Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail suspended journalist accounts at request of cybersecurity agency

theintercept.com

Post reply on HN
Print view View original

191–200 of 217 posts

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#191

Post by gond »

johnklos wrote: post #80

The true value of a company can be measured by our ability to communicate with them. If we can't communicate except after public outrage, then what does that say about the company? Here's a genuine question: is Proton Mail the least shitty of companies that provide email services? I self-host email and will continue until I die. But for others who need a company to do this for them, is Proton Mail the least shitty of…

I self hosted for 20 years, worked flawlessly, gave up because of security concerns. I would like to go back to it.

Question: How do you manage the security on such a box? Is there any simplification I missed?

I couldn’t keep up with it. So many patches, unrelated to mail, broke something in the stack, bringing the server into a critical state. Often, I had to lock down everything before going up again, consuming a day’s effort or two. These were two days without mail.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#192

Post by nsagent »

esseph wrote: post #137
nsagent wrote: post #103

Earlier quoted context omitted.

The person I was responding to literally said they were "a paying user for a very long time" and "never encountered a bug". No software is bug free. I can't think of a single software service I've used for as long as Proton (7 years now) where I haven't encountered a single issue over that time. I take their statement to be so incredibly unlikely as to be facetious or intentionally duplicitous. So I responded in kind…

Idk what to tell you. Email is mostly a solved problem for most cases, and object storage is mostly the same. Password manager is one of the best I've found in any platform, at least for the individual-user use case. The VPN has always just worked, too. If you're using desktop apps for things, really can't help you there as I have no experience with any proton offerings for that piece.

  Idk what to tell you. Email is mostly a solved problem for most cases
Idk what to tell you. Considering email is mostly a solved problem, Proton must be extra incompetent for inadvertently deleting people's emails due to multiple different bugs in their code that took them far too long to address (multiple years in some cases).

https://old.reddit.com/r/ProtonMail/comments/t8vwhf/deleting... https://news.ycombinator.com/item?id=33432296 https://old.reddit.com/r/ProtonMail/comments/yjz3yu/proton_b... https://old.reddit.com/r/ProtonMail/comments/1j79x7j/has_the...

(The temerity of the customer service response on that last one, saying they have no clue about the bug being asked about is galling, but par for the course for them).

BTW, make flippant responses, get responses in kind. Normally I'd ignore this idiocy, but today was your lucky day. Anyway, it's clear you're just a troll and I've indulged you enough.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#193

Post by illiac786 »

chatmasta wrote: post #73

Proton dropped from the top spot on my list of “user-first email platforms” when they announced they’ll be deleting accounts that haven’t logged into their service in some arbitrary amount of time. If I can’t rely on my email / messaging / phone / communications provider to keep an open line for as long as I need it – whether that’s one year or two years or twenty years, then I’m not going to use it. And if they requ…

Who is at the top spot now?

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#194

Post by illiac786 »

neobrain wrote: post #141
chatmasta wrote: post #73

Proton dropped from the top spot on my list of “user-first email platforms” when they announced they’ll be deleting accounts that haven’t logged into their service in some arbitrary amount of time. If I can’t rely on my email / messaging / phone / communications provider to keep an open line for as long as I need it – whether that’s one year or two years or twenty years, then I’m not going to use it. And if they requ…

> Proton dropped from the top spot on my list of “user-first email platforms” when they announced they’ll be deleting accounts that haven’t logged into their service in some arbitrary amount of time. ... for free accounts only, after 12-24 months of not having logged in at all. > And if they require payment in exchange for providing that service, then it better accept privacy-preserving payment, but even then, I’m pr…

Agree. A lot of outrage for little research.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#195

Post by 93po »

BoredPositron wrote: post #171
93po wrote: post #169

Earlier quoted context omitted.

they didnt do it because CERT said they legally had to - they did it presumably because they pay CERT to catch abuse and misuse and take action based on their findings

This doesn't change my statement, even if they take the word of the CERTs as gospel. This represents a significant attack vector for denial-of-service attacks, as demonstrated by what happened here, and for a service like Proton, such a vulnerability is nearly inexcusable.

