Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

431–440 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#431

Earlier quoted context omitted.

I'm not sure what you're trying to get at with the word "scan" here, so hopefully this abstraction will be useful. Imagine you have a message written on a piece of paper. You intentionally show this message to two people, Alice and Bob, and are fully aware that they have both read and can perfectly remember the entire contents of the message. Now imagine that Alice thought about the message independently (not recalli…

I don’t understand what you’re attempting to achieve with this. You’re weirdly abstracting about something that doesn’t need to be. People want to be able to have a private email correspondence about, for instance, dildos, and then not have to be served dildo ads outside of that context.

> I don’t understand what you’re attempting to achieve with this.

I was hoping to achieve a "yes" or "no", to at least one of the two questions. I don't know what GP thinks "scan" means when describing how a computer processes text, and was hoping that an analogy to a more natural concept would allow for that to be made clear. What's the actual action being taken that's the violation? It's clearly not simply being able to read the message, but is it "thinking" about it (for lack of a better word)? That's how I interpreted the initial comment, but it seems very reactionary, so I wanted to make sure I understood it.

> People want to be able to have a private email correspondence about, for instance, dildos, and then not have to be served dildo ads outside of that context.

Totally fair, but that's no longer about privacy (unless your concern is someone else watching your monitor over your shoulder, in which case that person is the one breaking your privacy).

Re: Climate activist arrested after ProtonMail provided his IP address

#432

Earlier quoted context omitted.

As a user, I'd take that to mean that they wouldn't keep any IP logs unless I turned logging on. I wouldn't expect that they would enable logging on their own. Interestingly, ProtonMail's privacy policy lists a number of cases in which they may log your IP address permanently (including if you breach their Terms and Conditions). But a request from law enforcement is not one them.

Use of the service for any “unlawful or prohibited activities” violates the TOS, so if law enforcement has evidence of that (which they may), then PM has a clear right to log IP.

Is that so? I thought, if one violates the TOS, the other side may terminate the service. I did not know they then had the automatic right to then log data suitable for tracking and identification.

Re: Climate activist arrested after ProtonMail provided his IP address

#433
post #429

It always amazes me that there is this hardcore of people on hn who are so anti ProtonMail. If you use gmail, It is my understanding that google ai will routinely read all your messages and add anything interesting to your profile so they can target you for ads. Law enforcement also has open access to everything in your mailbox all of the time. ProtonMail don't read your email but will supply metadata to authorities…

Gmail hasn't used email content for ads for years: source: https://www.nytimes.com/2017/06/23/technology/gmail-ads.html

Not for ads but for various kinds of text completion suggestions. Google's AI still reads contents from our email body to suggest text or reminders.

Re: Climate activist arrested after ProtonMail provided his IP address

#434

Earlier quoted context omitted.

By using the classics of course. https://en.wikipedia.org/wiki/Histiaeus#Ionian_revolt_(499-4... Sure the bitrate is a bit slow and it's UDP only but our governments have proved over and over again that they can't learn from history.

> In 499 BC, he shaved the head of his most trusted slave, tattooed a message on his head, and then waited for his hair to grow back. The slave was then sent to Aristagoras, who was instructed to shave the slave's head again and read the message, which told him to revolt against the Persians. Since this was a trusted slave, the tattoo seems unnecessary. The slave could just tell Aristagoras "Histiaeus says to revolt…

There is trust and there is trust.

There was enough trust that the slave did not desert and that they were taking the message to the destination.

There was not enough trust that the slave would actually know the CONTENT of the message. As such the slave wouldn't even know to where to desert to :)

Re: Climate activist arrested after ProtonMail provided his IP address

#435

I’m aware that this is a very silly sounding question, but I’m very confused about what’s going on here. If the subject of this investigation had been using ProtonVPN to connect to ProtonMail, would this have (in a marginal way) protected their anonymity? If Proton Mail can be compelled to begin logging, surely the same must be said of Proton VPN right? It’s interesting how many “privacy focused” companies tout being…

I'm Swiss and I volunteer for an organisation called Digital Society Switzerland. Although much smaller (and less powerful) we are similar to what the EFF is doing but on a national level.

