Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

Post reply on HN
Print view View original

301–310 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#301

Post by istingray »

akimball wrote: post #135
ivan_gammel wrote: post #128

Earlier quoted context omitted.

TBH in 2021 people engaging in potentially dangerous activities should be literate enough to understand, that no business will guarantee them full security and decline all requests from authorities to disclose their identity. The wording you suggest is equivalent of „do not dry your cat in microwave“ instruction - a legal protection from dumb customers, that does not contribute meaningfully to safety. For the non-Swi…

It’s not protection FROM your customers. It is protection FOR your customers. Most customers are not technically astute

I'm fine with Proton treating my data as a liability. Give me the tools to take away that liability by only sending them noise through an anonymous email address. I will pay for that.

Re: Climate activist arrested after ProtonMail provided his IP address

#302

Post by istingray »

o8r3oFTZPE wrote: post #289
OrvalWintermute wrote: post #256

Earlier quoted context omitted.

> "IP Logging: By default, we do not keep permanent IP logs in relation with your use of the Services. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions (spamming, DDoS attacks against our infrastructure, brute force attacks, etc). The legal basis of this processing is our legitimate…

Nothing is even defined. There is nothing in this policy that obligates the company to do, or restricts the company from doing, anything. This is the way most tech company "Privacy Policies" are written. There is a significant difference between a statement such as "We (Company) do not do X" versus a promise such as "Company shall not do X" or a statement such as "We do Y. We may do Z" versus a promise such as "Compa…

Solid points. A report card for various privacy policies would be useful. Seen anything like that?

Re: Climate activist arrested after ProtonMail provided his IP address

#303

Post by asdfasgasdgasdg »

Thorrez wrote: post #248
asdfasgasdgasdg wrote: post #236

Earlier quoted context omitted.

It is in contrast to the immediately following paragraph, which discusses a user-controllable setting that does cause ip logs to be retained permanently.

What immediately following paragraph? This is what I see: https://i.imgur.com/6sZFn78.png

In the twitter screenshot linked to in this post, there is a discussion of the authentication logging feature in the immediately following paragraph (the screenshot discussing IP logging).

https://twitter.com/OnEstLaTech/status/1434576598418796549?t...

Re: Climate activist arrested after ProtonMail provided his IP address

#304

Post by Brian_K_White »

ivan_gammel wrote: post #128
istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

TBH in 2021 people engaging in potentially dangerous activities should be literate enough to understand, that no business will guarantee them full security and decline all requests from authorities to disclose their identity. The wording you suggest is equivalent of „do not dry your cat in microwave“ instruction - a legal protection from dumb customers, that does not contribute meaningfully to safety. For the non-Swi…

Review and approval of 3 agencies is apparently not even a speed bump.

Re: Climate activist arrested after ProtonMail provided his IP address

#305

Post by dane-pgp »

cartoonworld wrote: post #98
Youden wrote: post #41

Earlier quoted context omitted.

Honest question, because I've been asking it of myself: what do you expect from such a service? I basically decided to just give up. Email is an insecure protocol and there's not much that can be done about it. Choosing a "secure" email provider feels like choosing a "secure" VPN provider: it's impossible to verify the provider's claims so it's a kind of security theatre.

It's impossible to choose a "secure" email provider, unfortunately. Email can't guarantee E2EE without a block cipher tool like GPG. Even if your provider stores and transmits only encrypted email data, once sent it does not maintain that guarantee while being passed by another entity's MTA. If you email google, google gets to do whatever googly stuff it would like to do with its algorithm. If you email exchange, rou…

> Even if your provider stores and transmits only encrypted email data, once sent it does not maintain that guarantee while being passed by another entity's MTA.

What? If Alice encrypts an email to Bob, using Bob's PGP key on her laptop, then it doesn't matter how many MTAs that email passes through, the email stays encrypted at every hop.

> it could wind up being archived to tape

I guess you're saying that an encrypted email could travel through a provider that keeps a copy of it in the hopes that quantum computers will one day be cheaply available enough that they can crack the private key and read the email.

That seems expensive (and illegal) for a company to do just on a whim (assuming the sender and recipient are periodically deleting old emails), and I'd like to think that a judge would turn down a request for a warrant that covers data that won't be readable for a decade or more.

Re: Climate activist arrested after ProtonMail provided his IP address

#306

Post by fishtacos »

goatsi wrote: post #272
istingray wrote: post #215

Earlier quoted context omitted.

Too bad, figure out a way to solve for it. I'm paying for private email service, not a pretty picture of the Swiss Alps on their website. If they don't provide it, someone else will, and I'll pay them instead. This isn't the Hotmail age where everyone expects free email.

>This isn't the Hotmail age where everyone expects free email. Protonmail does offer a free tier, which is the problem. I'm sure they would be happy to take a payment instead, as the whole point of phone verification is to impose a cost on account creation. Perhaps they can rework their account registration flow to offer the ability to upgrade to a paid account at the verification step.

If you're upgrading to a paid account, isn't that even worse than the initial step in terms of anonymity? I get that they need to make money to survive, but this requirement isn't displaced by e2ee - it provides a misleading and false sense of security.

Anonymity toward state actors is compromised in either situation, whether phone verification or payment validation.

Doubt I'm the only one who thinks this, but the value proposition of their service is cancelled by their stated terms, which at least they make available. I have similar doubts about the veracity of claims by VPN providers (including mine) in terms of not keeping logs.

tor remains the only usable anonymising method with a decent track record. It's a shame Protonmail discriminates against it.

Re: Climate activist arrested after ProtonMail provided his IP address

#307

Post by taneq »

winrid wrote: post #165
istingray wrote: post #102

Earlier quoted context omitted.

Protonmail should be pushing more of this messaging in their branding. "Don't trust us further than you can throw us. We're doing our best, and here's what we recommend, use Tor, etc."

This is just not realistic, though.

Of course not, because a company that strikes the perfect balance of being sorta-in-the-right-direction but then also using deliberately deceptive language to pretend they're all-the-way-in-the-right-direction is going to outcompete companies that genuinely go all the way.

Re: Climate activist arrested after ProtonMail provided his IP address

#308

Post by moocowtruck »

istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

what we would then do is work with them to get that login through tor nodes we monitor and go from there

Re: Climate activist arrested after ProtonMail provided his IP address

#309

Post by [deleted] »

barbacoa wrote: post #257
umvi wrote: post #186

Earlier quoted context omitted.

"we aren't much better than Gmail from a privacy standpoint, but please still give us money"

Most people accept search warrants signed by a judge for a crime. Proton mail was even nice enough to notify the user what they were the subject of a search. With Gmail/Hotmail/etc your communication are at the finger tips of governments for non-criminal domestic surveillance. For example it has been alleged that the NSA leaked private emails of a journalist in order to score political damage. https://nypost.com/2021…

[deleted]

Re: Climate activist arrested after ProtonMail provided his IP address

#310

Post by penagwin »

istingray wrote: post #244
istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

All the Protonmail customers out there, what did you do about this? For starters, I emailed Protonmail support. Here's mine: Hi, Your homepage reads "By default, we do not keep any IP logs..." This language is soft and misleading. Maybe in 2018 when I first began using ProtonMail it was good enough. But in 2021 it's not. I expect better from ProtonMail. Replace immediately with something clearer. "By default we don't…

From my understanding it depends on how naughty your current exit node has been. Most tor exits in my experience allow creation and you just need to verify another email (just use a random burner- they only block a few. Supposedly some well behaved exits require just a captcha but I've never seen it.
Post reply on HN