Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

Post reply on HN
Print view View original

351–360 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#351

Post by COGlory »

istingray wrote: post #71
tephra wrote: post #53

Earlier quoted context omitted.

So also a proton customer here. "By default we do not keep any IP logs" and this case does not seem like the default? Seems like they were required to by law to log and turn over this specific IP? (Of course I haven't seen the actual case but I would assume that meant a warrant.)

If this doesn't matter, what's important for you about being a Protonmail customer? (also a paying Protonmail customer)

End-to-end encrypted emails, not massive collection of metadata to build advertising profiles, and, maybe this will sound strange, but I wanted to pay for these services because I want to show everyone that there is a paying market and you don't have to rely on advertising to be profitable in this space.

No service is capable of completely hiding IPs and still getting you the data. If you "threat model" includes hiding from Western governments, I'd recommend not using the internet.

Re: Climate activist arrested after ProtonMail provided his IP address

#352

Post by COGlory »

hh3k0 wrote: post #85
COGlory wrote: post #57

Earlier quoted context omitted.

Perhaps, but I'd imagine that semantically, "by default" negates that since this is clearly not a default situation.

Stop trying to defend indefensible behavior by getting hung up on semantics. I, for one, will not renew my ProtonMail account if that's their status quo.

I'm extremely confused by this.

Unless you are naive enough to assume that ProtonMail is incapable of logging IP addresses (in which case they'd be incapable of serving HTTP requests...see the problem?) then they can log. And they most certainly aren't going to declare independence from Switzerland and refuse to turn on IP logging when required to by law.

Whereas with E2E-E, they actually are incapable of turning over readable emails.

Re: Climate activist arrested after ProtonMail provided his IP address

#353

Post by COGlory »

ipaddr wrote: post #178
kazen44 wrote: post #131

Earlier quoted context omitted.

what other status quo do you expect from them? Having to provide IP logs after a warrant has been issued is the law in switserland (and most if not all of the EU). Sure, the law would (hopefully) be changed, but at the moment, this is the best they can legally do?

Tell users you are being logged on website. Put alert warning that account has logging enabled Change the service so collecting logs is not possible Stop adding captcha to tor users login because you want to identify users

>Tell users you are being logged on website.

Frequently not legal

>Put alert warning that account has logging enabled

See above. Gag orders a problem with government in general. They do have a warrant canary page though, as well as a transparency report.

https://protonmail.com/blog/transparency-report/

>Change the service so collecting logs is not possible

You mean stop serving HTTP and MX requests?

>Stop adding captcha to tor users login because you want to identify users

You mean let bots brute-force my password?

Re: Climate activist arrested after ProtonMail provided his IP address

#354

Post by COGlory »

aborsy wrote: post #62
COGlory wrote: post #37

Disclaimer: I have a ProtonMail account that I pay for. I have seen a ton of disturbing pieces about ProtonMail. Every time I've looked into them, they seem to be maliciously motivated and usually not true, or otherwise twisting of the truth. This has been a confusing thing for me because why is there a small subset of people so vehemently against them? In this case, I'm not surprised. They say quite clearly they can…

>> What the authorities can't do, is read that person's email. What if authorities ask, serve this user this malicious JacaScript code to obtain their encryption key? PM has to obey and the result is the same.

I'm not totally sure on this, but if you use their mail bridge, I'm pretty sure the decryption happens on your local PC and the keys never have to leave that.

Re: Climate activist arrested after ProtonMail provided his IP address

#355

Post by chrisshroba »

jonas21 wrote: post #104
tephra wrote: post #53

Earlier quoted context omitted.

So also a proton customer here. "By default we do not keep any IP logs" and this case does not seem like the default? Seems like they were required to by law to log and turn over this specific IP? (Of course I haven't seen the actual case but I would assume that meant a warrant.)

As a user, I'd take that to mean that they wouldn't keep any IP logs unless I turned logging on. I wouldn't expect that they would enable logging on their own. Interestingly, ProtonMail's privacy policy lists a number of cases in which they may log your IP address permanently (including if you breach their Terms and Conditions). But a request from law enforcement is not one them.

