Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton is trying to become Google without your data

wired.com

Post reply on HN
Print view View original

101–110 of 185 posts

Re: Proton is trying to become Google without your data

#101

Post by r3trohack3r »

floren wrote: post #30

> The analogy to terrorism is interesting because, during the Bush-era War on Terror, there was a sense of literally anything being justified in the name of stopping terrorism. The US government was secretly spying on its own citizens. Yeah, Wired, they only did the spying during the Bush era... edit: I guess it was less secret after the Bush era > It's even harder to say, look, we've got to accept that some amount o…

> Yeah, Wired, they only did the spying during the Bush era... edit: I guess it was less secret after the Bush era

I don’t understand - it never ended. In fact, Obama ran on a platform of protecting whistleblowers and cracking down on government overreach. But, once he took office, he legalized the Presidential Surveillance Program that Snowden whistleblew and doubled down on pursuing Snowden.

Re: Proton is trying to become Google without your data

#102

Post by metadat »

ziddoap wrote: post #88
metadat wrote: post #85

Earlier quoted context omitted.

> Can you provide me the name of any company who does not comply court orders of the country it operates in and continues to operate freely? AT&T, Google, Apple, Comcast, Verizon, ... Oh, did you mean companies who refuse to comply specifically to legal inquiries about their users or customers? No company will (or even should) stick their neck out for you personally. With sufficient resources and clout, they will ris…

> AT&T, Google, Apple, Comcast, Verizon, ... Really? I understand that they fight court orders when they feel they need to, which Proton at least claims to do as well (have not verified that, though), but they get away with just... ignoring them? Or not complying after losing an appeal? I stand corrected if that is the case. > With sufficient resources and clout Does Proton have the clout to do so? I don't believe th…

tl;dr: The climate is heading towards the best option being to need as little privacy as possible.

Corporations and their employees have learned clever techniques to get away with "complying" without really complying in instances where they're sufficiently motivated. It's not always politically feasible, but is in many cases.

A quick (and ironic) Google search for "google lawsuit federal compliance" turns up many instances:

https://www.dol.gov/newsroom/releases/ofccp/ofccp20170104

https://www.justice.gov/opa/pr/justice-department-sues-monop...

These violations are all calculated risks on their part. Internally, they intentionally keep certain communications off of email to ensure it will never be discoverable through a legal process.

It's not like Big-G is the only one, do you think this is ubiquitously commonplace across the megacorps in virtually every industry in the United States?

Here's what happens when they come for your / our data:

https://www.nytimes.com/2006/01/20/technology/google-resists...

> even as three of its competitors agreed to provide information

> Rather than seeking data on individuals, it says it is trying to establish a profile of Internet use that will help it defend the Child Online Protection Act, a 1998 law that would impose tough criminal penalties on individuals whose Web sites carried material deemed harmful to minors.

Re: Proton is trying to become Google without your data

#103

Post by tediousdemise »

ziddoap wrote: post #94
Tijdreiziger wrote: post #87

Earlier quoted context omitted.

> Do you have evidence that Proton does not actually encrypt their emails? It doesn't matter. Proton supplies the client software, so if they want (or are forced to by law enforcement), they can easily push an update that exfiltrates decrypted data back to their server.

It seems rather harsh to brand them as pure snake oil based on a hypothetical situation that applies to basically every single piece of software and hardware ever invented, but fair enough.

I like to see it as an unsolved problem. Similar to when Diffie and Hellman revolutionized cryptography with the concept of public/private keys, I like to think that one day, a revolutionary proof will drop that demonstrates a true trustless privacy model where backdooring isn't even a remote possibility.

Re: Proton is trying to become Google without your data

#104

Post by ziddoap »

0daystock wrote: post #98
ziddoap wrote: post #76

Earlier quoted context omitted.

> Snake oil companies will always hide behind "it's encrypted" and "it's hosted in Switzerland" tropes that mean nothing to anyone who has done a modicum of research. Do you have evidence that Proton does not actually encrypt their emails? > Real privacy is not the result of some product, I do wholeheartedly agree with this, at least. Privacy is a scale and there are many, many pieces which tip the scale one way or t…

What does "encrypting" an email mean to you? If a Gmail user contacts me on Protonmail and Protonmail "encrypts" the message to me after receipt - what problem have we solved?

I wonder why you used quotes around encryption? They encrypt the email. That very obviously does not mean Proton somehow encrypted the sent email in the senders Gmail account.

However, lacking the other data point (e.g. knowing who has sent me an email from a service that does not encrypt their emails, and being able to access that email from that account), my emails are not readable without my secret.

I never claimed that Proton can encrypt someone else's emails.

Re: Proton is trying to become Google without your data

#105

Post by pretext-1 »

ziddoap wrote: post #76
0daystock wrote: post #56

Asserting "private email" is a modern litmus test for someone's technical understanding and capabilities, or lack thereof. Snake oil companies will always hide behind "it's encrypted" and "it's hosted in Switzerland" tropes that mean nothing to anyone who has done a modicum of research. Real privacy is not the result of some product, especially not when its so desperately and obviously shilled.

> Snake oil companies will always hide behind "it's encrypted" and "it's hosted in Switzerland" tropes that mean nothing to anyone who has done a modicum of research. Do you have evidence that Proton does not actually encrypt their emails? > Real privacy is not the result of some product, I do wholeheartedly agree with this, at least. Privacy is a scale and there are many, many pieces which tip the scale one way or t…

> Do you have evidence that Proton does not actually encrypt their emails?

