ProtonMail deletes 'we don't log your IP' from website after activist arrested • Hacker News Board

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#311

Post by jacquesm » Tue, Sep 07, 2021, 5:36 PM UTC

drstewart wrote: post #185

jacquesm wrote: post #3

Earlier quoted context omitted.

Since day #1 would be a safe guess. I don't think the honor system is a good way to deal with companies so when a company writes something like that and I have no way of verifying it then I don't believe them. Worked pretty good so far.

Just to be clear, there's no reason to believe you aren't a Chinese bot trying to sow division among western countries with this comment. It's a pretty safe guess and we have no way of verifying otherwise, after all.

Actually, there is. I've met 10's of HN'ers in person, this account is many years old and in pretty good standing, on top of that I have regular contact with the mods and many others on here IRL.

You probably should have picked a different account than mine to try this particular line with.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#312

Post by yaris » Tue, Sep 07, 2021, 5:42 PM UTC

LordRishav wrote: post #306

yaris wrote: post #293

Earlier quoted context omitted.

In Sweden you can get a prepaid phone number completely for free: Comviq literally gives away SIMs and to pre-pay you can still use cash. So from this point of view PM is not lying, not one bit.

Isn't a phone number personal information as well? And what about countries where it is mandatory to register your SIM card? ProtonMail can't just reply to this part by saying "Just move to a different country bro". A phone number is personal information and should be treated as such.

A phone number is PI as long as it is tied to your ID. If you managed to get a SIM that is not in any way tied to your ID - then you are fine. This is assuming that nobody tracks your calls etc... but if you use Tor to register a PM account, then you probably know all the do's and dont's of both Tor and prepaid SIMs. As for the second part - yes and no. Yes, PM cannot answer suggesting to move. No, PM is not to blame for that. As it has been pointed out (in one of other threads about PM) this serves as a (not so high) hurdle for spammers, otherwise PMs free tier will turn into spam machine overnight. And paying customers still have to disclose their identity. Also, if one values their privacy _that much_ then that person should be able to expend some effort to protect it, and not just make a couple of clicks on the webpage.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#313

Post by MichaelZuo » Tue, Sep 07, 2021, 6:05 PM UTC

charbonneau wrote: post #163

NmAmDa wrote: post #103

Earlier quoted context omitted.

I think signal approach is the best. You can't be forced to turn in something you don't have.

You can be forced to collect the data.

Bingo. And if the stakes were high enough many jurisdictions have laws that allow for it to happen under wraps. i.e. being forced to lie about collecting data.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#314

Post by edly » Tue, Sep 07, 2021, 6:28 PM UTC

dwild wrote: post #302

edly wrote: post #286

Earlier quoted context omitted.

I agree that Protonmail has been dishonest in their marketing, but marketing =/= policies. If you're storing any kind of information you'd rather keep private on a server you do not control and not diving into the policies and blog posts of said provider to make doubly sure they're all they say they are, it's no one's fault but your own when something inevitably happens. Either do your due diligence or blindly accept…

> And yes, I would say an order from Swiss courts that was unappealable is an extreme criminal case. Anything that could threaten Protonmail qualifies. So before this case, if I told you is someone in France trespassing enough for ProtonMail to log and provide IP, you would say sure? My point is that this is not what most people would expect by reading extreme criminal case. If it's not what they expect, it is thus m…

Note that I have not even mentioned France.

Protonmail was forced by Swiss courts, period. Protonmail will not risk themselves for you. No client of Protonmail is worth fighting the Swiss courts over. Protonmail bowed down to the laws of the country they operate in, a smart move if they wish to continue legal operations.

If you still do not understand this fact, or that I am speaking strictly about the repercussions that a Swiss company could face by ignoring a court order from Swiss courts in Swiss law in Switzerland, then we have nothing else to discuss.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#315

Post by staplers » Tue, Sep 07, 2021, 6:33 PM UTC

dhimes wrote: post #257

dexen wrote: post #104

Earlier quoted context omitted.

>"we'll never log your IPs" is something that no company can hold. Four words: The Intercept, Secure Drop. A one-way mail (content submission) system that runs exclusively on Tor, and thus can't be supboenated for users' IP address. While I get your premise due to concerns of law, I think it is entirely feasible - and hinges on execution, marketing ability. We already have IP-hiding technology, whether Tor or Freenet…

I also have to wonder if the market size for this a truly anonymous email truly is. Who would go out of their way to pay for more expensive email that was untraceable? How many reporters? How many "freedom fighters"? How many large-scale criminal organizations? And does the very fact of using it bring unwanted attention?

At this point, creating an entirely new protocol would be easier. Something like Bitmessage.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#316

Post by denton-scratch » Tue, Sep 07, 2021, 6:58 PM UTC

luckylion wrote: post #192

denton-scratch wrote: post #148

Earlier quoted context omitted.

