Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail discloses user data leading to arrest in Spain

restoreprivacy.com

Post reply on HN
Print view View original

131–140 of 283 posts

Re: Proton Mail discloses user data leading to arrest in Spain

#131

Post by rmbyrro »

lancebeet wrote: post #113
oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

You state this distinction as if it's established, but it's not a definition I've personally heard explicitly stated before. If I read the introduction of the Wikipedia article on "privacy", I find the following: >The right not to be subjected to unsanctioned invasions of privacy by the government, corporations, or individuals is part of many countries' privacy laws, and in some cases, constitutions. So according to…

If there's a court order from due judicial process, isnt't it sanctioned invasion of privacy?

Re: Proton Mail discloses user data leading to arrest in Spain

#132

Post by noname120 »

srockets wrote: post #14
fbdab103 wrote: post #10

Earlier quoted context omitted.

I think they should do like Mullvad claims and keep zero logs. You cannot share what you do not have.

This does not stop the host from being compelled to wiretap future communications. Just don't try to make encrypted email happen. It can't, and we don't need it to be. We have better solutions for encrypted communications, for those that need it.

It's harder and requires more red tape.

Re: Proton Mail discloses user data leading to arrest in Spain

#133

Post by 0xEF »

Klonoar wrote: post #118
lancebeet wrote: post #113

Earlier quoted context omitted.

You state this distinction as if it's established, but it's not a definition I've personally heard explicitly stated before. If I read the introduction of the Wikipedia article on "privacy", I find the following: >The right not to be subjected to unsanctioned invasions of privacy by the government, corporations, or individuals is part of many countries' privacy laws, and in some cases, constitutions. So according to…

Their breakdown is what’s parroted up and down comment chains on this site when it comes to privacy/anonymity, so I’m frankly not sure how you’ve missed it over the years.

That, and the terms themselves tend to invoke clues about the meaning. Privacy implies there is an identity, but it is kept hidden. Anonymity implies there is no identity established so there is nothing to hide.

We don't see much of the latter since most web services require an email to sign up, at minimum, which still leaves discoverable bread crumbs. The web services that require you to give up nothing to use them are far less popular, so I guess I can see why people might conflate the two.

Re: Proton Mail discloses user data leading to arrest in Spain

#135

Post by felsokning »

> This individual is suspected of being a member of the Mossos d’Esquadra (Catalonia’s police force) and of using their internal knowledge to assist the Democratic Tsunami movement.

...and...

> The requests were made under the guise of anti-terrorism laws, despite the primary activities of the Democratic Tsunami involving protests and roadblocks, which raises questions about the proportionality and justification of such measures.

As I understand it, Catalonia has long desired for independence[1]. Is the Democratic Tsunami movement something different, entirely? If not, can someone fill-in the blanks of how vying for independence (in this case) gets umbrella'ed under terrorism?

[1] - https://en.wikipedia.org/wiki/Catalan_independence_movement

Edit: Accidental caps-lock on a word. My bad.

Re: Proton Mail discloses user data leading to arrest in Spain

#136

Post by WhyNotHugo »

BobFromEnzyte wrote: post #81
lolmao wrote: post #2

Switzerland has laws? Did Proton lie to us?

This is something that I never understood with their "oh you are safe in Switzerland" bs. If the court presents them w/ a warrant they have to comply. There is no magically safe data haven and it isn't honest to pretend that they are one.

Switzerland does have strict laws on the topic. Data requests are only honoured for cases which are a crime both under the foreign country's law and under Swiss law.

If you live in a country where homosexuality is illegal, and your local government is chasing you because of this, a Swiss company won't comply with data requests, and a Swiss judge has no reason to honour any data request.

If your local government is chasing you because of something that is recognised as a crime in Switzerland, then they will disclose data to foreign authorities.

Re: Proton Mail discloses user data leading to arrest in Spain

#137

Post by alexey-salmin »

DEADMINCE wrote: post #66
newscracker wrote: post #54

Earlier quoted context omitted.

