Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail discloses user data leading to arrest in Spain

restoreprivacy.com

Post reply on HN
Print view View original

11–20 of 283 posts

Re: Proton Mail discloses user data leading to arrest in Spain

#11

Post by makeitdouble »

Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address.

In this case the email address was the lead, but I wonder what other info would be enough to get the phone provider to spill the beans. For instance would an IP address used at a specific time be uniquely identifying if it was VPNed by Apple at that moment ?

Or a Google Ad cookie that could get correlated to other devices showing similar behavior (the same way Google tracks households or related accounts) ?

Re: Proton Mail discloses user data leading to arrest in Spain

#12

Post by fbdab103 »

makeitdouble wrote: post #11

Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address. In this case the email address was the lead, but I wonder what other info would be enough to get the phone provider to spill the beans. For instance would an IP address used at a specific time be uniquely identifying if it was…

While an IP address is not an identity, it can still zero in on a location. I suspect governments and ISPs all keep historical logs of who was assigned what address.

Re: Proton Mail discloses user data leading to arrest in Spain

#13

Post by upofadown »

gertop wrote: post #7

> Proton provided us with an explanation that inbox contents remain secure. Yup, until they receive a court order asking them to mitm an inbox, if they haven't already... This entire system of "receive email in clear text but store it encrypted at rest" is smokes and shadows, really.

It depends on the local laws. Not all places can demand that a service provider do an active attack on a user. Of course many countries have passed such laws and others are planning to

It wouldn't technically be a MITM attack, they would just capture the incoming email. Tuta was famously forced to do that once by the German authorities.

Re: Proton Mail discloses user data leading to arrest in Spain

#14

Post by srockets »

fbdab103 wrote: post #10
lordofgibbons wrote: post #8

The heart of the issue is this: > Under Swiss law, Proton Mail was compelled to collect and provide information on the individual’s IP address to Swiss authorities, who then shared it with French police. They can claim all the privacy guarantees they want, but unless the privacy is guaranteed by cryptography, it's an empty gesture. Nobody is willing to do prison time to protect your privacy.

I think they should do like Mullvad claims and keep zero logs. You cannot share what you do not have.

This does not stop the host from being compelled to wiretap future communications.

Just don't try to make encrypted email happen. It can't, and we don't need it to be. We have better solutions for encrypted communications, for those that need it.

Re: Proton Mail discloses user data leading to arrest in Spain

#15

Post by srockets »

fbdab103 wrote: post #12
makeitdouble wrote: post #11

Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address. In this case the email address was the lead, but I wonder what other info would be enough to get the phone provider to spill the beans. For instance would an IP address used at a specific time be uniquely identifying if it was…

While an IP address is not an identity, it can still zero in on a location. I suspect governments and ISPs all keep historical logs of who was assigned what address.

An IP address in itself is not an identity, but it can be easily resolved to one. This is why IP address are considered PII, and are handled like such by any competent security organization.

Re: Proton Mail discloses user data leading to arrest in Spain

#16

Post by GGO »

fbdab103 wrote: post #10
lordofgibbons wrote: post #8

The heart of the issue is this: > Under Swiss law, Proton Mail was compelled to collect and provide information on the individual’s IP address to Swiss authorities, who then shared it with French police. They can claim all the privacy guarantees they want, but unless the privacy is guaranteed by cryptography, it's an empty gesture. Nobody is willing to do prison time to protect your privacy.

I think they should do like Mullvad claims and keep zero logs. You cannot share what you do not have.

you can be required to keep logs - they need to design a system that cannot collect logs - You cannot share what you cannot have.

Re: Proton Mail discloses user data leading to arrest in Spain

#17

Post by kaliqt »

fbdab103 wrote: post #10
lordofgibbons wrote: post #8

The heart of the issue is this: > Under Swiss law, Proton Mail was compelled to collect and provide information on the individual’s IP address to Swiss authorities, who then shared it with French police. They can claim all the privacy guarantees they want, but unless the privacy is guaranteed by cryptography, it's an empty gesture. Nobody is willing to do prison time to protect your privacy.

I think they should do like Mullvad claims and keep zero logs. You cannot share what you do not have.

I mean it's clear, the governments of the world are colluding to ensure that all companies and users must incriminate themselves by collecting logs. They're trying to do the same with cryptography.

Re: Proton Mail discloses user data leading to arrest in Spain

#18

Post by Dylan16807 »

lolinder wrote: post #9

> Use a good VPN service to hide your IP address whenever possible. (Failure to do this is what compromised a Proton Mail user in France who was arrested after after police obtained IP logs.) If your VPN is tied to a payment method then all you've done is give police one extra hop to follow to get at you, which wouldn't have saved this activist. Their list of VPNs only includes Mullvad in position 9 of 10, but as far…

Let's say I buy Mullvad access with a credit card, then access my otherwise-unrelated Proton Mail account via Mullvad.

How are police going to find me behind that hop?

Re: Proton Mail discloses user data leading to arrest in Spain

#19

Post by IAmGraydon »

Go try to create a ProtonMail account with Tor. It will ask you to confirm your account with a phone number. It skips this if you’re using a non-proxy IP. They want to know who you are, and it’s been this way for years. I think they’ve long been a honeypot.

Re: Proton Mail discloses user data leading to arrest in Spain

#20

Post by yieldcrv »

fbdab103 wrote: post #10
lordofgibbons wrote: post #8

The heart of the issue is this: > Under Swiss law, Proton Mail was compelled to collect and provide information on the individual’s IP address to Swiss authorities, who then shared it with French police. They can claim all the privacy guarantees they want, but unless the privacy is guaranteed by cryptography, it's an empty gesture. Nobody is willing to do prison time to protect your privacy.

I think they should do like Mullvad claims and keep zero logs. You cannot share what you do not have.

gullible vpn fans believe anything

or at least their favorite youtuber with the paid ads and zero domain knowledge of network topology

serious question I have is whether “internet reseller” is a compelling service. because that's all that VPNs are, and I dont mind paying to use them for that purpose.

Post reply on HN