Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

Post reply on HN
Print view View original

311–320 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#311

Post by mhitza »

londons_explore wrote: post #117

Cryptographers and developers need to step up their game... There needs to be a messaging service where as well as the messages being encrypted, the graph of who is talking to who and when must be encrypted. I'm imagining a system where your device forwards hundreds of messages for other people , hiding your own message flow. I perhaps send a few hundred messages per day, and even multiplying that by 1000, and the ty…

You're describing exactly I2P (darknet similar to Tor but more focused on internal services).

There's also a builtin I2P-Bote messaging system (bundled with the official I2P client) that is in a sense a substitute to email.

The tech is there, what the I2P ecosystem needs is a lot more users and a lot of UX improvements to make it 1-click accessible.

Re: Climate activist arrested after ProtonMail provided his IP address

#312

Post by pabs3 »

PeterisP wrote: post #254
istingray wrote: post #43

Earlier quoted context omitted.

I'm also a Protonmail customer. Tor solves this. Protonmail's Tor support is lukewarm. They have a Tor based login without captchas. It's mentioned on their homepage in the bottom menu under "Onion Site", (/tor). And there's one blog post from 2017 that still promotes their v2/shorter onion address. I expect Protonmail to push its users to login through Tor. "Don't trust us, trust math". Embed Tor support in their ap…

Aren't a big part of Tor entry/exit nodes considered to be monitored or even operated by the authorities?

The authorities don't need to run exit nodes, they just pwn enough routers, have enough interception devices or buy enough netflow data that they can trace data flowing through the Tor work back to its original location.

Re: Climate activist arrested after ProtonMail provided his IP address

#314

Post by seg_lol »

dredmorbius wrote: post #125
istingray wrote: post #73

Earlier quoted context omitted.

Put "By default we don't keep IP, but may be required to by local laws. We suggest you connect through Protonmail through Tor". I would much prefer this, as a Protonmail paying customer.

Tor helps, but is not especially robust against state-level actors / APTs. An actor running a sufficient number of entry/exit nodes could perform at least some traffic analysis. Tor is an improvement. It's still a limited tool.

It would have absolutely prevented this person from getting identified. It looks like some kids doing a climate protest.

I can't but help read your post in comic book guys voice.

Re: Climate activist arrested after ProtonMail provided his IP address

#315

Post by neltnerb »

istingray wrote: post #302
o8r3oFTZPE wrote: post #289

Earlier quoted context omitted.

Nothing is even defined. There is nothing in this policy that obligates the company to do, or restricts the company from doing, anything. This is the way most tech company "Privacy Policies" are written. There is a significant difference between a statement such as "We (Company) do not do X" versus a promise such as "Company shall not do X" or a statement such as "We do Y. We may do Z" versus a promise such as "Compa…

Solid points. A report card for various privacy policies would be useful. Seen anything like that?

Kind of limited since it's only evaluating websites, but https://tosdr.org/ attempts to implement this as a plugin.

Edit: And amusingly it only gives protonmail.com a B.

Re: Climate activist arrested after ProtonMail provided his IP address

#316

Post by goatsi »

fishtacos wrote: post #306
goatsi wrote: post #272

Earlier quoted context omitted.

>This isn't the Hotmail age where everyone expects free email. Protonmail does offer a free tier, which is the problem. I'm sure they would be happy to take a payment instead, as the whole point of phone verification is to impose a cost on account creation. Perhaps they can rework their account registration flow to offer the ability to upgrade to a paid account at the verification step.

If you're upgrading to a paid account, isn't that even worse than the initial step in terms of anonymity? I get that they need to make money to survive, but this requirement isn't displaced by e2ee - it provides a misleading and false sense of security. Anonymity toward state actors is compromised in either situation, whether phone verification or payment validation. Doubt I'm the only one who thinks this, but the va…

They support Bitcoin as a payment method. If you take precautions (ie use a Monero -> Bitcoin payment service over tor) I don't see it as compromising your identity.

Re: Climate activist arrested after ProtonMail provided his IP address

#317

Post by ksaj »

penagwin wrote: post #310
istingray wrote: post #244

Earlier quoted context omitted.

All the Protonmail customers out there, what did you do about this? For starters, I emailed Protonmail support. Here's mine: Hi, Your homepage reads "By default, we do not keep any IP logs..." This language is soft and misleading. Maybe in 2018 when I first began using ProtonMail it was good enough. But in 2021 it's not. I expect better from ProtonMail. Replace immediately with something clearer. "By default we don't…

From my understanding it depends on how naughty your current exit node has been. Most tor exits in my experience allow creation and you just need to verify another email (just use a random burner- they only block a few. Supposedly some well behaved exits require just a captcha but I've never seen it.

It would be nice if they had a tor presence so there would be no need to traverse an exit node. A lot of other privacy-forward sites do exactly this.

Re: Climate activist arrested after ProtonMail provided his IP address

#318

Post by alternatetwo »

kazen44 wrote: post #154

for those who are curious, this seems to be the reply from protonmail on reddit[0] >Hi everyone, Proton team here. We are also deeply concerned about this case. In the interest of transparency, here's some more context. In this case, Proton received a legally binding order from the Swiss Federal Department of Justice which we are obligated to comply with. Details about how we handle Swiss law enforcement requests can…

So Switzerland is evidently not a democracy anymore. Sad to hear.

Re: Climate activist arrested after ProtonMail provided his IP address

#319

Post by dredmorbius »

seg_lol wrote: post #314
dredmorbius wrote: post #125

Earlier quoted context omitted.

Tor helps, but is not especially robust against state-level actors / APTs. An actor running a sufficient number of entry/exit nodes could perform at least some traffic analysis. Tor is an improvement. It's still a limited tool.

It would have absolutely prevented this person from getting identified. It looks like some kids doing a climate protest. I can't but help read your post in comic book guys voice.

In comic-book voice, then: what would an intelligence agency or police force's response to a suspect known to be using Tor be?

Traffic analysis, at a cost, could establish that the suspect is using Tor.

TorMetrics shows slightly more than 1,250 currently-running Tor exit nodes. I'll presume this is typical, history shows it's pretty consisten over the past 3 months.

https://metrics.torproject.org/relayflags.html?start=2021-06...

I'm going to presume that a court could conceivably issue an order to log all Tor-based traffic. A state actor / APT might then be able to correlate a known IP and traffic at a given point in time with other data to identify a source IP. This might be combined with other measures to encourage circuit-jumping until the suspect is on a specific known or monitored Tor circuit.

Yes, costs increase. I don't see this as technically infeasible, however.

Might not be rolled out just for a house-squatter, however.

Re: Climate activist arrested after ProtonMail provided his IP address

#320

Post by [deleted] »

BenjiWiebe wrote: post #264
georgyo wrote: post #214

Earlier quoted context omitted.

_all_ VPNs are useless. They are the biggest security theater and a massive success of marketing. But really, it's completely bazaar to trust a VPN provider. They provide protection from your local network, but you they can do all the same things and more.

*bizarre Not bazaar. And really both words are spelled quite bizarrely.

[deleted]
Post reply on HN