Climate activist arrested after ProtonMail provided his IP address • Hacker News Board

Re: Climate activist arrested after ProtonMail provided his IP address

#401

Post by mytailorisrich » Mon, Sep 06, 2021, 5:48 AM UTC

pessimizer wrote: post #206

mytailorisrich wrote: post #63

Earlier quoted context omitted.

In this case it seems that they are a far left group that has decided to squat a restaurant for good old 'class struggle' reasons and vowed not to back down... It also seems that it is not any restaurant but one of the 'victims' of the 2015 terrorist attacks [1] Basically political extremists trying to disguise themselves as environmental activists. Not interesting people, to say the least. [1] https://www.tellerrepo…

Ah, they're sitting in a restaurant in protest. Clearly insane terrorists.

Don't trivialize extremism, please.

Re: Climate activist arrested after ProtonMail provided his IP address

#402

Post by seg_lol » Mon, Sep 06, 2021, 5:48 AM UTC

dredmorbius wrote: post #319

seg_lol wrote: post #314

Earlier quoted context omitted.

It would have absolutely prevented this person from getting identified. It looks like some kids doing a climate protest. I can't but help read your post in comic book guys voice.

In comic-book voice, then: what would an intelligence agency or police force's response to a suspect known to be using Tor be? Traffic analysis, at a cost, could establish that the suspect is using Tor. TorMetrics shows slightly more than 1,250 currently-running Tor exit nodes. I'll presume this is typical, history shows it's pretty consisten over the past 3 months. https://metrics.torproject.org/relayflags.html?star…

Yeah, what you outline means Tor is Swiss cheese (ha, ha, long game pun), when it comes to traffic analysis. Are all the IPs for Paris to Tor being logged at the ISP level? You bet!

Frankly, I don't think anyone is safe from the tip of a nation state, even small ones. But I do think we should protect everyone else and Tor would have done that.

Because this was clearly civil disobedience and that is what we really should be protecting.

https://www.cactusvpn.com/vpn/is-tor-safe/

Re: Climate activist arrested after ProtonMail provided his IP address

#403

Post by France_is_bacon » Mon, Sep 06, 2021, 5:48 AM UTC

Penguinx628 wrote: post #360

France_is_bacon wrote: post #251

For me, I NEVER expect protection from any governmemnt authorities. They have unlimited resources (compared to a regular person), and you can't fight city hall, as the saying goes. The reason I use tutamota (similar to protonmail) is to stop the Googles and Yahoos and hotmails from scanning all of my emails, using them to advertise to me, selling the information to advertisers. Could you imagine if the US post office…

FYI: https://en.m.wikipedia.org/wiki/Mail_Isolation_Control_and_T...

Does not negate what I said. I said that the USPS does not open your mail, scan it, and sell it to the highest bidder. And, actually, the article you linked to only gives that information to government entities, which, in my post, I said that you should not worry about the government, because they have infinite resources compared to the average person.

So not too sure on your point that you're trying to make. Yeah, if there's a subpoena, I'm sure the government could open and read every single piece of mail you send or receive, but that's what I said.

But, Google or Yahoo or Facebook is not going to have access to this information. But they will if you use their email system. Why do you think they offer it for free? Through the generosity of Sergey Brinn and Larry Page's black, black hearts?

Re: Climate activist arrested after ProtonMail provided his IP address

#404

Post by sellyme » Mon, Sep 06, 2021, 5:48 AM UTC

sodality2 wrote: post #387

sellyme wrote: post #369

Earlier quoted context omitted.

In both cases exactly the same entities read your email: you, the sender, and Gmail. I don't see how you could go "yeah, this is a privacy improvement" if your information is still visible to exactly the same entities, but one of them isn't really mentioning it.

The difference is that protonmail, again, doesn't scan any data in my emails. Google does, then stores and tailors and sells ads. My privacy is violated when google scans my mail, and not when protonmail doesn't.

I'm not sure what you're trying to get at with the word "scan" here, so hopefully this abstraction will be useful.

Imagine you have a message written on a piece of paper. You intentionally show this message to two people, Alice and Bob, and are fully aware that they have both read and can perfectly remember the entire contents of the message.

Now imagine that Alice thought about the message independently (not recalling it, but actually thinking new thoughts), and that Bob did not do this.

Are you claiming that Alice violated your privacy by thinking about something you showed her and asked her to remember? Or perhaps would it only be a violation of privacy if she then subsequently told you one of those thoughts?

Re: Climate activist arrested after ProtonMail provided his IP address

#405

Post by heavyset_go » Mon, Sep 06, 2021, 5:53 AM UTC

istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

One thing I've noticed is that many HN users don't believe that courts can compel companies to take positive actions to surveil their customers. This incident illustrates that, yes, courts can compel companies to keep logs even if their infrastructure is built to not keep them at all.

We cannot rely on what companies say about their privacy guarantees, or rely on vendors' technical analysis of their own black box systems, because a simple court order can essentially be a backdoor.