Use of the service for any “unlawful or prohibited activities” violates the TOS, so if law enforcement has evidence of that (which they may), then PM has a clear right to log IP.

Re: Climate activist arrested after ProtonMail provided his IP address

#356

Post by markmark2021 »

This comment will probably get buried. But I’m a paying ProtonMail customer and I noticed a number of things that seem to indicate the company is doing things to enable user surveillance without it being directly attributed to the company.

1) Malware scanning services. I noticed that links in my email are sent to a third party to be scanned for malicious content. I never signed up for this service.

2) Mobile phone analytics. Using a third party for mobile analytics known to track users.

3) CDN: using a content delivery network in countries that do not have the same privacy requirements as ProtonMail’s corporate domicile.

Privacy is a gimmick for the company at the very least, a front at the worst. I still use them because I trust other companies even less.

Re: Climate activist arrested after ProtonMail provided his IP address

#357

Post by ruined »

mytailorisrich wrote: post #100
keewee7 wrote: post #48

Earlier quoted context omitted.

The Climate Action youth movement is sometimes explicitly anti-capitalist in a very "direct action" way. Vandalising banks is stupid and also an efficient way to make powerful people dislike you.

They do seem to be a far left group using the "climate" umbrella. This squatting 'action' has nothing to do with the environment, it's class struggle. Unfortunately this sort of extremist group is harmful to people and organisations genuinely trying to do something for the environment.

unfortunately, climate is a class issue

https://www.oxfam.org/sites/www.oxfam.org/files/file_attachm...

https://ourworldindata.org/co2-by-income-region#emissions-by...

Re: Climate activist arrested after ProtonMail provided his IP address

#358

Post by ksaj »

testvox wrote: post #342
ksaj wrote: post #317

Earlier quoted context omitted.

It would be nice if they had a tor presence so there would be no need to traverse an exit node. A lot of other privacy-forward sites do exactly this.

They do https://protonmail.com/tor

Thanks. I thought they must.

https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7... is the URL that people should be using with Tor if they are concerned with being traced.

Using Tor to access a regular web site, ie: through an exit node, is (nearly) no different than using a proxy. Just assume all exit nodes are "naughty" and do your thing accordingly.

Re: Climate activist arrested after ProtonMail provided his IP address

#359

Post by godelski »

falcolas wrote: post #226
georgyo wrote: post #214

Earlier quoted context omitted.

_all_ VPNs are useless. They are the biggest security theater and a massive success of marketing. But really, it's completely bazaar to trust a VPN provider. They provide protection from your local network, but you they can do all the same things and more.

Yes. Yes! I’ve never understood how people argue that they are somehow better than an ISP by default.

My ISP throttles connections (strangely including Zoom).

My ISP mines my data and sells it to the highest bidder despite costs not coming down.

My ISP determines what I can look at and can't (such as torrent sites).

My ISP is participating in anti-competitive behavior and I need the internet but I don't have a meaningful way to tell them to fuck off.

My VPN doesn't log. My VPN doesn't filter my traffic. My VPN reduces what my ISP can know about me and monetize me. My VPN allows me to access sites appearing in different countries or as a different user which changes what content websites serve to me, including price of products.

VPNs are a soft security practice, but one hell of a way to tell your ISP to fuck off. I think there's this group of people that say "oh, a security feature isn't bullet proof, therefore it is useless." But this is just dumb. All security features are probabilistic in nature and depend not only on how you use them, but your threat model and the will of your adversary. For people, like me, trying to escape dragnet operations VPNs do help. But alone they aren't enough and that's okay.

Re: Climate activist arrested after ProtonMail provided his IP address

#360

Post by Penguinx628 »

France_is_bacon wrote: post #251

For me, I NEVER expect protection from any governmemnt authorities. They have unlimited resources (compared to a regular person), and you can't fight city hall, as the saying goes. The reason I use tutamota (similar to protonmail) is to stop the Googles and Yahoos and hotmails from scanning all of my emails, using them to advertise to me, selling the information to advertisers. Could you imagine if the US post office…

FYI:

https://en.m.wikipedia.org/wiki/Mail_Isolation_Control_and_T...

Post reply on HN