Climate activist arrested after ProtonMail provided his IP address • Hacker News Board

Re: Climate activist arrested after ProtonMail provided his IP address

#111

Post by caeril » Sun, Sep 05, 2021, 9:53 PM UTC

pgalvin wrote: post #84

aborsy wrote: post #62

Earlier quoted context omitted.

>> What the authorities can't do, is read that person's email. What if authorities ask, serve this user this malicious JacaScript code to obtain their encryption key? PM has to obey and the result is the same.

They claim this is not possible under Swiss law, fwiw. We’ve recently seen that it is possible under German law, with a competitor (Tutanota) building a server-side backdoor for one user.

...but we know it's possible under Swiss law, from this case, for them to be compelled to start logging specific account accesses, that they by default were not previously.

How is that any different from them being compelled to disable or weaken clientside encryption?

In both cases they're being compelled to make changes to their service.

The camel's nose is clearly already under the tent. Everybody needs to start diffing javascript served by them.

Re: Climate activist arrested after ProtonMail provided his IP address

#112

Post by znpy » Sun, Sep 05, 2021, 9:53 PM UTC

istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

In the US companies can make canary statement... https://en.wikipedia.org/wiki/Warrant_canary

Re: Climate activist arrested after ProtonMail provided his IP address

#113

Post by merb » Sun, Sep 05, 2021, 9:53 PM UTC

superflit wrote: post #78

CameronNemo wrote: post #21

Earlier quoted context omitted.

Protonmail and fastmail are different offerings. Proton offers encryption features, while fastmail makes no effort to promote encryption. So tutanota would be a good alternative to protonmail. And mailbox.org is a good alternative to fastmail. Both are based in Germany.

Occupied Germany is worse[1] Germany will handle your data as fast as you can order an hans schnitzel. [1] - https://militarybases.com/overseas/germany/

well posteo didn't. they tried to fight it as long as possible.

Re: Climate activist arrested after ProtonMail provided his IP address

#114

Post by dredmorbius » Sun, Sep 05, 2021, 9:54 PM UTC

Also mentioned in another submitted tweet:

https://nitter.eu/OnEstLaTech/status/1434575322465382404

Translation: "The company @ProtonMail delivered IPs of climate activists to the police, after which the activists were arrested and searched. ProtonMail claims on its website, however, that it does not store the IP addresses of its users."

Source (in French): https://secoursrouge.org/france-suisse-securite-it-protonmai...

Translation (via Google Translate):

The year 2020 and 2021 was marked by the establishment and repression of a series of occupations in the district of Place Sainte Marthe, in Paris, in order to fight against its gentrification. Some 20 people were arrested, three searches were carried out and several people were sentenced to suspended prison sentences or to fines of several thousand euros (more info here and here). In addition, seven people are on trial in early 2022 for “theft and degradation in assembly and home invasion” following the occupation of a with a file of more than 1000 pages. During the investigation, the police focused on the collective “Youth For Climate”. In particular, they were able to use photos published on Instagram, even if they were blurred because of the clothes.

The police also noticed that the collective communicated via a protonmail email address. They therefore sent a requisition (via EUROPOL) to the Swiss company managing the messaging system in order to find out the identity of the creator of the address. Protonmail responded to this request by providing the IP address and the fingerprint of the browser used by the collective. It is therefore imperative to go through the tor network (or at least a VPN) when using a Protonmail mailbox (or another secure mailbox) if you want to guarantee sufficient security.

(Disclaimer, Protonmail user.)

Re: Climate activist arrested after ProtonMail provided his IP address

#115

Post by throwawayswede » Sun, Sep 05, 2021, 9:54 PM UTC

This is seriously messed up. Purely because their marketing has been very aggressive to promote total and complete anonymity, directly sometimes and mostly indirectly. If it’s true that the French wording makes it seem like they don’t keep logs at all whatsoever, then I believe the person arrested has grounds to sue them, and I would hope they do. But even if not, I consider their marketing is a total and complete dark pattern from now on imo.

Tremendously disappointed.

What’s next? Is ddg selling search data to google?

Re: Climate activist arrested after ProtonMail provided his IP address

#116

Post by istingray » Sun, Sep 05, 2021, 9:55 PM UTC

acheron wrote: post #61

istingray wrote: post #26

Protonmail customer here. Sigh. This is why I keep my own domain and can point it wherever I need. Dear Protonmail, email is fucking cheap and easy, I pay you $58 a year to solve stupid shit like this. Vendors really need to figure out how to thread the needle of "No don't trust us" but still encourage customers to buy. Protonmail failed here. Apple's still very much in the "trust no one but us!" vibe, and it's just…

Where “this” in “solve stupid shit like this” is “hide you from police with a legally authorized warrant”? If you were relying on Protonmail to conceal evidence of criminal activity for you, you may not have thought that all the way through.

Where "this" is using soft language like "by default" to hide shortcomings. I expect Protonmail to do more to educate users to be aware of how surveillance happens, whether a rogue employee enables the function on their end, warrant, etc.

Re: Climate activist arrested after ProtonMail provided his IP address

#117

Post by londons_explore » Sun, Sep 05, 2021, 9:55 PM UTC

Cryptographers and developers need to step up their game...

There needs to be a messaging service where as well as the messages being encrypted, the graph of who is talking to who and when must be encrypted.

I'm imagining a system where your device forwards hundreds of messages for other people, hiding your own message flow.

I perhaps send a few hundred messages per day, and even multiplying that by 1000, and the typical message length of a few words, it's still a tiny amount of data transfer.

Re: Climate activist arrested after ProtonMail provided his IP address

#118

Post by dredmorbius » Sun, Sep 05, 2021, 9:55 PM UTC

znpy wrote: post #112

istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

In the US companies can make canary statement... https://en.wikipedia.org/wiki/Warrant_canary

The canary is dead, and the fact is widely publicised, if not necessarily well known.

Re: Climate activist arrested after ProtonMail provided his IP address

#119

Post by throwawayswede » Sun, Sep 05, 2021, 9:57 PM UTC

blondin wrote: post #105

okay. so today we are redefining what "not logging data" means. it changes meaning when used in the same sentence as the expression "by default". so by default, not logging data is not really not logging data. we've redefined quite a few things in the past few months. will be interesting to see where we go from here.

It has not really changed meaning. Asshole companies blatantly lying and using dark patterns only means one thing: that the company is a piece of trash and does not respect their customers.

Re: Climate activist arrested after ProtonMail provided his IP address

#120

Post by istingray » Sun, Sep 05, 2021, 9:57 PM UTC

znpy wrote: post #112

istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

In the US companies can make canary statement... https://en.wikipedia.org/wiki/Warrant_canary

Those canary things seem so 2018.

In 2021 the most powerful canary statement should be "Don't trust us. Seriously, treat us as an adversary. We still want you to be our customer of course, but here's how we really recommend you use our service, Tor, semi-anonymous payments, etc. In God we trust, for everyone else use math."