Climate activist arrested after ProtonMail provided his IP address • Hacker News Board

Re: Climate activist arrested after ProtonMail provided his IP address

#71

Post by istingray » Sun, Sep 05, 2021, 9:27 PM UTC

tephra wrote: post #53

polote wrote: post #50

Earlier quoted context omitted.

One of the first sentence on their website is "By default, we do not keep any IP logs". If as soon as police show up (Which is almost the only case that people would want their IP hidden) they give IP logs, it is clearly false advertising. The fact that only the anonymous feature is important to you will not change the fact that they do the opposite of what they advertise regarding IP logs

So also a proton customer here. "By default we do not keep any IP logs" and this case does not seem like the default? Seems like they were required to by law to log and turn over this specific IP? (Of course I haven't seen the actual case but I would assume that meant a warrant.)

If this doesn't matter, what's important for you about being a Protonmail customer?

(also a paying Protonmail customer)

Re: Climate activist arrested after ProtonMail provided his IP address

#72

Post by vmoore » Sun, Sep 05, 2021, 9:27 PM UTC

You can disable the recording of login sessions in Protonmail's settings dashboard. I do that, not only to avoid Protonmail learning of the logs, but by a hacker who, once upon breaching your account; also gets to learn the IP you use to login with.

Re: Climate activist arrested after ProtonMail provided his IP address

#73

Post by istingray » Sun, Sep 05, 2021, 9:28 PM UTC

polote wrote: post #60

tephra wrote: post #53

Earlier quoted context omitted.

So also a proton customer here. "By default we do not keep any IP logs" and this case does not seem like the default? Seems like they were required to by law to log and turn over this specific IP? (Of course I haven't seen the actual case but I would assume that meant a warrant.)

We do not kill people except the people we kill I see that you want to protect Protonmail, but if they want to stop being misleading they can just remove the IP log sentence

Put "By default we don't keep IP, but may be required to by local laws. We suggest you connect through Protonmail through Tor".

I would much prefer this, as a Protonmail paying customer.

Re: Climate activist arrested after ProtonMail provided his IP address

#74

Post by freshhawk » Sun, Sep 05, 2021, 9:28 PM UTC

blub wrote: post #33

If you think that's bad, Tutanota was forced by the court to change their SW, so that all incoming e-mails for a specific account would be intercepted before encryption: https://news.ycombinator.com/item?id=27303712

Hushmail had a similar warrant, they changed their login form so it would send the password in the clear to the server, which they used to decrypt the mail and logged all the traffic to help trace the user. If you get targeted these "anonymous" email services aren't going to be good for much in practice.

Re: Climate activist arrested after ProtonMail provided his IP address

#75

Post by s1artibartfast » Sun, Sep 05, 2021, 9:29 PM UTC

polote wrote: post #60

tephra wrote: post #53

Earlier quoted context omitted.

So also a proton customer here. "By default we do not keep any IP logs" and this case does not seem like the default? Seems like they were required to by law to log and turn over this specific IP? (Of course I haven't seen the actual case but I would assume that meant a warrant.)

We do not kill people except the people we kill I see that you want to protect Protonmail, but if they want to stop being misleading they can just remove the IP log sentence

It's not misleading in that many services do keep records by default. If people don't understand what default means, they should grow their understanding, not be outraged that their uninformed opinion was wrong.

Re: Climate activist arrested after ProtonMail provided his IP address

#76

Post by lelandfe » Sun, Sep 05, 2021, 9:29 PM UTC

COGlory wrote: post #59

polote wrote: post #55

Earlier quoted context omitted.

The end result is the same either way

No, if they were not collecting logs by default, then it is clearly not false advertising.

Technically correct but misleading.

They tout that off-by-default statement on their homepage, underneath the header of "Anonymous Email," with the closing sentence of "Your privacy comes first."

So why even market that? It provides no meaningful security.

Re: Climate activist arrested after ProtonMail provided his IP address

#77

Post by istingray » Sun, Sep 05, 2021, 9:30 PM UTC

Disclaimer: Paying Protonmail customer

Their homepage says "By default, we do not keep any IP logs"

In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself.

Replace immediately with "By default we don't log IP, but may be required to by local law enforcement. We recommend everyone connect through Protonmail through Tor. This month, 60% of our users connected through Tor".

Re: Climate activist arrested after ProtonMail provided his IP address

#78

Post by superflit » Sun, Sep 05, 2021, 9:31 PM UTC

CameronNemo wrote: post #21

gigel82 wrote: post #18

So with FastMail under Australian privacy-bashing laws and now this, what are our options for secure, private e-mail?

Protonmail and fastmail are different offerings. Proton offers encryption features, while fastmail makes no effort to promote encryption. So tutanota would be a good alternative to protonmail. And mailbox.org is a good alternative to fastmail. Both are based in Germany.

Occupied Germany is worse[1]

Germany will handle your data as fast as you can order an hans schnitzel.

[1] - https://militarybases.com/overseas/germany/

Re: Climate activist arrested after ProtonMail provided his IP address

#79

Post by tephra » Sun, Sep 05, 2021, 9:31 PM UTC

polote wrote: post #60

tephra wrote: post #53

Earlier quoted context omitted.

So also a proton customer here. "By default we do not keep any IP logs" and this case does not seem like the default? Seems like they were required to by law to log and turn over this specific IP? (Of course I haven't seen the actual case but I would assume that meant a warrant.)

We do not kill people except the people we kill I see that you want to protect Protonmail, but if they want to stop being misleading they can just remove the IP log sentence

I mean they are misleading in so far you want them to...

I'm a privacy activist and certainly think that a company should be able to not keep logs. If the law in the country they are in (or area, see for example the data retention directive in the EU) we should of course (and I am) work to change those laws.

It should come as no surprise to anyone who is privacy minded and actively seek out privacy focused services that are located within the EU or Switzerland that your IP (or other information) can be requested with a warrant and that a company is required to hand that over.

Re: Climate activist arrested after ProtonMail provided his IP address

#80

Post by neltnerb » Sun, Sep 05, 2021, 9:31 PM UTC

istingray wrote: post #71

tephra wrote: post #53

Earlier quoted context omitted.

So also a proton customer here. "By default we do not keep any IP logs" and this case does not seem like the default? Seems like they were required to by law to log and turn over this specific IP? (Of course I haven't seen the actual case but I would assume that meant a warrant.)

If this doesn't matter, what's important for you about being a Protonmail customer? (also a paying Protonmail customer)

That your emails are supposedly stored encrypted, that if other services support it end-to-end email encryption supposedly can be enabled easily, and that supposedly you cannot be served targeted ads because they cannot read the contents of your email (not that they have ads anyway).

Of course Protonmail is accessible via Tor. Not that you should need to do that to remain private.