Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail discloses user data leading to arrest in Spain

restoreprivacy.com

Post reply on HN
Print view View original

111–120 of 283 posts

Re: Proton Mail discloses user data leading to arrest in Spain

#111

Post by haakon »

AnonC wrote: post #97
samjmck wrote: post #70

Earlier quoted context omitted.

The identification came from the recovery email.

In a previous case some years ago, a French activist’s IP address was provided by Proton on court order. Proton does store IP address and does provide it when legally demanded to.

They were legally compelled to add IP logging for that specific user. After this incidence, they went on to obtain a court ruling in Switzerland, where they operate, so that this specific attack cannot happen again. In their blog post about it [1], they instruct concerned users to access their account over Tor.

Of course when Proton say they don't log, we just have to take their word for it. People who don't want that element of trust can use Tor. Personally I believe their story in this case.

[1] https://proton.me/blog/climate-activist-arrest

Re: Proton Mail discloses user data leading to arrest in Spain

#112

Post by matheusmoreira »

jorvi wrote: post #109
underlogic wrote: post #86

Earlier quoted context omitted.

It's a "trust me" story. Honeypot

It is also security theater. 99.9% of the time the other side you are communicating with stores their mails with server-side encryption. If your fancy encrypted e-mails have a "plaintext" mirror, your encryption is useless. You want to optimize your 99.9% case for convenience (say, use Fastmail), and optimize your 00.1% case for security (manually managed PGP with a secondary anonymous e-mail). It makes no sense to t…

I view Proton Mail as the convenient 99,9% case. It's a very polished service and it seems to offer a somewhat higher security baseline than the other email providers which probably don't even try to do anything encryption related.

The maximum security manual OpenPGP 0.1% case is still absolutely necessary though. No doubt about that. Anyone claiming that Proton Mail solved this doesn't actually understand how OpenPGP works. Not that I would fault them for failing to understand this ludicrously complicated stuff.

Re: Proton Mail discloses user data leading to arrest in Spain

#113

Post by lancebeet »

oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

You state this distinction as if it's established, but it's not a definition I've personally heard explicitly stated before. If I read the introduction of the Wikipedia article on "privacy", I find the following:

>The right not to be subjected to unsanctioned invasions of privacy by the government, corporations, or individuals is part of many countries' privacy laws, and in some cases, constitutions.

So according to Wikipedia, at least in some cases, privacy is protection against the state. Where does your definition come from?

Re: Proton Mail discloses user data leading to arrest in Spain

#114

Post by Ferret7446 »

chefkd wrote: post #33
lolinder wrote: post #22

Earlier quoted context omitted.

I don't know one way or the other how easy it is, but if I were an activist in an oppressive regime I wouldn't want to use a VPN that is connected to my identity in any way. I wouldn't trust zero-log policies to keep me safe, there are too many unknowns about the way they run these services and what metadata they have to turn over.

How could one go off grid without going off grid do you think? Cash, bitcoin, prepaid cards, VPNs they all seem traceable if truly needed

Speaking absolutely, you can't. Reality is public. You have to choose your risk tolerance level.

Re: Proton Mail discloses user data leading to arrest in Spain

#115

Post by [deleted] »

lancebeet wrote: post #113
oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

You state this distinction as if it's established, but it's not a definition I've personally heard explicitly stated before. If I read the introduction of the Wikipedia article on "privacy", I find the following: >The right not to be subjected to unsanctioned invasions of privacy by the government, corporations, or individuals is part of many countries' privacy laws, and in some cases, constitutions. So according to…

[deleted]

Re: Proton Mail discloses user data leading to arrest in Spain

#116

Post by Kbelicius »

lancebeet wrote: post #113
oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

You state this distinction as if it's established, but it's not a definition I've personally heard explicitly stated before. If I read the introduction of the Wikipedia article on "privacy", I find the following: >The right not to be subjected to unsanctioned invasions of privacy by the government, corporations, or individuals is part of many countries' privacy laws, and in some cases, constitutions. So according to…

> unsanctioned invasions of privacy

GPs definition might as well come from wikipedia.

Re: Proton Mail discloses user data leading to arrest in Spain

#118

Post by Klonoar »

lancebeet wrote: post #113
oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

You state this distinction as if it's established, but it's not a definition I've personally heard explicitly stated before. If I read the introduction of the Wikipedia article on "privacy", I find the following: >The right not to be subjected to unsanctioned invasions of privacy by the government, corporations, or individuals is part of many countries' privacy laws, and in some cases, constitutions. So according to…

Their breakdown is what’s parroted up and down comment chains on this site when it comes to privacy/anonymity, so I’m frankly not sure how you’ve missed it over the years.

Re: Proton Mail discloses user data leading to arrest in Spain

#119

Post by guappa »

matheusmoreira wrote: post #82
underlogic wrote: post #75

Earlier quoted context omitted.

fix it? are you kidding! that they demanded the private key tells you _everything_ you need to know about protonmail.

Well, they are literally in the business of making OpenPGP easy to use. I understand your worry but I can also understand where they're coming from. The fact is PGP is stupidly hard. I once ran into a gpg bug that deleted my master key . I got so frustrated I just gave up and forgot about it for years. Without services like Proton Mail, this stuff is just never going to be mainstream. The only way to retain full cont…

They could have kept the private key in the browser instead of in the server and let the user get the file there.

Re: Proton Mail discloses user data leading to arrest in Spain

#120

Post by baby »

oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

Thank you for making up a definition
Post reply on HN