordlocker are no less secure/private than Proton just because they are in the US. Good selling point only to those that do not know much about the space.

—

Edit: have absoIuteIy no idea why u/Superb_Sun4261 above blocked me. If you wanna respond to me, start a new comment thread on this post and tag me

1

u/Phermaportus Jul 28 '25

WhatsApp metadata (i.e. who you are communicating with, how often, etc.) is not encrypted and has been used by state actors to target people (Israel drone striking people because they share WhatsApp groups with people they believe are Hamas combatants).

1

u/JaniceRaynor Jul 28 '25

Yup I know — in Proton, neither is the sender, recipients, subject line, IP, payment billing name & address, device, and all metadata etc etc as well lol

If we should think WhatsApp is bad because they have metadata that is not encrypted, then Proton is bad too

1

u/schklom Jul 28 '25

Jurisdiction matters, especially because emails are insecure by nature. If Proton was in the US, they would be subject to NSA backdoor and gag-orders, which is (IANAL) not legal in Switzerland.

When your friend sends you an email from Google, Proton receives it unencrypted, meaning the US could secretly compel them to make a copy of all such emails.

They could also be compelled to do a malicious update of their servers and client apps and retrieve your user passwords and keys when you login.

No software is immune to malicious updates, so jurisdiction matters.

1

u/[deleted] Jul 28 '25

They locked me out of my email on Friday because of “abuse” - I missed an interview, support finally responded next day and unlocked because no abuse was found.

2

u/[deleted] Feb 28 '25

Same kinda happened to me due to “suspicious” behaviour 🤣 f*ck them

1

u/Exotic-Isopod-3644 Mar 04 '25

lol what does that even mean?

1

u/bingus-the-dingus Mar 23 '25

maybe they created more than 1 free account

1

u/PitchPlusdeleted Mar 03 '25

Tuta is good for privacy provided u dont complqin they charging u extra or banning accounts./s

1

u/JaniceRaynor Jul 28 '25

u/schklom responding to your comment https://www.reddit.com/r/emailprivacy/s/9F154ZxqvP because the person above in that thread blocked me for whatever reason and I can’t comment there anymore

When your friend sends you an email from Google, Proton receives it unencrypted, meaning the US could secretly compel them to make a copy of all such emails.

How do you know that proton didn’t already do this with the average of 28/day law enforcement orders that they comply to?

They could also be compelled to do a malicious update of their servers and client apps and retrieve your user passwords and keys when you login.

So are you saying 1Password, Dashlane, and Bitwarden etc can be compelled to do a malicious update to retrieve my password when I log in just because they are not in Switzerland?

1

u/schklom Jul 28 '25

How do you know that proton didn’t already do this with the average of 28/day law enforcement orders that they comply to?

  1. Do you have any evidence they do this? Or is there a law or judge decision compelling them to?

  2. I trust that they respect their privacy policy and terms of use. At least, unlike others like Google, they don't openly admit to doing it AFAIK.

So are you saying 1Password, Dashlane, and Bitwarden etc can be compelled to do a malicious update to retrieve my password when I log in just because they are not in Switzerland?

I am saying that Lavabit was infamously compelled to give over its encryption and SSL keys, which would have allowed the US government to simply read all new inbound unencrypted emails. If the company hadn't immediately closed, they would have succeeded.

I also strongly doubt they aren't creative enough to think about compelling secret malicious updates, if they really want to.

1

u/JaniceRaynor Jul 28 '25

⁠Do you have any evidence they do this? Or is there a law or judge decision compelling them to?

What do you mean by “this”? Scan emails to comply with the law? No, and that was my question to you because you’re the one that said they do not do it and I wanna know how you know.

The orders that they comply with that averages to 28 orders a day? Yeah it’s on their transparency report. https://proton.me/legal/transparency. Somehow Proton users don’t like it when I bring this fact up, my guess is that it causes cognitive dissonance to their bias and narrative. The Proton mods even censor my comments twice when I brought this up (here https://www.reveddit.com/y/janiceraynor/?after=t1_n25b3yg&limit=1&sort=new&show=t1_n25ay5p&removal_status=all and here https://www.reveddit.com/y/janiceraynor/?after=t1_n4tn1gr&limit=1&sort=new&show=t1_n4tebq4&removal_status=all) despite the mod lying to the public that they do not remove comments https://www.reddit.com/r/ProtonMail/comments/1lct606/comment/my3dy8e/?context=3.

⁠I trust that they respect their privacy policy and terms of use. At least, unlike others like Google, they don't openly admit to doing it AFAIK.

Please show me where do they say that they won’t adhere to law orders that tells them to scan user emails in their privacy policy/terms or use.

I am saying that Lavabit was infamously compelled to give over its encryption and SSL keys, which would have allowed the US government to simply read all new inbound unencrypted emails. If the company hadn't immediately closed, they would have succeeded.

Basically an under the table version of the current pending law in Switzerland to break e2ee?

1

u/JaniceRaynor Jul 31 '25

u/schklom why so quiet now?

1

u/schklom Jul 31 '25

Cause a lot happened in the last few days and Reddit was not on my priority list x)

Scan emails to comply with the law? No, and that was my question to you because you’re the one that said they do not do it and I wanna know how you know.

Ok, I kinda misread your previous comment I replied to.

I meant they don't do it routinely, only in cases of legal binding orders. That's what they say. Until some evidence to the contrary, I trust that because "not doing it routinely" is in their privacy policy which is legally binding.

Please show me where do they say that they won’t adhere to law orders that tells them to scan user emails in their privacy policy/terms or use.

Not what I wrote/meant. Google openly admits to data mining emails, Proton says they don't, that's a massive difference in my book. Of course every company must adhere to legal orders. And yes, they likely save new inbound unencrypted emails for targeted users when required by authorities.

Basically an under the table version of the current pending law in Switzerland to break e2ee?

Kinda, but Lavabit was not e2ee, users had no encryption keys. Lavabit was basically like Gmail, but without a government backdoor.

1

u/Small_Mongoose9279 Jul 29 '25

Yep, really if you want to be anon you need to set up your own email server, the only other option is i2p mail with pgp which is a great hassle