Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail discloses user data leading to arrest in Spain

restoreprivacy.com

Post reply on HN
Print view View original

181–190 of 283 posts

Re: Proton Mail discloses user data leading to arrest in Spain

#181

Post by TheCoelacanth »

fbdab103 wrote: post #10
lordofgibbons wrote: post #8

The heart of the issue is this: > Under Swiss law, Proton Mail was compelled to collect and provide information on the individual’s IP address to Swiss authorities, who then shared it with French police. They can claim all the privacy guarantees they want, but unless the privacy is guaranteed by cryptography, it's an empty gesture. Nobody is willing to do prison time to protect your privacy.

I think they should do like Mullvad claims and keep zero logs. You cannot share what you do not have.

How would a recovery email feature be possible without them knowing what your recovery email is?

Re: Proton Mail discloses user data leading to arrest in Spain

#183

Post by wepple »

quitit wrote: post #159

It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…

> It is up to the user

And therein lies the problem. We on HN may have a few ideas about how to do this, but the typical user of a secure email/VPN/tor unfortunately doesn’t and realistically can’t understand the corner cases and tricks.

Realistically, even HN users would make enough mistakes.

This is why I’m dubious of these types of products marketing to average consumers

Re: Proton Mail discloses user data leading to arrest in Spain

#184

Post by wepple »

blitzar wrote: post #170
nabla9 wrote: post #152

Proton Mail gives info only when the Swiss law mandates it and Swiss law enforcement requires it. Swiss privacy laws are quite good. That's the strictest privacy policy any company can hope. Proton Mail can't give email content, only things like email address, ip adressese etc.

Proton Mail can give email content, however, it is encrypted and they do not have the encryption keys. Anything that is stored by anyone can be handed over. That information may be useful, may be useless or may be useless now and useful tomorrow when they have the key.

> they do not have the encryption keys.

True, but they can trivially obtain them given they control everything in the browser.

The question then becomes, does the law allow compelling to that degree? Apple fought back in the San Bruno case, but they’re very well lawyered up

Re: Proton Mail discloses user data leading to arrest in Spain

#185

Post by blacklion »

mogiddy55 wrote: post #180
oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

Buying used phones and laptops with cash at a bazaar whilst wearing a wig, one at a time. You got a few days of Tor on each device; then they need to burn. I really don't know what more you can do beyond making your own chat client. Internet is not a place for revolution.

With all "security" cameras and face recognition software and big data mining, which links many sources together, real world in developed world is not a place for revolution too.

Welcome do dystopia and hope that governments in developed world will not become too nasty (CCP-level nasty) too soon due to inertia.

Re: Proton Mail discloses user data leading to arrest in Spain

#186

Post by wepple »

When thinking about these types of cases, always keep Parallel Construction in mind: https://en.m.wikipedia.org/wiki/Parallel_construction

There’s a reasonable chance that they already had this info (possibly even cleartext email via an ISP lawful intercept), and the proton/apple jig whilst bad, wasn’t as bad as the real source

Re: Proton Mail discloses user data leading to arrest in Spain

#187

Post by fifteen1506 »

I never thought of ProtonMail as a secure-from-state-surveillance provider. Only as a secure-from-civil-surveillance-aparatus provider. A replacement for Gmail, no more than that.

If I wanted to conduct illegal activities I would not use my main account on it, at minimum.

Protonmail is a step up from Gmail/Outlook, but no more than that. You need more layers on top of it.

Re: Proton Mail discloses user data leading to arrest in Spain

#188

Post by fifteen1506 »

sevagh wrote: post #163
Shacklz wrote: post #157

There are some serious anti-proton-vibes in this thread, so just my 2 cents as a paying customer: I'm rather happy with their service. I pay them money, they make sure that Joe in Marketing won't be able to harvest data from my emails. I'm also fairly optimistic that they take security serious enough that the blast radius of some dataleak is hopefully very limited. I have zero delusions however that they can protect…

Seconded, happy Proton customer for years since de-Googling my life. Par for the course at HN to have a "vaguely dislike-ish" relationship with Protonmail. Fastmail is the poster child of HN on the other hand. I would guess the gist of it is that if you promise _any_ amount of security (or whatever feature), HN will nitpick you to death on not going 100% (despite the general improvement to your security). If you don'…

It's normal. Dropbox was derided on HN because it wasn't much more than a glorified FTP.

Re: Proton Mail discloses user data leading to arrest in Spain

#189

Post by protonmail »

BodyCulture wrote: post #172
haakon wrote: post #111

Earlier quoted context omitted.

They were legally compelled to add IP logging for that specific user. After this incidence, they went on to obtain a court ruling in Switzerland, where they operate, so that this specific attack cannot happen again. In their blog post about it [1], they instruct concerned users to access their account over Tor. Of course when Proton say they don't log, we just have to take their word for it. People who don't want tha…

Is it possible now to sign up using TOR? It didn’t work a few years ago when I tried and never visited this website ever again.

We've worked on improving it in the meantime, so we recommend that you try again. If you come across any issues, please contact our support team at: https://proton.me/support/troubleshooting?product=account

Re: Proton Mail discloses user data leading to arrest in Spain

#190

Post by toolz »

0xEF wrote: post #133
Klonoar wrote: post #118

Earlier quoted context omitted.

Their breakdown is what’s parroted up and down comment chains on this site when it comes to privacy/anonymity, so I’m frankly not sure how you’ve missed it over the years.

That, and the terms themselves tend to invoke clues about the meaning. Privacy implies there is an identity, but it is kept hidden. Anonymity implies there is no identity established so there is nothing to hide. We don't see much of the latter since most web services require an email to sign up, at minimum, which still leaves discoverable bread crumbs. The web services that require you to give up nothing to use them…

I'm not sure where you're drawing your implications from, but that is not implied, to me. I frequently see the concept of privacy applied to situations where an entity isn't required to ID themselves for the sake of privacy.

The common description when contrasting anonymity vs privacy is that anonymity allows one to do things publicly without being ID'd while privacy allows one to do things without the public having knowledge. There is no implication or requirement that the private party has been ID'd by another other entity.

Post reply on HN