Proton Mail suspended journalist accounts at request of cybersecurity agency
1–10 of 217 posts
Re: Proton Mail suspended journalist accounts at request of cybersecurity agency
#2You either die a hero, or you live long enough to see yourself become the villain.
Re: Proton Mail suspended journalist accounts at request of cybersecurity agency
#3I thought Proton was a confidentiality / privacy oriented thing. How do they even know who owns the accounts?
Re: Proton Mail suspended journalist accounts at request of cybersecurity agency
#4Can proton even win here? The obvious solution would be "we don't take down unless there's a court order", but then you'd get exposé pieces saying how protonmail is a den for drug dealers/pedophiles/doxxers/cyber criminals.
Re: Proton Mail suspended journalist accounts at request of cybersecurity agency
#5I thought Proton was a confidentiality / privacy oriented thing. How do they even know who owns the accounts?
Second paragraph of the article:
>But last month, Proton disabled email accounts belonging to journalists reporting on security breaches of various South Korean government computer systems following a complaint by an unspecified cybersecurity agency
Re: Proton Mail suspended journalist accounts at request of cybersecurity agency
#6The silence of proton can only be interpreted to their disadvantage. This is not very smart and will make everyone doubt on them.
While I like the idea of a safe and uncompromising service, proton seems less so now.
Re: Proton Mail suspended journalist accounts at request of cybersecurity agency
#7I thought Proton was a confidentiality / privacy oriented thing. How do they even know who owns the accounts?
You can disable an account without knowing who owns it, although they do have credit card/payment information now, and I don't think new accounts get encryption services unless they pay.
That said, if your inbox is encrypted, protonmail does so on the client side with a second password. They can maybe delete the account, but proton mail doesn't know what the encrypted data is. What happens to new emails sent to a disabled address is anyone's guess though. Honestly I think they're doing the best they can given the circumstances
Re: Proton Mail suspended journalist accounts at request of cybersecurity agency
#8So, is this a case where Random Cybersecurity/Tech Group mistakes responsible disclosure for hacking, and then reported it to Proton, which took their word for it and disabled the account?
Re: Proton Mail suspended journalist accounts at request of cybersecurity agency
#9I've been following this on X/Twitter and I think one of the most egregious things that's important to point out is that folks from Phrack reached out to Proton in private multiple times, and Proton ghosted them. Proton only engaged with them and then reinstated the accounts after Phrack went public and their X/Twitter post went viral.
It also looks like one of the writers filed an appeal with Proton and Proton denied the appeal, so they manually investigated the incident and refused to reinstate the account and then only did after this got attention on X/Twitter.
So make no mistake about it: Proton didn't just disable the accounts after whatever CERT complained, which would have been bad enough - they also didn't do anything about it until this started getting lots of eyes on social media.
Re: Proton Mail suspended journalist accounts at request of cybersecurity agency
#10I thought Proton was a confidentiality / privacy oriented thing. How do they even know who owns the accounts?
You can disable an account without knowing who owns it, although they do have credit card/payment information now, and I don't think new accounts get encryption services unless they pay. That said, if your inbox is encrypted, protonmail does so on the client side with a second password. They can maybe delete the account, but proton mail doesn't know what the encrypted data is. What happens to new emails sent to a dis…
You are trusting them. They control the client, how the keys are created/stored, etc. Javascript, etc. If they were to suddenly turn one day, they could.
This is the weakness of cloud services.