Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail discloses user data leading to arrest in Spain

restoreprivacy.com

Post reply on HN
Print view View original

201–210 of 283 posts

Re: Proton Mail discloses user data leading to arrest in Spain

#201

Post by tephra »

RachelF wrote: post #68
makeitdouble wrote: post #11

Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address. In this case the email address was the lead, but I wonder what other info would be enough to get the phone provider to spill the beans. For instance would an IP address used at a specific time be uniquely identifying if it was…

Why are ProtonMail keeping this IP and email information in their logs?

They say quite clearly why in their privacy policy: https://proton.me/legal/privacy (section 2.5: IP Logging).

> 2.5 IP logging: By default, we do not keep permanent IP logs in relation with your Account. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions (e.g. spamming, DDoS attacks against our infrastructure, brute force attacks). The legal basis of this processing is our legitimate interest to protect our service against nefarious activities. If you enable authentication logging for your Account or voluntarily participate in Proton's advanced security program, the record of your login IP addresses is kept for as long as the feature is enabled. This feature is off by default, and all the records are deleted upon deactivation of the feature. The legal basis of this processing is consent, and you are free to opt in or opt out of that processing at any time in the security panel of your Account. The authentication logs feature records login attempts to your Account and does not track product-specific activity, such as VPN activity.

Re: Proton Mail discloses user data leading to arrest in Spain

#202

Post by SomeoneFromCA »

red_admiral wrote: post #162
lolinder wrote: post #9

> Use a good VPN service to hide your IP address whenever possible. (Failure to do this is what compromised a Proton Mail user in France who was arrested after after police obtained IP logs.) If your VPN is tied to a payment method then all you've done is give police one extra hop to follow to get at you, which wouldn't have saved this activist. Their list of VPNs only includes Mullvad in position 9 of 10, but as far…

If you're doing low-bandwidth stuff like sending e-mails, TOR (which is of course free) should be your first choice. But you have to absolutely "air-gap" that from the rest of your identity, such as not making a proton e-mail address over TOR and then using your usual email address as the recovery one.

nah tor is not trustworthy, as it also exposes you as a tor user; in a less developed countries, where not many people know how to use Tor, you'll stick out real bad. It is much better to use shady random proxy servers you'll find online, before connecting to Tor; it is extremely slow, but much safer, as the authoritarian state monitors won't be able to see that subpoenaed ip adresses come from tor exit nodes, conveniently at the same time period you (and basically no one else) were using Tor.

Re: Proton Mail discloses user data leading to arrest in Spain

#203

Post by nerdjon »

quitit wrote: post #159

It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…

I would argue that the second learning is to make it impossible to comply with these subpoenas where possible by making it so the company itself is unable to decrypt it.

Admittedly this is not really an easy solution with something as open as emails, it's possible within corporations but I don't know of a solution between "random" people.

But outside of email and things that have to be unencrypted for interoperability, everything should be encrypted and inaccessible to the company so this situation is impossible.

I think the ship has sailed on the idea of electing people who will actually care about privacy of their citizens.

Re: Proton Mail discloses user data leading to arrest in Spain

#204

Post by thinkerswell »

protonmail wrote: post #189
BodyCulture wrote: post #172

Earlier quoted context omitted.

Is it possible now to sign up using TOR? It didn’t work a few years ago when I tried and never visited this website ever again.

We've worked on improving it in the meantime, so we recommend that you try again. If you come across any issues, please contact our support team at: https://proton.me/support/troubleshooting?product=account

Yes please report back if it works

Re: Proton Mail discloses user data leading to arrest in Spain

#205

Post by wolfhumble »

felsokning wrote: post #135

> This individual is suspected of being a member of the Mossos d’Esquadra (Catalonia’s police force) and of using their internal knowledge to assist the Democratic Tsunami movement. ...and... > The requests were made under the guise of anti-terrorism laws, despite the primary activities of the Democratic Tsunami involving protests and roadblocks, which raises questions about the proportionality and justification of s…

The Democratic Tsunami was/is(?) more of a pure action based protest group lead by an anonymous leader structure. The leaders were/are probably certain leader figures within the independence seeking community; but that is just a speculation on my part.

