Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail deletes 'we don't log your IP' from website after activist arrested

theregister.com

Post reply on HN
Print view View original

261–270 of 352 posts

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#261

Post by stjohnswarts »

samstave wrote: post #245
WhyNotHugo wrote: post #55

Earlier quoted context omitted.

The premise of "we'll never log your IPs" is something that no company can hold. - Local law enforcement can force the to do so. - Locals laws can change. - Guys with guns might barge in and demand it. Mostly, you can understand that they don't _intend_ to log IPs, and aren't in the business of collecting and redistributing data. But that doesn't mean you can count on absolute and unconditional secrecy.

Whats the corollary with brick-and-mortar: Assume you're an all cash business - can governments require that you take and log every customer's ID?

Of course they can, at least in the US, however if someone asks for my ID while paying cash I will say "fuck that" and turn around and leave their brick building.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#262

Post by stjohnswarts »

chii wrote: post #189
bluGill wrote: post #108

Earlier quoted context omitted.

The trick is to grow big enough that by the time anyone thinks cutting your links you are big enough that you can't fail. I have no idea how to pull that off.

> I have no idea how to pull that off. you start with a military force that is enough to prevent another sovereign nation from doing something bad like cutting off your comm link, or forcing or freezing your bank account...

Which is basically impossible. No old military platform in the ocean would be able to do that.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#263

Post by istingray »

denton-scratch wrote: post #148
WhyNotHugo wrote: post #55

Earlier quoted context omitted.

The premise of "we'll never log your IPs" is something that no company can hold. - Local law enforcement can force the to do so. - Locals laws can change. - Guys with guns might barge in and demand it. Mostly, you can understand that they don't _intend_ to log IPs, and aren't in the business of collecting and redistributing data. But that doesn't mean you can count on absolute and unconditional secrecy.

Indymedia UK didn't log the IPs of website visitors. They used an Apache module that stripped IPs from Apache log messages. I know this, because I had root on the server. Indymedia was widely infiltrated, I think; certainly there were some infiltrators, and they often trolled that Indymedia loggeed IP addresses. There was a tool we could use to capture addresses; they were captured to memory only, and the tool could…

Not sure this would be a solution. In this case it seems like Protonmail wasn't logging IP but then was compelled to by law. So my assumption here is even if they stripped IPs, law enforcement could compel them to unstrip them going forward for an account. And that's what happened in this case.

That said, if there was a third entity that removed IPs for Protonmail, maybe that could get away with it. Kind of like how Tor is functioning.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#264

Post by istingray »

vanilla-almond wrote: post #84
plater wrote: post #34

Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy. Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference. Be also aware of the fact that many companies market themselves as Swiss, but all it mean…

I also dislike companies that use the label 'Made in [country]' as a prominent hook to promise users they will get enhanced privacy - which may or may not be true. I'd rather they be honest and say: these are the examples when we must comply with the law and must hand over the following details. We all need to make our own evaluation of the privacy promises of those services and whether they actually provide privacy…

Agreed, it's unsustainable for ProtonMail. They should operate out of China, and then build credibility from there. "Trust us" is not viable long term. In God we trust, for everyone else use math.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#265

Post by istingray »

dathinab wrote: post #152

> stated: "No personal information is required to create your secure email account. By default, we do not keep any IP logs which can be linked to your anonymous email account. Your privacy comes first." And it still holds!! What it didn't stat is that while _by default_ no such information is logged, but if they are legally compelled to they will log such the neseccary information for the email (account?) they are re…

ProtonMail requires a phone number for account creation through Tor.

"no personal information"...does it still say that? Let me know where, will email them.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#266

Post by istingray »

0xdeadb00f wrote: post #9

This is not surprising to me. I will still continue to use ProtonMail. I never signed up because of the "no IP logging" thing. In fact, if I had seen it before I just plain wouldn't have believed it, and still used ProtonMail. But hindsight is 20/20

What's important for you about using Protonmail then?

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#267

Post by lnxg33k1 »

atok1 wrote: post #243
lnxg33k1 wrote: post #202

Earlier quoted context omitted.

Yeah I also bought a lifetime plan from that cloud storage company few years ago, scammed by the marketing page, only to find out somewhere in the settings page that my data were never in switzerland or even in EU but were physically in US, and had to pay to move them to EU, just deleted my account, I guess the swiss thing is just a marketing scam

You got played. Just remember to never trust marketing in the future and always read the fine print, no matter how long it may be.

It's been a year since i bought anything, so i solved it like that, the issue is not even the fine print anymore is that anything retains the right to change the terms and conditions without explanation or warning, in Italy we have a law that if a company change the terms and conditions it has to communicate it to you and has to give you 30 days in order to stop the contract without any penalty, it works for services and software but we don't have anything to protect people from hardware to force company to buy back devices in case of unilateral TOS changes, so it sucks a bit, on the other hand in the rest of EU there isn't even the protection for software

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#268

Post by simonsaidit »

dathinab wrote: post #157
dsign wrote: post #22

The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happen. What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of…

> can't even protect the IP address of their customers. Why even the IP address is both technically and law-wise on of the hardest thinks to protect. The only way to get anywhere close to it is by using a VPN, Tor or similar additionally to whatever protection the service provides, and surprise, they do have a onion site (I think).

Their Tor have issues as i understand it.. eg redirecting to clearnet anf Old version and requiring phone number. But they say vpn would have solved it…

To quote

“ There's an important distinction here. Under Swiss law, email providers fall into a category which requires us to comply with certain legal requests. Swiss law does not have a provision which could force a VPN provider to log.”

“ With VPN the legal principle is different. Thousands of users might be using the same server, logging them all would be assuming everybody is guilty until proven innocent. This is considered to be disproportionate. In the email case, it is possible to request information on a specific user, and that is considered to be proportionate.”

https://www.reddit.com/r/ProtonMail/comments/pil6xi/climate_...

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#269

Post by jokoon »

plater wrote: post #34

Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy. Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference. Be also aware of the fact that many companies market themselves as Swiss, but all it mean…

The USA thus has authority over servers that are in Texas, iirc.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#270

Post by the-dude »

cbg0 wrote: post #209
_gohp wrote: post #198

Earlier quoted context omitted.

True, the swiss government has bent over in all directions imaginable regarding the banking secret once a powerful enough entity pressured them. Forget hosting, VPNs or email providers from Switzerland. It's exactly true, companies incorporate there due to tax laws, even Phillip Morris is there.

"Bent over in all directions" is a bit of an exaggeration, most countries nowadays abide by various conventions to prevent money laundering & terrorism funding, since the G7 founded the FATF https://en.wikipedia.org/wiki/Financial_Action_Task_Force

The US beat them in to submission you mean.
Post reply on HN