Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

Post reply on HN
Print view View original

251–260 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#251

Post by France_is_bacon »

For me, I NEVER expect protection from any governmemnt authorities. They have unlimited resources (compared to a regular person), and you can't fight city hall, as the saying goes.

The reason I use tutamota (similar to protonmail) is to stop the Googles and Yahoos and hotmails from scanning all of my emails, using them to advertise to me, selling the information to advertisers. Could you imagine if the US post office opened up all your mail, read it, and sold this information to anyone who asked? Preposterous. And keep track and sell who you send stuff to and who you receive info from? Of course, if the government decided to monitor you regular mail, they could. Fine. Nothing anyone can do about that. But at least the USPS doesn't read everything you send and sell that info to commercial entities.

So, that is why I use those types of services. I don't want to be anywhere near Googlemail, or Yahoomail, or Hotmail, etc.

Re: Climate activist arrested after ProtonMail provided his IP address

#252

Post by o8r3oFTZPE »

istingray wrote: post #249
o8r3oFTZPE wrote: post #230

Earlier quoted context omitted.

"Their homepage says..." Is the parent suggesting that no one should bother to read the Terms and Privacy Policy, linked to from the homepage. https://protonmail.com/privacy-policy Despite the parent's claim, the Privacy Policy says the company may log IP address. Temporarily. Irrespective of any request from local authorities regarding a specific user. IOW, they may log anyone's IP address temporarily regardless of…

I pasted an email I sent to Protonmail above. If they can't come up with language that's clear, use text from their privacy policy verbatim. Start educating users not to trust anything but what's in the policy, and even treat that as adversarial.

Devils advocate: Why trust the policy. Can you enforce it. If yes, then how.

Re: Climate activist arrested after ProtonMail provided his IP address

#253

Post by monkey_552 »

istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

Protonmail did not provide the authorities with the users IP address...they did allow the account to monitored which they are required by their laws to allow. It was the users sloppy OPSEC that allowed the authorities to eventually track them down. In the end, I believe, it was linking the user to a past Gmail account that finally did him in. Listen to this podcast episode, the presenter does a fairly good job summarizing the situation. The Privacy, Security, & OSINT Show – Episode 227

Re: Climate activist arrested after ProtonMail provided his IP address

#254

Post by PeterisP »

istingray wrote: post #43
COGlory wrote: post #37

Disclaimer: I have a ProtonMail account that I pay for. I have seen a ton of disturbing pieces about ProtonMail. Every time I've looked into them, they seem to be maliciously motivated and usually not true, or otherwise twisting of the truth. This has been a confusing thing for me because why is there a small subset of people so vehemently against them? In this case, I'm not surprised. They say quite clearly they can…

I'm also a Protonmail customer. Tor solves this. Protonmail's Tor support is lukewarm. They have a Tor based login without captchas. It's mentioned on their homepage in the bottom menu under "Onion Site", (/tor). And there's one blog post from 2017 that still promotes their v2/shorter onion address. I expect Protonmail to push its users to login through Tor. "Don't trust us, trust math". Embed Tor support in their ap…

Aren't a big part of Tor entry/exit nodes considered to be monitored or even operated by the authorities?

Re: Climate activist arrested after ProtonMail provided his IP address

#255

Post by sneak »

pphysch wrote: post #223
sneak wrote: post #136

Earlier quoted context omitted.

Tor is open source. Point to the vulnerability you are claiming, or stop spreading FUD.

"Open source" means literally nothing for the majority of Tor users that are downloading prebuilt binaries from US Government-funded www.torproject.org/download/

So now you're asserting that the binaries are backdoored, or built from something other than the published source.

Again, provide evidence or stop spreading FUD.

