Climate activist arrested after ProtonMail provided his IP address • Hacker News Board

Re: Climate activist arrested after ProtonMail provided his IP address

#101

Post by Sebb767 » Sun, Sep 05, 2021, 9:47 PM UTC

blacklion wrote: post #35

gigel82 wrote: post #18

So with FastMail under Australian privacy-bashing laws and now this, what are our options for secure, private e-mail?

Your own self-hosted service on rented server / cloud instance? AFAIU (IANAL!!!) you can refuse to give evidences against yourself in most jurisdictions. I don't thinks that dedicated server provider (like Hetzner) or cloud provider (like Digital Ocean or Vultr) stores traffic logs with enough details to be useful in such case. But payment will be a problem...

You can't be compelled to incriminate yourself, but your server provider can very much be compelled to give access to the server. And once the server is physically compromised the battle is lost, anyway, but in that case probably with a larger papertrail leading to you.

One expensive but possible option would be to build a server yourself with sufficient traps to shut off when it's tapered with. Then set it up with full disk encryption and put it in a shared rack.

Re: Climate activist arrested after ProtonMail provided his IP address

#102

Post by istingray » Sun, Sep 05, 2021, 9:48 PM UTC

sigmoid10 wrote: post #96

istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

People really don't seem to understand that Protonmail is a western company in a western country with pretty generous surveillance laws. Yes, your email text may be encrypted, but everything else is free game to the authorities unless you use additional protection.

Protonmail should be pushing more of this messaging in their branding. "Don't trust us further than you can throw us. We're doing our best, and here's what we recommend, use Tor, etc."

Re: Climate activist arrested after ProtonMail provided his IP address

#103

Post by nicce » Sun, Sep 05, 2021, 9:48 PM UTC

mikl wrote: post #30

I guess there isn’t much Protonmail can do if the prosecutor shows up with an ~Interpol~ Europol warrant. I wonder what this “activist” did to earn himself Europol attention. At least before the world went insane, that would only happen for serious crimes.

If you don’t collect data, you can’t give it even if you wanted?

Re: Climate activist arrested after ProtonMail provided his IP address

#104

Post by jonas21 » Sun, Sep 05, 2021, 9:49 PM UTC

tephra wrote: post #53

polote wrote: post #50

Earlier quoted context omitted.

One of the first sentence on their website is "By default, we do not keep any IP logs". If as soon as police show up (Which is almost the only case that people would want their IP hidden) they give IP logs, it is clearly false advertising. The fact that only the anonymous feature is important to you will not change the fact that they do the opposite of what they advertise regarding IP logs

So also a proton customer here. "By default we do not keep any IP logs" and this case does not seem like the default? Seems like they were required to by law to log and turn over this specific IP? (Of course I haven't seen the actual case but I would assume that meant a warrant.)

As a user, I'd take that to mean that they wouldn't keep any IP logs unless I turned logging on. I wouldn't expect that they would enable logging on their own.

Interestingly, ProtonMail's privacy policy lists a number of cases in which they may log your IP address permanently (including if you breach their Terms and Conditions). But a request from law enforcement is not one them.

Re: Climate activist arrested after ProtonMail provided his IP address

#105

Post by blondin » Sun, Sep 05, 2021, 9:50 PM UTC

okay.

so today we are redefining what "not logging data" means. it changes meaning when used in the same sentence as the expression "by default". so by default, not logging data is not really not logging data.

we've redefined quite a few things in the past few months. will be interesting to see where we go from here.

Re: Climate activist arrested after ProtonMail provided his IP address

#106

Post by rad_gruchalski » Sun, Sep 05, 2021, 9:50 PM UTC

Question: is it possible they do not log any of the data but were required to capture it on the next login? All the talk here implicitly assumes ProtonMail provided historical information.

Re: Climate activist arrested after ProtonMail provided his IP address

#107

Post by newbie789 » Sun, Sep 05, 2021, 9:51 PM UTC

I’m aware that this is a very silly sounding question, but I’m very confused about what’s going on here.

If the subject of this investigation had been using ProtonVPN to connect to ProtonMail, would this have (in a marginal way) protected their anonymity? If ProtonMail can be compelled to begin logging, surely the same must be said of ProtonVPN right?

It’s interesting how many “privacy focused” companies tout being based in Switzerland as some big badge of honor, which a layman consumer such as myself is supposed to be really impressed by due to the overall reputation of “Swiss privacy laws.”

In practice, I’ve never been to Switzerland. I don’t know any person that has had any legal issues there, let alone someone that’s litigated a digital privacy case there. I do not speak German or French, and don’t know where to start when it comes to looking up specific cases or court proceedings, so I’d be extremely slow on the uptake of the actual ins and outs of how the Swiss privacy model works from a practical standpoint.

The “based in Switzerland” thing strikes me as a bit of a black box bit of marketing speak. How much time, energy and money did ProtonMail expend fighting this surreptitious logging mandate? Does “Swiss privacy” actualy mean anything if ProtonMail is happy to hand over your IP address when spooked?

Re: Climate activist arrested after ProtonMail provided his IP address

#108

Post by IlliOnato » Sun, Sep 05, 2021, 9:52 PM UTC

lelandfe wrote: post #76

COGlory wrote: post #59

Earlier quoted context omitted.

No, if they were not collecting logs by default, then it is clearly not false advertising.

Technically correct but misleading. They tout that off-by-default statement on their homepage, underneath the header of "Anonymous Email," with the closing sentence of "Your privacy comes first." So why even market that? It provides no meaningful security.

Were _you_ mislead by this? Did you really expect a Switzerland-based company not to comply with law of the land?

There is a difference between "available to police, not retroactively, and only with a valid warrant" and "available to any government agency constantly and in bulk, as well as to data-collecting commercial entities, Russian and Chinese hackers, and their dogs". Don't you agree?

Re: Climate activist arrested after ProtonMail provided his IP address

#109

Post by luckylion » Sun, Sep 05, 2021, 9:52 PM UTC

drexlspivey wrote: post #45

Raed667 wrote: post #14

Earlier quoted context omitted.

You can be forced to log though. I'm not sure how your tech-stack has to look like for you to claim that you can't log IP addresses and user-agents etc...

Some VPN providers run their servers without hard drives.

Thank god their servers aren't on a network where they could simply send the log entries to a different server.

That's a cute idea, but it won't get them out of complying with a warrant.

Re: Climate activist arrested after ProtonMail provided his IP address

#110

Post by rileyphone » Sun, Sep 05, 2021, 9:52 PM UTC

vntok wrote: post #95

neltnerb wrote: post #80

Earlier quoted context omitted.

That your emails are supposedly stored encrypted, that if other services support it end-to-end email encryption supposedly can be enabled easily, and that supposedly you cannot be served targeted ads because they cannot read the contents of your email (not that they have ads anyway). Of course Protonmail is accessible via Tor. Not that you should need to do that to remain private.

> That your emails are supposedly stored encrypted, that if other services support it end-to-end email encryption supposedly can be enabled easily, and that supposedly you cannot be served targeted ads because they cannot read the contents of your email (not that they have ads anyway). Gmail does all of this for free though, right?

The last point very much not so - having my email provided as a free product by the world's largest ad company isn't a relationship I want to pursue.