ProtonMail deletes 'we don't log your IP' from website after activist arrested • Hacker News Board

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#121

Post by laurent123456 » Tue, Sep 07, 2021, 1:01 PM UTC

Verdex wrote: post #115

My day to day life is pretty boring, but occasionally I'll imagine what I would need to do if I ever had to get out a secret message out where it was important that it couldn't be traced back to me. It always ends up being something like, "Well, I could buy a bunch of raspberry PIs with cash and then go to a coffee shop that I never go to and upload the message to a gmail account that I'll only ever use once. Throw t…

Tor from a coffee shop should be sufficient shouldn't it? If the browser cannot be finger printed and the IP is not yours, it shouldn't be possible to identify you.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#122

Post by yaris » Tue, Sep 07, 2021, 1:01 PM UTC

ur-whale wrote: post #105

livinginfear wrote: post #50

The expectation that Proton would be able to disobey the legal requests of their local authorities with impunity is unrealistic. Protonmail makes certain claims about privacy, particularly about encryption. They don't make any claims that they have the intention, or ability for that matter, to defy local authorities at their peril. Like Grugq said in one of his presentations (paraphrased): "Don't expect your VPN comp…

> The expectation that Proton would be able to disobey the legal requests of their local authorities with impunity is unrealistic. Untrue. There are many way to resist authority without being seen as blatantly disobeying the law. In this particular case, they could have gone with the standard: "can't technically do it, we don't have the infrastructure". Or: "the guys who manages the logs just quit, we can't recover t…

The ways you've listed would work only once (each). With several hundreds of requests per year PM would pretty quickly run out of plausible excuses to not start storing the requested info. Also - what is so precious about this particular request compared to 700 requests PM received last year (if we trust PM on that)? Also - the purpose of any commercial activity (which surely PM email service is) is to make money for their owners. How much money and for how long would come from PM if they constantly would be resisting authorities (or from authorities point of view - obstructing justice)?

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#123

Post by rpadovani » Tue, Sep 07, 2021, 1:02 PM UTC

unyttigfjelltol wrote: post #53

EveYoung wrote: post #36

Earlier quoted context omitted.

In my opinion, email is the wrong medium for highly confidential communication. Especially, if someone's personal freedom or safety depends on it. Even if E2E works correctly, you still have to worry about meta data. Maybe Matrix over TOR would be a better alternative?

When someone's personal freedom or safety is at risk from their communications, said person should re-evaluate their career choices.

You really live in a marvelous world, where your communications reflect on your safety only due to career choices and not, let's say, gender, religious, political, or ethnicity related problems.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#124

Post by ArnoVW » Tue, Sep 07, 2021, 1:02 PM UTC

tyingq wrote: post #100

ArnoVW wrote: post #27

Earlier quoted context omitted.

From the blog posting I read yesterday, the individual was not arrested for his political convictions. He was not only a climate activist, but also a squatter. Apparently there were several police officers hurt during a legally mandated eviction of the building that he squatted. Saying "omg they arrested a climate activist" is like saying "omg, they arrested filesystem developer Hans Reiser!"

As far as I can tell, this was about squatting in an unused commercial space that was once a restaurant. The spot had been damaged prior to the squatting and no renovations to fix it had started. So, yes, a crime, but comparing it to Hans Reiser seems a bit over the top.

The issue was assault during eviction, not just squating.

And my point was not to equate assault and murder. Just to say that we were having the wrong discussion.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#125

Post by nicolas_t » Tue, Sep 07, 2021, 1:03 PM UTC

I think a distinction must be made between a service that will protect your privacy historically and a service that will continuously protect your privacy.

If I sign up with protonmail today using a vpn like mullwad, since I'm probably not currently be targeted, I can reasonably be sure that it will be difficult to track things back to me.

However, once I'm targeted and there's a warrant against me, any activity I have on such services is going to be logged going forward.

So, using the service once to receive some data or do something anonymously is reasonably secure... This is very different from services like gmail which will have kept any logs in the past about me and that will always be able to track me without any further logging.

It's imperfect but I think that given the current environment and the current laws, this might be the best we can have.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#126

Post by ipaddr » Tue, Sep 07, 2021, 1:03 PM UTC

pera wrote: post #24

craftinator wrote: post #15

Earlier quoted context omitted.

