161–170 of 283 posts
It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…
> Use a good VPN service to hide your IP address whenever possible. (Failure to do this is what compromised a Proton Mail user in France who was arrested after after police obtained IP logs.) If your VPN is tied to a payment method then all you've done is give police one extra hop to follow to get at you, which wouldn't have saved this activist. Their list of VPNs only includes Mullvad in position 9 of 10, but as far…
But you have to absolutely "air-gap" that from the rest of your identity, such as not making a proton e-mail address over TOR and then using your usual email address as the recovery one.
There are some serious anti-proton-vibes in this thread, so just my 2 cents as a paying customer: I'm rather happy with their service. I pay them money, they make sure that Joe in Marketing won't be able to harvest data from my emails. I'm also fairly optimistic that they take security serious enough that the blast radius of some dataleak is hopefully very limited. I have zero delusions however that they can protect…
Par for the course at HN to have a "vaguely dislike-ish" relationship with Protonmail. Fastmail is the poster child of HN on the other hand.
I would guess the gist of it is that if you promise _any_ amount of security (or whatever feature), HN will nitpick you to death on not going 100% (despite the general improvement to your security). If you don't promise security at all, it doesn't matter that you're less secure than Proton. Something like that.
Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address. In this case the email address was the lead, but I wonder what other info would be enough to get the phone provider to spill the beans. For instance would an IP address used at a specific time be uniquely identifying if it was…
While an IP address is not an identity, it can still zero in on a location. I suspect governments and ISPs all keep historical logs of who was assigned what address.
I assume it could be easily challenged in court (network was compromised, “i give out my WiFi to anyone who visits my home”) without other supporting evidence.
Earlier quoted context omitted.
We do fetch keys from WKD, as announced almost 5 years ago: https://proton.me/blog/security-updates-2019 :)
Actually, you have a bug that has been unfixed for 5 years now. I know because I submitted it. Still no action. Here's my last message to Proton Mail support, request ID 822331. I was directly told no resources would be spent on fixing it: > Well, it has been multiple years now so can you guys maybe prioritize this? How long do you want me to continue waiting on this issue? I can't count on PM users to send my mailse…
Earlier quoted context omitted.
This is something that I never understood with their "oh you are safe in Switzerland" bs. If the court presents them w/ a warrant they have to comply. There is no magically safe data haven and it isn't honest to pretend that they are one.
Switzerland does have strict laws on the topic. Data requests are only honoured for cases which are a crime both under the foreign country's law and under Swiss law. If you live in a country where homosexuality is illegal, and your local government is chasing you because of this, a Swiss company won't comply with data requests, and a Swiss judge has no reason to honour any data request. If your local government is ch…
Earlier quoted context omitted.
If there's a court order from due judicial process, isnt't it sanctioned invasion of privacy?
Sanctioned by the state, which the right to privacy should protect you from. The fact that your country habitually violates your rights doesn't change anything about the fact that you have a right to them.
Earlier quoted context omitted.
> Mainly privacy of communication doesn't always imply anonymity, through sometimes does (and has too!). Anonymity is simply people not knowing who you are, not necessarily what you say. It's not privacy of communication, but privacy of identity. I can post on the internet as Anonymous Coward, and those posts are public even though my identity is private. I can encrypt an email and send it, and it will be picked up b…
yes but also sometimes just knowing a persons identity can infringe on their privacy I would say anonymity is an aspect of privacy, one you sometimes but not always need. e.g. I would say leaking who was present at a anonymous self help group isn't just breaking anonymity but also infringing on privacy
I said that the post I responded to was conflating two different types of privacy.
Who said things is different to what was said.
Bob and Alice spoke about something, is not the same as Anon to Anon "The government is listening".
One is the message and one is metadata. They are protected in different ways and leaked in different ways. Mixing the two means that you will probably not get the protection that you desire.
Proton Mail gives info only when the Swiss law mandates it and Swiss law enforcement requires it. Swiss privacy laws are quite good. That's the strictest privacy policy any company can hope. Proton Mail can't give email content, only things like email address, ip adressese etc.
Anything that is stored by anyone can be handed over. That information may be useful, may be useless or may be useless now and useful tomorrow when they have the key.