I’m not the kind of journalist who counts on encrypted email for protection. But if I were, I’d be reconsidering how much I trust services that market themselves that way.
Welcome to Safe Mode, your weekly report for pressing security and privacy news—and what steps to take next. Want this newsletter to come directly to your inbox? Sign up on our website!
The reason for this concern: A bit of drama involving Proton, best known for its end-to-end encrypted email and VPN services. As initially reported by 404 Media, an aggressive push for AI use in development led to purported clashes between CEO Andy Yen and rank-and-file employees. In one exchange, a request for more time to check for security vulnerabilities in new code was criticized as “bullshit and loser thinking” by Yen, who also said, “Stop thinking always of how to be slower, and focus more on how to be faster.”
The final alleged directive: “Stop lovingly handcrafting all our code and use AI more.”
Responding furor came swiftly, with Proton’s own users reacting strongly in comment after comment online. Turns out, a loyal fanbase gets mad when they believe their secure email could become less secure. Particularly when a CEO speaks harshly to employees focused on security—while also planning to “re-interview” them about AI use, with the implication of firings for those unenthusiastic about AI.
(Y’all, even r/ProtonMail was upset enough to push back on Proton.)
Proton has since posted a public statement, which included a promise of greater transparency around use of AI and its approach to code and security reviews. Yen also commented on Reddit, saying:
“With the proliferation of AI tools, our code is also under more third party scrutiny than ever before. We see this across the industry, with critical software bugs (like the recent PHP bug) being found on an almost daily basis.”
Foundry
Yen has a good point, though perhaps not the one he intended. It’s why I’ve begun to wonder if secure email is more of a hope than a reality.
AI is helping attackers not just find flaws faster, but create exploits quickly too. And encryption, like many other things, works when implemented as intended. Add AI into the mix, and holes might appear. On the development side, AI could lead to bad code. (How much can a human properly review when working at a computer’s speed?) And then on the bad-actor side, AI can let hackers sniff out and take advantage of weaknesses.
So, if I were in a situation where lives literally depended on the privacy of my email and other communication—I’d stop fully trusting any service claiming to be secure. I’d treat any information passing through Proton as data that could someday leak or become otherwise compromised. I wouldn’t quit the service, but I wouldn’t view my Inbox as impenetrable.
But if I just wanted to escape from the Google, Microsoft, or Apple ecosystems, with an extra dose of privacy on top? (End-to-end encrypted email goes beyond what those three providers offer.) And without worrying that the company is treating its workers poorly? Alternatives exist. Time to give Tuta a try, perhaps.
In the news
I’m on vacation right now, so I’m not around to track the news as I usually do. I’ll be back next week with the top stories from around the web!
Tip of the Week
Mozilla
Speaking of alternatives, have you ever tried a browser other than Chrome or Edge? On both PCs and phones, trying a different browser can significantly boost your privacy while browsing. In some cases, your security too.
On PC, I usually first recommend Firefox, followed by Vivaldi. On a smartphone, I also recommend Firefox, but also DuckDuckGo. (DuckDuckGo has the added neat feature of being able to generate email masks entirely for free!) These browsers all come with built-in tracking protection, and you can also install or enable ad-blocking easily.
(Malware can spread through advertisements, so ad-blocking is an act of self-preservation. You can still support your favorite websites through other means, like subscriptions.)
