One reason is that tuta does not require you to have any other connection to create and account.
Protonmail require a second mail, phone or possibly some kind of payment if I recall correctly (for verification?) that could be linked from your account in theory.
Without having a good anonymous starting point, protonmail does not let you get that starting point, at least the last time I tired (maybe a year ago).
It's a stark contrast to Tuta, which allows anonymous account creation with Tor Browser if you pay with cryptocurrency (Monero or Bitcoin, via their partner ProxyStore) and doesn't require a whitelisted verification email address or any other data.
An additional email address is required only in cases when our system detects something suspicious about your network, so if you are coming across this, we recommend changing nodes. If you keep coming across the same issue, please contact us at: https://proton.me/support/contact, so we can take a closer look.
The email addresses, however, are not tied to your account - we only save a cryptographic hash of your email address. Due to the hash functions being one-way, we cannot derive your data back from the hash: https://proton.me/support/human-verification.
Who cares if you hash it, cracking a hash of an e-mail is easy AF compared to passwords. Especially on agency scale... How do you hash it? Argon2 or rather some extremely fast to crack hash?
It's a difficult issue. If they allow unlimited signups via Tor, people will bulk sign up for accounts and use them for spamming, scamming, threats, phishing and other crap. I can imagine why they don't tbh.
Proton forbidding anons from opening free accounts might be necessary for anti-spam/deliverability. But even paid accounts?
"They accept cryptocurrency, but only for existing accounts - after you've already doxxed yourself" (during the initial signup flow, where this payment option has been removed)
You don't doxx yourself by creating a Free account. In most cases, no human verification method is required or it's captcha only. As explained above, an additional email address would be required only in cases when our system detects something suspicious about your network.
It takes a while for the Bitcoin transaction to come through, which is why we the process is the way it is. The same process applies to users who wish to pay with cash or bank transfer.
And what suspicious thing about the network would you be detecting for Tor Browser users arriving on the .onion? Their network is uniform as far as you can tell, and you are blocking them from opening either a free account without an invasive verification method (non-disposable email or phone) if it works at all, or a paid account without an invasive payment method.
For Tor users arriving on proton.me, what sense is there in saying "There's a surprise in every 100th exit node! If you cycle through enough of them maybe you too will be allowed to open an account anonymously!" Not treating them as equivalent to .onion visitors is a you problem.
> It takes a while for the Bitcoin transaction to come through, which is why we the process is the way it is.
By not allowing this payment option at all in the signup flow? Removing what would be the only way for Tor users to sign up to your service anonymously without beating lottery odds. Just use any normal off-the-shelf checkout page that waits for however many transaction confirmations you want! (Let's not even get into the lack of privacy coin support, e.g. Monero. For a privacy focused service, Bitcoin L1 only is substandard in 2023.)
I'm not saying you are a honeypot. I'm saying you've cultivated such a careless indifference to data minimization that you've become indistinguishable from one.
So fix your backend to exempt Tor visitors from those measures, if it's really all due to hallucinating clusters of abuse from a network where abuse categorically does not appear in clusters of the kind that your backend is attempting to detect.
To add an exemption for proton.me: The list of Tor exit IPs is public. For the .onion: That's loopback traffic from the tor daemon running on your own load balancer or wherever you've put it.
You can definitely search back more than a month. However the search is genuinely atrocious. I've been using tutanota for a few years now but every time I need to search my emails I think about switching to something else. It is just not acceptable for the service to need to slowly iterate through emails, downloading them one by one the first time you decide to go back that far, just to find something important.
I have a tuta account, I tried to search for something recently and it only let me search from October 12th or something. I'm not sure you can search back more than a month on the free plan.
I used to love Tuta for the tempting price (1eur/month). But now due to the increasing price, poor UX, no bridge to Thunderbird, broken filter rules, I switched to another provider.
I still have an account that I have some stuff linked to, I want to close it down entirely soon, it sucks there isn't any way to export all my emails without paying though.
It was possible to get "pro" version credits with coupons from very different places, for example Humble Bundle book bundles. Sometimes they gave them themselves. I guess you were also able to buy credits directly, but I am not sure about that.
Well, anyway when the credits ended, your service did not downgrade but they put your negative credit automatically, and if you don't pay it, you were never able to use your account until you pay this negative part.
There was no mention in anywhere that this would happen, and also all the messages were quite threatening.
Tuta has all kind of weird restrictions, like not being able to search back more than a month.