Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail discloses user data leading to arrest in Spain

restoreprivacy.com

Post reply on HN
Print view View original

31–40 of 283 posts

Re: Proton Mail discloses user data leading to arrest in Spain

#31

Post by oooyay »

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public.

If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures for anonymity you require will not incorporate fancy UIs, nice features, or even reasonable reliability at times because they will be sacrificed in the name of leaving no trace.

Re: Proton Mail discloses user data leading to arrest in Spain

#32

Post by godelski »

lolinder wrote: post #22
Dylan16807 wrote: post #18

Earlier quoted context omitted.

Let's say I buy Mullvad access with a credit card, then access my otherwise-unrelated Proton Mail account via Mullvad. How are police going to find me behind that hop?

I don't know one way or the other how easy it is, but if I were an activist in an oppressive regime I wouldn't want to use a VPN that is connected to my identity in any way. I wouldn't trust zero-log policies to keep me safe, there are too many unknowns about the way they run these services and what metadata they have to turn over.

> but if I were an activist in an oppressive regime

Then mail them your money

I think most people are considering less serious threat models

Re: Proton Mail discloses user data leading to arrest in Spain

#33

Post by chefkd »

lolinder wrote: post #22
Dylan16807 wrote: post #18

Earlier quoted context omitted.

Let's say I buy Mullvad access with a credit card, then access my otherwise-unrelated Proton Mail account via Mullvad. How are police going to find me behind that hop?

I don't know one way or the other how easy it is, but if I were an activist in an oppressive regime I wouldn't want to use a VPN that is connected to my identity in any way. I wouldn't trust zero-log policies to keep me safe, there are too many unknowns about the way they run these services and what metadata they have to turn over.

How could one go off grid without going off grid do you think? Cash, bitcoin, prepaid cards, VPNs they all seem traceable if truly needed

Re: Proton Mail discloses user data leading to arrest in Spain

#34

Post by binary132 »

GGO wrote: post #16
fbdab103 wrote: post #10

Earlier quoted context omitted.

I think they should do like Mullvad claims and keep zero logs. You cannot share what you do not have.

you can be required to keep logs - they need to design a system that cannot collect logs - You cannot share what you cannot have.

I’d be more interested in a system that can prove to me that it’s not collecting logs. Hard, but not impossible.

Re: Proton Mail discloses user data leading to arrest in Spain

#35

Post by Repulsion9513 »

godelski wrote: post #32
lolinder wrote: post #22

Earlier quoted context omitted.

I don't know one way or the other how easy it is, but if I were an activist in an oppressive regime I wouldn't want to use a VPN that is connected to my identity in any way. I wouldn't trust zero-log policies to keep me safe, there are too many unknowns about the way they run these services and what metadata they have to turn over.

> but if I were an activist in an oppressive regime Then mail them your money I think most people are considering less serious threat models

I assume by "less serious threat models" you mean non-governmental, in which case just signing up for ProtonMail without a VPN is perfectly safe.

Re: Proton Mail discloses user data leading to arrest in Spain

#36

Post by weikju »

lordofgibbons wrote: post #8

The heart of the issue is this: > Under Swiss law, Proton Mail was compelled to collect and provide information on the individual’s IP address to Swiss authorities, who then shared it with French police. They can claim all the privacy guarantees they want, but unless the privacy is guaranteed by cryptography, it's an empty gesture. Nobody is willing to do prison time to protect your privacy.

> The heart of the issue is this:

No, that was last year's issue.

This time it's:

> The core of the controversy stems from Proton Mail providing the Spanish police with the recovery email address associated with the Proton Mail account of an individual using the pseudonym ‘Xuxo Rondinaire.’ This individual is suspected of being a member of the Mossos d’Esquadra (Catalonia’s police force) and of using their internal knowledge to assist the Democratic Tsunami movement.

and

> Upon receiving the recovery email from Proton Mail, Spanish authorities further requested Apple to provide additional details linked to that email, leading to the identification of the individual.

Re: Proton Mail discloses user data leading to arrest in Spain

#37

Post by betaby »

oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

> Privacy does not protect you from the state. Privacy is good enough to protect you from the public.

Public doesn't care mostly. Governments on the other hand...

Re: Proton Mail discloses user data leading to arrest in Spain

#38

Post by binary132 »

amatecha wrote: post #25
gertop wrote: post #7

> Proton provided us with an explanation that inbox contents remain secure. Yup, until they receive a court order asking them to mitm an inbox, if they haven't already... This entire system of "receive email in clear text but store it encrypted at rest" is smokes and shadows, really.

Yeah, they can just deliver an alternate version of the web client (assuming the target user uses the web interface) -- probably the easiest (or least-detectable) way for ProtonMail to read a user's encrypted email contents.

This is where the security stuff starts going down the rabbit-hole into Wonderland. I’m still trying to figure out how to write a compiler that won’t be subject to the “what if my ur-compiler was infected with a virus that only infects compilers” problem....

Re: Proton Mail discloses user data leading to arrest in Spain

#39

Post by dheera »

betaby wrote: post #37
oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

> Privacy does not protect you from the state. Privacy is good enough to protect you from the public. Public doesn't care mostly. Governments on the other hand...

The public might care if you are rich, influential, or conventionally highly attractive, in which case privacy is a good thing to have.
Post reply on HN