561–570 of 619 posts
Earlier quoted context omitted.
PM mails are encrypted with PGP at rest, as is metadata. The police can request to log incoming and outgoing mail metadata if available but not retroactively.
Wait what's stopping them from logging the body of email too then?
Earlier quoted context omitted.
I have no contempt for web devs beyond those that implement invasive tracking against their users. I could setup a service that masks any clients IP address towards my service with no problem. If a client connects through TOR or similar network I would not be the wiser either. So apart from just not logging connection attempts, there are other tricks. Of course that doesn't work if law enforcement is knocking on your…
You are mixing around client and server side ideas, so I’m still convinced that you don’t know how web services work. You also don’t seem to understand the gravity of an international criminal warrant, and counter with ideas of “paying a provider in Timbuktu to mask IPs”. I don’t like feeding trolls, so I’ll stop replying now.
Still, just for technicalities:
Any proxy server hides your IP. VPN, Tor, McDonalds Wifi...
Earlier quoted context omitted.
Unless you use end-to-end encryption (like PGP) then that's not true.
PM mails are encrypted with PGP at rest, as is metadata. The police can request to log incoming and outgoing mail metadata if available but not retroactively.
Earlier quoted context omitted.
Thanks. I thought they must. https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7... is the URL that people should be using with Tor if they are concerned with being traced. Using Tor to access a regular web site, ie: through an exit node, is (nearly) no different than using a proxy. Just assume all exit nodes are "naughty" and do your thing accordingly.
HN: Be careful when visiting Tor links that are suggested anywhere. There are many malicious clones of popular websites
Earlier quoted context omitted.
It's impossible to choose a "secure" email provider, unfortunately. Email can't guarantee E2EE without a block cipher tool like GPG. Even if your provider stores and transmits only encrypted email data, once sent it does not maintain that guarantee while being passed by another entity's MTA. If you email google, google gets to do whatever googly stuff it would like to do with its algorithm. If you email exchange, rou…
> Even if your provider stores and transmits only encrypted email data, once sent it does not maintain that guarantee while being passed by another entity's MTA. What? If Alice encrypts an email to Bob, using Bob's PGP key on her laptop, then it doesn't matter how many MTAs that email passes through, the email stays encrypted at every hop. > it could wind up being archived to tape I guess you're saying that an encryp…
>I guess you're saying that an encrypted email could travel through a provider that keeps a copy of it in the hopes that quantum computers will one day be cheaply available enough that they can crack
No, I'm saying when you send the email, the next MTA might not use encrypted transport and any mailbox/mail spool/cache might not store the data encrypted in any way.
You can of course get E2EE if you use GPG (you always could), but if somebody doesn't know how to use GPG or uses it wrong, that is problematic.
You can also just broadcast your gpg block message via public/ham radio or even hire a skywriter to spend his day tracing out your GPG cyphertext as a huge QR code in the sky :-)
Earlier quoted context omitted.
It's impossible to choose a "secure" email provider, unfortunately. Email can't guarantee E2EE without a block cipher tool like GPG. Even if your provider stores and transmits only encrypted email data, once sent it does not maintain that guarantee while being passed by another entity's MTA. If you email google, google gets to do whatever googly stuff it would like to do with its algorithm. If you email exchange, rou…
> since you can easily inspect the envelope for evidence of tampering Except that's not true. Often envelopes can be opened and resealed without any trace, meaning contents can be read or changed.
Earlier quoted context omitted.
This is completely false. I have created accounts (for others) over tor, without ever divulging a number. The exit node is a factor here. Sometimes email is required; if the need is there, throwaway emails work. I hate to tragedy-of-the-commons a good service, though, which is why I have a subscription.
Can you do it now?
For those concerned about using a temp mail site, it's only used to verify the account; it can never be used to recover it.
But the account is made and I can log into it just fine, perfectly accessible.
Earlier quoted context omitted.
FWIW, what they were accused of was squatting, not protesting climate change. I still think that's a ludicrous abuse of police powers, but it's worth being accurate.
And in the spirit of accuracy : the reason for the arrest was the violence during an eviction (several injured police officers), not the squatting itself.
Earlier quoted context omitted.
The canary is dead, and the fact is widely publicised, if not necessarily well known.
Our canary[1] - the very first one[2] - is alive and well. In fact, it turned 15 years old this past April[3]. [1] https://www.rsync.net/resources/notices/canary.txt [2] https://en.wikipedia.org/wiki/Warrant_canary#Usage [3] https://twitter.com/rsyncnet/status/1387090538273206274
I was referring to Protonmail's canary specifically, in the event that wasn't clear.
I guess there isn’t much Protonmail can do if the prosecutor shows up with an ~Interpol~ Europol warrant. I wonder what this “activist” did to earn himself Europol attention. At least before the world went insane, that would only happen for serious crimes.
Interpol warrants are widely used for fighting political opponents [ https://stockholmcf.org/wp-content/uploads/2017/09/Abuse-Of-... ] [ http://www.opinione.it/societa/2017/08/29/claudia-candelmo-e... ]