Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail deletes 'we don't log your IP' from website after activist arrested

theregister.com

Post reply on HN
Print view View original

61–70 of 352 posts

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#61

Post by Sebb767 »

dsign wrote: post #22

The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happen. What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of…

> So it was bound to happen.

And this was quite obvious for someone who actually looked into staying anonymous (or gave the Protonmail threat model page a deeper read).

> What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of their customers.

That's a big simplification. It took quite a few authorities to wave through a very draconian request for (what appears to be) a minor crime. As Protonmail themselves pointed out, they never promised to protect the IPs and they could explicitly not promise that. In fact, they even stated very clearly that they could not. Expecting them to print that on the frontpage is quite unreasonable when their marketing has to compete with shady VPNs that promise the sky.

> From there, all it takes is for somebody to change a law in Switzerland and end-to-end encryption of the messages themselves will only be "by default."

While this is a reasonable threat, it's not like one could do this in an afternoon.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#62

Post by edly »

livinginfear wrote: post #50

The expectation that Proton would be able to disobey the legal requests of their local authorities with impunity is unrealistic. Protonmail makes certain claims about privacy, particularly about encryption. They don't make any claims that they have the intention, or ability for that matter, to defy local authorities at their peril. Like Grugq said in one of his presentations (paraphrased): "Don't expect your VPN comp…

This is exactly what baffled me about people saying "I'm cancelling my PM subscription" as if they didn't make this abundantly clear. In their transparency report, they state very clearly that they "may also be obligated to monitor the IP addresses" being used to access accounts engaged in criminal activity.

Privacy activists, for some reason, don't take the time to read transparency reports.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#63

Post by occamrazor »

shafyy wrote: post #43

I see many comments here that seem to be uninformed. Please, make sure to ProtonMail's official statement first. It includes a lot of important background info: https://protonmail.com/blog/climate-activist-arrest/ For example, this paragraph is important: > Unlike other providers, we do fight on behalf of our users. Few people know this (it’s in our transparency report), but we actually fought over 700 cases in 2020…

They also say that they had no idea about the identity of the activist and the charges against them. That means that the information was not provided in the warrant/police request, and thus that they can’t or don’t want to look into the merits of any requests. My hypothesis is that the 700 cases they mention are requests from _foreign_ authorities, to whom they answer that they need the request to come through Swiss authorities. More like a template email than a “fight”

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#64

Post by happybirds07 »

unyttigfjelltol wrote: post #53
EveYoung wrote: post #36

Earlier quoted context omitted.

In my opinion, email is the wrong medium for highly confidential communication. Especially, if someone's personal freedom or safety depends on it. Even if E2E works correctly, you still have to worry about meta data. Maybe Matrix over TOR would be a better alternative?

When someone's personal freedom or safety is at risk from their communications, said person should re-evaluate their career choices.

Not everybody have the luxury of being born in your Scandinavian haven.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#65

Post by [deleted] »

kylehotchkiss wrote: post #41
plater wrote: post #34

Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy. Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference. Be also aware of the fact that many companies market themselves as Swiss, but all it mean…

The company you’re mentioning in the end is Tresorit, right? If so, they still do get some kudos for running a pretty solid end to end encrypted storage service. Their whitepaper checked out to me and their heavy focus on business users instead of consumer seems to attract less of the advocate types of users that ended ProtonMail in this weeks situation to begin with

[deleted]

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#66

Post by indymike »

WhyNotHugo wrote: post #55
dsign wrote: post #22

The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happen. What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of…

The premise of "we'll never log your IPs" is something that no company can hold. - Local law enforcement can force the to do so. - Locals laws can change. - Guys with guns might barge in and demand it. Mostly, you can understand that they don't _intend_ to log IPs, and aren't in the business of collecting and redistributing data. But that doesn't mean you can count on absolute and unconditional secrecy.

Add to your list:

- engineer troubleshooting might do so temporarily.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#67

Post by vmception »

rvz wrote: post #2

It has been admitted. So they DO log your IP address when you use their service. So their customers have been lied to and have their privacy at risk. They cannot be trusted. So how long have ProtonMail kept this massive lie from its users then?

pretty much every comment section about protonmail has been pointing this out for years

their users were too fanatical over "Swiss laws" to pay attention, going as far to demand proof when observers were merely pointing out the fundamental flaw in the Protonmail concept and incongruent advertising

well, now there is proof

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#68

Post by plater »

kylehotchkiss wrote: post #41
plater wrote: post #34

Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy. Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference. Be also aware of the fact that many companies market themselves as Swiss, but all it mean…

The company you’re mentioning in the end is Tresorit, right? If so, they still do get some kudos for running a pretty solid end to end encrypted storage service. Their whitepaper checked out to me and their heavy focus on business users instead of consumer seems to attract less of the advocate types of users that ended ProtonMail in this weeks situation to begin with

No, I'm referring to pcloud. I'm not saying they are necessarily a bad service or anything, just that their marketing is false.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#69

Post by rossmohax »

WhyNotHugo wrote: post #55
dsign wrote: post #22

The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happen. What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of…

The premise of "we'll never log your IPs" is something that no company can hold. - Local law enforcement can force the to do so. - Locals laws can change. - Guys with guns might barge in and demand it. Mostly, you can understand that they don't _intend_ to log IPs, and aren't in the business of collecting and redistributing data. But that doesn't mean you can count on absolute and unconditional secrecy.

Same for end to end encryption, no? Law enforcement can force them to serve backdoored JS client payload.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#70

Post by destitude »

edly wrote: post #62
livinginfear wrote: post #50

The expectation that Proton would be able to disobey the legal requests of their local authorities with impunity is unrealistic. Protonmail makes certain claims about privacy, particularly about encryption. They don't make any claims that they have the intention, or ability for that matter, to defy local authorities at their peril. Like Grugq said in one of his presentations (paraphrased): "Don't expect your VPN comp…

This is exactly what baffled me about people saying "I'm cancelling my PM subscription" as if they didn't make this abundantly clear. In their transparency report, they state very clearly that they "may also be obligated to monitor the IP addresses" being used to access accounts engaged in criminal activity. Privacy activists, for some reason, don't take the time to read transparency reports.

What about the perception they gave that state if you were being monitored you would be notified? The part not made clear was that they could delay notifying you for months.
Post reply on HN