Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Climate activist arrested after ProtonMail provided his IP address

twitter.com

Post reply on HN
Print view View original

511–520 of 619 posts

Re: Climate activist arrested after ProtonMail provided his IP address

#511

Post by samhw »

VBprogrammer wrote: post #455
monkey_552 wrote: post #253

Earlier quoted context omitted.

Protonmail did not provide the authorities with the users IP address...they did allow the account to monitored which they are required by their laws to allow. It was the users sloppy OPSEC that allowed the authorities to eventually track them down. In the end, I believe, it was linking the user to a past Gmail account that finally did him in. Listen to this podcast episode, the presenter does a fairly good job summar…

I've worked with back end webservices for 10 years or so but I'm struggling to understand the concept of allowing a singular account to be monitored. What does this actually mean? An account in all of the systems I've dealt with is basically the collective understanding of a bunch of database queries. How does one allow an account to be monitored in any way which is less frightening than providing an IP address from…

It means:

``` if user.isUnderInvestigation { log(request.sourceIP) } ```

Re: Climate activist arrested after ProtonMail provided his IP address

#512

Post by blacklion »

PeterisP wrote: post #276
blacklion wrote: post #35

Earlier quoted context omitted.

Your own self-hosted service on rented server / cloud instance? AFAIU (IANAL!!!) you can refuse to give evidences against yourself in most jurisdictions. I don't thinks that dedicated server provider (like Hetzner) or cloud provider (like Digital Ocean or Vultr) stores traffic logs with enough details to be useful in such case. But payment will be a problem...

In most jurisdictions you can refuse to testify against yourself but you are still required to give up all physical evidence against yourself if an appropriate warrant requests them, the immunity only applies to things in your mind. Things like hiding or destroying evidence of a crime generally are separate crimes of which you can be convicted even if you're acquitted of the original crime (e.g. burying a corpse in t…

Here is interesting collision: password IS thing in my mind, for sure.

But, as far as I understand, case law is not in my favor in this case :-(

Re: Climate activist arrested after ProtonMail provided his IP address

#513

Post by sodality2 »

jnsaff2 wrote: post #466
sodality2 wrote: post #327

Earlier quoted context omitted.

That canary statement would kill their userbase. Seriously, who expects a company to admit the value they provide is not much? They expect the more savvy users (ie, those who need the privacy, typically) to understand basic OPSEC. I admit that the marketing is bad, I do not agree with it, and I do not tolerate it in terms of my own OPSEC. But, there's just no way they would just admit they provide hardly any value be…

Not having that canary may LITERALLY kill some of their users. If they have some decency they should own up to the truth and if they end up being out of business they will have a lot of goodwill for their next business.

And I 100% agree that they should. I'm just saying there's an incredibly slim chance they will. From a business perspective, which is the perspective they always take, it makes no sense.

Re: Climate activist arrested after ProtonMail provided his IP address

#514

Post by blacklion »

Sebb767 wrote: post #101
blacklion wrote: post #35

Earlier quoted context omitted.

Your own self-hosted service on rented server / cloud instance? AFAIU (IANAL!!!) you can refuse to give evidences against yourself in most jurisdictions. I don't thinks that dedicated server provider (like Hetzner) or cloud provider (like Digital Ocean or Vultr) stores traffic logs with enough details to be useful in such case. But payment will be a problem...

You can't be compelled to incriminate yourself, but your server provider can very much be compelled to give access to the server. And once the server is physically compromised the battle is lost, anyway, but in that case probably with a larger papertrail leading to you. One expensive but possible option would be to build a server yourself with sufficient traps to shut off when it's tapered with. Then set it up with f…

Dedicated server (with standard hardware) can be prepared to be almost tamper-protected, for almost everything realistic attacks. Yes, it will be prone to freeze memory (physical freeze, with liquid nitrogen or liquid helium), but I don't think that it is what police in any country will do.

But as sibling comment mention, it can be seen as destroying of evidences in many jurisdictions :-(

Re: Climate activist arrested after ProtonMail provided his IP address

#515

Post by BrandoElFollito »

bromuro wrote: post #339
BrandoElFollito wrote: post #70

Earlier quoted context omitted.

Has your home in France been squatted? No? Or maybe you do not own a house in France? If so, on which basis do you ironically call squatting a "terrible crime"? Squatters in your house in France means that you you have zero rights on this place until a lengthy process gives it back to you, ruined. You are then expected to be grateful and can forget about any reimbursement from the poor people who stole your property.

Squatting is about occupying uninhabited places. It should be welcomed or at least tolerated.

I assume that you are not trolling.

Please give your opinion about squatting primary and secondary homes of people. Who worked to buy them and have zero rights afterwards, when a colony of parasites come and destroy their belongings.

This is what happens in France.

Re: Climate activist arrested after ProtonMail provided his IP address

