Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail suspended journalist accounts at request of cybersecurity agency

theintercept.com

Post reply on HN
Print view View original

21–30 of 217 posts

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#21

Post by a0123 »

fivefives55555 wrote: post #9

I've been following this on X/Twitter and I think one of the most egregious things that's important to point out is that folks from Phrack reached out to Proton in private multiple times, and Proton ghosted them. Proton only engaged with them and then reinstated the accounts after Phrack went public and their X/Twitter post went viral. It also looks like one of the writers filed an appeal with Proton and Proton denie…

Which the reddit fanatics on their sub are bending over backwards to defend and explain away when there is no two ways about it tbh.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#22

Post by j-bos »

Sunspark wrote: post #10
guywithahat wrote: post #7

Earlier quoted context omitted.

You can disable an account without knowing who owns it, although they do have credit card/payment information now, and I don't think new accounts get encryption services unless they pay. That said, if your inbox is encrypted, protonmail does so on the client side with a second password. They can maybe delete the account, but proton mail doesn't know what the encrypted data is. What happens to new emails sent to a dis…

You are trusting them. They control the client, how the keys are created/stored, etc. Javascript, etc. If they were to suddenly turn one day, they could. This is the weakness of cloud services.

Trusting them is almost guaranteed, but it doesn't have to be, sort of. The clients are opensource so you literally clone, audit, and run the clients locally.

Full disclosure, I use Proton and overall trust them so unless I see strong evidence of abuse or lies on their part I'm inclined to post contextualizing comments on stuff like this, b/c well I don't wanna host my own mail server, at least not in prod.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#23

Post by nsagent »

j-bos wrote: post #17
fivefives55555 wrote: post #9

I've been following this on X/Twitter and I think one of the most egregious things that's important to point out is that folks from Phrack reached out to Proton in private multiple times, and Proton ghosted them. Proton only engaged with them and then reinstated the accounts after Phrack went public and their X/Twitter post went viral. It also looks like one of the writers filed an appeal with Proton and Proton denie…

> Phrack reached out to Proton in private multiple times, and Proton ghosted them. According to Proton's response in the linked reddit post: https://news.ycombinator.com/item?id=45227356 They say: "Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the si…

To be honest, I've found Proton's public customer service representatives to be very duplicitous, so it's hard to take their word at face value. It's pretty ridiculous to see their response to legitimate concerns start with: "That doesn't sound right..." 80-90% of the time.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#24

Post by autoexec »

gruez wrote: post #4

Can proton even win here? The obvious solution would be "we don't take down unless there's a court order", but then you'd get exposé pieces saying how protonmail is a den for drug dealers/pedophiles/doxxers/cyber criminals.

> The obvious solution would be "we don't take down unless there's a court order", but then you'd get exposé pieces saying how protonmail is a den for drug dealers/pedophiles/doxxers/cyber criminals

I think it'd be crazy to make a service worse because of worry over potential hit pieces that might whine about a perfectly reasonable policy. It isn't as if Proton Mail hasn't been accused of those things before anyway (along with accusations of being a honeypot and not private enough).

It's better to have integrity and fight for your users than to cave just to avoid click bait articles by people with irrational views.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#25

Post by j-bos »

HeatrayEnjoyer wrote: post #20
Sunspark wrote: post #10

Earlier quoted context omitted.

You are trusting them. They control the client, how the keys are created/stored, etc. Javascript, etc. If they were to suddenly turn one day, they could. This is the weakness of cloud services.

Or just use an open source email client. I would expect their own apps to be open source, are they not?

Indeed they are: https://github.com/ProtonMail

If you, or someone else, like please audit the repos. Could be cool to see trusted forks of some of the clients.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#26

Post by commmentator »

j-bos wrote: post #17
fivefives55555 wrote: post #9

I've been following this on X/Twitter and I think one of the most egregious things that's important to point out is that folks from Phrack reached out to Proton in private multiple times, and Proton ghosted them. Proton only engaged with them and then reinstated the accounts after Phrack went public and their X/Twitter post went viral. It also looks like one of the writers filed an appeal with Proton and Proton denie…

> Phrack reached out to Proton in private multiple times, and Proton ghosted them. According to Proton's response in the linked reddit post: https://news.ycombinator.com/item?id=45227356 They say: "Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the si…

You'll note that Proton's PR only mentions the second date - " last one on Sep 6 with a 48-hour deadline."

Proton doesn't mention that the first email from Phrack which Proton ignored was weeks prior to that, which is what led to the second email in the first place.

You'll also note that Proton doesn't mention that their Abuse Team refused to re-anable the account after the article author did the appeals process, as per Phrack's timeline at the top of their article.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#27

Post by a0123 »

j-bos wrote: post #17
fivefives55555 wrote: post #9

I've been following this on X/Twitter and I think one of the most egregious things that's important to point out is that folks from Phrack reached out to Proton in private multiple times, and Proton ghosted them. Proton only engaged with them and then reinstated the accounts after Phrack went public and their X/Twitter post went viral. It also looks like one of the writers filed an appeal with Proton and Proton denie…

> Phrack reached out to Proton in private multiple times, and Proton ghosted them. According to Proton's response in the linked reddit post: https://news.ycombinator.com/item?id=45227356 They say: "Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the si…

Sorry but doubt.

The whole "we have only received two emails" is a classic move of every company caught with their pants down. Considering Proton's history, they don't get the benefit of the doubt on this one.

As for the "company size excuse" sorry but considering the business you claim to be in (the private and secure email), having an on-call skeleton crew legal team available over the weekend for urgent requests is a bare minimum (and I'm pretty sure they have people available to hand over everything the cops request if "the proper process is followed").

Remember that they have turned over information in less than 24 hours before (for what they call an extreme case of course). So the "size" excuse doesn't hold. Doesn't matter how urgent it is, if they are the small bean they claim they are, there is no chance they can have a turnaround of less than 24 hours.

Again, it's not what they did that's the biggest issue, it's the coverup. Just like last time they got in hot water. Because the coverup raises a lot more questions.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#28

Post by j-bos »

commmentator wrote: post #26
j-bos wrote: post #17

Earlier quoted context omitted.

> Phrack reached out to Proton in private multiple times, and Proton ghosted them. According to Proton's response in the linked reddit post: https://news.ycombinator.com/item?id=45227356 They say: "Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the si…

You'll note that Proton's PR only mentions the second date - " last one on Sep 6 with a 48-hour deadline." Proton doesn't mention that the first email from Phrack which Proton ignored was weeks prior to that, which is what led to the second email in the first place. You'll also note that Proton doesn't mention that their Abuse Team refused to re-anable the account after the article author did the appeals process, as…

That's a great point. I guess at this point it'd be ideal for them to treat this an incident and do a proper postmortem with timelines and decision calculus.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#29

Post by rvnx »

It is very naive to believe that email providers and VPNs do not have to respect the laws.

If this would be the case they would not be approved by any payment providers at all.

On top of that, add the possibility that hosting companies and upstream network peers would shut them down.

Re: Proton Mail suspended journalist accounts at request of cybersecurity agency

#30

Post by luqtas »

daft_pink wrote: post #2

You either die a hero, or you live long enough to see yourself become the villain.

not all heroes wear capes, much less releases personal AI assistant to navigate your own data while the MAIL CLIENT AND CALENDAR APP is on beta on Linux for YEARS
Post reply on HN