Its biggest action was probably at the Barcelona Airport in October 2019, a protest a couple of years after the Catalan independence election in October 2017. The election itself was deemed unconstitutional by the Spanish government. The registered voters/turnout of this election was 43.03%; where 92.01% voted for separation from Spain and 7.99% voted to stay within Spain –– see: https://en.wikipedia.org/wiki/2017_Catalan_independence_refe... –– but this was not a normal election by any means (read the link for more).

Typically the ANC –– see: https://en.wikipedia.org/wiki/Assemblea_Nacional_Catalana –– has been the leading organization in the independence movement. They have been organizing big independence rallies etc. and the actions has been peaceful (from what I've read and seen). The Democratic Tsunami based protests were different in this regard, where more direct confrontation was more the norm. From what I have read Democratic Tsunami is not particularly active at the moment, but of course this might change.

Re: Proton Mail discloses user data leading to arrest in Spain

#206

Post by moosemess »

It is 2024 and there are still people who cling to the idea there can be privacy with email, so much so they are willing to be parted with their money for the "privilege". I really cannot imagine a more diametrically opposed schism in privacy threat modeling.

Re: Proton Mail discloses user data leading to arrest in Spain

#207

Post by moosemess »

IAmGraydon wrote: post #19

Go try to create a ProtonMail account with Tor. It will ask you to confirm your account with a phone number. It skips this if you’re using a non-proxy IP. They want to know who you are, and it’s been this way for years. I think they’ve long been a honeypot.

No shit. People actually do not apprend intelligence agencies have the capability, desire and resources to operate legitimate "privacy" services. Why not just roll out the red carpet and let all the sus people walk in?

Re: Proton Mail discloses user data leading to arrest in Spain

#208

Post by kobalsky »

wepple wrote: post #184
blitzar wrote: post #170

Earlier quoted context omitted.

Proton Mail can give email content, however, it is encrypted and they do not have the encryption keys. Anything that is stored by anyone can be handed over. That information may be useful, may be useless or may be useless now and useful tomorrow when they have the key.

> they do not have the encryption keys. True, but they can trivially obtain them given they control everything in the browser. The question then becomes, does the law allow compelling to that degree? Apple fought back in the San Bruno case, but they’re very well lawyered up

> True, but they can trivially obtain them given they control everything in the browser.

Open source clients that you can self-host are available. I mean of course you still have to trust the code if you can't audit it. But hijacking your keys won't be as easy as visiting their webmail.

Re: Proton Mail discloses user data leading to arrest in Spain

#209

Post by ThrowawayTestr »

ApolloFortyNine wrote: post #30
lolinder wrote: post #9

> Use a good VPN service to hide your IP address whenever possible. (Failure to do this is what compromised a Proton Mail user in France who was arrested after after police obtained IP logs.) If your VPN is tied to a payment method then all you've done is give police one extra hop to follow to get at you, which wouldn't have saved this activist. Their list of VPNs only includes Mullvad in position 9 of 10, but as far…

Only if the vpn provider had logs. Most claim they don't, PIA even was subpoenad at least once and responded they don't have logs.

Keep in mind that was years and at least one owner ago.

Re: Proton Mail discloses user data leading to arrest in Spain

#210

Post by wepple »

pc86 wrote: post #193
wepple wrote: post #183

Earlier quoted context omitted.

> It is up to the user And therein lies the problem. We on HN may have a few ideas about how to do this, but the typical user of a secure email/VPN/tor unfortunately doesn’t and realistically can’t understand the corner cases and tricks. Realistically, even HN users would make enough mistakes. This is why I’m dubious of these types of products marketing to average consumers

If your threat model is "utilize secure email/VPN/tor to evade organizations on the spectrum of [law enforcement...intelligence services]" you are not a typical user even of those services and saying that it's on you to understand all the corner cases and tricks to avoid persecution, prosecution, execution, etc. seems pretty reasonable.

I wouldn’t call it reasonable.

If you’re trying to evade LE because it’s illegal to be gay in your country, and you get caught because you’d listed an Apple address in your ProtonMail account - can’t we design better products to make this less likely?

Post reply on HN