101–110 of 352 posts
Earlier quoted context omitted.
Care to share more information about this?
Probably refers to this: > Under current Swiss law, email and VPN are treated differently, and ProtonVPN cannot be compelled to log user data. https://protonmail.com/blog/climate-activist-arrest/
This is just ridiculous.. If they receive a notice to log your IP address, they should notify you first. My trust in ProtonMail is gone.
According to their statement: > Under Swiss law, it is obligatory for a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. But the timeline is unclear to me. If they notified you via e-mail, and then immediately turned on IP logging. So... you'd go and check your e-mail, learn about the third-party request, but by then it's too late as you…
The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happen. What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of…
The premise of "we'll never log your IPs" is something that no company can hold. - Local law enforcement can force the to do so. - Locals laws can change. - Guys with guns might barge in and demand it. Mostly, you can understand that they don't _intend_ to log IPs, and aren't in the business of collecting and redistributing data. But that doesn't mean you can count on absolute and unconditional secrecy.
The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happen. What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of…
The premise of "we'll never log your IPs" is something that no company can hold. - Local law enforcement can force the to do so. - Locals laws can change. - Guys with guns might barge in and demand it. Mostly, you can understand that they don't _intend_ to log IPs, and aren't in the business of collecting and redistributing data. But that doesn't mean you can count on absolute and unconditional secrecy.
Four words: The Intercept, Secure Drop. A one-way mail (content submission) system that runs exclusively on Tor, and thus can't be supboenated for users' IP address.
While I get your premise due to concerns of law, I think it is entirely feasible - and hinges on execution, marketing ability. We already have IP-hiding technology, whether Tor or Freenet or other such. The concern is "are we good enough yet to make it a sustainable business?"
For sake of example: if a hypothetical competitor to ProtonMail was to offer sign-up and email access only over Tor protocol, it would effectively be safe from police's demands to start logging IPs - thanks to technical measures. The actual difficulty is in the business side: getting enough paying customers to install & enable relevant browser or browser plugin.
Granted, the police could try to force the hypothetical competitor to install malicious JavaScript that would try to gather & leak users' IP address or other identifying information through other means, but that's solvable in the longer run just as well.
The expectation that Proton would be able to disobey the legal requests of their local authorities with impunity is unrealistic. Protonmail makes certain claims about privacy, particularly about encryption. They don't make any claims that they have the intention, or ability for that matter, to defy local authorities at their peril. Like Grugq said in one of his presentations (paraphrased): "Don't expect your VPN comp…
Untrue.
There are many way to resist authority without being seen as blatantly disobeying the law.
In this particular case, they could have gone with the standard: "can't technically do it, we don't have the infrastructure". Or: "the guys who manages the logs just quit, we can't recover the information". Or: "we don't have the budget to implement that, it'd bankrupt us" ... etc ... make as many lame excuses as the day is long.
Drag things into court and just bog the effing big brother machine down in technicalities long enough until they simply give up or the French activist has had ample time to skedaddle.
Earlier quoted context omitted.
In my opinion, email is the wrong medium for highly confidential communication. Especially, if someone's personal freedom or safety depends on it. Even if E2E works correctly, you still have to worry about meta data. Maybe Matrix over TOR would be a better alternative?
When someone's personal freedom or safety is at risk from their communications, said person should re-evaluate their career choices.
Some people try to make the world a better place. Your message is personal freedoms matters more than my beliefs. That is not true for everyone. Many will turn in their own mother to save themselves others will put their lives on the line to save your mother.
Earlier quoted context omitted.
From the blog posting I read yesterday, the individual was not arrested for his political convictions. He was not only a climate activist, but also a squatter. Apparently there were several police officers hurt during a legally mandated eviction of the building that he squatted. Saying "omg they arrested a climate activist" is like saying "omg, they arrested filesystem developer Hans Reiser!"
Your point is well taken that the headline is misleadingly conflating “who he was” with “what he did wrong”. But is the actual crime any better, though? If squatting and resisting arrest were the crimes, then I don’t see what justification there could be for wanting to probe into his emails. They already know the extent of what he did, and where he did it, by nature of the crimes themselves… no?
I haven't more on the subject, but I can certainly imagine that they started an investigation only in the days afterwards, when doctors had established reports and cooler heads prevailed.
Look at it from the perspective of the state / society. What's the alternative? Arrest everyone you find in the house, every time when you think you may press charges, and hold them indefinitely until you sort things out?
The article stated that he refused to give ID / fingerprints at the time (which is his right, as he was not charged). Clearly he no longer has a house; you just kicked him out. What do you do? How do you find him?
So they asked for an international warrant for his IP (not the contents) so that they could find him, which was approved by a disinterested third party. The warrant was executed, and now he will answer in a court of law, where he can argue his innocence while the onus is on the state to prove the contrary.
Contrast that with the alternative approach "in the heat of things" (arresting everyone, retrebutive escalating violence) and I think it's pretty amazing that our society works this way, and how much effort is spent to safeguard both justice and individual liberties. Hell, in the US, 25% of homicide-by-police is happen as the result of traffic stops that turned sour.
Earlier quoted context omitted.
>I think there is a market for datacenters in open seas. The idea of having a isolated sovereign floating platform in the ocean doesn't doesn't really solve the problem of escaping the rules of national governments because it still needs network connections into those countries . Whether it's underseas fiber optic cables or bouncing signals off of satellites, the datacenter will be rendered useless if nations' citize…
Exactly. Sealand/HavenCo could Play their micronation thing right up until the UK cut their supply and comms links. Does it raise the bar for bothering to do that? Sure. But it’s certainly not absolute protection.
I have no idea how to pull that off.
Earlier quoted context omitted.
This is exactly what baffled me about people saying "I'm cancelling my PM subscription" as if they didn't make this abundantly clear. In their transparency report, they state very clearly that they "may also be obligated to monitor the IP addresses" being used to access accounts engaged in criminal activity. Privacy activists, for some reason, don't take the time to read transparency reports.
What about the perception they gave that state if you were being monitored you would be notified? The part not made clear was that they could delay notifying you for months.
> Swiss law requires a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. However, in certain situations, notification can be delayed. This includes the following cases [...]
From https://web.archive.org/web/20210724054806/https://protonmai... (under "ProtonMail User Notification Policy", emphasis is mine).
I guess ProtonVPN also is not an exception to such "undeniable" requests. Bad day for company who bank on "no log" policy. Their marketing division will have a ton of work to fix reputation :)
No, ProtonVPN isn't subject to the same problem (according to the CEO).
and what's left of his credibility.