I can only confirm your doubts about the "Swiss privacy laws". The current laws in Switzerland are very week (at least compared to the GDPR) and it has powerful surveillance laws in place (6 months data retention for telecommunication data, mass surveillance of internet traffic entering and leaving the country). If at all, being based in Switzerland as a privacy friendly company is rather a risk than giving you a "badge of honor".

I can only speculate where this myth and reputation of "Swiss privacy laws" is coming from. I guess it is related to the bank secret we had in place for a long time: It allowed you to own a bank account anonymously. While many states (especially the US) protested strongly (and for good reasons), it gave Switzerland an aura of discretion.

Re: Climate activist arrested after ProtonMail provided his IP address

#436

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

I don't trust any "secure" communications service that hasn't been subpoenaed and provided nothing in return. Having a national security letter canary doesn't hurt either.

Re: Climate activist arrested after ProtonMail provided his IP address

#437
post #112

Earlier quoted context omitted.

In the US companies can make canary statement... https://en.wikipedia.org/wiki/Warrant_canary

The canary is dead, and the fact is widely publicised, if not necessarily well known.

Our canary[1] - the very first one[2] - is alive and well.

In fact, it turned 15 years old this past April[3].

[1] https://www.rsync.net/resources/notices/canary.txt

[2] https://en.wikipedia.org/wiki/Warrant_canary#Usage

[3] https://twitter.com/rsyncnet/status/1387090538273206274

Re: Climate activist arrested after ProtonMail provided his IP address

#438

I’m aware that this is a very silly sounding question, but I’m very confused about what’s going on here. If the subject of this investigation had been using ProtonVPN to connect to ProtonMail, would this have (in a marginal way) protected their anonymity? If Proton Mail can be compelled to begin logging, surely the same must be said of Proton VPN right? It’s interesting how many “privacy focused” companies tout being…

I used to work for a now defunct Swiss company that had “Swiss quality, security and privacy” plastered all over the website and marketing materials. The number of actual Swiss people on the team could be counted on one hand, the rest of developers being from every European country out there, with the most represented ones being Ukraine and Romania. And from talking with my coworkers, the situation is the same across…

Almost every company in Switzerland that produces software has a bunch of eastern Europeans on the payroll, that either immigrated to the country or work remotely. But if the company started in Switzerland, or management and especially senior devs are based in Switzerland, I feel like that's good enough to apply the "Swiss quality" marketing because the Swiss _do_ have high standards and expected high quality of work produced.

Re: Climate activist arrested after ProtonMail provided his IP address

#439

Earlier quoted context omitted.

From what I understood, they don't log ip addresses by default, but can be compelled to legally. They can only provide ip addresses for subsequent logins.

So, they changed their server software to surveil a particular user? It seems even worse than logging all IPs systematically.

No, this is a security feature which can also be enabled by users - last logins basically.

Re: Climate activist arrested after ProtonMail provided his IP address

#440

Earlier quoted context omitted.

In comic-book voice, then: what would an intelligence agency or police force's response to a suspect known to be using Tor be? Traffic analysis, at a cost, could establish that the suspect is using Tor. TorMetrics shows slightly more than 1,250 currently-running Tor exit nodes. I'll presume this is typical, history shows it's pretty consisten over the past 3 months. https://metrics.torproject.org/relayflags.html?star…

Yeah, what you outline means Tor is Swiss cheese (ha, ha, long game pun), when it comes to traffic analysis. Are all the IPs for Paris to Tor being logged at the ISP level? You bet! Frankly, I don't think anyone is safe from the tip of a nation state, even small ones. But I do think we should protect everyone else and Tor would have done that. Because this was clearly civil disobedience and that is what we really sho…

Agreed on goals. Tor undoubtedly helps, and even where it fails, the raised costs are themselves a win for the pro-privacy crowd.

Just ... don't think it's a majykal bullet. It's not. Tradecraft matters, vulnerabilities exist. Examine and review your threat models.

Post reply on HN