Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail discloses user data leading to arrest in Spain

restoreprivacy.com

Post reply on HN
Print view View original

231–240 of 283 posts

Re: Proton Mail discloses user data leading to arrest in Spain

#231

Post by snakeyjake »

quitit wrote: post #159

It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…

>I suppose the second learning is to elect governments which respect democratic freedoms, even if that puts them on the back foot.

Democratic freedoms, in the United States at least, protect people from UNREASONABLE search and seizure.

Compelling a third party to reveal information about a customer via a court order is not now, has never been, and will never be until the end of time and space, unreasonable.

The order itself might be unreasonable and should be challenged if so, but the procedure and ability to do so is not and will never be.

Re: Proton Mail discloses user data leading to arrest in Spain

#232

Post by sonicanatidae »

snakeyjake wrote: post #231
quitit wrote: post #159

It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…

>I suppose the second learning is to elect governments which respect democratic freedoms, even if that puts them on the back foot. Democratic freedoms, in the United States at least, protect people from UNREASONABLE search and seizure. Compelling a third party to reveal information about a customer via a court order is not now, has never been, and will never be until the end of time and space, unreasonable. The order…

>Democratic freedoms, in the United States at least, protect people from UNREASONABLE search and seizure.

You're conflating what's written in the law and the sad reality of how a lot of that is simply ignored by law enforcement, while they are standing on your neck, searching your car.

Re: Proton Mail discloses user data leading to arrest in Spain

#233

Post by dheera »

binary132 wrote: post #229
dheera wrote: post #46

Earlier quoted context omitted.

As long as we are talking about classical communication (and not quantum) it is impossible to prove that it isn't collecting at least ciphertext logs.

Consider a certified tamper-resistant operating system which cryptographically certifies the versions of software it operates, and prohibits uncertified processes from running. The certificate of authenticity verifying the software is made available to the clients which connect to the remote application. This cert specifies all of the program transforms which were required in order to produce the compiled software, a…

> Consider a certified tamper-resistant operating system which cryptographically certifies the versions of software it operates, and prohibits uncertified processes from running.

If I own the hardware, I can decide how the software is executed, including containerizing your certification processes to make them feel warm and fuzzy and happy but in reality they are running inside a simulation.

If push comes to shove I could theoretically manufacture my own RAM sticks that copy everything and your OS wouldn't even know, but there's a 99% chance I could successfully pull it off at the kernel virtualization level.

Re: Proton Mail discloses user data leading to arrest in Spain

#234

Post by dheera »

lordofgibbons wrote: post #95
dheera wrote: post #46

Earlier quoted context omitted.

As long as we are talking about classical communication (and not quantum) it is impossible to prove that it isn't collecting at least ciphertext logs.

Not really. Tor, I2P, and Monero manage this just fine. Building on these technologies should allow one to have privacy and anonymity without any exotic quantum technology.

These technologies give privacy and anonymity under normal conditions, but they do not prevent anyone from logging ciphertexts. If someone has logged ciphertext, and the government subponies someone to divulge their private key and subponies whoever has the ciphertext, those ciphertexts as good as plain text.

Re: Proton Mail discloses user data leading to arrest in Spain

#235

Post by alexey-salmin »

Retr0id wrote: post #225
protonmail wrote: post #141

Earlier quoted context omitted.

This is not true - most of the time all you need to do is fill out the captcha. In some cases (when our systems detect something suspicious about your network), we would request an additional email address. Even in those cases, the email addresses are not tied to your account - we only save a cryptographic hash of your email. Due to the hash functions being one-way, we cannot derive your data back from the hash: http…

> Due to the hash functions being one-way, we cannot derive your data back from the hash This isn't true in practice. It's not hard to build a big list of ~every email address (give or take), and have a GPU churn through them all until you get a match. If you've ever received a spam email, your email address is on such a list.

argon2id with dynamic salt should effectively prevent this, but it will also not allow to tell if two users have the same e-mail or not -- which I suspect is the main reason for hashing in the first place.

If equality-check is required to prevent e-mail reuse by spammers then argon2id with static salt rotated every few months will be reasonably strong too.

Of course I have no idea if any of this is implemented or it's just sha256(email). Just replying to the question of general feasibility.

