Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

Post reply on HN
Print view View original

491–500 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#491

Post by TomSwirly »

istingray wrote: post #244
istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

All the Protonmail customers out there, what did you do about this? For starters, I emailed Protonmail support. Here's mine: Hi, Your homepage reads "By default, we do not keep any IP logs..." This language is soft and misleading. Maybe in 2018 when I first began using ProtonMail it was good enough. But in 2021 it's not. I expect better from ProtonMail. Replace immediately with something clearer. "By default we don't…

I simply closed my (free) account.

Their page is full of what are now obviously lies. They admit that in the cases of "extreme crimes" they might be forced to give up information. _By no stretch of the imagination are these peaceful political protests "extreme crimes"._

I specifically advocate for the sorts of people that Protonmail ratted out and had arrested - climate change activists.

Re: Climate activist arrested after ProtonMail provided his IP address

#492

Post by rsync »

buran77 wrote: post #478
rsync wrote: post #426

Earlier quoted context omitted.

That is what a “2FA mule” is for. I have two - both on MVNOs, not in my name, and sitting in my office doing nothing but relaying sms to email: https://news.ycombinator.com/item?id=28251107

If you need it one time for registration while staying anonymous using a burner SIM will work just fine. This way you anonimously create the account and then keep your location hidden using Tor. Authorities may even know who you are but will be unable to locate you. But the mule only gives you some extra functionality, resilience, and is like having an email address just for spam or a home VPN endpoint. It gives you…

Let me explain both my threat model and my use-case.

My threat model is not state level actors or law enforcement. My threat model is simply individuals working at providers I use that get curious and go hunting for my traffic. So, for instance, someone that works at my ISP or for my cellular provider or (github/twilio/twitter).

I don't want these private actors to see my name or my phone number. However, VOIP numbers are typically blocked by providers for purposes of authentication and security because they need you to "burn" an actual SIM card number just to incur costs on you. This is their blunt response to a rather difficult spam/scam problem that would just explode if no costs were involved.

...

My use-case is that I don't want to carry around three phones everywhere I go and eSIMs don't work for these functions (again, their numbers are often discriminated against). I also don't want a single SIM card to correlate across multiple providers - that is why I have three (one personal SIM (not in my name) and two "mule" SIMs).

...

"It's still in your proximity even if it's not in your name so anyone able to obtain your IPs from the services you use would also be able to get the location of your mule."

No, they are rarely in my proximity. In fact, at this moment they are 12000 miles away from me. I keep them at my office and might move them to a datacenter ... but only if I can convert them from a phone form factor to a rpi-with-cellular-hat form factor ... or maybe ssh into the phone ?

Well, remember - their interactions with these 2FA Mules are SMS only - there is no IP/network connection made here. So the providers, at least, don't have an IP address to look up. Also, in case it is not obvious, I fully control my entire mail and dns infrastructure - as in, I own the machines and rent the racks.

Re: Climate activist arrested after ProtonMail provided his IP address

#493

Post by ivan_gammel »

istingray wrote: post #218
ivan_gammel wrote: post #128

Earlier quoted context omitted.

TBH in 2021 people engaging in potentially dangerous activities should be literate enough to understand, that no business will guarantee them full security and decline all requests from authorities to disclose their identity. The wording you suggest is equivalent of „do not dry your cat in microwave“ instruction - a legal protection from dumb customers, that does not contribute meaningfully to safety. For the non-Swi…

The problem is that engaging in "potentially dangerous activities" includes such a wide range of people. Think about a journalist in Afghanistan, a whisteblower in the USA, or a human rights activist in China. They're all engaging in potentially dangerous activities. Are they "dumb" because they don't understand all the ins and outs of surveillance? How about some empathy for them as users? The proposed statement abo…

You do not have to understand all aspects of privacy to realize that governments may have sufficient resources to track your identity and to put enough pressure on businesses to provide information they need.

At the same time, Tor is not the only, the required and the sufficient way to ensure privacy. There are different circumstances requiring different approaches. In many cases Tor will be redundant, in some cases it may be impossible to use, will offer insufficient protection or will actually put the person in an immediate danger, so giving this kind of advice is at least equally harmful as not having full disclosure on logs.

