>>106346336
>how do they allow lost key recovery
They don't. Read up on zero-knowledge. Proton Pass and Bitwarden for example will never show you what your master password is because they simply do not have access to it. You can setup recovery methods to regain access, but you can never get your master password back, only reset it.
The entire way products like this work is that you generate an actual encryption key (DEK) behind the scenes which is encrypted by your master password AND any recovery method used (ie: recovery file, keys, etc). The DEK is what encrypts/decrypts your actual data. Your password/recovery phases decrypt/encrypt the versions of the DEK. If you're using a cloud product they only store your encrypted files from you. Without your password or recovery phase they can't access your unencrypted DEK => they can't access your unencrypted data.
Btw all of their code for both products are open source so you can literally audit this yourself, but i'm guessing you won't.
Unless you're a nutter that thinks AES-GCM is cracked then this is largely a nothing burger.
>>106346223
>A few years ago, proton mail intercepted credentials of their users to help lea arrest activists.
Did you read your own article lmao?
>Under no circumstances can our encryption be bypassed, meaning emails, attachments, calendars, files, etc. cannot be compromised by legal orders.
>Proton Mail does not give data to foreign governments; that’s illegal under Article 271 of the Swiss Criminal code. We only comply with legally binding orders from Swiss authorities.
>The fact that Proton Mail was not able to hand over any messages even under legal order proves that our encryption works, and very likely will be of great assistance to the activist in this case.
The only thing Proton provided to authorities was an IP address of the user, which is what they admitted to.
