Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

Post reply on HN
Print view View original

211–220 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#211

Post by istingray »

tephra wrote: post #183
istingray wrote: post #71

Earlier quoted context omitted.

If this doesn't matter, what's important for you about being a Protonmail customer? (also a paying Protonmail customer)

I never said it didn't matter. I think the data retention laws and for what crimes the police are able to get certain warrants in the EU and Switzerland can be better. But that is not a proton issue that is an issue with our current governments.

Ah I see. It's an issue for my use of Protonmail, in that I may cancel and move to another vendor who is more forthright. Here's what I would expect my future vendor to say about this:

"Hey, we respect your needs. However, we have to tell you that you should treat us as a bit of an adversary. We will do what we can as a private company, but ultimately we can be compelled by the government, rogue employee, or if somehow we get hacked. This is the case for any company no matter what they promise or avoid telling you. We do tell you. As our customer, here's what we recommend you do: Use Tor, fund open source, vote, etc."

Re: Climate activist arrested after ProtonMail provided his IP address

#212

Post by [deleted] »

gregsadetsky wrote: post #16
kdunglas wrote: post #9

Earlier quoted context omitted.

They claim that they don’t keep logs on their French homepage. The climate activist is French: https://twitter.com/onestlatech/status/1434596410977030155?s... And even on their English website, the marketing is misleading. They say that the service is "anonymous" and also: "By default, we do not keep any IP logs which can be linked to your anonymous email account".

The CEO's position on Twitter is that "by default" (from the sentence you're quoting) means when there is no criminal investigation, but when there is a legal order in place, Protonmail will collect the IP... https://twitter.com/andyyen/status/1434600373059297284 "As described in the link above, under Swiss law, we can be forced to collect info on accounts belonging to users under criminal investigation. This is obvi…

[deleted]

Re: Climate activist arrested after ProtonMail provided his IP address

#213

Post by dangero »

shiado wrote: post #189
istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

I once tried to create a Protonmail account over TOR and I believe they require a phone number from 'malicious' IPs so if you want anonymity Protonmail is not the service for you.

If they don’t do this then spammers will use their service en masse and degrade the service for all customers by black holing their ips and domain through all other email providers.

Re: Climate activist arrested after ProtonMail provided his IP address

#214

Post by georgyo »

anothernewdude wrote: post #197
istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

"Also, our VPNs are useless"

_all_ VPNs are useless. They are the biggest security theater and a massive success of marketing. But really, it's completely bazaar to trust a VPN provider.

They provide protection from your local network, but you they can do all the same things and more.

Re: Climate activist arrested after ProtonMail provided his IP address

#215

Post by istingray »

dangero wrote: post #213
shiado wrote: post #189

Earlier quoted context omitted.

I once tried to create a Protonmail account over TOR and I believe they require a phone number from 'malicious' IPs so if you want anonymity Protonmail is not the service for you.

If they don’t do this then spammers will use their service en masse and degrade the service for all customers by black holing their ips and domain through all other email providers.

Too bad, figure out a way to solve for it. I'm paying for private email service, not a pretty picture of the Swiss Alps on their website.

If they don't provide it, someone else will, and I'll pay them instead. This isn't the Hotmail age where everyone expects free email.

Re: Climate activist arrested after ProtonMail provided his IP address

#216

Post by chrononaut »

Sebb767 wrote: post #101
blacklion wrote: post #35

Earlier quoted context omitted.

Your own self-hosted service on rented server / cloud instance? AFAIU (IANAL!!!) you can refuse to give evidences against yourself in most jurisdictions. I don't thinks that dedicated server provider (like Hetzner) or cloud provider (like Digital Ocean or Vultr) stores traffic logs with enough details to be useful in such case. But payment will be a problem...

You can't be compelled to incriminate yourself, but your server provider can very much be compelled to give access to the server. And once the server is physically compromised the battle is lost, anyway, but in that case probably with a larger papertrail leading to you. One expensive but possible option would be to build a server yourself with sufficient traps to shut off when it's tapered with. Then set it up with f…

> .. and put it in a shared rack

What would be the benefit of being in a shared rack? Wouldn't the service provider still know which physical system is yours if you only rented a 1/2/3U space? (Or is there an advantage at a network layer?)

Re: Climate activist arrested after ProtonMail provided his IP address

#217

Post by [deleted] »

Godel_unicode wrote: post #200
pseudalopex wrote: post #169

Earlier quoted context omitted.

Why not?

Because of the dirty little secret of protonmail; it's actually just privacy cosplay. If they told people what's actually involved in having a truly private email account, most of their customers would say screw it and go back to Gmail.

[deleted]

Re: Climate activist arrested after ProtonMail provided his IP address

#218

Post by istingray »

ivan_gammel wrote: post #128
istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

TBH in 2021 people engaging in potentially dangerous activities should be literate enough to understand, that no business will guarantee them full security and decline all requests from authorities to disclose their identity. The wording you suggest is equivalent of „do not dry your cat in microwave“ instruction - a legal protection from dumb customers, that does not contribute meaningfully to safety. For the non-Swi…

The problem is that engaging in "potentially dangerous activities" includes such a wide range of people. Think about a journalist in Afghanistan, a whisteblower in the USA, or a human rights activist in China. They're all engaging in potentially dangerous activities. Are they "dumb" because they don't understand all the ins and outs of surveillance? How about some empathy for them as users?

The proposed statement above is intended to help people like that.

Do I have such activities? Nope. But I believe that those activities should be enabled, whether for me in the future or others around the world.

I advocate on behalf such "dumb" people by supporting simple services like Protonmail with my money. If Protonmail isn't supporting these users, why should I bother supporting Protonmail?

Re: Climate activist arrested after ProtonMail provided his IP address

#219

Post by acmdas »

istingray wrote: post #116
acheron wrote: post #61

Earlier quoted context omitted.

Where “this” in “solve stupid shit like this” is “hide you from police with a legally authorized warrant”? If you were relying on Protonmail to conceal evidence of criminal activity for you, you may not have thought that all the way through.

Where "this" is using soft language like "by default" to hide shortcomings. I expect Protonmail to do more to educate users to be aware of how surveillance happens, whether a rogue employee enables the function on their end, warrant, etc.

"hide shortcomings" like what? Doesn't language like "by default" infer/suggest/imply that there would be circumstances in which they would save logs? And wouldn't an obvious circumstance like that be a warrant?

Re: Climate activist arrested after ProtonMail provided his IP address

#220

Post by AmericanChopper »

jonas21 wrote: post #104
tephra wrote: post #53

Earlier quoted context omitted.

So also a proton customer here. "By default we do not keep any IP logs" and this case does not seem like the default? Seems like they were required to by law to log and turn over this specific IP? (Of course I haven't seen the actual case but I would assume that meant a warrant.)

As a user, I'd take that to mean that they wouldn't keep any IP logs unless I turned logging on. I wouldn't expect that they would enable logging on their own. Interestingly, ProtonMail's privacy policy lists a number of cases in which they may log your IP address permanently (including if you breach their Terms and Conditions). But a request from law enforcement is not one them.

I understand it to mean they can enable IP logging for a mailbox in response to a court order.
Post reply on HN