Climate activist arrested after ProtonMail provided his IP address • Hacker News Board

Re: Climate activist arrested after ProtonMail provided his IP address

#141

Post by Aachen » Sun, Sep 05, 2021, 10:15 PM UTC

polote wrote: post #66

COGlory wrote: post #59

Earlier quoted context omitted.

No, if they were not collecting logs by default, then it is clearly not false advertising.

So the default is when nobody ask for the logs? What the point of not collecting IP unless for the time it is useful?

I mean it's either this or traffic analysis. If you use your clearnet IP address to do illegal things, it's nothing more than reasonable that you can get in trouble for it.

This is also why I don't get protonmail in the first place. Unless you use pgp or equivalent, you'll always be subject to law enforcement. Just that protonmail cares more and caters more to activists and so might not give it out without checking that the asker is really legit and then give the minimal amount possible. But they'll always be able to turn over your emails and log IPs, it's not protonmail's fault the laws were voted into action like this.

Re: Climate activist arrested after ProtonMail provided his IP address

#142

Post by kazen44 » Sun, Sep 05, 2021, 10:17 PM UTC

glitcher wrote: post #139

keewee7 wrote: post #28

Earlier quoted context omitted.

If you're doing subversive activities against a Western country you should probably use some Russian or Chinese state-owned service.

Part of the issue is that the bar for subversive activities in the eyes of western law enforcement seems to be getting lower and lower. I don't know the specifics of this case, but it seems many authorities are also not shy about using these methods to identify and track peaceful protesters as well.

while i agree this is a problem, this is something that isn't to blame on protonmail (or any other company following the law). This is something that should be changed through politics/lawmaking.

Re: Climate activist arrested after ProtonMail provided his IP address

#143

Post by Aachen » Sun, Sep 05, 2021, 10:17 PM UTC

istingray wrote: post #43

COGlory wrote: post #37

Disclaimer: I have a ProtonMail account that I pay for. I have seen a ton of disturbing pieces about ProtonMail. Every time I've looked into them, they seem to be maliciously motivated and usually not true, or otherwise twisting of the truth. This has been a confusing thing for me because why is there a small subset of people so vehemently against them? In this case, I'm not surprised. They say quite clearly they can…

I'm also a Protonmail customer. Tor solves this. Protonmail's Tor support is lukewarm. They have a Tor based login without captchas. It's mentioned on their homepage in the bottom menu under "Onion Site", (/tor). And there's one blog post from 2017 that still promotes their v2/shorter onion address. I expect Protonmail to push its users to login through Tor. "Don't trust us, trust math". Embed Tor support in their ap…

How is that lukewarm? Sounds like first class support if they have a dedicated onion address and not just let you connect to the regular clearnet. Or is that address only in that old blog post and not mentioned in places you'd usually look? It's a bit unclear to me.

Re: Climate activist arrested after ProtonMail provided his IP address

#144

Post by elmo2you » Sun, Sep 05, 2021, 10:18 PM UTC

I don't think that ProtonMail complying with the law here is in any way the problem. They simply have to.

However, in this case just as in a few other ones before this one, it has become pretty clear to me that ProtonMail's marketing is deceptive at best an in a few cases some of their claims just blatantly not true.

What surprised me most is that when I pointed this out in the past, I was immediately attacked by what appeared to be like Apple-style fanboys, whole would not stand by anyone criticizing ProtonMail.

To this day I'm not so sure if that was just the genuinely zealous behavior of a few deranged individuals, or if it might have been a concerted commercial effort at damage control.

Either way, to me ProtonMail certainly is not what it claims to be (if not explicitly than at least implied). To me it's just another commercial entity trying to make a profit by tapping a relative niche market while convincing gullible people they are something they actually are not, in any way that will make them a bigger profit. Nothing really shocking about that, and mostly just standard behavior for any other modern commercial entity operating within a capitalistic economy.

