121–130 of 283 posts
Earlier quoted context omitted.
> I suspect governments and ISPs all keep historical logs of who was assigned what address. They do. It's often required by law.
1 maybe 2KB of storage for the IP addresses of an individual for a year. Of course they are doing it even if accidentally.
> Use a good VPN service to hide your IP address whenever possible. (Failure to do this is what compromised a Proton Mail user in France who was arrested after after police obtained IP logs.) If your VPN is tied to a payment method then all you've done is give police one extra hop to follow to get at you, which wouldn't have saved this activist. Their list of VPNs only includes Mullvad in position 9 of 10, but as far…
Let's say I buy Mullvad access with a credit card, then access my otherwise-unrelated Proton Mail account via Mullvad. How are police going to find me behind that hop?
Earlier quoted context omitted.
As long as we are talking about classical communication (and not quantum) it is impossible to prove that it isn't collecting at least ciphertext logs.
Not really. Tor, I2P, and Monero manage this just fine. Building on these technologies should allow one to have privacy and anonymity without any exotic quantum technology.
Earlier quoted context omitted.
Let's say I buy Mullvad access with a credit card, then access my otherwise-unrelated Proton Mail account via Mullvad. How are police going to find me behind that hop?
They can find you if they are lucky with choosing your ISP, and there are not many people connecting to VPN you have used at specific time.
I hate when companies mislead, they claim email encryption. but the question is how they know the email is suspicious. it means they monitor emails and obviously, Proton Mail is (not) the trusted choice for secure and private communication.
While I agree this makes Proton unreliable for many things, there's no indication they were reading any emails.
I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…
What if my recovery email is to another proton mail account? What if my VPN used is Proton VPN?
Earlier quoted context omitted.
I don't know one way or the other how easy it is, but if I were an activist in an oppressive regime I wouldn't want to use a VPN that is connected to my identity in any way. I wouldn't trust zero-log policies to keep me safe, there are too many unknowns about the way they run these services and what metadata they have to turn over.
In this case an activist in the oppressive regime of...Spain?! Opsec is hard and most activists in western countries don't take it seriously. It's not like we live in PRC or DPRK right? Ironically, it is likely far harder for PRC or DPRK to get data from Proton than it is for Spanish police.
https://www.wired.com/story/europe-break-encryption-leaked-d...
“Ideally, in our view, it would be desirable to legislatively prevent EU-based service providers from implementing end-to-end encryption,” Spanish representatives said in the document.
Earlier quoted context omitted.
So can you put in a dummy master key after the export and before the upload?
Maybe. I haven't tried it. Someone actually suggested this to me on the #gnupg IRC but I just kinda forgot about it. The --export-secret-subkeys command does just that: it replaces the master key with some GNU specific stub packet thing. It's conceivable that they could detect this and reject the uploaded key. In order to avoid that, one might edit the secret key packet manually instead. Just zero fill or randomize a…