Re: Climate activist arrested after ProtonMail provided his IP address

#494

Post by ranguna »

hk1337 wrote: post #323
istingray wrote: post #77

Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be req…

I didn't ever have proof, just a gut feeling, but I never really bought into Protonmail. I created an account but rarely used it and as far as I know has been deleted for a few years now.

What are you using now?

Re: Climate activist arrested after ProtonMail provided his IP address

#495

Post by foxfluff »

CyanBird wrote: post #453
blacklight wrote: post #451

I moved from Gmail to ProtonMail exactly because they were promising strong encryption, no logging of IPs and no data leaked outside for whatever reason. I know that every IT company eventually turns into a bunch of creepy and greedy jerks that end up contradicting all of their initial "don't be evil" statements. But please, Proton, don't do this so early in the process. I'm tired of migrating from one jerk company t…

You should set up your own email server, they can't be trusted If they are announcing this, think of the ones they are under gag orders to not announce /disclose

What does setting up your own server solve?

Like you can trust your ISP?

Chances are tracing your mailserver to you isn't any harder than tracing a protonmail account to you.

Re: Climate activist arrested after ProtonMail provided his IP address

#497

Post by aero-glide2 »

smsm42 wrote: post #398
kazen44 wrote: post #154

for those who are curious, this seems to be the reply from protonmail on reddit[0] >Hi everyone, Proton team here. We are also deeply concerned about this case. In the interest of transparency, here's some more context. In this case, Proton received a legally binding order from the Swiss Federal Department of Justice which we are obligated to comply with. Details about how we handle Swiss law enforcement requests can…

In other words, your information is safe from the police if the police doesn't want it, but the second they want it, they're getting it and Proton can't do anything about it. The "default" is only useful for hiding your past actions before the police took interest in you, but not for any action since it happened.

this is inaccurate, no one can't fetch the the body of emails.

Re: Climate activist arrested after ProtonMail provided his IP address

#498

Post by jraby3 »

xvector wrote: post #471
jraby3 wrote: post #457

Earlier quoted context omitted.

I was COO of a vpn company for several years. It’s almost impossible not to keep any ip info. We had issues with fraud and one of the best ways to prevent or limit it was to track IP address and save it for several months. I agree PM should be more forthright in their messaging but realistically I don’t believe any company that takes payments and doesn’t track any info at all.

Did your company market itself as a no-logs VPN company?

I don’t remember the actual marketing message as it was about 7 years ago, but I know in the TOS it was carefully written to include that it had to collect some ip info to prevent fraud.

Re: Climate activist arrested after ProtonMail provided his IP address

#499

Post by yunohn »

cookiengineer wrote: post #479
yunohn wrote: post #443

Earlier quoted context omitted.

While you’re not technically wrong about IP address hiding, that wasn’t my question. I’m asking if there’s any feasible way for ProtonMail to not have the ability to know which IP addresses connect to their services.

> I’m asking if there’s any feasible way for ProtonMail to not have the ability to know which IP addresses connect to their services. Maybe ProtonMail could offer an alternative .onion service? This way they couldn't legally be forced to give a way the IPs, because on the other end it's a TOR exit node anyways. And by design they cannot see the real IP from their point of view, so a legal enforcement would be useless…

That’s a good point - mandating Tor usage. The Guardian also provides a Filedrop Onion service.

Though I guess you could also access via Tor regardless, if not for the account creation stage.

Re: Climate activist arrested after ProtonMail provided his IP address

#500

Post by ranguna »

geewee wrote: post #429
jimnotgym wrote: post #427

It always amazes me that there is this hardcore of people on hn who are so anti ProtonMail. If you use gmail, It is my understanding that google ai will routinely read all your messages and add anything interesting to your profile so they can target you for ads. Law enforcement also has open access to everything in your mailbox all of the time. ProtonMail don't read your email but will supply metadata to authorities…

Gmail hasn't used email content for ads for years: source: https://www.nytimes.com/2017/06/23/technology/gmail-ads.html

Moreover, it doesn't matter if they use it for commercial purposes, what matter here is that governments can force protonmail to collect IPs and nothing else.

You're on Gmail or outlook ?

Well, now governments can have your IP, email contents and anything else you can imagine.

Post reply on HN