Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

271–280 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#271
post #112

Earlier quoted context omitted.

In the US companies can make canary statement... https://en.wikipedia.org/wiki/Warrant_canary

Those canary things seem so 2018. In 2021 the most powerful canary statement should be "Don't trust us. Seriously, treat us as an adversary. We still want you to be our customer of course, but here's how we really recommend you use our service, Tor, semi-anonymous payments, etc. In God we trust, for everyone else use math."

Anybody serious has moved from "perimeter security" to "zero trust" in network architecture. We need to treat more of the real world the same way.

Re: Climate activist arrested after ProtonMail provided his IP address

#272

Earlier quoted context omitted.

If they don’t do this then spammers will use their service en masse and degrade the service for all customers by black holing their ips and domain through all other email providers.

Too bad, figure out a way to solve for it. I'm paying for private email service, not a pretty picture of the Swiss Alps on their website. If they don't provide it, someone else will, and I'll pay them instead. This isn't the Hotmail age where everyone expects free email.

>This isn't the Hotmail age where everyone expects free email.

Protonmail does offer a free tier, which is the problem. I'm sure they would be happy to take a payment instead, as the whole point of phone verification is to impose a cost on account creation. Perhaps they can rework their account registration flow to offer the ability to upgrade to a paid account at the verification step.

Re: Climate activist arrested after ProtonMail provided his IP address

#273

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

Protonmail did not provide the authorities with the users IP address...they did allow the account to monitored which they are required by their laws to allow. It was the users sloppy OPSEC that allowed the authorities to eventually track them down. In the end, I believe, it was linking the user to a past Gmail account that finally did him in. Listen to this podcast episode, the presenter does a fairly good job summar…

Lie that you care about user privacy, give sucke- I mean, users' data to law enforcement anyway, blame the users when they get nailed due to your snitching. It's a perfect business model!

Re: Climate activist arrested after ProtonMail provided his IP address

#274

Climate activist or general miscreant masquerading under the guise of climate activism?

I am fairly law abiding except for when it comes to the intersection of a vehicle and a heavy pedal.

But

Configuring logging on a user's IP address information on a private email service for what appears to be a fairly petty crime seems rather like dropping a nuke on an ant, both on the side of the French/Europol LE, and also for Swiss authorities, and then Swiss companies to be responsive to something so petty.

For something this "Organizing a Climate Camp" [1] involved I'd expect at least a serious felony, or a dramatic terrorist incident with loss of life.

If the crimes involved are truly so minor, it raises the spectre of what would they do for an actual serious crime?

I hope I am misreading this......

[1] https://www.liberation.fr/terre/2020/09/27/camp-climat-a-par...

Re: Climate activist arrested after ProtonMail provided his IP address

#275

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

Protonmail did not provide the authorities with the users IP address...they did allow the account to monitored which they are required by their laws to allow. It was the users sloppy OPSEC that allowed the authorities to eventually track them down. In the end, I believe, it was linking the user to a past Gmail account that finally did him in. Listen to this podcast episode, the presenter does a fairly good job summar…

Not my problem. I pay Protonmail to work on behalf of users, and empower users to the extent allowed by law. This includes educating users about the adversarial actions that Protonmail itself can take against them (warrant, rogue employee, hackers). Otherwise I can take my $ elsewhere, email services are cheap.

Re: Climate activist arrested after ProtonMail provided his IP address

#276
post #18

So with FastMail under Australian privacy-bashing laws and now this, what are our options for secure, private e-mail?

Your own self-hosted service on rented server / cloud instance? AFAIU (IANAL!!!) you can refuse to give evidences against yourself in most jurisdictions. I don't thinks that dedicated server provider (like Hetzner) or cloud provider (like Digital Ocean or Vultr) stores traffic logs with enough details to be useful in such case. But payment will be a problem...

In most jurisdictions you can refuse to testify against yourself but you are still required to give up all physical evidence against yourself if an appropriate warrant requests them, the immunity only applies to things in your mind.

Things like hiding or destroying evidence of a crime generally are separate crimes of which you can be convicted even if you're acquitted of the original crime (e.g. burying a corpse in the woods or throwing a gun in the river).

Destruction of evidence with the intent to hide it from prosecution also may enable so called 'adverse inference' where essentially the jury/judge can assume that the destroyed evidence actually showed what the prosecution intended to find there. For example, if you're being prosecuted for possession of child sexual abuse material, there's a warrant for your hard drive, but it gets fully destroyed because you have rigged some device to destroy it (and the prosecution proves that you did that with the intent to destroy evidence) then the court may take it as a fact that the hard drive did indeed contain CSAM and treat it as sufficient evidence to convict you.

In short, self-hosted service on a rented service does not provide much protection.

Re: Climate activist arrested after ProtonMail provided his IP address

#277

Earlier quoted context omitted.

Protonmail did not provide the authorities with the users IP address...they did allow the account to monitored which they are required by their laws to allow. It was the users sloppy OPSEC that allowed the authorities to eventually track them down. In the end, I believe, it was linking the user to a past Gmail account that finally did him in. Listen to this podcast episode, the presenter does a fairly good job summar…

Lie that you care about user privacy, give sucke- I mean, users' data to law enforcement anyway, blame the users when they get nailed due to your snitching. It's a perfect business model!

Don't call it a "HoneyProt"!

Re: Climate activist arrested after ProtonMail provided his IP address

#278
post #94
post #18

So with FastMail under Australian privacy-bashing laws and now this, what are our options for secure, private e-mail?

I say don't use email, it's not a good choice for private communications.

I agree that one should not use it for private comms. But many people have to use it, and they would rather not use a provider like MS or Google. For those people, mailbox.org is a good offering (IMO).

Re: Climate activist arrested after ProtonMail provided his IP address

#279
post #136

Earlier quoted context omitted.

Tor is open source. Point to the vulnerability you are claiming, or stop spreading FUD.

"Open source" means literally nothing for the majority of Tor users that are downloading prebuilt binaries from US Government-funded www.torproject.org/download/

And yet, confirmation attacks and traffic shaping by global adversaries are where the actual design flaws lie, inherent to any 'low-latency' (read: performance trumps privacy) anonymizing network, and you know that. Even efforts such as the Invisible Internet Project (I2P) which pile on tactic after tactic to improve upon this, but are too scared to delve in outright mixing traffic, are vulnerable to traffic confirmation attacks.

Re: Climate activist arrested after ProtonMail provided his IP address

#280

Earlier quoted context omitted.

What does using Tor have to do with trusting math?

"What makes Tor different from the usual thesaurus-full of government projects is that Tor is essentially a very elaborate math trick, using layers of math puzzles to create a network-within-the-network. That math is being implemented in front of a global audience of millions of sophisticated watchers. It is likely the most examined codebase in the world. It has been subjected to multiple public audits. The math, wel…

"Trusting mathematics" would be a much more accurate claim if we were talking about mix networks, such as Loopix (https://arxiv.org/abs/1703.00536). But Tor is vulnerable to confirmation attacks to varying degrees, (depending on whether you are accessing clearnet or not, of course) which is very much worth noting in the context of a global passive adversary.
Post reply on HN