Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail deletes 'we don't log your IP' from website after activist arrested

theregister.com

Post reply on HN
Print view View original

31–40 of 352 posts

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#31

Post by dewey »

warp wrote: post #16
ajay-b wrote: post #6

This is just ridiculous.. If they receive a notice to log your IP address, they should notify you first. My trust in ProtonMail is gone.

According to their statement: > Under Swiss law, it is obligatory for a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. But the timeline is unclear to me. If they notified you via e-mail, and then immediately turned on IP logging. So... you'd go and check your e-mail, learn about the third-party request, but by then it's too late as you…

> but by then it's too late as your IP address has already been logged?

If someone is so sensitive about leaking their IP address and they access some service with their real IP and relying on a service's promise to not log it they already are not very careful to begin with.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#32

Post by marcyb5st »

anothernewdude wrote: post #13

For such a stupid thing too. I'm surprised Switzerland provided a warrant for a climate activist.

It's an international request from Europol. Switzerland is somewhat forced to comply with these (and this one in particular) for two reasons. One political and one to serve its own interests.

The political one is that if Switzerland in the future will create an international request countries could rebuff that in lieu of this very event. And to be honest I am not sure if they can refuse such requests after the recent referendum about abiding the EU constitution.

The self-interest one is that those activists are/were prone to vandalizing banks which are a cornerstone of Swiss economy to this day (in smaller measure compared to the past since they now can pass information of account holders to other countries). Anyway, banks are still a big deal in the Swiss mentality and giving a literal "out of jail card" to someone that targets banks would set a bad precedent in Swiss public opinion.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#33

Post by qwertox »

aero-glide2 wrote: post #21
7demons wrote: post #11

I guess ProtonVPN also is not an exception to such "undeniable" requests. Bad day for company who bank on "no log" policy. Their marketing division will have a ton of work to fix reputation :)

No, ProtonVPN isn't subject to the same problem (according to the CEO).

Care to share more information about this?

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#34

Post by plater »

Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy.

Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference.

Be also aware of the fact that many companies market themselves as Swiss, but all it means is they have a head office in Switzerland due to tax reasons. In one example, it's a cloud storage company, they say on their marketing page and their about page that they are based in Switzerland and under Swiss law, but if you look at the legal pages the company you sign up with are actually based in Bulgaria. Their servers are based in Texas, USA and Luxemburg, Europe and their development team in Bulgaria.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#35

Post by timdaub »

Well, at least they own their mistakes and change accordingly.

All email is shit. Nothing is encrypted and many company's simply try to sell you on better productivity (hey.com). Already having my email be encrypted so that the host can't read it is a step forward, in my opinion.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#36

Post by EveYoung »

ddevault wrote: post #10

ProtonMail has been fraught with problems for a long time, and it's good that serious issues are being brought to light. Their marketing is very good and critics of them have struggled to communicate to users for a while. The most important thing a serious privacy-minded service provider can do is be forthright and honest with users about the limitations of their privacy guarantees, particularly with respect to what…

In my opinion, email is the wrong medium for highly confidential communication. Especially, if someone's personal freedom or safety depends on it. Even if E2E works correctly, you still have to worry about meta data. Maybe Matrix over TOR would be a better alternative?

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#38

Post by nickthemagicman »

ohgodplsno wrote: post #23

The homepage has always been misleading, since their TOS does mention that they can keep your IP address, for law-related purposes or spam prevention. Additionally, once they receive a request from Swiss police, they _have_ to comply and log those addresses. You can fight tooth and nail and pretend that your entire service is built to never see any IP, but in the end, you will still be made to log it. Welcome to real…

They can force you to implement functionality if it doesn't exist? Like logging?

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#39

Post by ddevault »

EveYoung wrote: post #36
ddevault wrote: post #10

ProtonMail has been fraught with problems for a long time, and it's good that serious issues are being brought to light. Their marketing is very good and critics of them have struggled to communicate to users for a while. The most important thing a serious privacy-minded service provider can do is be forthright and honest with users about the limitations of their privacy guarantees, particularly with respect to what…

In my opinion, email is the wrong medium for highly confidential communication. Especially, if someone's personal freedom or safety depends on it. Even if E2E works correctly, you still have to worry about meta data. Maybe Matrix over TOR would be a better alternative?

I would not go so far as to day that email cannot be used privately, but I would say that it is very very difficult to use email privately. I agree that most people with highly confidential needs would be better served by another system, though I don't know what to recommend - Matrix over Tor seems viable, perhaps.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#40

Post by teekert »

dsign wrote: post #22

The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happen. What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of…

Or you protect your own IP, I wonder if ProtonVPN could have done that? Would have been a nice test of those claims as well.

All in all, I still trust ProtonMail, they are handling this quite well and transparently. Their original messaging was probably a compromise between getting the message out there and leaving some room for things like this. Arguably that was a mistake, or maybe with the whole truth in bold on the front page, people would have flocked less to ProtonMail? I still don't agree with that original messaging though, as they don't themselves anymore.

Still pretty great free service if you ask me. If a family plan was cheaper I'd have migrated everyone there a long time ago.

Post reply on HN