Re: Climate activist arrested after ProtonMail provided his IP address

#406

Post by yosito » Mon, Sep 06, 2021, 6:02 AM UTC

France_is_bacon wrote: post #251

For me, I NEVER expect protection from any governmemnt authorities. They have unlimited resources (compared to a regular person), and you can't fight city hall, as the saying goes. The reason I use tutamota (similar to protonmail) is to stop the Googles and Yahoos and hotmails from scanning all of my emails, using them to advertise to me, selling the information to advertisers. Could you imagine if the US post office…

This, 100%. I think Protonmail gives people a false sense of security. I want to protect myself from companies that collect my data to profile me and sell that profile to people with money who want to manipulate me (aka advertisers). All of the parties I communicate with via email use more insecure providers, so even if Protonmail was perfectly secure, my emails are vulnerable anyway. I think it's important to keep in mind that the providers you're sending email to also have the ability to scan those emails and profile you based on them. As an additional layer of protection from this profiling, it's helpful to use a wildcard alias both when sending and recieving mail to make it harder (but not impossible) for third parties to build a single profile of you.

Personally, I've switched from Protonmail to Fastmail. Yes, Fastmail is in Australia which has draconian state surviellance laws and will comply with state requests for your data and share it with other countries. But you can't assume that any other email provider won't, as evidenced by what Protonmail just did. And Fastmail has better features for protecting you from being profiled, such as unlimited wildcard aliases, and the ability to create filters and deactivate aliases directly from incoming messages, in addition to a far better overall email experience.

Re: Climate activist arrested after ProtonMail provided his IP address

#407

Post by uncoder0 » Mon, Sep 06, 2021, 6:04 AM UTC

vages wrote: post #395

grappler wrote: post #361

Earlier quoted context omitted.

Sad to say, Proton's onion service is for their old version. Proton has recently rolled out a new updated version of their service, and as far as I'm aware they don't offer a Tor onion service for that newer version. So Proton users who like to connect via Tor onion services have been faced with a choice of either staying on the old version of ProtonMail, or giving up on connecting via a Tor onion service. It definit…

I tested this, and you're right: Their Tor service runs the (in my opinion nearly as usable) older version. It's plausible that Proton does not care about their Tor service, but there may be another reason: The new version relies more on Javascript code than their old version, and a Tor user is more likely to browse with scripts disabled than a regular user. Proton may be holding back the rollout of the newer version…

Tor + Scripts is not good. You're probably right on why there isn't a newer version on their onion service.

Re: Climate activist arrested after ProtonMail provided his IP address

#408

Post by drivebycomment » Mon, Sep 06, 2021, 6:06 AM UTC

France_is_bacon wrote: post #399

drivebycomment wrote: post #383

Earlier quoted context omitted.

> to stop the Googles and Yahoos and hotmails from scanning all of my emails, using them to advertise to me, selling the information to advertisers. They don't sell your information to advertisers. So your threat model here is factually false.

Do you work for a PR company that works for the industry? Are you an industry flak? Peddle your wares elsewhere. Go tell it to the Marines. https://www.eff.org/deeplinks/2020/03/google-says-it-doesnt-...

From the article:

"And companies like Google shouldn’t be able to monetize data they collect without consent even if they aren’t technically “selling” it. Data collection, use, and sharing should be minimized by default."

If you meant "selling the information" more broadly as EFF used it here (which I think is not an unreasonable way ultimately, just not what most people would commonly understand the phrase as), then please next time clarify. As EFF had to clarify in their article, that's not what most people understand those phrase as. If you want to avoid confusion, it would be more clear if you say "you don't want your data monetized".

Re: Climate activist arrested after ProtonMail provided his IP address

#409

Post by kaba0 » Mon, Sep 06, 2021, 6:07 AM UTC

sellyme wrote: post #369

sodality2 wrote: post #326

Earlier quoted context omitted.

>The scanning of email contents that Gmail does is, from a privacy standpoint, indistinguishable from them simply sending you the email The privacy violation of creating a profile on me based on my mail to tailor ads is not the same thing as simply delivering mail.

In both cases exactly the same entities read your email: you, the sender, and Gmail. I don't see how you could go "yeah, this is a privacy improvement" if your information is still visible to exactly the same entities, but one of them isn't really mentioning it.

You don’t see the difference between “seeing an email” en transit vs training a ML algorithm on it and extracting values like when will your airplane depart, when is your vacation, etc and automatically propagating that to other google products? I mean, it sure is comfortable, but you can sure as hell know that they build an extensive profile out of your private emails and your ads are targeted based on that..

Re: Climate activist arrested after ProtonMail provided his IP address

#410

Post by drivebycomment » Mon, Sep 06, 2021, 6:09 AM UTC

Ansil849 wrote: post #393

drivebycomment wrote: post #391

Earlier quoted context omitted.

> at least not openly. In other words, they could have concealed the location of their services. You can't provide a paid commercial service while hiding your business entity. And, on top of that, DNS and SMTP make this basically impossible technically as well. So what you're looking for is, at least when it comes to email, something that doesn't and can't exist.

> You can't provide a paid commercial service while hiding your business entity. You absolutely can. This is how many entities on the dark web function. And in fact, so do many entities on the clear web (see the RBN and its successors as an example).

Good luck building a paid email service on the dark web.