Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

Post reply on HN
Print view View original

241–250 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#241

Post by Daneel_ »

acmdas wrote: post #219
istingray wrote: post #116

Earlier quoted context omitted.

Where "this" is using soft language like "by default" to hide shortcomings. I expect Protonmail to do more to educate users to be aware of how surveillance happens, whether a rogue employee enables the function on their end, warrant, etc.

"hide shortcomings" like what? Doesn't language like "by default" infer/suggest/imply that there would be circumstances in which they would save logs? And wouldn't an obvious circumstance like that be a warrant?

I think for most people the interpretation of "by default" means "we will not log your IP unless you enable it", i.e. the power is in the hands of the user. The complaint people are making here is that this statement should really have a clarifying clause saying "or unless requested to do so by law enforcement".

Re: Climate activist arrested after ProtonMail provided his IP address

#242

Post by jelling »

istingray wrote: post #218
ivan_gammel wrote: post #128

Earlier quoted context omitted.

TBH in 2021 people engaging in potentially dangerous activities should be literate enough to understand, that no business will guarantee them full security and decline all requests from authorities to disclose their identity. The wording you suggest is equivalent of „do not dry your cat in microwave“ instruction - a legal protection from dumb customers, that does not contribute meaningfully to safety. For the non-Swi…

The problem is that engaging in "potentially dangerous activities" includes such a wide range of people. Think about a journalist in Afghanistan, a whisteblower in the USA, or a human rights activist in China. They're all engaging in potentially dangerous activities. Are they "dumb" because they don't understand all the ins and outs of surveillance? How about some empathy for them as users? The proposed statement abo…

Also ProtonMail's only reason for being is that they are supposed to provide some higher level of privacy. If they don't, how are they any different than a commodity grade SMTP/IMAP provider? I will withhold judgement until I know more about the case but the early context does not look good for ProtonMail's value proposition, which is the least of things.

Re: Climate activist arrested after ProtonMail provided his IP address

#243

Post by bigiain »

shadowgovt wrote: post #148
akimball wrote: post #135

Earlier quoted context omitted.

It’s not protection FROM your customers. It is protection FOR your customers. Most customers are not technically astute

A corporation is a power centralization, and government authority can lean on power centralization. In general, regardless of what their TOS say, never believe that a corporation can't be compelled by the law to do anything they could physically do. CEOs can be jailed; when's the last time we heard of one actually going to jail over user privacy?

> CEOs can be jailed; when's the last time we heard of one actually going to jail over user privacy?

Ladar Levison from Lavabit came close. But even he admits that was because the FBI wanted to subvert every single Lavabit user's account (attempting vast overreach on the brazen assumption that "we are after Snowden" was going to pull the wool over everybody's eyes). Levison admits though, to having "responded to" at least two dozen subpoenas and complied with at least one warrant before.

https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...

Re: Climate activist arrested after ProtonMail provided his IP address

#244

Post by istingray »

istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

All the Protonmail customers out there, what did you do about this?

For starters, I emailed Protonmail support.

Here's mine: Hi, Your homepage reads "By default, we do not keep any IP logs..."

This language is soft and misleading. Maybe in 2018 when I first began using ProtonMail it was good enough. But in 2021 it's not. I expect better from ProtonMail.

Replace immediately with something clearer. "By default we don't log IP, but may be required to by law enforcement. We recommend all customers connect through Protonmail through Tor. This month, 60% of our users connected through Tor".

If you can't come up with anything better for users, just fall back on your privacy statement verbatim and avoid any marketing language.

Think about a journalist in Afghanistan, a whistleblower in the USA, or a human rights activist in China. They're all engaging in potentially dangerous activities.

I advocate on behalf such people by supporting services like Protonmail with my money. If Protonmail isn't supporting these users, why should I bother supporting Protonmail?

I expect Protonmail to educate users like this about how Protonmail itself can be turned into an adversary. Educate users about how to use Tor. Do better. Improve the internet.

I look forward to your reply.

Also, registering a new account through Tor requires a phone number for verification, even though Proton says no unique identification is required to register. If this requirement isn't removed by the time I renew my account I will no longer renew.

