Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ProtonMail deletes 'we don't log your IP' from website after activist arrested

theregister.com

Post reply on HN
Print view View original

271–280 of 352 posts

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#271

Post by istingray »

livinginfear wrote: post #50

The expectation that Proton would be able to disobey the legal requests of their local authorities with impunity is unrealistic. Protonmail makes certain claims about privacy, particularly about encryption. They don't make any claims that they have the intention, or ability for that matter, to defy local authorities at their peril. Like Grugq said in one of his presentations (paraphrased): "Don't expect your VPN comp…

Disclaimer: Paying Protonmail customer here

Protonmail has been dishonest in their marketing.

1. Their homepage stated ""By default, we do not keep any IP logs...". Due to complaints about this being a lie, they have today removed this statement

2. Their website also stated "No personal information required to create an account". However, for creating an account through Tor a phone number is required. This has been an issue for 4 years [1]

How could I expect Proton to disobey legal requests? That's crazy.

[1] https://www.reddit.com/r/ProtonMail/comments/638ykr/phone_nu...

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#272

Post by dexen »

dhimes wrote: post #257
dexen wrote: post #104

Earlier quoted context omitted.

>"we'll never log your IPs" is something that no company can hold. Four words: The Intercept, Secure Drop. A one-way mail (content submission) system that runs exclusively on Tor, and thus can't be supboenated for users' IP address. While I get your premise due to concerns of law, I think it is entirely feasible - and hinges on execution, marketing ability. We already have IP-hiding technology, whether Tor or Freenet…

I also have to wonder if the market size for this a truly anonymous email truly is. Who would go out of their way to pay for more expensive email that was untraceable? How many reporters? How many "freedom fighters"? How many large-scale criminal organizations? And does the very fact of using it bring unwanted attention?

Excellent contention, and I don't have a ready-made answer yet.

Curiously enough, we've seen anonymous services succeed for results unrelated to privacy-from-government: places like Omegle & ChatRoulette use anonymity for fun; places like 4chan use anonymity both for fun and also to avoid certain problems common to name-posting. Anonymity has long been a viable alternative put to good use in literature, arts, and entertainment. Perhaps the proper marketing would be along those lines?

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#273

Post by istingray »

dwild wrote: post #248
edly wrote: post #62

Earlier quoted context omitted.

This is exactly what baffled me about people saying "I'm cancelling my PM subscription" as if they didn't make this abundantly clear. In their transparency report, they state very clearly that they "may also be obligated to monitor the IP addresses" being used to access accounts engaged in criminal activity. Privacy activists, for some reason, don't take the time to read transparency reports.

> This is exactly what baffled me about people saying "I'm cancelling my PM subscription" as if they didn't make this abundantly clear. We are on a thread talking about them removing claims on their marketing material... that's abundantly clear to you? Have we reached that level of expectation? That it's abundantly clear when marketing material are not saying the same thing as reports? > In addition to the items list…

> We are on a thread talking about them removing claims on their marketing material... that's abundantly clear to you?

As a Protonmail customer, thanks for saying this. There seems to be this idea that a blog post Proton made in 2014 is being "up front" about their policies.

Protonmail needs to do better.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#275

Post by istingray »

qwerty456127 wrote: post #179

ProtonMail has an official TOR page, there hardly is a reason for those performing activities illegal under relevant jurisdictions (I support the notion of illegal non necessarily being evil - in many countries many good things like fighting corruption, loving a same-sex partner or responsibly using psychoactive substances for genuine medical reasons can be illegal) to use it the way exposing their actual IP address.…

Agreed, that's why I've asked Protonmail to promote their Tor page. Before yesterday the only mention was in their footer under "Onion site" and in a single blog post from 2017. They need to do better at promoting and supporting users through Tor. Heck, add it to their transparency report "40% of users connected through Tor, our goal is 90%"

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#276

Post by ibaikov »

plater wrote: post #34

Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy. Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference. Be also aware of the fact that many companies market themselves as Swiss, but all it mean…

Last time there was a protonmail discussion on HN I brought up the point that they save Metadata and of course got downvoted to the oblivion and had to remove my comment....

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#277

Post by istingray »

SV_BubbleTime wrote: post #232
CalChris wrote: post #134

Wasn't this a form of fraud? I don't know what the Swiss law is but in the United States, fraud is both a civil tort and criminal wrong. The elements of a fraud are: 1) the making of a statement 2) the falsity of the statement 3) an intent to deceive 4) reasonable reliance on the statement by the injured party 5) injury sustained as the result of the reliance ProtonMail knowingly told this activist 'we don't log your…

“We don’t log your ip by default ” This is all very silly. They said right up front they can. Their TOS said they can. It’s also very silly to assume PM would disobey EU requests. They were created with EU funding.

Maybe for you that's clear. But I use Protonmail to advocate for journalists, whistleblowers, and teachers, many of which are not security experts and not familiar with the twisted language used by Protonmail's marketing team.

If their marketing team can't come up with something better, just take text from the privacy policy verbatim.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#278

Post by istingray »

ohgodplsno wrote: post #46
rawbot wrote: post #28

So they "don't log your IP", until the first time someone challenged that statement. Talk is cheap.

ProtonMail has always said that they would comply with Swiss law. Your IP will not be logged unless you commit a crime in Switzerland and the swiss police hands in a request.

Until yesterday their homepage said "By default, we do not keep any IP logs".

That was unclear and has now been removed.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#279

Post by istingray »

mark_l_watson wrote: post #205

ProtonMail is my main e-mail, so I am positively biased in their favor. I think their advertising copy about not logging IP addresses was poorly done, but their service is private enough for me. It probably doesn’t much matter or make much difference, but I feel OK with using their service, and tweaking my account settings for Google and Apple to the minimum amount of data retention. I feel that people who let corpor…

What's important for you about using Protonmail? Would any non-Google non-Apple email account suffice?

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#280

Post by rsync »

lnxg33k1 wrote: post #202
plater wrote: post #34

Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy. Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference. Be also aware of the fact that many companies market themselves as Swiss, but all it mean…

Yeah I also bought a lifetime plan from that cloud storage company few years ago, scammed by the marketing page, only to find out somewhere in the settings page that my data were never in switzerland or even in EU but were physically in US, and had to pay to move them to EU, just deleted my account, I guess the swiss thing is just a marketing scam

Ironically, I am in Zurich right now supervising upgrades and capacity increases in ZH4.

Our terms of service[1] Explicitly state that your data will never leave the location you’ve chosen.

So if you’re still in the market for cloud storage in Zürich, email us. We’ll give you a “screwed by pcloud” discount.

[1] rsync.net/resources/notices/tos.html

Post reply on HN