Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Is Protonmail logging my email content?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 53 posts

Re: Is Protonmail logging my email content?

#41

Post by md_ »

tejohnso wrote: post #30
ziddoap wrote: post #16

Earlier quoted context omitted.

This is always posted like some 'gotcha', despite it being right there in the transparency report. In case you trust any company blindly: any company that wants to keep playing the money game will follow the laws forced upon them by the government they are beholden to.

Isn't this what seasteading, and other jurisdiction avoidance schemes attempt to address? I wonder if anything like that has ever worked out.

There seem to be two popular approaches to avoiding the need to trust institutions.

One is technical: e2ee, implementation transparency, and similar.

The other is social: have fewer institutions.

I have never understood people who think the latter is a good approach. Like, "I don't trust these people who use their real names and are registered in a jurisdiction that has strong privacy obligations, so I'm gonna trust some randos on an abandoned oil rig instead."

Re: Is Protonmail logging my email content?

#42

Post by aleister_777 »

ProtonTeam wrote: post #10

Please be aware that we don't log email content (and we are also not vulnerable to Log4j). Our anti-spam systems do check for malicious links from third party email services so we can proactively warn users about phishing attempts.

Nobody believes you. Your track record is trash and I was happy to cancel all services and never pay you anymore money.

Re: Is Protonmail logging my email content?

#43

Post by cf100clunk »

gizdan wrote: post #26

Seems odd for PM to be vulnerable by the log4j CVE considering (from what I understand) they're mostly Go house. Maybe in the Android app, but otherwise I'd be surprised. Unrelated: I've been getting quite frustrated with some of the functionality and limitations of PM especially for the price I pay (I have 2 catch-all domains, 1 user for each, which requires 2 times pro accounts), so recently I've been trying to mig…

That would be a good Ask HN.

Re: Is Protonmail logging my email content?

#46

Post by vasuki »

ProtonTeam wrote: post #10

Please be aware that we don't log email content (and we are also not vulnerable to Log4j). Our anti-spam systems do check for malicious links from third party email services so we can proactively warn users about phishing attempts.

This is definitely not precise. I confirmed that the lookup is also performed by Proton servers for mails sent to third party mail services, not just from third party mail services. Are they also scanned?

Source IP I got in my test: 185.70.43.80

```

# whois.ripe.net

inetnum: 185.70.40.0 - 185.70.43.255

netname: CH-PROTONMAIL-20140915

mnt-by: protonmail-mnt

org-name: Proton AG

```

From privacy policy https://protonmail.com/privacy-policy

> We do NOT have access to encrypted message content, but unencrypted messages sent from external providers to ProtonMail are scanned for Spam and Viruses to pursue the legitimate interest of the protection of our users.

very disappointing.

Re: Is Protonmail logging my email content?

#47

Post by adamhp »

TYMorningCoffee wrote: post #32
top_sigrid wrote: post #31

Earlier quoted context omitted.

If you are not vunerable to log4j, how did the screenshots come about?

I believe ProtonTeam's claim is that the spam filter visits the links in the email content. As a result, it's not the log4shell vulnerability making the connection, it's the spam filter.

I.e. try to send some e-mails without the log4j vuln syntax (just put your IP) and see if you still get hit. It's just the fact that there is the IP, not that it happens to use the jndi syntax.

Re: Is Protonmail logging my email content?

#48

Post by dang »

aleister_777 wrote: post #42
ProtonTeam wrote: post #10

Please be aware that we don't log email content (and we are also not vulnerable to Log4j). Our anti-spam systems do check for malicious links from third party email services so we can proactively warn users about phishing attempts.

Nobody believes you. Your track record is trash and I was happy to cancel all services and never pay you anymore money.

You can't attack others like that on HN, regardless of how right you are or you feel you are. Please review https://news.ycombinator.com/newsguidelines.html and don't post like this again.

You may not feel you owe your target better, but you owe this community much better if you're participating in it. The damage this sort of poison causes to the ecosystem greatly exceeds any benefits it may have.

Re: Is Protonmail logging my email content?

#49

Post by dankwizard »

tpoacher wrote: post #45

Hate to be that guy, but evidence has no plural. Similar words often wrongly used in plural: - advices - feedbacks - codes (when referring to source code) - moneys - datas - syntaxes

If you're going to be that guy at least be correct

https://dictionary.cambridge.org/dictionary/english/moneys

Re: Is Protonmail logging my email content?

#50

Post by tablespoon »

pavel_lishin wrote: post #40
tejohnso wrote: post #30

Earlier quoted context omitted.

Isn't this what seasteading, and other jurisdiction avoidance schemes attempt to address? I wonder if anything like that has ever worked out.

I can't imagine seasteading is going to be able to avoid a nation's navy.

> I can't imagine seasteading is going to be able to avoid a nation's navy.

Seasteaders: "My Libertarian non-aggression principle trumps your cruise missiles!"

Navy: "No."

Post reply on HN