Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail suspended journalist accounts at request of cybersecurity agency

theintercept.com

Post reply on HN
Print view View original

171–180 of 217 posts

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#171

Post by BoredPositron »

93po wrote: post #169
BoredPositron wrote: post #151

Earlier quoted context omitted.

This makes the situation even worse for me. CERTs lack any legal authority to compel action or enforce compliance. Without a thorough and fast post mortem analysis, this incident is deeply concerning for anyone who relies on Proton as their primary email provider. I guess getting trigger happy just comes as soon as you get a bigger user base but that's exactly when you get caught slipping. Like they did with the fals…

they didnt do it because CERT said they legally had to - they did it presumably because they pay CERT to catch abuse and misuse and take action based on their findings

This doesn't change my statement, even if they take the word of the CERTs as gospel. This represents a significant attack vector for denial-of-service attacks, as demonstrated by what happened here, and for a service like Proton, such a vulnerability is nearly inexcusable.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#172

Post by estimator7292 »

crossroadsguy wrote: post #107
immibis wrote: post #78

Earlier quoted context omitted.

Their controls are buffed up: all of those accounts are linked due to having been created with the same IP address. If one is blocked, they all are. If you try to circumvent this with a well-known proxy (such as Tor or a V"P""N") you will find that captcha activation will not exist as an option.

That definitely doesn't look good for privacy POV. If they do not want abuse, they ought to use other means. They should not associate IPs with account creation. That is kind of scary. In fact, if what you have said is true, then one's account can be blocked by someone else's mischief on the same IP, which is not very uncommon at all i.e sharing the IP.

They could take government ID, or fingerprint your machine, make you submit a picture of your face, do these options seem better to you?

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#173

Post by ziml77 »

abnercoimbre wrote: post #90
drnick1 wrote: post #69

And this is why I host my own email server, even if I am not a journalist investigating governments or anything of the sort. It's a matter of control over my computing.

Common folklore is that this is extremely onerous to self-host (and have it work successfully.) How did you go about it?

Also, how do you mask your identity if you self-host? I can have as many mailboxes as I want but they're all trivial to correlate because they share a domain that isn't providing email accounts to large amounts of users. And then there's the matter of a VPS not actually being under my control. It's a VM running in a datacenter. I could run the mail server locally, but then I'd still need to relay through a VPS to mask my IP address. And that's still only protecting from a casual adversary...

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#174

Post by kevin_thibedeau »

int_19h wrote: post #150
cedws wrote: post #126

Earlier quoted context omitted.

Not allowing IMAP/POP isn’t just for the lulz, it’s not compatible with the encryption architecture Proton uses, which is kind of the selling point of the product. You can either have your emails encrypted at rest with your key OR you can have plain IMAP/POP without a bridge client, you can’t have both.

I never really understood the point of that. If you are exchanging emails with someone using one of the most popular email services that together make 99% of the marketshare, their server retains your email unencrypted anyway. So the only time that encryption will really matter is when emailing someone who is also using Proton.

Proton also supports PGP emails... for the dozen or so people who are setup to receive them.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#175

Post by 0xbadcafebee »

Fethbita wrote: post #149
akshitgaur2005 wrote: post #138

Earlier quoted context omitted.

> get a WiFi access point with Wireguard and Dynamic DNS at your home Could you elaborate more on this?

Not the parent but you can set up Dynamic DNS at home and Wireguard in your router and later use the Wireguard connection to connect to your home network and have a safe tunnel. It’s quite easy to do with openwrt routers.

Yep! And TP-Link, Asus, GL.iNet, MicroTik, and other consumer routers also have Wireguard/OpenVPN servers and Dynamic DNS clients.

For the parent commenter: you set up an account at a Dynamic DNS service, and configure your router so when it's online, a dynamic DNS hostname will always point at your router's IP. Then you set up a Wireguard or OpenVPN server on your wifi AP. Then set up your phone, laptop, etc to connect to that server at the dynamic dns hostname. Now you have a VPN server running on your home wifi AP. Connect when you're away from home, and your traffic will go securely through your home ISP connection.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#176

Post by 0xbadcafebee »

crossroadsguy wrote: post #124
0xbadcafebee wrote: post #50

Earlier quoted context omitted.