If that is the case, why did they remove this statement? It seems to me that if the statement remained true even though this guy got arrested, it would be true under the "by default" clause. By removing it, they indicate it was never true; or, I suppose, they discovered just how fun it is to get people arrested, and decided to change their policy on the fly! I was even considering switching to them...

> If that is the case, why did they remove this statement? As far as I understand according to several comments I read here in HN "99%" of the people don't understand what "by default" means, making the sentence misleading for most.

Most were falling for the trickey in wording and they are mad.

Throwing in a word like default changes the entire meaning.

Instead of we don't log anything*

* we log only when requested

They should say your ip can be logged.

It's like saying in big headline.

No meat burgers *

* meat means carots

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#127

Post by plater » Tue, Sep 07, 2021, 1:03 PM UTC

cf_ wrote: post #77

kylehotchkiss wrote: post #41

Earlier quoted context omitted.

The company you’re mentioning in the end is Tresorit, right? If so, they still do get some kudos for running a pretty solid end to end encrypted storage service. Their whitepaper checked out to me and their heavy focus on business users instead of consumer seems to attract less of the advocate types of users that ended ProtonMail in this weeks situation to begin with

As far as I know Tresorit has actual offices and staff in Zurich, Switzerland. They also appeared clear to me in the past that they have multiple offices around the world (I listened to a presentation from them recently at a conference).

I was referring to pcloud and pcloud also have an office in Switzerland. But similar applies to Tresorit I believe, thy just have it for tax and marketing reasons.

The issue is both Tresorit and pcloud store the data outside of Switzerland. If you start using pcloud on the expectation that it's stored in Switzerland you are wrong, it will be stored in Texas or in Luxemburg. So, how can Swiss law really apply once it really matter? And secondly, who cares if it's Swiss law, it's nothing special with that.

People seem to believe there is some kind of banking secrecy that applies to data storage. On top of that, the Swiss banking secrecy does actually not exist anymore.

And looking at the Terms & Conditions from pcloud, it says: "If a European Union user of the Site or Services is located outside of Switzerland, then, for the purposes of any claim or action relating to these Terms, the Privacy Policy, the Site, or any Services, the applicable jurisdiction will be the courts that are located in the territory of residence of such European User."

So what is the point to highlight they are in Switzerland, if Swiss laws do not apply if you do not live in Switzerland? It's just false marketing.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#128

Post by teekert » Tue, Sep 07, 2021, 1:04 PM UTC

ducktective wrote: post #91

plater wrote: post #34

Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy. Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference. Be also aware of the fact that many companies market themselves as Swiss, but all it mean…

What, you mean those landing pages with that majestic snowy mountain doesn't automatically mean robust security and unparalleled privacy? My life has been a lie...

I thought those impenetrable looking mountains were part of their datacenter defenses.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#129

Post by alisonkisk » Tue, Sep 07, 2021, 1:04 PM UTC

laurent123456 wrote: post #116

plater wrote: post #34

Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy. Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference. Be also aware of the fact that many companies market themselves as Swiss, but all it mean…

> In one example, it's a cloud storage company, they say on their marketing page and their about page that they are based in Switzerland and under Swiss law, but if you look at the legal pages the company you sign up with are actually based in Bulgaria. Their servers are based in Texas, USA and Luxemburg, Europe and their development team in Bulgaria. Just out of curiosity, in this kind of situation what laws actuall…

The laws of all connected countries apply, even if they contradict.

Re: ProtonMail deletes 'we don't log your IP' from website after activist arrested

#130

Post by wasmitnetzen » Tue, Sep 07, 2021, 1:05 PM UTC

underseacables wrote: post #111

nvarsj wrote: post #90

Earlier quoted context omitted.

I find Sealand fascinating. Imagine founding an off-grid location as a data haven, and it got popular. What would happen? I can see covert operations from foreign governments happening for example, driven by copyright lobbyists. Would they then need to hire security forces or train their own armed forces? Would it eventually join global political organizations to influence and protect its position? It gets really int…

Let us suppose for a moment that you could put a ship out in the sea, using solar panels and wind power, and satellites, you could provide a service. It might not be a service that’s always available, or all that fast, but it is technically feasible.

A ship is way too easily intercepted by any country with a navy. And your flag bearing country probably won't care, if you even have one. You need to go to space!