Re: Climate activist arrested after ProtonMail provided his IP address

#245

Post by sellyme »

mikeyjk wrote: post #233
umvi wrote: post #186

Earlier quoted context omitted.

"we aren't much better than Gmail from a privacy standpoint, but please still give us money"

I thought Gmail was much worse, scanning email contents etc.

The scanning of email contents that Gmail does is, from a privacy standpoint, indistinguishable from them simply sending you the email. Their server has to know the contents of that email either way.

Re: Climate activist arrested after ProtonMail provided his IP address

#246

Post by istingray »

YLYvYkHeB2NRNT wrote: post #238
ivan_gammel wrote: post #156

Earlier quoted context omitted.

A customer that specifically chooses Proton for privacy, must read and agree to privacy policy, which explicitly states, that Proton may in fact keep temporary IP logs and that user may opt in for login IP logs. Requests from authorities may ask for this kind of information and Proton will have to provide it. The „opt-in“ part for login logs is particularly interesting, because in fact Proton recommends this as a sec…

Anyone that uses ANY electronic device to plan and arrange clandestine opetations - IS AN IDIOT.

Do tell, how do you plan your clandestine operations?

Re: Climate activist arrested after ProtonMail provided his IP address

#247

Post by bigiain »

istingray wrote: post #215
dangero wrote: post #213

Earlier quoted context omitted.

If they don’t do this then spammers will use their service en masse and degrade the service for all customers by black holing their ips and domain through all other email providers.

Too bad, figure out a way to solve for it. I'm paying for private email service, not a pretty picture of the Swiss Alps on their website. If they don't provide it, someone else will, and I'll pay them instead. This isn't the Hotmail age where everyone expects free email.

> This isn't the Hotmail age where everyone expects free email.

It totally is.

I was running my own mail server for a while. The thing that finally pushed me into not bothering any more was when I looked at my logs and realised 82% of my non-spam non-marketing email was captured by google (where at least one recipient was either @gmail.com or a gsuite custom domain).

Re: Climate activist arrested after ProtonMail provided his IP address

#248

Post by Thorrez »

asdfasgasdgasdg wrote: post #236
Thorrez wrote: post #155

Earlier quoted context omitted.

Sure, the wording istingray suggested is a bit over the top. But the existing wording "By default, we do not keep any IP logs" is misleading. Why even say it? They should simply delete it.

It is in contrast to the immediately following paragraph, which discusses a user-controllable setting that does cause ip logs to be retained permanently.

What immediately following paragraph? This is what I see:

https://i.imgur.com/6sZFn78.png

Re: Climate activist arrested after ProtonMail provided his IP address

#249

Post by istingray »

o8r3oFTZPE wrote: post #230
istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

"Their homepage says..." Is the parent suggesting that no one should bother to read the Terms and Privacy Policy, linked to from the homepage. https://protonmail.com/privacy-policy Despite the parent's claim, the Privacy Policy says the company may log IP address. Temporarily. Irrespective of any request from local authorities regarding a specific user. IOW, they may log anyone's IP address temporarily regardless of…

I pasted an email I sent to Protonmail above. If they can't come up with language that's clear, use text from their privacy policy verbatim. Start educating users not to trust anything but what's in the policy, and even treat that as adversarial.

Re: Climate activist arrested after ProtonMail provided his IP address

#250

Post by OrvalWintermute »

akimball wrote: post #135
ivan_gammel wrote: post #128

Earlier quoted context omitted.

TBH in 2021 people engaging in potentially dangerous activities should be literate enough to understand, that no business will guarantee them full security and decline all requests from authorities to disclose their identity. The wording you suggest is equivalent of „do not dry your cat in microwave“ instruction - a legal protection from dumb customers, that does not contribute meaningfully to safety. For the non-Swi…

It’s not protection FROM your customers. It is protection FOR your customers. Most customers are not technically astute

If the tech. companies involved have monetized surveillance, and no I am not talking about the kind they do for advertising, but instead the $ for data on users/portal, all that jazz, fees for LE levels of access, cost for responses, etc the LE are also the customers too then?
Post reply on HN