Their encryption is based on PGP and therefore only message contents are "E2E" encrypted. Subject, From, To, etc. are not. These fields contain most of the information already. For example, Amazon puts the name of the ordered item in the subject line, so they can still see what you ordered.

And I'm putting "E2E" in quotes because if the sender does not send encrypted emails, then they can read the full content at delivery time, obviously. They immediately encrypt them with your public key and they claim that they discard the unencrypted version after that but there is no way we can verify that.

Long story short: you still have to trust your email provider after all. If I'd want to switch away from Google, I'd probably switch to some "normal" email provider (Fastmail, Apple, etc.). The benefits of "E2E" encryption for email are questionable and the drawbacks huge (for example search is very limited). But competition is good and I'm glad they are advancing.

Re: Proton is trying to become Google without your data

#106

Post by floren »

r3trohack3r wrote: post #101
floren wrote: post #30

> The analogy to terrorism is interesting because, during the Bush-era War on Terror, there was a sense of literally anything being justified in the name of stopping terrorism. The US government was secretly spying on its own citizens. Yeah, Wired, they only did the spying during the Bush era... edit: I guess it was less secret after the Bush era > It's even harder to say, look, we've got to accept that some amount o…

> Yeah, Wired, they only did the spying during the Bush era... edit: I guess it was less secret after the Bush era I don’t understand - it never ended. In fact, Obama ran on a platform of protecting whistleblowers and cracking down on government overreach. But, once he took office, he legalized the Presidential Surveillance Program that Snowden whistleblew and doubled down on pursuing Snowden.

I was attempting sarcasm, because as you say, Obama loved that surveillance shit.

Re: Proton is trying to become Google without your data

#107

Post by 0daystock »

Havoc wrote: post #96
0daystock wrote: post #59

Earlier quoted context omitted.

> I do think they'll try harder & more earnestly than the rest of the gang attempting it. Why, though? What do people base this assertion on, other than clever marketing materials which extol virtually meaningless controls like "it's hosted abroad" (which is actually much worse for foreign nationals' privacy, for example)?

>Why, though? Not US based for starters - definitely willing to pay a premium for that. Nor five eyes or any of the other [0] eyes. > extol virtually meaningless controls like "it's hosted abroad" There is no value in abroad in itself, what matters is how trigger happy countries are with warrants etc. I'd like to be in a jurisdiction where it is possible for law enforcement to get to the data...but I'd like the logis…

A US Citizen has more legal and practical safeguards with their data hosted in the US than abroad, but unfortunately the widespread privacy anti-marketing has obscured this critical concept entirely in exchange for "Swiss are probably good at privacy stuff".

Re: Proton is trying to become Google without your data

#108

Post by Tijdreiziger »

ziddoap wrote: post #94
Tijdreiziger wrote: post #87

Earlier quoted context omitted.

> Do you have evidence that Proton does not actually encrypt their emails? It doesn't matter. Proton supplies the client software, so if they want (or are forced to by law enforcement), they can easily push an update that exfiltrates decrypted data back to their server.

It seems rather harsh to brand them as pure snake oil based on a hypothetical situation that applies to basically every single piece of software and hardware ever invented, but fair enough.

I suppose you always have to trust someone. (I'm not the one who branded them as snake oil, BTW)

Re: Proton is trying to become Google without your data

#109

Post by 0daystock »

ziddoap wrote: post #104
0daystock wrote: post #98

Earlier quoted context omitted.

What does "encrypting" an email mean to you? If a Gmail user contacts me on Protonmail and Protonmail "encrypts" the message to me after receipt - what problem have we solved?

I wonder why you used quotes around encryption? They encrypt the email. That very obviously does not mean Proton somehow encrypted the sent email in the senders Gmail account. However, lacking the other data point (e.g. knowing who has sent me an email from a service that does not encrypt their emails, and being able to access that email from that account), my emails are not readable without my secret. I never claime…

I think the point of contention is exactly how obvious this is to most Protonmail users. I worry too many read "it's encrypted" and make dangerous assumptions about what can actually be guaranteed rather than investigating first-hand; this is the real risk of such services, in my opinion.

I put "encryption" in quotes to indicate nuance in the characterization. A locksmith installs an amazing door and lock at my home, but keeps a copy of the key at the shop - I think a fitting analogy for what Protonmail is essentially doing here. This isn't a value judgement - such a setup is perfectly reasonable for most people's threat model - rather an honest apprehension of actual trust boundaries.

Re: Proton is trying to become Google without your data

#110

Post by r3trohack3r »

floren wrote: post #30

> The analogy to terrorism is interesting because, during the Bush-era War on Terror, there was a sense of literally anything being justified in the name of stopping terrorism. The US government was secretly spying on its own citizens. Yeah, Wired, they only did the spying during the Bush era... edit: I guess it was less secret after the Bush era > It's even harder to say, look, we've got to accept that some amount o…

> It's even harder to say, look, we've got to accept that some amount of child exploitation is going to happen and people are going to use digital tools to spread it. But at some point, I think you do have to defend the principle that we have to tolerate a certain amount of even the very worst things if we want to have meaningful civil liberties.

This is not how I’d articulate it. We tolerate some terrible things because trying to stop them would be even worse. There are really bad people out there. Unfortunately those bad people can also run for office and/or get hired on to 3 letter agencies.

A pedophile with a camera is less dangerous than a senator without the 4th amendment. A racist on social media is less dangerous than a president without the first amendment.

Fascism doesn’t happen because you elect a fascist president. The seeds of fascism had to be sown long before that. Fascism is the result of eroding protections designed to prevent a leader from over-reaching. The path to fascism is paved in good intentions.

Post reply on HN