[dead]
Proton Mail discloses user data leading to arrest in Spain
191–200 of 283 posts
Re: Proton Mail discloses user data leading to arrest in Spain
#192It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…
Yes, if your information is stored with a third-party, it can be subject to disclosure with a lawful subpoena.
Re: Proton Mail discloses user data leading to arrest in Spain
#193It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…
> It is up to the user And therein lies the problem. We on HN may have a few ideas about how to do this, but the typical user of a secure email/VPN/tor unfortunately doesn’t and realistically can’t understand the corner cases and tricks. Realistically, even HN users would make enough mistakes. This is why I’m dubious of these types of products marketing to average consumers
If your threat model is "utilize secure email/VPN/tor to evade organizations on the spectrum of [law enforcement...intelligence services]" you are not a typical user even of those services and saying that it's on you to understand all the corner cases and tricks to avoid persecution, prosecution, execution, etc. seems pretty reasonable.
Re: Proton Mail discloses user data leading to arrest in Spain
#194Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address. In this case the email address was the lead, but I wonder what other info would be enough to get the phone provider to spill the beans. For instance would an IP address used at a specific time be uniquely identifying if it was…
> Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address. Irrelevant to the point. Proton Mail provided authorities with user data.
Please quote from the linked article where it says that (it doesn't).
Re: Proton Mail discloses user data leading to arrest in Spain
#195> This individual is suspected of being a member of the Mossos d’Esquadra (Catalonia’s police force) and of using their internal knowledge to assist the Democratic Tsunami movement. ...and... > The requests were made under the guise of anti-terrorism laws, despite the primary activities of the Democratic Tsunami involving protests and roadblocks, which raises questions about the proportionality and justification of s…
They did extreme protests like road blockages, and some other stuff which the government considered sabotage and so pursued them with anti-terrorist legislation.
Also some members were arrested apparently planning even more extreme things.
The IRA and ETA were vying for independence too...
That said, I think it's crazy how much time the government wastes on this when the cities are full of petty criminals acting with impunity. Someone was stabbed to death outside my apartment just in a robbery and yet nothing changes.
Re: Proton Mail discloses user data leading to arrest in Spain
#196It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…
>I suppose the second learning is to elect governments which respect democratic freedoms,
This will _never_ happen. It's the human condition....
Re: Proton Mail discloses user data leading to arrest in Spain
#197Earlier quoted context omitted.
In this case an activist in the oppressive regime of...Spain?! Opsec is hard and most activists in western countries don't take it seriously. It's not like we live in PRC or DPRK right? Ironically, it is likely far harder for PRC or DPRK to get data from Proton than it is for Spanish police.
Well Spain probably never got over the Franco legacy. https://www.wired.com/story/europe-break-encryption-leaked-d... “Ideally, in our view, it would be desirable to legislatively prevent EU-based service providers from implementing end-to-end encryption,” Spanish representatives said in the document.
Spain had to deal with homegrown terrorism not that long ago. Not excusing them, but it should be pointed out for more context.
Re: Proton Mail discloses user data leading to arrest in Spain
#198Earlier quoted context omitted.
Seconded, happy Proton customer for years since de-Googling my life. Par for the course at HN to have a "vaguely dislike-ish" relationship with Protonmail. Fastmail is the poster child of HN on the other hand. I would guess the gist of it is that if you promise _any_ amount of security (or whatever feature), HN will nitpick you to death on not going 100% (despite the general improvement to your security). If you don'…
It's normal. Dropbox was derided on HN because it wasn't much more than a glorified FTP.
I've just been poking around at the Dropbox APIs recently when I got so frustrated by the fact that the Fastmail "attach from Dropbox" feature has been loading directly into my personal files space rather than showing the shared team folders since we switched over to using those last year - and I now have to download and re-upload files from those folders.
It's more than a glorified FTP. FTP does some heinous things with a separate control channel and stuff (let me tell you about adding encryption support to the Perl FTP server some other day), but this is next level!
https://developers.dropbox.com/dbx-team-files-guide
It's not even as simple as just sending a fixed string in the "Dropbox-API-Path-Root" header for every API request (and they're all path based, so you have to make sure you always send that header or the paths won't parse right) - you have to get an ID for the real root, with a separate request, with a scope that we weren't requesting on refresh tokens.
So I hacked together something that worked on my testbed on the train ride home, but making it good is going to include adding a caching layer to the token refresh code, and suddenly it's not just a casual project. I'm still going to do it though, because dammit I have a file to attach to an email on Friday and I'm happy to spend hours on this to save myself 30 seconds.
Re: Proton Mail discloses user data leading to arrest in Spain
#199Earlier quoted context omitted.
Not really. Tor, I2P, and Monero manage this just fine. Building on these technologies should allow one to have privacy and anonymity without any exotic quantum technology.
Well they don't actually, Tor especially has enormous amounts of government nodes so they can trace and log exactly what and who. And all of those still rely on the IP network which always will allow logging without you ever knowing, it's just math really, the proof of not-logged is just impossible.
Interesting, do you have a source? All fully p2p networks are vulnerable to sybil attacks to some extent, but specifically a source that Tor actively has enough "government nodes" to de-anonymize everything.
Re: Proton Mail discloses user data leading to arrest in Spain
#200Quite interesting how the Spanish authorities got the recovery email: (from a link in the article)
> In the police cooperation form requesting the information, the Spanish officers indicate to the Swiss authorities that the investigation is for the crime of terrorism.