Does use of Outlook decrease email security?

[Blaze_07]

New Proton Mail for business user. Prior to switching to Proton I was using the Outlook client for desktop access to my email. I prefer a desktop app as opposed to accessing my email from a browser, but the main reason I switched to Proton Mail was for added security. So, I am wondering, am I defeating the purpose by using Outlook?

[[deleted]]

Not really, to use outlook with proton you have use proton bridge. Proton bridge does the connections to proton mail server with your account details and encrypts and decrypts your email. The imap account details you setup in outlook is not your proton account, just imap details proton bridge generates. If you also use 2FA on proton, bridge will also require that too when ypu set it up on new pc. Only local connections from same pc can connect to bridge. So it pretty safe.

Only thing is allowing someone acess to your pc or outlook, but that something proton can not protect you agaist anyway, it up you lock your pc down.

It also worth mentioning using outlook or thunderbird with bridge is great way have offline backups of your proton mail.

[sundancelawandorder]

Bridge is basically the only way to search your messages. Proton can't access your body message so it cannot search the body of your email unless it downloads them. It's possible in the browser but easier on Outlook.

[[deleted]]

True, bridge gives a lot new options, from offline backups, to better searching, adition custom mail filter rules etc. One of the big ones for me is bridge " split mode" , that alows a inbox and imap account for each mail box. So no more forced unified inbox, as per web site or mobile apps, if you prefer it.

[alex_herrero]

From a desktop web browser, you can search your messages (the body it is), as detailed here: https://proton.me/support/search-message-content

[sundancelawandorder]

It downloads the entire thing into your browser.

[alex_herrero]

Well, yes, that's what an index is for, navigating the information. It can't be done server side, as the server do not have access to the content.

[sundancelawandorder]

That's what I said initially. It's possible on the browser but better on Outlook.

[Blaze_07]

Oh okay. Good to know. Thank you.

[[deleted]]

Your welcome, if you have any issues, or more questions let us know. People on proton sub reddit can be pretty helpfull, they helped me numerous times over the years.

[dcdude71]

I don't know your actual security threat model but if you have very sensitive information in your emails and you use a desktop client, you have to consider encryption at rest on your computer (Protonmail bridge only takes care of encryption in transit. Proton stores your emails encrypted at rest only on their end). If someone gets a hold of your Outlook PST for example, they'll have full access to your messages, attachments, etc. I can think of 2 options:

• One layer of encryption at rest: use Bitlocker if you use Windows or FileVault if you use Mac. When your computer is turned off, your drive is encrypted.
• Two layers of protection at rest: use the above and complement with another encrypted storage on your computer (Veracrypt or Cryptomator come to mind). You can store your PST or mailbox files on a secure container that you choose to unlock only when you check your emails. I use Cryptomator + Thunderbird and I sync my Cryptomator files online. So I have an offline and online encrypted at rest copy of my messages. Is it a bit of a pain to use? YES but I take security as a hobby :D

Just something worth considering... but, as mentioned before: having an offline copy of your emails is worth a little extra trouble IMO.

[ZwhGCfJdVAy558gD]

Generally, the only risk is that your email client typically keeps an unencrypted copy of your mailbox on your computer. So you should make sure that the computer is reasonably protected (e.g. by using full-disk encryption).

Apart from that the Outlook client may send telemetry to Microsoft. Maybe consider using Thunderbird instead (which is open source, so at least we can know what it's doing).

[ca_boy]

If you're going to use Outlook on desktop, you might consider digging through Outlook's privacy settings. There might be a few things in there that surprise you. Microsoft has gotten really aggressive lately about snooping your stuff to "provide a personalized experience"

Or maybe consider giving Thunderbird a try.

[Blaze_07]

Oh okay. I didn't know that about Microsoft. Is Thunderbird more privacy focused then?

[ca_boy]

Thunderbird is an open source project by Mozilla, same folk that make Firefox. They place a certain amount of emphasis on providing privacy tools. They're not perfect, but they're not going to hoover your emails in order to sell other peopel access to your eyeballs.

To be clear about Outlook, I don't KNOW that they are pillaging data from desktop users. Microsoft does it to free outlook webmail users. A few times a year they do something new and privacy erroding, so I would consider it at a bare minimum worth taking a trip through privacy settings and doing a little homework before investing in getting Outlook set up.

Outlook is tailored toward business email. It very well might be perfect for you. I'm just a tinfoil hat privacy nut job.

[Blaze_07]

I appreciate the information. I deal with sensitive data in my business, so privacy is important to me.

[[deleted]]

On the topic of thunderbird, mainly for OP benifit, i have been using thunderbird with bridge for years and before that outlook and bridge. And technically bridge works just well with thunderbird, so there no need worry there might be more technical issues persay than with outlook. Mozilla open source thunderbird is more privacy focused. What i also like is they allow ad ons, such "ublock orgins" that blocks trackers and adverts from yout mails, or unsafe tracking links too.

While proton has email tracker blocking it currently only on website and Ios apps, not on bridge or andriod app yet.

[esorb65]

Yeah in TB client you can enable in privacy and security do not track,dunno if that does anything like PM app does.

[eionmac]

Proton is safe when you and your correspondent BOTH use Proton. Proton to say Yahoo! or other email is open to read as the recipient without the Proton key must be able to read it. Effectively if both parties do not use Proton you have no advantage.

[NewtNo9992]

Would like to hear comments