#516

Post by BrandoElFollito »

estaseuropano wrote: post #365
bromuro wrote: post #339

Earlier quoted context omitted.

Squatting is about occupying uninhabited places. It should be welcomed or at least tolerated.

I Don't know about France but in some places its near impossible to evict squatters, meaning if your property stands empty a month (e.g. waiting for new tenant or repairs) and some squatters move in you are basically screwed for years to come - they won't pay rent, you'll lose thousands and much lifetime evicting them, and for a few years they'll run down your property as they have no legal or other interest in maint…

This is exactly the case in France.

Re: Climate activist arrested after ProtonMail provided his IP address

#517

Post by blacklion »

upbeat_general wrote: post #40
blacklion wrote: post #35

Earlier quoted context omitted.

Your own self-hosted service on rented server / cloud instance? AFAIU (IANAL!!!) you can refuse to give evidences against yourself in most jurisdictions. I don't thinks that dedicated server provider (like Hetzner) or cloud provider (like Digital Ocean or Vultr) stores traffic logs with enough details to be useful in such case. But payment will be a problem...

It’s certainly possible that they store IP addresses. Even if they don’t, as long as they have the email address then they can probably find the mail server even if the payment is anonymous.

Find mail server itself — sure. Find all clients which submitted mail through it in the past — I'm in doubt.

Anonymous/protected enough payment is the problem.

Re: Climate activist arrested after ProtonMail provided his IP address

#518

Post by iggldiggl »

chrononaut wrote: post #157
Youden wrote: post #41

Earlier quoted context omitted.

Honest question, because I've been asking it of myself: what do you expect from such a service? I basically decided to just give up. Email is an insecure protocol and there's not much that can be done about it. Choosing a "secure" email provider feels like choosing a "secure" VPN provider: it's impossible to verify the provider's claims so it's a kind of security theatre.

> I basically decided to just give up. Email is an insecure protocol and there's not much that can be done about it. Choosing a "secure" email provider feels like choosing a "secure" VPN provider: it's impossible to verify the provider's claims so it's a kind of security theatre. Notionally, I would imagine something that looks like "email" and acts like "e-mail" (to the end user) could eventually exist that provides…

A number of features I expect from e-mail seem rather between hard up to impossible to achieve if you insist on the "your server cannot be trusted, either" model of operations, though:

- The ability to login from multiple devices (using both dedicated clients and webmail) and subsequently being able to immediately access all my old messages, too.

- Global filtering, tagging, folders, read/unread tracking etc.

- Full-text search that doesn't require downloading all messages to your local device beforehand.

Re: Climate activist arrested after ProtonMail provided his IP address

#519

Post by BrandoElFollito »

russianbandit wrote: post #380
estaseuropano wrote: post #365

Earlier quoted context omitted.

I Don't know about France but in some places its near impossible to evict squatters, meaning if your property stands empty a month (e.g. waiting for new tenant or repairs) and some squatters move in you are basically screwed for years to come - they won't pay rent, you'll lose thousands and much lifetime evicting them, and for a few years they'll run down your property as they have no legal or other interest in maint…

But if someone just moves into your property why can’t police just kick them out? That’s an illegal action. If someone came into your house and started stealing your things and you call the cops on them you don’t go to court to prove those things are really yours.

In France once someone entered your house (and stayed a generally agreed upon 48 hours) you have no right to evict them.

Then starts a possibly very long process to have them evicted/ If they have a child you are basically screwed and won't be able to get your property back. Or you will wait months/years and get a ruin back.

Re: Climate activist arrested after ProtonMail provided his IP address

#520

Post by sodality2 »

sellyme wrote: post #404
sodality2 wrote: post #387

Earlier quoted context omitted.

The difference is that protonmail, again, doesn't scan any data in my emails. Google does, then stores and tailors and sells ads. My privacy is violated when google scans my mail, and not when protonmail doesn't.

I'm not sure what you're trying to get at with the word "scan" here, so hopefully this abstraction will be useful. Imagine you have a message written on a piece of paper. You intentionally show this message to two people, Alice and Bob, and are fully aware that they have both read and can perfectly remember the entire contents of the message. Now imagine that Alice thought about the message independently (not recalli…

The act of analyzing my data is what is the violation. The act of telling me is simply revealing that violation. This is why, when the US intelligence agencies were scanning and analyzing everyone in America's cell phone history and social graph, without interaction or active intervention, it was a privacy violation even when it wasn't being used. It doesn't matter who sees it. The fact that it is being scanned and analyzed for possible future use and abuse is the problem. Yes, this means that a computer in the middle of the rainforest analyzing my mail offline and nothing else is a violation of my privacy. And no, I do not believe that the two, Alice and Bob, can be equated.
Post reply on HN