ProtonMail deletes 'we don't log your IP' from website after activist arrested • Hacker News Board

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#171

Post by janmo » Tue, Sep 07, 2021, 1:26 PM UTC

livinginfear wrote: post #50

The expectation that Proton would be able to disobey the legal requests of their local authorities with impunity is unrealistic. Protonmail makes certain claims about privacy, particularly about encryption. They don't make any claims that they have the intention, or ability for that matter, to defy local authorities at their peril. Like Grugq said in one of his presentations (paraphrased): "Don't expect your VPN comp…

There are 180 countries and not one will let you create a company that doesn't have to log IP addresses? Proton should change their description to: "We don't really care so much about your privacy and make fake marketing claims because we are just another tech company trying to make as much money as possible"

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#172

Post by ipaddr » Tue, Sep 07, 2021, 1:27 PM UTC

unyttigfjelltol wrote: post #162

ipaddr wrote: post #106

Earlier quoted context omitted.

Like a journalist covering China from Hong Kong? Some people try to make the world a better place. Your message is personal freedoms matters more than my beliefs. That is not true for everyone. Many will turn in their own mother to save themselves others will put their lives on the line to save your mother.

That's the fair point among the objections here, re: HK, because you've identified a state actor doing arguably a wrong thing, but would such a state actor be able to satisfy Swiss law to compel the email vendor here to act? The other objections are about whistleblowing on private parties, discrimination or in one case a corrupt petty politician/magistrate. None of them would generate a safety concern to someone prot…

Privacy means you don't know if the email is from the pope or gangster. Trying to separate them means no privacy for either group.

China could easily pressure an EU nation to make the request.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#173

Post by erk__ » Tue, Sep 07, 2021, 1:27 PM UTC

jhugo wrote: post #159

faeyanpiraat wrote: post #155

Earlier quoted context omitted.

You think you host your PI data in the EU, but in fact it is sitting on US soil.

If you are hosting your PI data in Switzerland and you think you are hosting it in the EU, you already have a problem.

As I understand it it is actually not a issue as they have strong enough privacy laws that EU have said good for it. Though when doing business with EU citizens they of course still have to follow the rest of gdpr.

https://ec.europa.eu/info/law/law-topic/data-protection/inte...

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#174

Post by OrvalWintermute » Tue, Sep 07, 2021, 1:27 PM UTC

teekert wrote: post #128

ducktective wrote: post #91

Earlier quoted context omitted.

What, you mean those landing pages with that majestic snowy mountain doesn't automatically mean robust security and unparalleled privacy? My life has been a lie...

I thought those impenetrable looking mountains were part of their datacenter defenses.

Nope, that is what you need to scale to reach their customer support.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#175

Post by 1cvmask » Tue, Sep 07, 2021, 1:28 PM UTC

For those who love Swiss "privacy" and security they should read about the CIA front-company from Switzerland for secure encrypted communications:

https://en.wikipedia.org/wiki/Crypto_AG

And remember Mark Twain: “History Doesn't Repeat Itself, but It Often Rhymes”

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#176

Post by philipov » Tue, Sep 07, 2021, 1:28 PM UTC

NmAmDa wrote: post #103

WhyNotHugo wrote: post #55

Earlier quoted context omitted.

The premise of "we'll never log your IPs" is something that no company can hold. - Local law enforcement can force the to do so. - Locals laws can change. - Guys with guns might barge in and demand it. Mostly, you can understand that they don't _intend_ to log IPs, and aren't in the business of collecting and redistributing data. But that doesn't mean you can count on absolute and unconditional secrecy.

I think signal approach is the best. You can't be forced to turn in something you don't have.

https://xkcd.com/538/

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#177

Post by micromacrofoot » Tue, Sep 07, 2021, 1:31 PM UTC

dsign wrote: post #22

The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happen. What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of…

Data centers at sea lowers the bar from "government with a warrant" to "guy with a gun and a boat"

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#178

Post by ohgodplsno » Tue, Sep 07, 2021, 1:31 PM UTC

maxo133 wrote: post #74

ohgodplsno wrote: post #46

Earlier quoted context omitted.

ProtonMail has always said that they would comply with Swiss law. Your IP will not be logged unless you commit a crime in Switzerland and the swiss police hands in a request.

So... if they receive valid swiss court order they can be forced to log user passwords on demand and their entire service is then useless? As when you have password you can decrypt entire mailbox content. They market their service to journalists and activists, which are often targetted by their own governments. Seems that they cannot protect any of them.

Be real for a second: if a government targets you, you have no way of escaping it. If you're targeted by a small country, with not much power, so your only real options are kidnapping you if you are ever in said country. So, moving away does keep you safe. Should be, say, a Chilean journalist reporting on wrong deeds in your own country, you can safely assume that ProtonMail is safe for you. (That is, unless the government knows who you are).

But a first world country ? They have laws, they have international influence, they have technical means and the ability to intervene wherever you are.

"Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. In summary, https:// and two dollars will get you a bus ticket to nowhere. Also, SANTA CLAUS ISN’T REAL. When it rains, it pours." - https://www.schneier.com/blog/archives/2015/08/mickens_on_se...

This applies to ProtonMail too. What do you think happened with Lavabit ? They were pretending full security too, and we all know what happened.

Stop thinking this is a problem technology can fix.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#179

Post by qwerty456127 » Tue, Sep 07, 2021, 1:31 PM UTC

ProtonMail has an official TOR page, there hardly is a reason for those performing activities illegal under relevant jurisdictions (I support the notion of illegal non necessarily being evil - in many countries many good things like fighting corruption, loving a same-sex partner or responsibly using psychoactive substances for genuine medical reasons can be illegal) to use it the way exposing their actual IP address.

I also don't understand why does ProtonMail record the device type - I doubt there is a law requiring this.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#180

Post by rarba786 » Tue, Sep 07, 2021, 1:32 PM UTC

I don't see why it's AS big a scandal given what CEO stated and reading accounts from reputable news sources.

My quick take: France tells Switzerland who then compels PM to START tracking account holder(s) and prevented PM (by law from what I've read) from telling account holder. Per PM CEO this type of Swiss order could not be disputed with the way PM has disputed other claims.

To me, it's not logging of the IP; it's when did it start and from my reading they started after being compelled to do so over a period of time between compelled to and this coming to light.

To me, strong pushback (for those who feel passionate about it) should be directed to Switzerland for complying with France for what many think is not a high enough bar to compel all this tracking. Maybe they did scrutinize it and maybe they didn't.

Any meta-data saving isn't secure but sharing that after being compelled to track account holders isn't surprising.

There's a line in their agreement that says " If a request is made for encrypted message content that we do not possess the ability to decrypt, the fully encrypted message content may be turned over.".

Maybe I'm missing something in my logic.