Re: Climate activist arrested after ProtonMail provided his IP address

#145

Post by H8crilA » Sun, Sep 05, 2021, 10:18 PM UTC

newbie789 wrote: post #107

I’m aware that this is a very silly sounding question, but I’m very confused about what’s going on here. If the subject of this investigation had been using ProtonVPN to connect to ProtonMail, would this have (in a marginal way) protected their anonymity? If Proton Mail can be compelled to begin logging, surely the same must be said of Proton VPN right? It’s interesting how many “privacy focused” companies tout being…

Shhh, the entire country runs on similar myths, most prominently banking. But then, all that the common man is capable of understanding is myths, sooo ...

Re: Climate activist arrested after ProtonMail provided his IP address

#146

Post by CraneWorm » Sun, Sep 05, 2021, 10:18 PM UTC

salawat wrote: post #20

gregsadetsky wrote: post #16

Earlier quoted context omitted.

The CEO's position on Twitter is that "by default" (from the sentence you're quoting) means when there is no criminal investigation, but when there is a legal order in place, Protonmail will collect the IP... https://twitter.com/andyyen/status/1434600373059297284 "As described in the link above, under Swiss law, we can be forced to collect info on accounts belonging to users under criminal investigation. This is obvi…

Once again: if you can't see their server software, you should assume they are FOS, and are capable of recording anything. Also: One more reason NAT was a good thing over IPv6. The closer we get to the platonic ideal of "UUID per person" the more likely justice systems will use it that way. The day everyone learns how to self-host mail on ephemeral compute instances is the day law enforcement starts requiring MX doma…

doesn't the amount of available IPv6 mean you can get a new one every time?

Re: Climate activist arrested after ProtonMail provided his IP address

#147

Post by kazen44 » Sun, Sep 05, 2021, 10:18 PM UTC

luckylion wrote: post #123

skitter wrote: post #88

Earlier quoted context omitted.

One option not mentioned yet is Posteo. They don't keep your IP and strip it in case your mail client sets it in the headers. They also don't take any personal identification for signup or billing (you can even send them letters with money to pay for a mailbox).

I don't know what came of it, but they've been told by the German constitutional court that their approach ("we're using NAT, we don't know the IP on the actual server") doesn't fly and does not protect them from complying with a court order.

This is correct.

This also applies to ISP's and wiretaps. They need to provide NAT mappings when doing a wiretap if i remember correctly.

Re: Climate activist arrested after ProtonMail provided his IP address

#148

Post by shadowgovt » Sun, Sep 05, 2021, 10:19 PM UTC

akimball wrote: post #135

ivan_gammel wrote: post #128

Earlier quoted context omitted.

TBH in 2021 people engaging in potentially dangerous activities should be literate enough to understand, that no business will guarantee them full security and decline all requests from authorities to disclose their identity. The wording you suggest is equivalent of „do not dry your cat in microwave“ instruction - a legal protection from dumb customers, that does not contribute meaningfully to safety. For the non-Swi…

It’s not protection FROM your customers. It is protection FOR your customers. Most customers are not technically astute

A corporation is a power centralization, and government authority can lean on power centralization.

In general, regardless of what their TOS say, never believe that a corporation can't be compelled by the law to do anything they could physically do. CEOs can be jailed; when's the last time we heard of one actually going to jail over user privacy?

Re: Climate activist arrested after ProtonMail provided his IP address

#149

Post by kazen44 » Sun, Sep 05, 2021, 10:19 PM UTC

rad_gruchalski wrote: post #106

Question: is it possible they do not log any of the data but were required to capture it on the next login? All the talk here implicitly assumes ProtonMail provided historical information.

As far as i understand from the article, this is roughly what happened. Protonmail got a warrant, and thus enabled logging for the user (as is required by law).

Re: Climate activist arrested after ProtonMail provided his IP address

#150

Post by chrononaut » Sun, Sep 05, 2021, 10:20 PM UTC

luckylion wrote: post #109

drexlspivey wrote: post #45

Earlier quoted context omitted.

Some VPN providers run their servers without hard drives.

Thank god their servers aren't on a network where they could simply send the log entries to a different server. That's a cute idea, but it won't get them out of complying with a warrant.

Yeah, that seems more a mechanism to prevent forensics analysis of a hard disk to retrieve transient logs that might've been briefly written to disk (?). I hope it isn't being as a means to prevent the means to log for future connections, for the reasons you state.