Here's how to create a free email account without phone number verification (with secure encryption, hide-my-email-aliases, and more) using Proton Mail.
Proton is such a hassle and implements security in a completely illogical manner. I honestly can't believe that people are content with such mediocrity.
They can't. I've seen similar critiques popup and I'm certain it's a shill trying to move people away from proton. Why? To what end? No clue on either front.
Proton is the shiznit. They answer to no one except their customers. They are self funded with lots of help from us. They never took any money from the investment firms that would try to control how they do things usually to the detriment of quality, security, etc.
They're not bad, you're just misinformed at a fundamental level.
Proton Mail is like Bitwarden, it encrypts data client side and stores the encrypted blob server side, which is exactly what they're doing with your private key. Otherwise, you'd have to carry it around on a USB or do some other voodoo to be able to read your emails.
That paper is god awful bad. They're basically saying things like "it can't be secure because they rely on the client code to be delivered by TLS and you could have a MITM that results in different client code being sent!" and "proton allows you to set passwords that are weak, thereby not looking out for your best interest!
Their conclusion can be summarized as "Proton can't provide a secure web mail application, because nobody can." Their suggested remedy is also actually a thing now because there is a Proton Mail desktop application.
The whole thing is pretty ridiculous in any case because someone would have to have control over your DNS server, you'd have to go to a phishing instance of proton instead of the real one, you'd be logged out because the cookies wouldn't be decryptable by their server, so you'd then finally have to login handing over your password.
If you use Proton VPN (or some other trustworthy DNS) that situation can happen. For most people it's an extremely unlikely situation. It's not a Proton problem though, it's a web technology problem.
For most people this situation will never happen (but it would be nice if someone would solve the problem).
When using TOR or a VPN, they also force you to verify your account with SMS.
People are going to abuse services that allow anonymous signups... Proton does not claim to be an anonymous email service, merely a private email service.
You mean that they store your private key "encrypted" and that it is encrypted by using served JS to the user? Do you know how many users would actually be technically capable of detecting an obfuscated modified JS that they randomly send should they become a target?