Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

Post reply on HN
Print view View original

191–200 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#191

Post by nyolfen »

newbie789 wrote: post #107

I’m aware that this is a very silly sounding question, but I’m very confused about what’s going on here. If the subject of this investigation had been using ProtonVPN to connect to ProtonMail, would this have (in a marginal way) protected their anonymity? If Proton Mail can be compelled to begin logging, surely the same must be said of Proton VPN right? It’s interesting how many “privacy focused” companies tout being…

> The “based in Switzerland” thing strikes me as a bit of a black box bit of marketing speak. How much time, energy and money did ProtonMail expend fighting this surreptitious logging mandate? Does “Swiss privacy” actualy mean anything if ProtonMail is happy to hand over your IP address when spooked?

it does not; witness the swiss banking system's capitulation to the US, crypto AG, etc

Re: Climate activist arrested after ProtonMail provided his IP address

#192

Post by dragonwriter »

znpy wrote: post #112
istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

In the US companies can make canary statement... https://en.wikipedia.org/wiki/Warrant_canary

> In the US companies can make canary statement...

What is far less clear is if you can trust the continuation of a canary statement to indicate the absence of the action it denies, since it is both legally disputed whether continuation of the statement could be mandated by government and because anyone who has an interest in the PR value of providing a canary statement also potentially has the same interest in continuing it as long as it is impractical to falsify.

Re: Climate activist arrested after ProtonMail provided his IP address

#193

Post by tephra »

istingray wrote: post #97
s1artibartfast wrote: post #75

Earlier quoted context omitted.

It's not misleading in that many services do keep records by default. If people don't understand what default means, they should grow their understanding, not be outraged that their uninformed opinion was wrong.

Default means "we do whatever the fuck we want, any assumptions are your fault"

I'm pretty sure it means that both the user and the company is bound by the terms of service and privacy policy that clearly spells out that they comply with legal warrants (from switz authorities) and provide the limited data that they are asked for if they have it (IPs being one such thing).

Re: Climate activist arrested after ProtonMail provided his IP address

#194

Post by pas »

dheera wrote: post #175
MattGaiser wrote: post #122

Earlier quoted context omitted.

I suspect that you can order to collect it going forward.

If they order to collect someone's data, can't ProtonMail just say "we've been ordered to collect data for a user" on the front page?

It depends on jurisdiction. For example the UK has the infamous gag orders that are even harder to fight in court (successfully) than their US counterparts.

Sure, ProtonMail and its current operators could opt to stop operating in such jurisdictions, but usually it's too late for that when you get the [secret] court order, because if you refuse the operators personally are quickly found in contempt of court (or whatever other bad legal circumstance), and eventually that can lead to similar InterPol/EuroPol (other MLAT) warrants.

Re: Climate activist arrested after ProtonMail provided his IP address

#195

Post by tephra »

pessimizer wrote: post #188
tephra wrote: post #79

Earlier quoted context omitted.

I mean they are misleading in so far you want them to... I'm a privacy activist and certainly think that a company should be able to not keep logs. If the law in the country they are in (or area, see for example the data retention directive in the EU) we should of course (and I am) work to change those laws. It should come as no surprise to anyone who is privacy minded and actively seek out privacy focused services t…

As a privacy activist, what's productive about arguing that protonmail shouldn't need to make a greater effort to pound into their customers' heads exactly what you just explained? I get that you think people should already know this, but do you feel they should be punished for not already knowing this, and not reminded by a company that markets itself on protecting its users? Protonmail was forced to get an IP addre…

They clearly spell out in their privacy policy that they respond to warrants....

> We will only disclose the limited user data we possess if we are instructed to do so by a fully binding request coming from the competent Swiss authorities (legal obligation). While we may comply with electronically delivered notices (see exceptions below), the disclosed data can only be used in court after we have received an original copy of the court order by registered post or in person, and provide a formal response.

It would also be nice if they were allowed to notify the customer but I'm not familiar enough with Swiss laws to know if they can.

Re: Climate activist arrested after ProtonMail provided his IP address

#196

Post by pessimizer »

feu wrote: post #176
caeril wrote: post #111

Earlier quoted context omitted.

...but we know it's possible under Swiss law, from this case, for them to be compelled to start logging specific account accesses, that they by default were not previously. How is that any different from them being compelled to disable or weaken clientside encryption? In both cases they're being compelled to make changes to their service. The camel's nose is clearly already under the tent. Everybody needs to start di…

[Deleted]

That's not the claim. The claim is that we don't know if X is possible under Swiss law. You seem to be the one claiming that because they said it's not possible, then it's not possible. If not, I don't know what you're claiming.

The GP says that it's possible under German law. Is it "FUD" to say that it could end up being possible under Swiss law?

Shouldn't there be fear, uncertainty, and doubt about any channel that activists use to communicate with each other?

Re: Climate activist arrested after ProtonMail provided his IP address

#197

Post by anothernewdude »

istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

"Also, our VPNs are useless"

Re: Climate activist arrested after ProtonMail provided his IP address

#198

Post by KeepFlying »

calvinmorrison wrote: post #185
cabalamat wrote: post #174

Earlier quoted context omitted.

I wonder how many TOR nodes are run by the NSA?

Doesn't matter if you are going to an internal onion address

Why not? It would just mean that the NSA needs to own more routers than it would to break TOR->Public internet routing.

From what I understand, connecting to an onion address 'just' involves 6 routers, not the typical 3. (Of course an oversimplification.)

Or am I misunderstanding your threat model here?

Re: Climate activist arrested after ProtonMail provided his IP address

#200

Post by Godel_unicode »

pseudalopex wrote: post #169
winrid wrote: post #165

Earlier quoted context omitted.

This is just not realistic, though.

Why not?

Because of the dirty little secret of protonmail; it's actually just privacy cosplay. If they told people what's actually involved in having a truly private email account, most of their customers would say screw it and go back to Gmail.
Post reply on HN