151–160 of 619 posts
I do not trust protonmail with my privacy. I only use them to sign up for various services, trying to escape the data mining google does.
Not sure I want to support a company that is dishonest however. I'm reaching the bye-bye point myself slowly but surely.
I suppose this would land them in hot water, but there might be something else really clever?
I’m aware that this is a very silly sounding question, but I’m very confused about what’s going on here. If the subject of this investigation had been using ProtonVPN to connect to ProtonMail, would this have (in a marginal way) protected their anonymity? If Proton Mail can be compelled to begin logging, surely the same must be said of Proton VPN right? It’s interesting how many “privacy focused” companies tout being…
I believe it comes about due to the old trope of Swiss banks being the most secure places to hide money, which of course is not true and hasn't been for a long time. Even in that period, I am sure they complied with Interpol/Europol requests to divulge account details of evil masterminds with a beeellion dollars hidden away in a Swiss vault.
this seems to be the reply from protonmail on reddit[0]
>Hi everyone, Proton team here. We are also deeply concerned about this case. In the interest of transparency, here's some more context.
In this case, Proton received a legally binding order from the Swiss Federal Department of Justice which we are obligated to comply with. Details about how we handle Swiss law enforcement requests can found in our transparency report:
https://protonmail.com/blog/transparency-report/
Transparency with the user community is extremely important to us and we have been publishing a transparency report since 2015.
As detailed in our transparency report, our published threat model, and also our privacy policy, under Swiss law, Proton can be forced to collect info on accounts belonging to users under Swiss criminal investigation. This is obviously not done by default, but only if Proton gets a legal order for a specific account. Under no circumstances however, can our encryption be bypassed.
Our legal team does in fact screen all requests that we receive but in this case, it appears that an act contrary to Swiss law did in fact take place (and this was also the determination of the Federal Department of Justice which does a legal review of each case). This means we did not have grounds to refuse the request. Thus Swiss law gives us no possibility to appeal this particular request.
The prosecution in this case seems quite aggressive. Unfortunately, this is a pattern we have increasingly seen in recent years around the world (for example in France where terror laws are inappropriately used). We will continue to campaign against such laws and abuses.
to me this seems like they did all the could in regards to handling this request.
[0]https://www.reddit.com/r/ProtonMail/comments/pil6xi/climate_...
Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…
TBH in 2021 people engaging in potentially dangerous activities should be literate enough to understand, that no business will guarantee them full security and decline all requests from authorities to disclose their identity. The wording you suggest is equivalent of „do not dry your cat in microwave“ instruction - a legal protection from dumb customers, that does not contribute meaningfully to safety. For the non-Swi…
Earlier quoted context omitted.
TBH in 2021 people engaging in potentially dangerous activities should be literate enough to understand, that no business will guarantee them full security and decline all requests from authorities to disclose their identity. The wording you suggest is equivalent of „do not dry your cat in microwave“ instruction - a legal protection from dumb customers, that does not contribute meaningfully to safety. For the non-Swi…
It’s not protection FROM your customers. It is protection FOR your customers. Most customers are not technically astute
The „opt-in“ part for login logs is particularly interesting, because in fact Proton recommends this as a security best practice. Whether it’s in the best interest of the customer or not, it’s an open question. I would say, in a risk model, where threat of human rights violation by Swiss government is much lower than risks of unauthorized party accessing the account, it makes sense. Tough luck for the criminals that followed this advice.
So with FastMail under Australian privacy-bashing laws and now this, what are our options for secure, private e-mail?
Honest question, because I've been asking it of myself: what do you expect from such a service? I basically decided to just give up. Email is an insecure protocol and there's not much that can be done about it. Choosing a "secure" email provider feels like choosing a "secure" VPN provider: it's impossible to verify the provider's claims so it's a kind of security theatre.
Notionally, I would imagine something that looks like "email" and acts like "e-mail" (to the end user) could eventually exist that provides the same (conceptual) security that the Signal protocol provides (and perhaps a hosting provider option that's the same level of user confidentiality that we get the Signal foundation), although you're correct that foundationally it would be a different protocol. Backwards-compatibility would be required, at least for seamless transition (perhaps represented as "secure" and "plaintext")
Wasn't Ladar Levison (the individual behind Lavabit) working on something like this? https://darkmail.info/
Earlier quoted context omitted.
Tor is a State Dept/DARPA project, so at best a sidegrade from Proton if your concern is being surveilled by Western governments.
Tor is open source. Point to the vulnerability you are claiming, or stop spreading FUD.
Disclaimer: I have a ProtonMail account that I pay for. I have seen a ton of disturbing pieces about ProtonMail. Every time I've looked into them, they seem to be maliciously motivated and usually not true, or otherwise twisting of the truth. This has been a confusing thing for me because why is there a small subset of people so vehemently against them? In this case, I'm not surprised. They say quite clearly they can…
I'm also a Protonmail customer. Tor solves this. Protonmail's Tor support is lukewarm. They have a Tor based login without captchas. It's mentioned on their homepage in the bottom menu under "Onion Site", (/tor). And there's one blog post from 2017 that still promotes their v2/shorter onion address. I expect Protonmail to push its users to login through Tor. "Don't trust us, trust math". Embed Tor support in their ap…