Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail discloses user data leading to arrest in Spain

restoreprivacy.com

Post reply on HN
Print view View original

261–270 of 283 posts

Re: Proton Mail discloses user data leading to arrest in Spain

#261

Post by nthb3kk »

quitit wrote: post #159

It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…

If Protonmail, and Apple, and Google, and Microsoft and Phone companies, etc., all, in concert, give some parts of the identity -- the total identity can fairly easily be found.

Re: Proton Mail discloses user data leading to arrest in Spain

#262

Post by wepple »

obelus wrote: post #253
wepple wrote: post #184

Earlier quoted context omitted.

> they do not have the encryption keys. True, but they can trivially obtain them given they control everything in the browser. The question then becomes, does the law allow compelling to that degree? Apple fought back in the San Bruno case, but they’re very well lawyered up

But Swiss law can't make a request like that.

I would hope so, but is that confirmed?

Is there a clear definition between handing over data they have and being compelled to make modifications in order to intercept?

Re: Proton Mail discloses user data leading to arrest in Spain

#263

Post by wepple »

pjlegato wrote: post #259
wepple wrote: post #210

Earlier quoted context omitted.

I wouldn’t call it reasonable. If you’re trying to evade LE because it’s illegal to be gay in your country, and you get caught because you’d listed an Apple address in your ProtonMail account - can’t we design better products to make this less likely?

Who gets to decide which specific sorts of evasion of law enforcement are acceptable? Should we consult your personal moral preferences for that, as applied to each of the 200+ countries on the planet? Why do your preferences overrule those jurisdictions' decisions?

I think you’ve completely missed the point.

Folks who design products that are trying to protect privacy should do their absolute best to sand down the sharp edges and make them secure-by-default wherever possible.

Re: Proton Mail discloses user data leading to arrest in Spain

#264

Post by yencabulator »

xinayder wrote: post #218
quitit wrote: post #159

It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…

I don't think this is solely the issue that users don't understand that the companies are obliged to provide the data requested by the authorities. The whole controversy surrounding Proton started when they marketed themselves as "secure and private email", promising they would NEVER give away their users' data, until they did. I had a similar discussion with my friends today about this topic and the issue I have wit…

The one good way forward I can see for any such privacy-conscious service provider is to let the user see exactly what data is stored about them (and purge it where feasible).

You store my access times and IP addresses? I should see that.

I think this would align well with GDPR, too.

Re: Proton Mail discloses user data leading to arrest in Spain

#265

Post by jacooper »

xinayder wrote: post #218
quitit wrote: post #159

It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…

I don't think this is solely the issue that users don't understand that the companies are obliged to provide the data requested by the authorities. The whole controversy surrounding Proton started when they marketed themselves as "secure and private email", promising they would NEVER give away their users' data, until they did. I had a similar discussion with my friends today about this topic and the issue I have wit…

But that's not true? Proton said they will not hand over your emails, which they never did because they couldn't and still can't.

Re: Proton Mail discloses user data leading to arrest in Spain

#266

Post by immibis »

Adrox wrote: post #178
refurb wrote: post #164

Earlier quoted context omitted.

It can be used to identify a location, but not an individual. I assume it could be easily challenged in court (network was compromised, “i give out my WiFi to anyone who visits my home”) without other supporting evidence.

Not in Germany, where you are responsible for the Wifi access, see hundreds of copyrights fines each year... Anyway, it puts the persons living in that location on the radar of the police, and other evidence can be collected (For example by getting a warrant and taking all electronics out of the "location").

Apparently in Germany you can do public wifi now, but you have to register as a telecommunications provider, and comply with all law enforcement requests to wiretap your wifi.

Re: Proton Mail discloses user data leading to arrest in Spain

#267

Post by immibis »

protonmail wrote: post #189
BodyCulture wrote: post #172

Earlier quoted context omitted.

Is it possible now to sign up using TOR? It didn’t work a few years ago when I tried and never visited this website ever again.

We've worked on improving it in the meantime, so we recommend that you try again. If you come across any issues, please contact our support team at: https://proton.me/support/troubleshooting?product=account

It works sometimes. Usually, it requires phone number or email verification. This is important for protonmail to maintain a revenue stream as they don't allow multiple free accounts for the same person.

Re: Proton Mail discloses user data leading to arrest in Spain

#268

Post by quitit »

xinayder wrote: post #218
quitit wrote: post #159

It seems there is some mental conflict going in readers between the reality of what ProtonMail does for its customers and their expectations of what kinds of protections a legitimate business can provide. Both ProtonMail and Apple will challenge subpoenas when they believe they are not valid, however neither company has the final say in the matter and can be compelled to provide access to data that they reasonably ha…

I don't think this is solely the issue that users don't understand that the companies are obliged to provide the data requested by the authorities. The whole controversy surrounding Proton started when they marketed themselves as "secure and private email", promising they would NEVER give away their users' data, until they did. I had a similar discussion with my friends today about this topic and the issue I have wit…

I disagree, while the marketing is carefully worded, it doesn't say that and both Proton's privacy policy and their transparency report detail what kinds of information they gather and how often they hand over that data.

https://proton.me/legal/privacy

https://proton.me/legal/transparency

I standby the assertion that people will believe what they want to, despite there being easily accessible information that contradicts those ideas.

Re: Proton Mail discloses user data leading to arrest in Spain

#269

Post by Repulsion9513 »

godelski wrote: post #226
Repulsion9513 wrote: post #35

Earlier quoted context omitted.

I assume by "less serious threat models" you mean non-governmental, in which case just signing up for ProtonMail without a VPN is perfectly safe.

> you mean non-governmental I would say most people are concerned with dragnets, not targeted attacks. There's quite a lot you can hide from the government in terms of dragnets, in the same way you'd hide from big tech. "Hide" isn't the right word. "Defend from" I think is probably better. Defending our constitutional rights from government and defending our privacy from big tech. I'm actually perfectly okay with gov…

How does mailing them your money help against a dragnet? How does a VPN help against a dragnet? Like the government can spy on (and somehow SSL MITM) your home ISP but not spy on your VPN ISP?

Re: Proton Mail discloses user data leading to arrest in Spain

#270

Post by protonmail »

immibis wrote: post #267
protonmail wrote: post #189

Earlier quoted context omitted.

We've worked on improving it in the meantime, so we recommend that you try again. If you come across any issues, please contact our support team at: https://proton.me/support/troubleshooting?product=account

It works sometimes. Usually, it requires phone number or email verification. This is important for protonmail to maintain a revenue stream as they don't allow multiple free accounts for the same person.

Note that even in those cases when additional verification is requested, the email addresses are not tied to your account - we only save a cryptographic hash of your email. Due to the hash functions being one-way, we cannot derive it back from the hash: https://proton.me/support/human-verification
Post reply on HN