You seem to be confusing privacy with practicality. In practice, nothing is ever secure, nothing is ever private and nothing is ever safe. What matters here is what Proton promises and advertises to users/potential users vs. what it can actually deliver. I don’t know if Proton is more open about this, but hopefully this isn’t just buried in some long Terms of Service that almost nobody reads.

> In practice, nothing is ever secure, Well that's clearly not true.

Ever heard of thermorectal cryptanalysis?

As long as your secure world is not fully isolated but has any interactions with the physical world at all (e.g a human being somewhere receiving and reading your message with his eyes), then it's only a matter of resources allocated to trace you. You can pile up layers of "hops" through uncooperative jurisdictions -- this certainly helps to raise the bar but doesn't give you a mathematical proof of security.

Re: Proton Mail discloses user data leading to arrest in Spain

#138

Post by [deleted] »

lolinder wrote: post #9

> Use a good VPN service to hide your IP address whenever possible. (Failure to do this is what compromised a Proton Mail user in France who was arrested after after police obtained IP logs.) If your VPN is tied to a payment method then all you've done is give police one extra hop to follow to get at you, which wouldn't have saved this activist. Their list of VPNs only includes Mullvad in position 9 of 10, but as far…

[deleted]

Re: Proton Mail discloses user data leading to arrest in Spain

#139

Post by twiss »

matheusmoreira wrote: post #63
dathinab wrote: post #43

Earlier quoted context omitted.

Privacy is also meant to protect you from the state, or more specifically state abuse. It's an essential aspect of privacy. Like privacy is also meant to e.g. not disclose topics you have communicated about so that it can't be abused against you. For example there is a long history of states persecuting people for idk. being gay, believing in a certain religion or being a journalist which was involved in a unpleasant…

Some interesting facts about Proton Mail. It generates OpenPGP keys on their own servers, and if you want to use your own keys their instructions show users how to upload upload their entire OpenPGP secret keychain to Proton Mail. Not just encryption/signing subkeys, the master key also needs to be included. I've emailed them to ask that they fix this. I also created a post on their user voice thing about it. https:/…

Hi! Crypto team lead here.

1. We don't generate OpenPGP keys on the server, we generate them in the client, and then encrypt them with a key derived from your password (which we never send to the server), and store the encrypted key on the server. Then, when you login again, we fetch and decrypt the private key, and use it in the client. The server never has access to your private keys.

2. We do support "GNU Dummy" keys now (which is what `gpg --export-secret-subkeys` creates). The required private key material needs to be in a single OpenPGP key though (with a dummy primary key), but that's what `gpg --export-secret-subkeys` does by default. Though, as mentioned above, we don't have access to the primary key on our servers either way.

2a. Note that "GNU Dummy" keys are a gpg-specific extension to OpenPGP [1]. The upcoming new version of the OpenPGP standard [2] allows a more standardized way of doing this by combining public key packets and private key packets in a single transferable private key, but it's not widely implemented yet.

3. I would argue that the private key material of the subkeys (used to encrypt and sign your emails) is actually much more important in this case (but of course we don't have access to that either). That's the reason we don't explicitly recommend this: it doesn't meaningfully improve security. But we don't stop you from doing it (now that we support it, even though it's a nonstandard feature), either.

[1]: https://github.com/gpg/gnupg/blob/master/doc/DETAILS#gnu-ext...

[2]: https://datatracker.ietf.org/doc/html/draft-ietf-openpgp-cry...

Re: Proton Mail discloses user data leading to arrest in Spain

#140

Post by protonmail »

jorvi wrote: post #109
underlogic wrote: post #86

Earlier quoted context omitted.

It's a "trust me" story. Honeypot

It is also security theater. 99.9% of the time the other side you are communicating with stores their mails with server-side encryption. If your fancy encrypted e-mails have a "plaintext" mirror, your encryption is useless. You want to optimize your 99.9% case for convenience (say, use Fastmail), and optimize your 00.1% case for security (manually managed PGP with a secondary anonymous e-mail). It makes no sense to t…

https://news.ycombinator.com/item?id=40283698
Post reply on HN