Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton is taking its privacy-first apps to a nonprofit foundation model

arstechnica.com

Post reply on HN
Print view View original

21–30 of 82 posts

Re: Proton is taking its privacy-first apps to a nonprofit foundation model

#21

Post by DowagerDave »

vzaliva wrote: post #10

The new emerging hybrid model of non-profit foundations paired with for-profit businesses is certainly interesting, as it combines some "greater good" principles with the ability to build products and run businesses in a modern competitive market. I feel it may take some time to work out the details of these models. The biggest example we've seen is OpenAI, which, in my opinion, still hasn't solved this model and is…

I agree we'll need to work out the kinks, but the big difference is it's hard to see a path towards a gazillion $$$ upside for Proton, while with OpenAI it seemed inevitable. Maybe the AI/ML space will be perfect for a hybrid organization in 30-50 years?

Re: Proton is taking its privacy-first apps to a nonprofit foundation model

#22

Post by notaustinpowers »

theultdev wrote: post #16
notaustinpowers wrote: post #14

Earlier quoted context omitted.

You're making multiple conjectures to get to that conclusion, of which the only evidence presented is another company based in a different country than Proton. It may be true, it may not be, but there needs to be more information or facts before we get to the original comments statement that Proton gives data to expose protestors to protect "the powers that be".

I'm not making conjectures, these events happened. That's the flow of how government legal requests work with no-log vpn services. What do you think "Orders complied with" means then? Here's an instance of Proton adding logging of an activist's IP Address and Device ID after a request from the French authorities: https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre... > French police sent a request to Swiss p…

If a government says "Give us everything you have on this user", and Proton gives them a sheet of paper that says "Here's the primary email for the account, we don't have access to anything else", the order is legally complied with.

Granted, I don't know much of how Swiss legal processes work, but I do know Switzerland has the best privacy laws when it comes to VPNs (which is why a lot of VPNs use Switzerland). Switzerland even has laws on their books that prevent them from compelling no-log VPNs based in Switzerland to log specific users.

Re: Proton is taking its privacy-first apps to a nonprofit foundation model

#23

Post by theultdev »

notaustinpowers wrote: post #22
theultdev wrote: post #16

Earlier quoted context omitted.

I'm not making conjectures, these events happened. That's the flow of how government legal requests work with no-log vpn services. What do you think "Orders complied with" means then? Here's an instance of Proton adding logging of an activist's IP Address and Device ID after a request from the French authorities: https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre... > French police sent a request to Swiss p…

If a government says "Give us everything you have on this user", and Proton gives them a sheet of paper that says "Here's the primary email for the account, we don't have access to anything else", the order is legally complied with. Granted, I don't know much of how Swiss legal processes work, but I do know Switzerland has the best privacy laws when it comes to VPNs (which is why a lot of VPNs use Switzerland). Switz…

I provided an instance of Proton giving the IP address and Device ID of a user after the French authorities requested it.

In their own policy:

> “In addition to the items listed in our privacy policy, in extreme criminal cases, ProtonMail may also be obligated to monitor the IP addresses which are being used to access the ProtonMail accounts which are engaged in criminal activities.”

So there's no question whether or not they do it, it's more of how often they do it and for what. The French case was a big deal because it didn't seem to meet the "extreme criminal case" threshold, and yet the logging was still carried out.

Re: Proton is taking its privacy-first apps to a nonprofit foundation model

#24

Post by WhackyIdeas »

jszymborski wrote: post #19
WhackyIdeas wrote: post #18

Earlier quoted context omitted.

Listen, if you don’t trust their ProtonDrive - GPG encrypt before uploading. If you don’t trust their email, GPG your message and paste it in or include as an attachment. There are a lot of ways to be able to use proton without trusting them… and if you are an activist of any sort, like just stop oil or cnd, then I am sure they will be doing all of that. I am not an activist so I don’t need to jump through such looph…

Cryptomator is great for the ProtonDrive example: https://cryptomator.org/

Cool idea. But, if I personally wanted that functionality I would code my own solution with a shell script I think (because it is super easy to do).

Re: Proton is taking its privacy-first apps to a nonprofit foundation model

#25

Post by freehorse »

devwastaken wrote: post #3

Reminder that Proton is not "private". They have all the keys, and willingly operate in a jurisdiction where they bend over backwards for ridiculous court orders. From their own transparency page: Number of legal orders: 6,378 Contested orders: 407 Orders complied with: 5,971 They did this to expose protestors and people who upset the powers that be, rarely real criminals. They could choose to operate in a country th…

> They did this to expose protestors and people who upset the powers that be, rarely real criminals.

Source? How exactly do you know what cases of people the legal orders were about?

Re: Proton is taking its privacy-first apps to a nonprofit foundation model

#26

Post by notaustinpowers »

theultdev wrote: post #23
notaustinpowers wrote: post #22

Earlier quoted context omitted.

If a government says "Give us everything you have on this user", and Proton gives them a sheet of paper that says "Here's the primary email for the account, we don't have access to anything else", the order is legally complied with. Granted, I don't know much of how Swiss legal processes work, but I do know Switzerland has the best privacy laws when it comes to VPNs (which is why a lot of VPNs use Switzerland). Switz…

I provided an instance of Proton giving the IP address and Device ID of a user after the French authorities requested it. In their own policy: > “In addition to the items listed in our privacy policy, in extreme criminal cases, ProtonMail may also be obligated to monitor the IP addresses which are being used to access the ProtonMail accounts which are engaged in criminal activities.” So there's no question whether or…

Yeah, that's shitty, and it's no excuse, but I understand that, as a company, Proton will still have to comply with Swiss law, and if Swiss law requires IP Address monitoring in "extreme criminal cases" which I doubt Proton has the ability to decide whether it fits that or not.

