Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail discloses user data leading to arrest in Spain

restoreprivacy.com

Post reply on HN
Print view View original

101–110 of 283 posts

Re: Proton Mail discloses user data leading to arrest in Spain

#101

Post by sintax »

BobFromEnzyte wrote: post #79
IAmGraydon wrote: post #19

Go try to create a ProtonMail account with Tor. It will ask you to confirm your account with a phone number. It skips this if you’re using a non-proxy IP. They want to know who you are, and it’s been this way for years. I think they’ve long been a honeypot.

You can create anonymous accounts with Tuta through Tor and they don't ask for a phone number or contact email address. They even made a tutorial video on YouTube a few weeks ago for how to do it: https://youtu.be/oXv3llPIfvo If you continued using the account only through Tor, there wouldn't be any traceable info.

I'm not a lawyer, but doesn't GDPR and No-Log contradict each other.

Re: Proton Mail discloses user data leading to arrest in Spain

#102

Post by peanut-walrus »

lolinder wrote: post #22
Dylan16807 wrote: post #18

Earlier quoted context omitted.

Let's say I buy Mullvad access with a credit card, then access my otherwise-unrelated Proton Mail account via Mullvad. How are police going to find me behind that hop?

I don't know one way or the other how easy it is, but if I were an activist in an oppressive regime I wouldn't want to use a VPN that is connected to my identity in any way. I wouldn't trust zero-log policies to keep me safe, there are too many unknowns about the way they run these services and what metadata they have to turn over.

In this case an activist in the oppressive regime of...Spain?!

Opsec is hard and most activists in western countries don't take it seriously. It's not like we live in PRC or DPRK right?

Ironically, it is likely far harder for PRC or DPRK to get data from Proton than it is for Spanish police.

Re: Proton Mail discloses user data leading to arrest in Spain

#104

Post by zzz999 »

fbdab103 wrote: post #12
makeitdouble wrote: post #11

Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address. In this case the email address was the lead, but I wonder what other info would be enough to get the phone provider to spill the beans. For instance would an IP address used at a specific time be uniquely identifying if it was…

While an IP address is not an identity, it can still zero in on a location. I suspect governments and ISPs all keep historical logs of who was assigned what address.

[dead]

Re: Proton Mail discloses user data leading to arrest in Spain

#106

Post by fullspectrumdev »

sintax wrote: post #101
BobFromEnzyte wrote: post #79

Earlier quoted context omitted.

You can create anonymous accounts with Tuta through Tor and they don't ask for a phone number or contact email address. They even made a tutorial video on YouTube a few weeks ago for how to do it: https://youtu.be/oXv3llPIfvo If you continued using the account only through Tor, there wouldn't be any traceable info.

I'm not a lawyer, but doesn't GDPR and No-Log contradict each other.

Nope. What’s funny is it’s actually easier to be GDPR compliant if you keep no logs.

Re: Proton Mail discloses user data leading to arrest in Spain

#107

Post by TaylorAlexander »

peanut-walrus wrote: post #102
lolinder wrote: post #22

Earlier quoted context omitted.

I don't know one way or the other how easy it is, but if I were an activist in an oppressive regime I wouldn't want to use a VPN that is connected to my identity in any way. I wouldn't trust zero-log policies to keep me safe, there are too many unknowns about the way they run these services and what metadata they have to turn over.

In this case an activist in the oppressive regime of...Spain?! Opsec is hard and most activists in western countries don't take it seriously. It's not like we live in PRC or DPRK right? Ironically, it is likely far harder for PRC or DPRK to get data from Proton than it is for Spanish police.

> It's not like we live in PRC or DPRK right?

Right. Western governments are much, much better at mass covert surveillance.

> it is likely far harder for PRC or DPRK to get data from Proton than it is for Spanish police

You balk at the idea of a western government being oppressive while pointing out that our “secure” email services can be easily compromised by government action.

Re: Proton Mail discloses user data leading to arrest in Spain

#108

Post by Y_Y »

matheusmoreira wrote: post #82
underlogic wrote: post #75

Earlier quoted context omitted.

fix it? are you kidding! that they demanded the private key tells you _everything_ you need to know about protonmail.

Well, they are literally in the business of making OpenPGP easy to use. I understand your worry but I can also understand where they're coming from. The fact is PGP is stupidly hard. I once ran into a gpg bug that deleted my master key . I got so frustrated I just gave up and forgot about it for years. Without services like Proton Mail, this stuff is just never going to be mainstream. The only way to retain full cont…

So can you put in a dummy master key after the export and before the upload?

Re: Proton Mail discloses user data leading to arrest in Spain

#109

Post by jorvi »

underlogic wrote: post #86
matheusmoreira wrote: post #82

Earlier quoted context omitted.

Well, they are literally in the business of making OpenPGP easy to use. I understand your worry but I can also understand where they're coming from. The fact is PGP is stupidly hard. I once ran into a gpg bug that deleted my master key . I got so frustrated I just gave up and forgot about it for years. Without services like Proton Mail, this stuff is just never going to be mainstream. The only way to retain full cont…

It's a "trust me" story. Honeypot

It is also security theater. 99.9% of the time the other side you are communicating with stores their mails with server-side encryption. If your fancy encrypted e-mails have a "plaintext" mirror, your encryption is useless.

You want to optimize your 99.9% case for convenience (say, use Fastmail), and optimize your 00.1% case for security (manually managed PGP with a secondary anonymous e-mail). It makes no sense to trade away swathes of convenience and security just so you can be lazy with your 00.1% case.

Re: Proton Mail discloses user data leading to arrest in Spain

#110

Post by matheusmoreira »

Y_Y wrote: post #108
matheusmoreira wrote: post #82

Earlier quoted context omitted.

Well, they are literally in the business of making OpenPGP easy to use. I understand your worry but I can also understand where they're coming from. The fact is PGP is stupidly hard. I once ran into a gpg bug that deleted my master key . I got so frustrated I just gave up and forgot about it for years. Without services like Proton Mail, this stuff is just never going to be mainstream. The only way to retain full cont…

So can you put in a dummy master key after the export and before the upload?

Maybe. I haven't tried it. Someone actually suggested this to me on the #gnupg IRC but I just kinda forgot about it.

The --export-secret-subkeys command does just that: it replaces the master key with some GNU specific stub packet thing. It's conceivable that they could detect this and reject the uploaded key. In order to avoid that, one might edit the secret key packet manually instead. Just zero fill or randomize all the secret key bits or something. I assume it wouldn't match up with the public key though. Aren't the public and private keys mathematically related? Maybe you can detect that the key is bogus if you try to do cryptographic operations with it. Maybe the operation somehow fails or produces nonsense results. I don't really know enough cryptography to say.

Post reply on HN