Re: Climate activist arrested after ProtonMail provided his IP address

#256

Post by OrvalWintermute »

o8r3oFTZPE wrote: post #230
istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

"Their homepage says..." Is the parent suggesting that no one should bother to read the Terms and Privacy Policy, linked to from the homepage. https://protonmail.com/privacy-policy Despite the parent's claim, the Privacy Policy says the company may log IP address. Temporarily. Irrespective of any request from local authorities regarding a specific user. IOW, they may log anyone's IP address temporarily regardless of…

> "IP Logging: By default, we do not keep permanent IP logs in relation with your use of the Services. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions (spamming, DDoS attacks against our infrastructure, brute force attacks, etc). The legal basis of this processing is our legitimate interest to protect our Services against nefarious activities."

Just how transient do logs need to be to fit this criteria?

Am guessing the 7 years or so we need for some of our specific logs might fit the temporary definition too.....

Re: Climate activist arrested after ProtonMail provided his IP address

#257

Post by barbacoa »

umvi wrote: post #186
pseudalopex wrote: post #169

Earlier quoted context omitted.

Why not?

"we aren't much better than Gmail from a privacy standpoint, but please still give us money"

Most people accept search warrants signed by a judge for a crime. Proton mail was even nice enough to notify the user what they were the subject of a search.

With Gmail/Hotmail/etc your communication are at the finger tips of governments for non-criminal domestic surveillance. For example it has been alleged that the NSA leaked private emails of a journalist in order to score political damage.

https://nypost.com/2021/08/11/tucker-carlson-unmasking-claim...

Re: Climate activist arrested after ProtonMail provided his IP address

#258

Post by Thorrez »

sweetbitter wrote: post #234
KeepFlying wrote: post #198

Earlier quoted context omitted.

Why not? It would just mean that the NSA needs to own more routers than it would to break TOR->Public internet routing. From what I understand, connecting to an onion address 'just' involves 6 routers, not the typical 3. (Of course an oversimplification.) Or am I misunderstanding your threat model here?

https://svn-archive.torproject.org/svn/projects/design-paper...

>A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers.

Re: Climate activist arrested after ProtonMail provided his IP address

#259

Post by lavabiopsy »

jelling wrote: post #242
istingray wrote: post #218

Earlier quoted context omitted.

The problem is that engaging in "potentially dangerous activities" includes such a wide range of people. Think about a journalist in Afghanistan, a whisteblower in the USA, or a human rights activist in China. They're all engaging in potentially dangerous activities. Are they "dumb" because they don't understand all the ins and outs of surveillance? How about some empathy for them as users? The proposed statement abo…

Also ProtonMail's only reason for being is that they are supposed to provide some higher level of privacy. If they don't, how are they any different than a commodity grade SMTP/IMAP provider? I will withhold judgement until I know more about the case but the early context does not look good for ProtonMail's value proposition, which is the least of things.

Is it though? I don't know much about this company but their main selling point seems to be end to end encryption for mail messages. That's not a "privacy" feature by itself. Now it is a tool that you can use it to gain more privacy, but you could also have people who use it to cc all their emails to their entire facebook list. So it seems it all depends on how you use it and what type of privacy you try to achieve.

Re: Climate activist arrested after ProtonMail provided his IP address

#260

Post by bigiain »

pseudalopex wrote: post #201
umvi wrote: post #186

Earlier quoted context omitted.

"we aren't much better than Gmail from a privacy standpoint, but please still give us money"

Does every email provider but Gmail make the same misleading claim as ProtonMail? Fastmail for example?

I like and respect Fastmail.

but...

I live in Australia - and they're totally fucked by our laws and government policy.

"The Australian Federal Police (AFP) and Australian Criminal Intelligence Commission (ACIC) will now be able to access the computers and networks of those suspected of conducting criminal activity online, and even take over their online accounts covertly, under the Identify and Disrupt bill, which was passed by the Senate on Wednesday." -- https://www.innovationaus.com/extraordinary-new-hacking-powe...

and:

"Amends: the Surveillance Devices Act 2004 and Telecommunications (Interception and Access) Act 1979 to: introduce data disruption warrants to enable the Australian Federal Police (AFP) and the Australian Criminal Intelligence Commission (ACIC) to disrupt data by modifying, adding, copying or deleting data in order to frustrate the commission of serious offences online; and make minor technical corrections; " -- https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...

Post reply on HN