Re: Proton Mail discloses user data leading to arrest in Spain

#236

Post by matheusmoreira »

snakeyjake wrote: post #231
quitit wrote: post #159

It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…

>I suppose the second learning is to elect governments which respect democratic freedoms, even if that puts them on the back foot. Democratic freedoms, in the United States at least, protect people from UNREASONABLE search and seizure. Compelling a third party to reveal information about a customer via a court order is not now, has never been, and will never be until the end of time and space, unreasonable. The order…

Yeah. This stuff is all about putting an end to the global mass surveilance dragnets. Police and government should still be able to operate of course, with checks and balances.

They should not be able to push a button and learn everything about a person. If they want to learn about an individual's private life, they should have to get a warrant then put people to work on the guy's case. They should have to literally follow their targets, photograph them, put hardware keyloggers into their keyboards. That sort of hardship imposes natural limits on the scale of their operations: there are only so many police officers you can assign. With computerized dragnet surveillance, the scale of their operations is essentially limitless.

These encrypted communications services aren't generally in the business of going to jail in their customer's place. They gotta comply with the government laws. When a court orders them to do something, they either obey or they are held in contempt of court if not worse. It can't be helped. It's still helping reduce global surveillance by forcing them to target their attacks.

Re: Proton Mail discloses user data leading to arrest in Spain

#237

Post by Shacklz »

xinayder wrote: post #220
Shacklz wrote: post #157

There are some serious anti-proton-vibes in this thread, so just my 2 cents as a paying customer: I'm rather happy with their service. I pay them money, they make sure that Joe in Marketing won't be able to harvest data from my emails. I'm also fairly optimistic that they take security serious enough that the blast radius of some dataleak is hopefully very limited. I have zero delusions however that they can protect…

I'm a free customer and I am always annoyed by ads in my inbox about other services provided by Proton. I signed up for an email box, I don't care about Proton Drive nor ProtonVPN. I chose Proton specifically because it supposedly had less or no ads at all, but it seems like Gmail continues to be the better choice.

Maybe this is disabled for free customers but at least for me there are settings to enable/disables what I kind of informations I'd like to receive from them.

Gmail in that regard I've always perceived as worse - every few months or so they update their policy, linking to some gargantuan document that I can't be bothered to read, each time wondering how much of my soul I've sold this time around...

Re: Proton Mail discloses user data leading to arrest in Spain

#238

Post by trogdor »

BSDobelix wrote: post #151
denton-scratch wrote: post #148

Earlier quoted context omitted.

It focuses on Proton because Proton is the link that purports to be secure. Nobody expects Apple or telcos to guard your identity.

I can think of one country in the whole world (Iceland) where a company can tell the country it operates from, NO. However in this case (an operating police officer who gave information to a group who wants to split away from the country) i make a bold assumption that even Iceland would order the company to give the data out (since it has nothing to do with protecting journalists/whistleblowers, but espionage)

>I can think of one country in the whole world (Iceland) where a company can tell the country it operates from, NO.

Are you claiming that businesses in Iceland are not required to comply with court orders? On what basis do you believe that to be true?

Re: Proton Mail discloses user data leading to arrest in Spain

#239

Post by denton-scratch »

trogdor wrote: post #238
BSDobelix wrote: post #151

Earlier quoted context omitted.

I can think of one country in the whole world (Iceland) where a company can tell the country it operates from, NO. However in this case (an operating police officer who gave information to a group who wants to split away from the country) i make a bold assumption that even Iceland would order the company to give the data out (since it has nothing to do with protecting journalists/whistleblowers, but espionage)

>I can think of one country in the whole world (Iceland) where a company can tell the country it operates from, NO. Are you claiming that businesses in Iceland are not required to comply with court orders? On what basis do you believe that to be true?

Doh. I read it as "a company can tell the country it operates from, Norway."

I thought "Huh? Why would an Icelandic company operate from Norway?" Well, I thought, I suppose there must be quite a few. But why's he mentioning it here?

Thanks for inadvertently clarifying.

Re: Proton Mail discloses user data leading to arrest in Spain

#240

Post by EclipseMantis »

pc86 wrote: post #194
lkdfjlkdfjlg wrote: post #173

Earlier quoted context omitted.

> Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address. Irrelevant to the point. Proton Mail provided authorities with user data.

Please quote from the linked article where it says that (it doesn't).

Are you sure?

> The core of the controversy stems from Proton Mail providing the Spanish police with the recovery email address associated with the Proton Mail account of an individual using the pseudonym ‘Xuxo Rondinaire.’

Post reply on HN