Fastmail is fine. It's somewhat limited in its UX, but technically speaking, everything works, and it's snappy. Very few outages. I really like their integrations with calendars, contacts, and mail for 3rd party sites/services. Not a ton of features or deals re: custom domains or multiple users, but it's fine if it's just for yourself. edit They literally -JUST- turned on Offline support for their app and web interfa…

Hey, what's the trick of keeping your VPS OS/etc updated and upgraded without having to nuke (or replace or copy to elsewhere and "paste" back) the current setup on that VPS? In all my self hosting attempts it works butter smooth until I try to update/upgrade my VPS OS or hell even the app I am using like a VPN, or a seedbox, a notes app etc etc. I mean it's been really painful. Sometimes I have used the VPS w/o upda…

Two basic ways:

1) Use your VPS OS's native software upgrade mechanism

2) Build, test, and deploy immutable images

For 1), you configure your OS (Ubuntu LTS let's say) to do automatic unattended upgrades only for security updates (check documentation for instructions). They're designed to be backwards compatible so this is safe and automatic. May require you to periodically reboot the box. When that version of Ubuntu is eventually end-of-life, they usually provide a manual upgrade procedure to upgrade in-place to a newer version of Ubuntu. A couple manual steps over an hour or two and you're set until the new version goes EOL (many years for Ubuntu LTS).

For 2), you would build either a container or a disk image with your OS, preferred software, configs, etc. Build the image (Packer for disk image, Docker for container), write a simple test to run it and make sure it's working. Now you can install that new container or disk image onto your VPS, and you know it'll work. This is more work, but the resulting image is guaranteed to work the same way every time. So every time you upgrade, you just build a new image. If the new image doesn't work for some reason, just go back to the last image that did work. Set all this up on a CI/CD platform (GitHub Actions, CircleCI, etc) and you can just keep using that setup forever, no need to get it set up on your laptop again if you reinstall your laptop OS.

For either of these, it helps to use only software that is packaged for your OS, rather than installing custom software. There will be less extra work to perform to get the software to work and configured, and upgrade steps will be smoother.

For 2), it also helps to use a VPS which has a Terraform provider (https://registry.terraform.io/browse/providers?category=infr...) so you can write code to automate updating your VPS's disk image (or restoring an old one).

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#177

Post by traceroute66 »

hulitu wrote: post #163
a0123 wrote: post #27

Earlier quoted context omitted.

Sorry but doubt. The whole "we have only received two emails" is a classic move of every company caught with their pants down. Considering Proton's history, they don't get the benefit of the doubt on this one. As for the "company size excuse" sorry but considering the business you claim to be in (the private and secure email), having an on-call skeleton crew legal team available over the weekend for urgent requests i…

> having an on-call skeleton crew legal team available over the weekend for urgent requests is a bare minimum I don't know about Switzerland, but in Germany, no company will be available "over the weekend". Almost everything on the internet in DE is Mo-Fr 9-17.

> I don't know about Switzerland, but in Germany, no company will be available "over the weekend".

Before 31 December 2020, the Swiss Airforce famously only operated during office hours....

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#178

Post by traceroute66 »

johnklos wrote: post #80

The true value of a company can be measured by our ability to communicate with them. If we can't communicate except after public outrage, then what does that say about the company? Here's a genuine question: is Proton Mail the least shitty of companies that provide email services? I self-host email and will continue until I die. But for others who need a company to do this for them, is Proton Mail the least shitty of…

> The true value of a company can be measured by our ability to communicate with them.

True, but sadly too many people don't care.

Look at how many people will happily throw $$$ per month at Claude when it is basically absolutely impossible to contact a human being at Antrhopic.

> is Proton Mail the least shitty of companies that provide email services?

Tutanota could be worth a look.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#180

Post by johnisgood »

estimator7292 wrote: post #172
crossroadsguy wrote: post #107

Earlier quoted context omitted.

That definitely doesn't look good for privacy POV. If they do not want abuse, they ought to use other means. They should not associate IPs with account creation. That is kind of scary. In fact, if what you have said is true, then one's account can be blocked by someone else's mischief on the same IP, which is not very uncommon at all i.e sharing the IP.

They could take government ID, or fingerprint your machine, make you submit a picture of your face, do these options seem better to you?

Nope. Zero-knowledge proofs seem to be the middle ground, IMO. Prove X without revealing X itself.
Post reply on HN