Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton is trying to become Google without your data

wired.com

Post reply on HN
Print view View original

181–185 of 185 posts

Re: Proton is trying to become Google without your data

#181

Post by jrockway »

ping00 wrote: post #179
jrockway wrote: post #162

Earlier quoted context omitted.

Yeah, that's fine. If you want to spend 20,000 hours rewriting our 100% open-source product from scratch because we used to have a hosted offering that was overrun by fraud and I made a rash decision in the middle of the night, feel free! Recommend just downloading the source from Github though and using our work for free. That is absolutely the best way to stick it to me for sharing my thought process on HN. (Use th…

Appreciate the thoughtful answer despite the downvotes; I didn't consider how bad fraudulent email creation still is -- would CAPTCHA protection have solved this issue? I'm picturing a web GUI for your product, but I see a console offering on your website too.

They weren't actually doing much automation for account creation; we would see accounts created from mobile phone providers using mobile UAs, and then after they had an API key we'd see the accounts used from compromised cloud hosting accounts. (Free CI trials were probably a big chunk of this too, but I can't prove that.) The mistake we made was really being too generous with free trials; you need the compute to test our product, but free compute is something you just can't give out these days because of the crypto gold rush. I signed up for fly.io recently and they just ask you for a credit card as soon as you hit "create account". We were scared of that at the time, but I thought it was completely reasonable.

Re: Proton is trying to become Google without your data

#182

Post by distracted_boy »

yabones wrote: post #36
imwillofficial wrote: post #23

But they'll give your data away if asked.

The value of proton is not that they'll break the law for you -- they absolutely will not. They are bound by the laws of the land, and when compelled will hand over all the data they are required. The value IS that they simply don't have that much data. All your emails are encrypted at rest with a key they can't read. All your data is stored in such a way that they can't decrypt it on demand. Think about it. When Mic…

They can't perhaps decrypt emails sent between proton users, but that is not the case if you are communicating with someone using a different email service.

Re: Proton is trying to become Google without your data

#183

Post by kmeisthax »

brewdad wrote: post #127
0daystock wrote: post #107

Earlier quoted context omitted.

A US Citizen has more legal and practical safeguards with their data hosted in the US than abroad, but unfortunately the widespread privacy anti-marketing has obscured this critical concept entirely in exchange for "Swiss are probably good at privacy stuff".

>A US Citizen has more legal and practical safeguards with their data hosted in the US than abroad Citation needed. I get that, in theory, US state level actors shouldn't be spying on US citizens acting within the US but the vast majority of us are more likely to get caught up in bog standard law enforcement activities. A US based provider will be forced to comply with a lawful court order from a US court. A Swiss ba…

What happens is that the US spymasters ask the Swiss spymasters very nicely to spy on this foreigner using their countries' tech services. Legally, there's no real way to contest this, because most rights apply to "citizens" or "residents" and not "people".

If you sue Switzerland for violating your right to privacy, Swiss courts won't do anything, because you're not a Swiss citizen. If you sue American courts for violating your right to privacy, American courts won't do anything, because the US constitution only binds the US[0] and not Switzerland. There is plenty of law, precedent, and/or jurisprudence[1] in both jurisdictions that restricts a country spying on their own citizens, but not a country spying on other countries' citizens. So yes, the Swiss company can technically ignore a US court order, but Switzerland can issue their own court orders that will have far few protections for you.

That's also not to mention that the basis for jurisdiction is actually really broad. Like, some countries will actually use "speaking our language" as a jurisdictional basis. So the likelihood of a Swiss company being able to resist a court order is lower than you think - basically the company would have to cut all ties with the US and forego the entire US market to protect you.

Of course, I'm writing all of the above assuming you are an innocent, privacy-conscious individual, where:

1. The balance of US law is in your favor

2. Swiss law is not

3. Stolen information can be laundered across jurisdictions

If you are actually committing crimes, then both US and Swiss law are against your right to privacy, and adding more jurisdictions will absolutely help you in the sense that it makes it far harder to investigate your crimes. That's the sort of thing that the "Swiss privacy law" hype is trying to market off of. The spymasters generally don't like the idea of letting regular law enforcement agencies (LEAs) touch their tools, if only because the evidence they gathered probably isn't actually admissible. So LEAs have to go through official channels[2], which are actually slower and less efficient than things like Five Eyes.

[0] State Actors doctrine notwithstanding

[1] French for "precedent, but we're not doing that 'common law' thing the filthy English do"

[2] CLOUD Act and parallel construction notwithstanding

Re: Proton is trying to become Google without your data

#184

Post by charles_kaw »

mden wrote: post #80
charles_kaw wrote: post #62

Earlier quoted context omitted.

>Do you have any info on this because that is a wild claim. Not only has the concept and implementation of automated law enforcement portals been around since the 90s, the Snowden docs revealed that major providers were providing such portals. AND that their inter-datacenter communications were being piped directly into global intelligence databases without. These portals, NSLs, and other mechanisms have also been co…

You're making a wildly different claim than the initial one. The initial claim is "obviously Gmail and such are piped directly into global intelligence databases". Portals for law enforcement which likely require some kind of warrant and very likely have regular audits are not slightly the same thing as directly piping the data to the intelligence community. As for "their inter-datacenter communications were being pi…

> "obviously Gmail and such are piped directly into global intelligence databases"

well, they were. without google's consent :) past tense, obviously

Re: Proton is trying to become Google without your data

#185

Post by Ansil849 »

rusk wrote: post #136
Ansil849 wrote: post #92

It's kind of disingenuous to keep touting "Swiss privacy laws" as some sort of selling point on their homepage, when shit like this happens https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre... Why's a privacy-first service logging IPs in the first place?

You always have the option of connecting to PM over tor [0] if you are concerned about this. You can also use any of the VPN services that are available. Get yourself an anonymous mulvad account, and pay with some laundered btc good luck to anyone that wants to track down your IP. [0] https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7...

> You always have the option of connecting to PM over tor [0] if you are concerned about this. You can also use any of the VPN services that are available. Get yourself an anonymous mulvad account, and pay with some laundered btc good luck to anyone that wants to track down your IP.

Yes, you could do all that. But if you're doing all that, you can also just use Gmail.

Post reply on HN