**Can you trust ProtonApps.com?**
https://shkspr.mobi/blog/2024/03/can-you-trust-protonapps-com/
I've recently signed up to the privacy-preserving service [Proton](https://proton.me/). All the email, calendar, drive, VPN, and other services seem to hang off the proton.**me** domain.
I wanted to download the Android apps to my phone - without using the Google Play Store. The [VPN app is on F-Droid](https://f-droid.org/en/packages/ch.protonvpn.android/) but none of the others are. So, because I'm lazy, I Googled "Download Proton Mail".
I landed on https://protonapps.com/.
It *looks* like a genuine site. But is it? .me is signed by Let's Encrypt, whereas .com is signed by Amazon. There is **no link** from Proton.me to ProtonApps.com. There's nothing I can find that shows it is genuine.
But, let's assume for the moment, that it is legitimate. What happens when you try to download the Android apps from it?<li>The <a href="https://protonapps.com/protonmail-android">email app page</a> links to the <a href="https://github.com/ProtonMail/proton-mail-android/releases">ProtonMail repository on GitHub</a> - there's no link from the .me site to their GitHub. But I'm reasonably sure that's them.<p></p></li><li><p>The <a href="https://protonapps.com/protonvpn-android">VPN app page</a> leads to a <a href="https://github.com/ProtonVPN/android-app/releases"><em>different</em>; GitHub organisation</a>! I don't know why they're different organisation. It isn't linked to from the the .me site, nor from the <a href="https://protonvpn.com/">https://protonvpn.com/</a>; site (yet another domain!)</p></li><li><p>The <a href="https://protonapps.com/protoncalendar-android">calendar app page</a> links to <a href="https://protonmail.com/download/CalendarAndroid/ProtonCalendar-Android.apk">ProtonMail.<strong>com</strong></a>; - is that them? The .com redirects to the .me, but anyone can set up a redirect.</p></li><li><p>The <a href="https://protonapps.com/protondrive-android">drive app page</a> and the <a href="https://protonapps.com/protonpass-android">Pass app page</a> do both link to Proton.me!</p></li>
So there are multiple domains - Proton.me, ProtonApps.com, ProtonMail.com, ProtonVPN.com - and there are at least 2 different GitHub organisations.
How do you tell which ones are legitimate? I signed up and paid on the .me page - so I have high confidence in it.
The [official Proton Mastodon account](https://mastodon.social/@protonmail/112053863641320051) says the ProtonApps.com site is legitimate (and the Mastodon account is verified by the .me site). But you can't expect users to chase through a dozen different pages and enquire on social media just to verify which page is safe.
This is my plea to *all* developers - simplify your customer-facing infrastructure to make your domains consistent & trustworthy.
https://shkspr.mobi/blog/2024/03/can-you-trust-protonapps-com/
#OpenSource #privacy #Proton
Terence Eden’s Blog /
npub1y6…reusx
2024-03-11 12:34:41
Author Public Key
npub1y66rre8r3yptrcumrxelkmpr2hd8tpg35rxsx4eqcuejpgj5dgcslreusxPublished at
2024-03-11 12:34:41Event JSON
{
"id": "07cb637ec69b370f5312e900db88c54772c9c3f9717cd2d0b83882cc2a1a82b8",
"pubkey": "26b431e4e38902b1e39b19b3fb6c2355da758511a0cd035720c73320a2546a31",
"created_at": 1710160481,
"kind": 1,
"tags": [
[
"t",
"privacy"
],
[
"t",
"OpenSource"
],
[
"t",
"Proton"
],
[
"proxy",
"https://shkspr.mobi/blog/2024/03/can-you-trust-protonapps-com/",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://shkspr.mobi/blog/2024/03/can-you-trust-protonapps-com/",
"pink.momostr"
]
],
"content": "**Can you trust ProtonApps.com?**\nhttps://shkspr.mobi/blog/2024/03/can-you-trust-protonapps-com/\n\nI've recently signed up to the privacy-preserving service [Proton](https://proton.me/). All the email, calendar, drive, VPN, and other services seem to hang off the proton.**me** domain.\n\nI wanted to download the Android apps to my phone - without using the Google Play Store. The [VPN app is on F-Droid](https://f-droid.org/en/packages/ch.protonvpn.android/) but none of the others are. So, because I'm lazy, I Googled \"Download Proton Mail\".\n\nI landed on https://protonapps.com/.\n\n\n\nIt *looks* like a genuine site. But is it? .me is signed by Let's Encrypt, whereas .com is signed by Amazon. There is **no link** from Proton.me to ProtonApps.com. There's nothing I can find that shows it is genuine.\n\nBut, let's assume for the moment, that it is legitimate. What happens when you try to download the Android apps from it?\u003cli\u003eThe \u003ca href=\"https://protonapps.com/protonmail-android\"\u003eemail app page\u003c/a\u003e links to the \u003ca href=\"https://github.com/ProtonMail/proton-mail-android/releases\"\u003eProtonMail repository on GitHub\u003c/a\u003e - there's no link from the .me site to their GitHub. But I'm reasonably sure that's them.\u003cp\u003e\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe \u003ca href=\"https://protonapps.com/protonvpn-android\"\u003eVPN app page\u003c/a\u003e leads to a \u003ca href=\"https://github.com/ProtonVPN/android-app/releases\"\u003e\u003cem\u003edifferent\u003c/em\u003e GitHub organisation\u003c/a\u003e! I don't know why they're different organisation. It isn't linked to from the the .me site, nor from the \u003ca href=\"https://protonvpn.com/\"\u003ehttps://protonvpn.com/\u003c/a\u003e site (yet another domain!)\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe \u003ca href=\"https://protonapps.com/protoncalendar-android\"\u003ecalendar app page\u003c/a\u003e links to \u003ca href=\"https://protonmail.com/download/CalendarAndroid/ProtonCalendar-Android.apk\"\u003eProtonMail.\u003cstrong\u003ecom\u003c/strong\u003e\u003c/a\u003e - is that them? The .com redirects to the .me, but anyone can set up a redirect.\u003c/p\u003e\u003c/li\u003e\u003cli\u003e\u003cp\u003eThe \u003ca href=\"https://protonapps.com/protondrive-android\"\u003edrive app page\u003c/a\u003e and the \u003ca href=\"https://protonapps.com/protonpass-android\"\u003ePass app page\u003c/a\u003e do both link to Proton.me!\u003c/p\u003e\u003c/li\u003e\n\nSo there are multiple domains - Proton.me, ProtonApps.com, ProtonMail.com, ProtonVPN.com - and there are at least 2 different GitHub organisations.\n\nHow do you tell which ones are legitimate? I signed up and paid on the .me page - so I have high confidence in it.\n\nThe [official Proton Mastodon account](https://mastodon.social/@protonmail/112053863641320051) says the ProtonApps.com site is legitimate (and the Mastodon account is verified by the .me site). But you can't expect users to chase through a dozen different pages and enquire on social media just to verify which page is safe.\n\nThis is my plea to *all* developers - simplify your customer-facing infrastructure to make your domains consistent \u0026 trustworthy.\n\nhttps://shkspr.mobi/blog/2024/03/can-you-trust-protonapps-com/\n\n#OpenSource #privacy #Proton",
"sig": "4fe222485cf67f769f0a10c06fce737779ba1bab3335a9129ca40a6bbaea01ff2dd0794e8a77159db9e8d7ccf43a62b2bb6d6a34e044544f9fc77d672fe768fd"
}