What's the attack vector? I'm genuinely curious, I'm not seeing it. My understanding that I'm too lazy to investigate further is that the use of this account by a journalist got caught up in a block of accounts because the nature of its legitimate activities too closely mimicked the behavior used by illegitimate accounts. No one can force a journalist's account to take actions if they don't have the credentials of the account.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#197

Post by BoredPositron »

93po wrote: post #195
BoredPositron wrote: post #171

Earlier quoted context omitted.

This doesn't change my statement, even if they take the word of the CERTs as gospel. This represents a significant attack vector for denial-of-service attacks, as demonstrated by what happened here, and for a service like Proton, such a vulnerability is nearly inexcusable.

What's the attack vector? I'm genuinely curious, I'm not seeing it. My understanding that I'm too lazy to investigate further is that the use of this account by a journalist got caught up in a block of accounts because the nature of its legitimate activities too closely mimicked the behavior used by illegitimate accounts. No one can force a journalist's account to take actions if they don't have the credentials of th…

Automated Trust Chain. According to their official statement, the accounts were reinstated following individual review. The vector is that legitimate accounts that don't break the ToS get dumped in a big set of accounts that actually do. A classic case of automated systems being gamed to trigger false positives. The vague statement about other accounts from the same set that couldn't be restored while not explicitly naming that these accounts were also phrack accounts makes the case even stronger. It was a denial-of-service and they blatantly didn't care until social media outrage hit them. I am not even blaming the CERT here maybe they were real false positives on their side. It's on Proton. They need to verify before taking actions against their own customers.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#198

Post by RandomBacon »

crossroadsguy wrote: post #123
nsagent wrote: post #18

I've need a paying subscriber to Proton since 2018, but I recently canceled my subscription (which ends in November). I just got fed up with the constant bugginess and jankiness of their offerings. Any suggestions for mail hosting and VPN? I hear good things about Fastmail and mailbox.org (I see they very recently rebranded to just mailbox and revamped their offering). Also, I've been a heavy user of the SimpleLogin…

I am a Fastmail customer. Absolutely horrible customer support but pretty solid email. Do not even think about using the "suit" they offer alongside email. The rebranding and "revamp" is limited to the logo and colour changes :D everything under the hood is still the same good old OX inferiority. Hell, you may never want to use their webmail either (my 99.9999% mail usage is via IMAP clients). They are fine other tha…

Interesting. I've used their customer service a couple of times, and it's been okay for me. What was horrible that you experienced?

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#199

Post by RandomBacon »

crossroadsguy wrote: post #107
immibis wrote: post #78

Earlier quoted context omitted.

Their controls are buffed up: all of those accounts are linked due to having been created with the same IP address. If one is blocked, they all are. If you try to circumvent this with a well-known proxy (such as Tor or a V"P""N") you will find that captcha activation will not exist as an option.

That definitely doesn't look good for privacy POV. If they do not want abuse, they ought to use other means. They should not associate IPs with account creation. That is kind of scary. In fact, if what you have said is true, then one's account can be blocked by someone else's mischief on the same IP, which is not very uncommon at all i.e sharing the IP.

Proton is not a true privacy-advocate in my opinion.

I wanted to try Proton out when they were having a sale, but I could not complete the purchase because I was on Mullvad's VPN.

I created a ticket, and when they got back to me 5 days later, they told me to disconnect from the VPN to sign up for Proton.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#200

Post by RandomBacon »

nerpderp82 wrote: post #88
overfeed wrote: post #81

Earlier quoted context omitted.

I'll go out on a limb and say it: it's an American cybersecurity agency. Proton's CEO/Proton[1] loves the current US admin. I wouldn't be surprised if they comply now and ask questions later, if at all. 1. According to the now-deleted Reddit comment from the official Proton account glazing Republicans, so I assume they were speaking on behalf of all of Proton. https://theintercept.com/2025/01/28/proton-mail-andy-yen-…

Proton is a honey watering hole pot. This has always been clear.

Makes sense to me.

I wanted to try Proton out when they were having a sale, but I could not complete the purchase because I was on Mullvad's VPN.

I created a ticket, and when they got back to me 5 days later, they told me to disconnect from the VPN to sign up for Proton.

Post reply on HN