Why I'm not using Tutanota anymore

Because of Edward Snowden's #PRISM wistleblowing, I wanted to ween myself off of GMail and other Google products as soon as possible. After seeing the service plugged in a Daily Decrypt episode, Tutanota.de seemed to be a great concept, encrypted mail for everyone. It was pretty good during the honeymoon phase, but after four months of daily use, I have found too many issues with it that I give up, and I'm switching providers. Here are my reasons for leaving Tutanota's service.

The spam filter is trash.

The spam filter does not seem to identify spam based on content. It also does not seem to learn based on what I mark as spam. There was one spam message so out there, and I received it so often, that I could easily identify it and see whether or not the Tutanota spam filter was effective. I used this message as a benchmark because it came through every time with the unchanged subject line, "SHE WANTED TO CUT MY PENIS OFF." Even after tweaking my spam filter settings between receipt, not once did Tutanota send this benchmark to the spam folder.

The Inbox rules are bad

Because the spam filter failed so miserably, I resorted to using the inbox rules to get the spam I was receiving under control. I was getting so much spam from the top level domains .stream, .top, and .win, I just wanted to block these entire TLDs, rather than creating a new inbox rule for every domain that was sending me spam. I think it was very unlikely that any legitimate, non-spammy E-Mails would come from these TLDs, so I was prepared to block them completely. I quickly discovered that this was impossible to accomplish in Tutanota. Tutanota would allow creating a rule for a domain such as iSpamU.stream, but would not allow me to block an entire TLD, or use a wildcard such as *.stream to block the entire TLD.

The desktop UI is slow

I have a plethera of issues with the user interface, but the one that bothered me the most is that it is painfully slow to load the inbox, a task that I carry out several times a day. It became a habit to open app.tutanota.de, then walk away from the computer and grab some water or something, then going back to the computer and waiting some more before the inbox was loaded. I ended up leaving a tab open all the time with my Tutanota inbox, rather than closing when I'm done and loading it when I need it. Having to leave something open, and consuming precious RAM, I might as well not use a cloud platform and use a desktop e-mail client. The encryption bonus that Tutanota offers is not even a valid counter argument here, for reasons I'll get to below.

The desktop UI has no search

Want to search for an old e-mail in Tutanota? Too bad, there is no way to search. My workaround was to drop important messages into subfolders as soon as I receive them. Any old message I needed that was not saved in a subfolder could be considered lost, because clicking the "Load more" button, waiting for content, and browsing through a mess of uncaught spam and read messages was too time consuming.

The "easy" encryption is oversold

When I saw the sales pitch page for Tutanota, they made it seem like encryption through Tutanota is the easiest thing ever. It is not. When I think of easy end-to-end encryption, I think of Telegram, WhatsApp, even Facebook chat (ew). The bar for easy encryption has been set at the point where end-to-end encryption is transparent to the user; easy encryption is when the user doesn't even have to think about encryption.

Tutanota offers end-to-end encryption from Tutanota inbox to Tutanota inbox, not Tutanota inbox to any inbox. When you send an encrypted e-mail to a non-Tutanota inbox, the user receiving the message is forced to create a Tututanota inbox so they can decrypt the message. Ok, so it's a closed garden of encryption between Tutanota users, whatever, but even then it's still not transparent. The party you are e-mailing must first be informed that you are sending a secret message, and a pre-shared key (password) must be exchanged between sender and receiver. To unlock, the receiver needs to use the PSK. That's probably easier than using GPG, but that's not easy. The bar for easy has been set by encrypted messengers. Easy is pressing one button, "SEND".

Conclusion

Encryption is only worth it's salt when it's used, but during my four month test of Tutanota, I used the encryption feature one time, during a test of the encryption feature. I'm not going to make my family create a Tutanota inbox so they can read a private message from me. Tutanota is trying to be e-mail without using the existing e-mail infrastructure; Tutanota is trying to create a closed source, non-interoperable, walled garden of privacy, and any other e-mail clients or e-mail services wanting to communicate are out of luck. If e-mail is to be encrypted, it should be encrypted e-mail, not a branded, proprietary new thing that only works with itself.

This whole experience has made me appreciate GPG a lot more. Using GPG, I can use whatever e-mail provider I want, whatever mail client I want, and send an e-mail to any provider's inbox, all with pretty good privacy for any receiver who has taken the time to learn how GPG works. Going forward, I think inboxes with tighter GPG integration are the way to do encrypted e-mail.