Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

Post reply on HN
Print view View original

171–180 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#171

Post by istingray »

cortesoft wrote: post #160
istingray wrote: post #43

Earlier quoted context omitted.

I'm also a Protonmail customer. Tor solves this. Protonmail's Tor support is lukewarm. They have a Tor based login without captchas. It's mentioned on their homepage in the bottom menu under "Onion Site", (/tor). And there's one blog post from 2017 that still promotes their v2/shorter onion address. I expect Protonmail to push its users to login through Tor. "Don't trust us, trust math". Embed Tor support in their ap…

What does using Tor have to do with trusting math?

"What makes Tor different from the usual thesaurus-full of government projects is that Tor is essentially a very elaborate math trick, using layers of math puzzles to create a network-within-the-network. That math is being implemented in front of a global audience of millions of sophisticated watchers. It is likely the most examined codebase in the world. It has been subjected to multiple public audits. The math, well known and widely standardized, will work for everyone, or it will not, whoever pays the bills."

from https://pando.com/2014/12/09/clearing-the-air-around-tor/

Re: Climate activist arrested after ProtonMail provided his IP address

#172

Post by alfiedotwtf »

I'm looking forward to the day where email is not mistakenly used for clandestine communication.

Why hasn't there been made a Tor-only, store-and-forward, text-only communication app? You'd think this would be a no-brainer for communities that need real private communications.

Re: Climate activist arrested after ProtonMail provided his IP address

#173

Post by Barrin92 »

sigmoid10 wrote: post #96
istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

People really don't seem to understand that Protonmail is a western company in a western country with pretty generous surveillance laws. Yes, your email text may be encrypted, but everything else is free game to the authorities unless you use additional protection.

I wonder how long the 'Swiss privacy' brand, which seems to be fairly valuable will hold if these things keep happening, I had to immediately think of Crypto AG

https://en.wikipedia.org/wiki/Crypto_AG

Re: Climate activist arrested after ProtonMail provided his IP address

#174

Post by cabalamat »

istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

I wonder how many TOR nodes are run by the NSA?

Re: Climate activist arrested after ProtonMail provided his IP address

#175

Post by dheera »

MattGaiser wrote: post #122
nicce wrote: post #103

Earlier quoted context omitted.

If you don’t collect data, you can’t give it even if you wanted?

I suspect that you can order to collect it going forward.

If they order to collect someone's data, can't ProtonMail just say "we've been ordered to collect data for a user" on the front page?

Re: Climate activist arrested after ProtonMail provided his IP address

#176

Post by feu »

caeril wrote: post #111
pgalvin wrote: post #84

Earlier quoted context omitted.

They claim this is not possible under Swiss law, fwiw. We’ve recently seen that it is possible under German law, with a competitor (Tutanota) building a server-side backdoor for one user.

...but we know it's possible under Swiss law, from this case, for them to be compelled to start logging specific account accesses, that they by default were not previously. How is that any different from them being compelled to disable or weaken clientside encryption? In both cases they're being compelled to make changes to their service. The camel's nose is clearly already under the tent. Everybody needs to start di…

[Deleted]

Re: Climate activist arrested after ProtonMail provided his IP address

#177

Post by lelandfe »

ivan_gammel wrote: post #162
Thorrez wrote: post #155

Earlier quoted context omitted.

Sure, the wording istingray suggested is a bit over the top. But the existing wording "By default, we do not keep any IP logs" is misleading. Why even say it? They should simply delete it.

How do you understand „by default“ and „keep“ in this phrase? Does it actually mean that they do not collect the logs?

My first reading of "by default" here is that I can optionally enable it through my account.

Really, it's a phrase that means 3 things: I can enable it, ProtonMail can enable it[0], or the authorities can compel ProtonMail to enable it.

Saying any of that, or at least linking to a page that does, would be a smart move.

[0] https://protonmail.com/privacy-policy - "IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions"

Re: Climate activist arrested after ProtonMail provided his IP address

#178

Post by ipaddr »

kazen44 wrote: post #131
hh3k0 wrote: post #85

Earlier quoted context omitted.

Stop trying to defend indefensible behavior by getting hung up on semantics. I, for one, will not renew my ProtonMail account if that's their status quo.

what other status quo do you expect from them? Having to provide IP logs after a warrant has been issued is the law in switserland (and most if not all of the EU). Sure, the law would (hopefully) be changed, but at the moment, this is the best they can legally do?

Tell users you are being logged on website.

Put alert warning that account has logging enabled

Change the service so collecting logs is not possible

Stop adding captcha to tor users login because you want to identify users

Re: Climate activist arrested after ProtonMail provided his IP address

#179

Post by pessimizer »

shadowgovt wrote: post #148
akimball wrote: post #135

Earlier quoted context omitted.

It’s not protection FROM your customers. It is protection FOR your customers. Most customers are not technically astute

A corporation is a power centralization, and government authority can lean on power centralization. In general, regardless of what their TOS say, never believe that a corporation can't be compelled by the law to do anything they could physically do. CEOs can be jailed; when's the last time we heard of one actually going to jail over user privacy?

The point being made agrees with you, and is just saying that since protonmail can't help but obey sometimes, they should make the effort to educate their customers about that fact and whatever their customers can personally do to mitigate the risks of that fact.

Re: Climate activist arrested after ProtonMail provided his IP address

#180

Post by [deleted] »

chrononaut wrote: post #137
u_r_dumb wrote: post #10

Earlier quoted context omitted.

Literally on their front page: > No personal information is required to create your secure email account. By default, we do not keep any IP logs which can be linked to your anonymous email account. Your privacy comes first.

> No personal information is required to create your secure email account. Except your phone number? That's highly personal. https://news.ycombinator.com/item?id=28428092 (I recall encountering this too when creating an account a few months ago.)

[deleted]
Post reply on HN