Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail deletes 'we don't log your IP' from website after activist arrested

theregister.com

Post reply on HN
Print view View original

71–80 of 352 posts

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#71

Post by raverbashing »

dskloet wrote: post #49
raverbashing wrote: post #25

If people are unhappy about Protonmail I suggest they try find an email provider that is impervious to any judicial requests. Of any country. It is naive to imagine companies that have an address and take payments can ignore judicial decisions. Yes there's a point about fighting decisions, but as people say "we live in a society".

Some companies try harder to fight the decision than others and it makes a difference.

Protonmail fought 700 actions the past year as per the twitter thread. I think that's very above average. https://twitter.com/andyyen/status/1434665937203077120

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#73

Post by rpadovani »

livinginfear wrote: post #50

The expectation that Proton would be able to disobey the legal requests of their local authorities with impunity is unrealistic. Protonmail makes certain claims about privacy, particularly about encryption. They don't make any claims that they have the intention, or ability for that matter, to defy local authorities at their peril. Like Grugq said in one of his presentations (paraphrased): "Don't expect your VPN comp…

This. If you pay ProtonMail, you don't have your emails automatically scanned by some company to show you advertisements, and you have encryption at rest. That's all.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#74

Post by maxo133 »

ohgodplsno wrote: post #46
rawbot wrote: post #28

So they "don't log your IP", until the first time someone challenged that statement. Talk is cheap.

ProtonMail has always said that they would comply with Swiss law. Your IP will not be logged unless you commit a crime in Switzerland and the swiss police hands in a request.

So... if they receive valid swiss court order they can be forced to log user passwords on demand and their entire service is then useless? As when you have password you can decrypt entire mailbox content.

They market their service to journalists and activists, which are often targetted by their own governments. Seems that they cannot protect any of them.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#75

Post by rPlayer6554 »

plater wrote: post #68
kylehotchkiss wrote: post #41

Earlier quoted context omitted.

The company you’re mentioning in the end is Tresorit, right? If so, they still do get some kudos for running a pretty solid end to end encrypted storage service. Their whitepaper checked out to me and their heavy focus on business users instead of consumer seems to attract less of the advocate types of users that ended ProtonMail in this weeks situation to begin with

No, I'm referring to pcloud. I'm not saying they are necessarily a bad service or anything, just that their marketing is false.

This is extra problematic because pcloud doesn't encrypt files by default.

(It does have its "secure vault" but you can't sync it to your computer and costs a significant extra fee to use. You may as well use cryptomator)

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#76

Post by dsign »

teekert wrote: post #40
dsign wrote: post #22

The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happen. What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of…

Or you protect your own IP, I wonder if ProtonVPN could have done that? Would have been a nice test of those claims as well. All in all, I still trust ProtonMail, they are handling this quite well and transparently. Their original messaging was probably a compromise between getting the message out there and leaving some room for things like this. Arguably that was a mistake, or maybe with the whole truth in bold on t…

I agree that they are a great email provider, the lesser evil, and I myself use a paid plan. But I believe that, as a society, we are rolling down a slippery slope where digital privacy becomes more difficult everyday.

A couple of weeks ago, it was Apple announcing that they will spy by default in all of their customers via the iPhones because of child pornography. Apple has spent galleons of gold marketing itself as a privacy-first company and they are not a pushover; for them to do that, whatever is going on behind the curtains must be grim.

I thought it would be a few years before somebody wanted to use something like that technology for something less serious. Then yesterday the news broke that courts had forced ProtonMail to break their business just so the French police could find a climate activist.

In my view, we are heading to a world where our electronic devices and services will be used to prosecute petty crimes, like drinking alcohol in Arab countries or even parking over the line anywhere else.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#77

Post by cf_ »

kylehotchkiss wrote: post #41
plater wrote: post #34

Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy. Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference. Be also aware of the fact that many companies market themselves as Swiss, but all it mean…

The company you’re mentioning in the end is Tresorit, right? If so, they still do get some kudos for running a pretty solid end to end encrypted storage service. Their whitepaper checked out to me and their heavy focus on business users instead of consumer seems to attract less of the advocate types of users that ended ProtonMail in this weeks situation to begin with

As far as I know Tresorit has actual offices and staff in Zurich, Switzerland. They also appeared clear to me in the past that they have multiple offices around the world (I listened to a presentation from them recently at a conference).

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#78

Post by thrownaway561 »

question... why did they have this information readily available for them? couldn't they not retain logs and delete this sort of information right away? is there some legal aspect that makes them have to retain it for a certain amount of time or something?

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#79

Post by maxo133 »

ddevault wrote: post #10

ProtonMail has been fraught with problems for a long time, and it's good that serious issues are being brought to light. Their marketing is very good and critics of them have struggled to communicate to users for a while. The most important thing a serious privacy-minded service provider can do is be forthright and honest with users about the limitations of their privacy guarantees, particularly with respect to what…

Nothing stops them from deploying malicious javascript code to comply with court orders.

Nothing stops them from logging user password either, then the entire mailbox contents is compromised

Many good points + 1.

Post reply on HN