I saw in the article that Proton also offers an onion address, which will make the IP Address monitoring useless anyway. So they, legally, have to do the monitoring, but provide a tool that makes their "monitoring" useless.

Re: Proton is taking its privacy-first apps to a nonprofit foundation model

#27

Post by ni10c »

theultdev wrote: post #23
notaustinpowers wrote: post #22

Earlier quoted context omitted.

If a government says "Give us everything you have on this user", and Proton gives them a sheet of paper that says "Here's the primary email for the account, we don't have access to anything else", the order is legally complied with. Granted, I don't know much of how Swiss legal processes work, but I do know Switzerland has the best privacy laws when it comes to VPNs (which is why a lot of VPNs use Switzerland). Switz…

I provided an instance of Proton giving the IP address and Device ID of a user after the French authorities requested it. In their own policy: > “In addition to the items listed in our privacy policy, in extreme criminal cases, ProtonMail may also be obligated to monitor the IP addresses which are being used to access the ProtonMail accounts which are engaged in criminal activities.” So there's no question whether or…

Feels to me after reading the article they earnestly try to do their best to offer privacy enhancing alternatives and push back often. What percent of these requests do Meta, Google or Microsoft fight? Ratios like that matter

Proton is extremely transparent and said:

If you are breaking Swiss law, ProtonMail can be legally compelled to log your IP address as part of a Swiss criminal investigation. This obligation however does not extend to ProtonVPN (see VPN privacy policy here). Additional details can be found in our transparency report.

Re: Proton is taking its privacy-first apps to a nonprofit foundation model

#28

Post by PhilippGille »

vzaliva wrote: post #10

The new emerging hybrid model of non-profit foundations paired with for-profit businesses is certainly interesting, as it combines some "greater good" principles with the ability to build products and run businesses in a modern competitive market. I feel it may take some time to work out the details of these models. The biggest example we've seen is OpenAI, which, in my opinion, still hasn't solved this model and is…

> it combines some "greater good" principles with the ability to build products and run businesses in a modern competitive market

There's also the PBC (Public Benefit Corporation), which in addition to profit / shareholder value explicitly defines positive impact on society as a goal, and exists since 2010 in some states, while in others only since 2022 [1]. But as far as I understand there are no legal requirements or audits that ensure those goals are followed.

Kagi (the search engine, popular in the HN community and I'm a happy customer myself) is one example of a PBC [2].

[1] https://en.wikipedia.org/wiki/Benefit_corporation

[2] https://blog.kagi.com/what-is-next-for-kagi#4

Re: Proton is taking its privacy-first apps to a nonprofit foundation model

#29

Post by theultdev »

ni10c wrote: post #27
theultdev wrote: post #23

Earlier quoted context omitted.

I provided an instance of Proton giving the IP address and Device ID of a user after the French authorities requested it. In their own policy: > “In addition to the items listed in our privacy policy, in extreme criminal cases, ProtonMail may also be obligated to monitor the IP addresses which are being used to access the ProtonMail accounts which are engaged in criminal activities.” So there's no question whether or…

Feels to me after reading the article they earnestly try to do their best to offer privacy enhancing alternatives and push back often. What percent of these requests do Meta, Google or Microsoft fight? Ratios like that matter Proton is extremely transparent and said: If you are breaking Swiss law, ProtonMail can be legally compelled to log your IP address as part of a Swiss criminal investigation. This obligation how…

> What percent of these requests do Meta, Google or Microsoft fight? Ratios like that matter

What others are doing doesn't matter, that's whataboutism. Yes there's many shittier services, and Proton is much better than them.

What matters is if you can trust Proton to be private, and the answer is... mostly.

Yes I like Proton and I use Proton as my daily email driver, because I don't expect privacy from governments, I just don't want Google tracking.

But a lot of people see the "no logs" thing and think that there's never any logs, which is not true, they add them on request, and they've done it based on foreign government requests, for questionable searches, as I've linked above.

If you want privacy in your hands, use Tor when accessing Proton and pay in crypto obviously.

Those are techniques needed for privacy because they can access that data and you can't trust them to safeguard any data they can access because they legally can't.

It's not their fault, it's just the system, but you must expect it.

Re: Proton is taking its privacy-first apps to a nonprofit foundation model

#30

Post by devwastaken »

drpossum wrote: post #5
devwastaken wrote: post #3

Reminder that Proton is not "private". They have all the keys, and willingly operate in a jurisdiction where they bend over backwards for ridiculous court orders. From their own transparency page: Number of legal orders: 6,378 Contested orders: 407 Orders complied with: 5,971 They did this to expose protestors and people who upset the powers that be, rarely real criminals. They could choose to operate in a country th…

You should back up your claim of "they have all the keys", because for things like email and file contents they claim they cannot decrypt them because they do not have those keys (which you have said they do). I believe it was stated on the page you copied those stats from https://proton.me/legal/transparency > As stated in our Privacy Policy, all emails, files and invites are encrypted and we have no means to decryp…

Proton has the burden of proof, and has continually failed to ensure their systems are E2E. They have failed to develop better tech like signal, and continue to change their infrastructure to appease swiss orders that come from other countries.

They have every means to decrypt, they control both the client software, server, and data. You would never know if they logged your key, and they can be compelled to by flimsy order.

Post reply on HN