Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

Post reply on HN
Print view View original

281–290 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#281

Post by codyro »

cedws wrote: post #64
COGlory wrote: post #37

Disclaimer: I have a ProtonMail account that I pay for. I have seen a ton of disturbing pieces about ProtonMail. Every time I've looked into them, they seem to be maliciously motivated and usually not true, or otherwise twisting of the truth. This has been a confusing thing for me because why is there a small subset of people so vehemently against them? In this case, I'm not surprised. They say quite clearly they can…

I am also paying for ProtonMail. They come off as a very dodgy company willing to twist the truth themselves. They claim that they can provide E2EE for email, being careful not to give away the fact that this is impossible for regular emails to non-PM customers. Frankly I only use them because they're the biggest "private" email service and that provides a kind of safety in numbers.

Also a paying ProtonMail customer.

While I concur that it's a bit misleading nothing is stopping you from using your own key and mail client (albeit with their "bridge" solution) to send E2EE e-mails.

If you rely on the keys they generate you can export them and use them accordingly but one should be weary of the handling of said keys if they were compelled to make a backdoor as others have noted.

That being said this does leave a bad taste in my mouth.

Re: Climate activist arrested after ProtonMail provided his IP address

#284

Post by Mandatum »

melbourne_mat wrote: post #205

I'm also a proton mail user. It sounds like you have privacy as long as you don't break any European law. That's certainly not the "Swiss bunker" style of service I was expecting

I think Mullvad's approach is best. Choose a solid provider, handle encryption yourself. Mullvad use Gmail.

https://mullvad.net/en/help/using-encrypted-email/

Re: Climate activist arrested after ProtonMail provided his IP address

#285

Post by istingray »

goatsi wrote: post #272
istingray wrote: post #215

Earlier quoted context omitted.

Too bad, figure out a way to solve for it. I'm paying for private email service, not a pretty picture of the Swiss Alps on their website. If they don't provide it, someone else will, and I'll pay them instead. This isn't the Hotmail age where everyone expects free email.

>This isn't the Hotmail age where everyone expects free email. Protonmail does offer a free tier, which is the problem. I'm sure they would be happy to take a payment instead, as the whole point of phone verification is to impose a cost on account creation. Perhaps they can rework their account registration flow to offer the ability to upgrade to a paid account at the verification step.

See, I like this idea. This is the type of thinking I'm paying Protonmail for.

Re: Climate activist arrested after ProtonMail provided his IP address

#286

Post by jacksonkmarley »

Would be good to have some other sources for this story.

So a Swiss company has been apparently forced to provide details of a user who is under investigation by police in another country? I'm curious about the way that actually works, that a Swiss court receives a request from a foreign police force and a private company has no recourse to refuse or appeal the resulting order. Seems a bit weird to me, although I don't know a lot about the legal system there.

Re: Climate activist arrested after ProtonMail provided his IP address

#287

Post by istingray »

bigiain wrote: post #271
istingray wrote: post #120

Earlier quoted context omitted.

Those canary things seem so 2018. In 2021 the most powerful canary statement should be "Don't trust us. Seriously, treat us as an adversary. We still want you to be our customer of course, but here's how we really recommend you use our service, Tor, semi-anonymous payments, etc. In God we trust, for everyone else use math."

Anybody serious has moved from "perimeter security" to "zero trust" in network architecture. We need to treat more of the real world the same way.

Any new tools developed with that in mind for us mortals?

Would love to sign up for some Tor-first services. So far the best we've got are Tor services that mirror public ones.

Re: Climate activist arrested after ProtonMail provided his IP address

#288

Post by pseudalopex »

bigiain wrote: post #260
pseudalopex wrote: post #201

Earlier quoted context omitted.

Does every email provider but Gmail make the same misleading claim as ProtonMail? Fastmail for example?

I like and respect Fastmail. but... I live in Australia - and they're totally fucked by our laws and government policy. "The Australian Federal Police (AFP) and Australian Criminal Intelligence Commission (ACIC) will now be able to access the computers and networks of those suspected of conducting criminal activity online, and even take over their online accounts covertly, under the Identify and Disrupt bill, which w…

The question was if email providers have to choose misleading people about privacy or going out of business. Specifically about IP logs.

Fastmail's privacy page says "Your data is for you and no one else".[1] So they do mislead about that. I didn't see anything about IP logs though. And Fastmail was just an example.

[1] https://www.fastmail.com/privacy-and-security/

Re: Climate activist arrested after ProtonMail provided his IP address

#289

Post by o8r3oFTZPE »

OrvalWintermute wrote: post #256
o8r3oFTZPE wrote: post #230

Earlier quoted context omitted.

"Their homepage says..." Is the parent suggesting that no one should bother to read the Terms and Privacy Policy, linked to from the homepage. https://protonmail.com/privacy-policy Despite the parent's claim, the Privacy Policy says the company may log IP address. Temporarily. Irrespective of any request from local authorities regarding a specific user. IOW, they may log anyone's IP address temporarily regardless of…

> "IP Logging: By default, we do not keep permanent IP logs in relation with your use of the Services. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions (spamming, DDoS attacks against our infrastructure, brute force attacks, etc). The legal basis of this processing is our legitimate…

Nothing is even defined. There is nothing in this policy that obligates the company to do, or restricts the company from doing, anything.

This is the way most tech company "Privacy Policies" are written.

There is a significant difference between a statement such as "We (Company) do not do X" versus a promise such as "Company shall not do X" or a statement such as "We do Y. We may do Z" versus a promise such as "Company shall do Y."

Why not have our own "Policies" as users that we publish for tech companies to read. In them, we could describe what we do and what we do not do, and what we may or may not do. Tech companies could rely on these statements. You can see how silly that sounds. Yet users are expected to read and rely on hundreds of different "privacy policies", collection of non-binding statements like "We take privacy seriously".

Re: Climate activist arrested after ProtonMail provided his IP address

#290

Post by newacct583 »

monkey_552 wrote: post #253
istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

Protonmail did not provide the authorities with the users IP address...they did allow the account to monitored which they are required by their laws to allow. It was the users sloppy OPSEC that allowed the authorities to eventually track them down. In the end, I believe, it was linking the user to a past Gmail account that finally did him in. Listen to this podcast episode, the presenter does a fairly good job summar…

> Protonmail did not provide the authorities with the users IP address...they did allow the account to monitored which they are required by their laws to allow.

Something their marketing material appears to disclaim. This is just excuse-making. ProtonMail did what ProtonMail has (for years!) led their customers to believe they would not do. And they did.

I think there's an argument to be made that any commercial email/messaging provider simply can't do what ProtonMail claimed to do. But that doesn't change the fact that ProtonMail did it.

Post reply on HN