Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

Post reply on HN
Print view View original

11–20 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#11

Post by ramesh31 »

bawolff wrote: post #3
josephcsible wrote: post #2

Has ProtonMail done anything wrong themselves, or is this just a case of them existing in the wrong country? If they refused to cooperate, could the government have just seized their servers and collected the data they wanted themselves?

I think the argument is that their advertising is misleading (i.e. if they really didn't keep logs, there would be nothing to hand over)

Anyone who ever says "we don't log" is definitely logging, and that statement alone should tell you that they are untrustworthy. No one is stupid enough to take on that kind of liability. The same applies for VPNs.

If you need trust, theres no way around rolling your own service.

Re: Climate activist arrested after ProtonMail provided his IP address

#12

Post by goldcd »

josephcsible wrote: post #2

Has ProtonMail done anything wrong themselves, or is this just a case of them existing in the wrong country? If they refused to cooperate, could the government have just seized their servers and collected the data they wanted themselves?

Legally nothing wrong - but they've maybe been a bit disingenuous to their users.

However, better than most (both by jurisdiction and their own rules) than other email providers - and I'd have thought any of their users who were serious about anonymity would have used Tor/Tails etc to connect anyway and used pgp for their messages.

Details of connections to the account (IP and connection fingerprint) shouldn't matter if you were taking your privacy seriously.

Basically just signing up for protonmail doesn't make you secure and there's nothing they could do to help if you just rely on that.

Re: Climate activist arrested after ProtonMail provided his IP address

#13

Post by drexlspivey »

ramesh31 wrote: post #11
bawolff wrote: post #3

Earlier quoted context omitted.

I think the argument is that their advertising is misleading (i.e. if they really didn't keep logs, there would be nothing to hand over)

Anyone who ever says "we don't log" is definitely logging, and that statement alone should tell you that they are untrustworthy. No one is stupid enough to take on that kind of liability. The same applies for VPNs. If you need trust, theres no way around rolling your own service.

Logging is the liability not the other way around. You can’t be forced to hand over something you don’t have

Re: Climate activist arrested after ProtonMail provided his IP address

#14

Post by Raed667 »

drexlspivey wrote: post #13
ramesh31 wrote: post #11

Earlier quoted context omitted.

Anyone who ever says "we don't log" is definitely logging, and that statement alone should tell you that they are untrustworthy. No one is stupid enough to take on that kind of liability. The same applies for VPNs. If you need trust, theres no way around rolling your own service.

Logging is the liability not the other way around. You can’t be forced to hand over something you don’t have

You can be forced to log though.

I'm not sure how your tech-stack has to look like for you to claim that you can't log IP addresses and user-agents etc...

Re: Climate activist arrested after ProtonMail provided his IP address

#15

Post by kafkaIncarnate »

kdunglas wrote: post #9
dogma1138 wrote: post #6

Earlier quoted context omitted.

They never advertised that they don’t keep logs they just said they aren’t permanent, in fact you can view your own connection logs if you enable it in which case they are maintained forever. https://protonmail.com/privacy-policy They also provide a report of all warrants received https://protonmail.com/blog/transparency-report/

They claim that they don’t keep logs on their French homepage. The climate activist is French: https://twitter.com/onestlatech/status/1434596410977030155?s... And even on their English website, the marketing is misleading. They say that the service is "anonymous" and also: "By default, we do not keep any IP logs which can be linked to your anonymous email account".

REALLY misleading. They created this feature for Mr. Robot, the TV show, too:

https://protonmail.com/blog/protonmail-mr-robot-secure-email...

Scroll down to comment:

> Liam, October 14, 2015 at 10:30 PM

> But https://protonmail.com/security-details page says “No tracking or logging of personally identifiable information. Unlike competing services, we do not save any tracking information. We do not record metadata such as the IP addresses used to log into accounts.” So, now it turns to be that you introduced tracking and logging? Is this data encrypted as well?

> Admin, October 17, 2015 at 9:14 PM

> We don’t save any of this data by default, the user must explicitly turn it on for us to save it.

There should be a reasonable assumption that given they have end-to-end encryption for the service, they just encrypt the logging for the user and store it encrypted without the key themselves like they do the emails.

Also to note, they at least have an onion link to use their email service.

Re: Climate activist arrested after ProtonMail provided his IP address

#16

Post by gregsadetsky »

kdunglas wrote: post #9
dogma1138 wrote: post #6

Earlier quoted context omitted.

They never advertised that they don’t keep logs they just said they aren’t permanent, in fact you can view your own connection logs if you enable it in which case they are maintained forever. https://protonmail.com/privacy-policy They also provide a report of all warrants received https://protonmail.com/blog/transparency-report/

They claim that they don’t keep logs on their French homepage. The climate activist is French: https://twitter.com/onestlatech/status/1434596410977030155?s... And even on their English website, the marketing is misleading. They say that the service is "anonymous" and also: "By default, we do not keep any IP logs which can be linked to your anonymous email account".

The CEO's position on Twitter is that "by default" (from the sentence you're quoting) means when there is no criminal investigation, but when there is a legal order in place, Protonmail will collect the IP...

https://twitter.com/andyyen/status/1434600373059297284

"As described in the link above, under Swiss law, we can be forced to collect info on accounts belonging to users under criminal investigation. This is obviously not done by default, but only if we get a legal order."

Activists beware.

Re: Climate activist arrested after ProtonMail provided his IP address

#19

Post by civilized »

gregsadetsky wrote: post #16
kdunglas wrote: post #9

Earlier quoted context omitted.

They claim that they don’t keep logs on their French homepage. The climate activist is French: https://twitter.com/onestlatech/status/1434596410977030155?s... And even on their English website, the marketing is misleading. They say that the service is "anonymous" and also: "By default, we do not keep any IP logs which can be linked to your anonymous email account".

The CEO's position on Twitter is that "by default" (from the sentence you're quoting) means when there is no criminal investigation, but when there is a legal order in place, Protonmail will collect the IP... https://twitter.com/andyyen/status/1434600373059297284 "As described in the link above, under Swiss law, we can be forced to collect info on accounts belonging to users under criminal investigation. This is obvi…

"We won't keep logs on you, except if you're in trouble with The Authorities, then we'll definitely keep logs on you and rat you out"

Weird definition of privacy we've got going these days

Re: Climate activist arrested after ProtonMail provided his IP address

#20

Post by salawat »

gregsadetsky wrote: post #16
kdunglas wrote: post #9

Earlier quoted context omitted.

They claim that they don’t keep logs on their French homepage. The climate activist is French: https://twitter.com/onestlatech/status/1434596410977030155?s... And even on their English website, the marketing is misleading. They say that the service is "anonymous" and also: "By default, we do not keep any IP logs which can be linked to your anonymous email account".

The CEO's position on Twitter is that "by default" (from the sentence you're quoting) means when there is no criminal investigation, but when there is a legal order in place, Protonmail will collect the IP... https://twitter.com/andyyen/status/1434600373059297284 "As described in the link above, under Swiss law, we can be forced to collect info on accounts belonging to users under criminal investigation. This is obvi…

Once again: if you can't see their server software, you should assume they are FOS, and are capable of recording anything.

Also: One more reason NAT was a good thing over IPv6. The closer we get to the platonic ideal of "UUID per person" the more likely justice systems will use it that way.

The day everyone learns how to self-host mail on ephemeral compute instances is the day law enforcement starts requiring MX domain logs to be maintained in a historical manner. Work around that magically, and some law'll go on the books to try to tame the super spooky criminal communicators hiding from law enforcement.

This is why we can't have nice things.

Post reply on HN