Indymedia UK didn't log the IPs of website visitors. They used an Apache module that stripped IPs from Apache log messages. I know this, because I had root on the server. Indymedia was widely infiltrated, I think; certainly there were some infiltrators, and they often trolled that Indymedia loggeed IP addresses. There was a tool we could use to capture addresses; they were captured to memory only, and the tool could…

> Indymedia UK didn't log the IPs of website visitors. They used an Apache module that stripped IPs from Apache log messages. I know this, because I had root on the server. I believe you're confusing "is not actively logging" with "will not log, even when law enforcement takes over the server" (which a court order essentially comes down to, if you don't comply). The former is what ProtonMail also does. The latter is…

Our server was seized by the police. Nobody was arrested (well, they didn't really know who we were). We weren't even asked to make the server start up for them; we certainly weren't asked to circumvent the logging suppression; and had we been asked, we would have declined.

But then we weren't a corporation. Between us, we had little to lose. We didn't have to help the cops. Protonmail is a business, so I suppose they are much more likely to roll over. Still, I'm pretty disappointed; their whole sctick is security, and they pitch to the likes of whistleblowers. It looks pretty bad to me.

The IndyUK server was seized from Rackspace, under the directions of the FBI (this was in Manchester, UK; I guess Rackspace US were leaned on by the feds, and HQ leaned on the Manchester datacenter). I think the feds kept the disks, which were encrypted.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#317

Post by istingray » Tue, Sep 07, 2021, 7:04 PM UTC

yaris wrote: post #312

LordRishav wrote: post #306

Earlier quoted context omitted.

Isn't a phone number personal information as well? And what about countries where it is mandatory to register your SIM card? ProtonMail can't just reply to this part by saying "Just move to a different country bro". A phone number is personal information and should be treated as such.

A phone number is PI as long as it is tied to your ID. If you managed to get a SIM that is not in any way tied to your ID - then you are fine. This is assuming that nobody tracks your calls etc... but if you use Tor to register a PM account, then you probably know all the do's and dont's of both Tor and prepaid SIMs. As for the second part - yes and no. Yes, PM cannot answer suggesting to move. No, PM is not to blame…

Privacy is a human right.

I support providers that believe this as well, and act in accordance.

Your model more treats privacy as something to be earned or attained through technical knowledge. No thanks. Journalists and whistleblowers need others looking out for them when no one else will.

If Protonmail doesn't solve this by the time my account is up for renewal, I will not be renewing.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#318

Post by denton-scratch » Tue, Sep 07, 2021, 7:15 PM UTC

istingray wrote: post #263

denton-scratch wrote: post #148

Earlier quoted context omitted.

Indymedia UK didn't log the IPs of website visitors. They used an Apache module that stripped IPs from Apache log messages. I know this, because I had root on the server. Indymedia was widely infiltrated, I think; certainly there were some infiltrators, and they often trolled that Indymedia loggeed IP addresses. There was a tool we could use to capture addresses; they were captured to memory only, and the tool could…

Not sure this would be a solution. In this case it seems like Protonmail wasn't logging IP but then was compelled to by law. So my assumption here is even if they stripped IPs, law enforcement could compel them to unstrip them going forward for an account. And that's what happened in this case. That said, if there was a third entity that removed IPs for Protonmail, maybe that could get away with it. Kind of like how…

> law enforcement could compel them to unstrip

We don't know what jurisdiction this happened in - Belarus, Switzerland, or the USA. I doubt that Switzerland or the USA empower the police to force a private company to put up a bogus service on the internet - especially on behalf of China.

We also don't know whether the activist was taking advantage of Protonmail-to-Protonmail security, or whether one end of the connection was non-Protonmail.

My guess: they were logging IP addresses, at least for SMTP, and the activist was using SMTP.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#319

Post by bmn__ » Tue, Sep 07, 2021, 7:21 PM UTC

OldHand2018 wrote: post #247

audiometry wrote: post #230

Earlier quoted context omitted.

Switzerland deserves no brand for secrecy. USA broke their back. They opened their private banking. Their Crypto AG was totally rooted.

> USA broke their back. They opened their private banking If you've ever been to a really large American city, you'll notice all the logos of the large Swiss banks on big tall shiny office towers. The USA said that if they want to keep doing that, then they have to follow American laws. The Swiss banks decided that running their businesses in America was more profitable than secrecy. "Follow our laws or get out" is n…

However, "implement our idea of intrusive laws in your country" is.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#320

Post by stilisstuk » Tue, Sep 07, 2021, 7:54 PM UTC

lnxg33k1 wrote: post #305

stilisstuk wrote: post #295

Earlier quoted context omitted.

I am fairly happy with pcloud though. Didn't buy for privacy (i use encryption for that), but for cheapness. I am not aware of any violation of trust like what is mentioned here.

But to be honest i have had my files there for few years unencrypted and in US without realizing, so it's not that encryption was needed or anything special, but it just sucks to be a victim of marketing practice advertising "your files are under the jurisdiction of Switzerland" and find out that they never been, then it's a good service? It's debatable, it's cross platform and has good client support for Linux OSes,…

In that case... I get it. But yeah... Everybody did/does it and it's stupid. And i knew it was stupid back then (even my current mail provider does the same; Belgium yada yada, but have been honest about cooperating with police). I even figured the lifetime option was a sign that they would collapse years ago. But i took a risk, and I have very cheap storage online.

Also. Yes. The Android app is very bad compared to e.g. drive/photos