- The provider's: The providers
- I would move the line "Most internet companies [...]" to the paragraph following it, and make that paragraph a list item. Because there is a difference between ISPs tracking the e-mail accounts provided by them and vulnerabilities in web clients.
Actually I'm not sure the last paragraph of section 1.2.1 is a compelling argument. Online authentication and phishing are difficult subjects that stretch way beyond e-mail. Web-based cryptocurrency wallets in particular have the same vulnerability and so may any applications using the WWAM protocol.
Funny, Maxime had the exact same train of thoughts on that sentence I remember having that discussion. I personally thought it was relevant in a way, as of today almost everyone uses a web based application for accessing their e-mails. Of course that' not a vulnerability of the protocol itself, it's more of an implementation problem and it does not belong in the same category as the other vulnerabilities exposed, but when it's so widely used it starts to become a relevant point, in my humble opinion