41–50 of 283 posts
> Proton provided us with an explanation that inbox contents remain secure. Yup, until they receive a court order asking them to mitm an inbox, if they haven't already... This entire system of "receive email in clear text but store it encrypted at rest" is smokes and shadows, really.
Go try to create a ProtonMail account with Tor. It will ask you to confirm your account with a phone number. It skips this if you’re using a non-proxy IP. They want to know who you are, and it’s been this way for years. I think they’ve long been a honeypot.
Get one from your neighborhood coffee shop Wi-Fi, and pay cash for your coffee.
I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…
Like privacy is also meant to e.g. not disclose topics you have communicated about so that it can't be abused against you. For example there is a long history of states persecuting people for idk. being gay, believing in a certain religion or being a journalist which was involved in a unpleasant disclosure.
Still privacy and anonymity are two tightly related but different things. Mainly privacy of communication doesn't always imply anonymity, through sometimes does (and has too!).
Anyway it is foolish and somewhat strange to believe that a legally operating email service will protect you against judge backed lawful orders (no matter if it should be lawful or not).
Handing out metadata isn't even the worst which can happen, e.g. a judge might order them to make copies of unencrypted mails you receive or make copies of unencrypted mails you write or even undermine your encryption the next time you login.
They can try to dispute it and that alone does reduce abuse potential (if they operate in a place which still can be called a state of law) in the end especially for mail there is just no true privacy and even less anonymity.
Which doesn't mean their service is useless.
Just if you worry about political prosecution by EU countries, or do crime it's not protecting you.
Earlier quoted context omitted.
Yeah, they can just deliver an alternate version of the web client (assuming the target user uses the web interface) -- probably the easiest (or least-detectable) way for ProtonMail to read a user's encrypted email contents.
This is where the security stuff starts going down the rabbit-hole into Wonderland. I’m still trying to figure out how to write a compiler that won’t be subject to the “what if my ur-compiler was infected with a virus that only infects compilers” problem....
https://dwheeler.com/trusting-trust/
There are also a number of people making minimal OSes, interpreters, and compilers that you can, for example, assemble by hand and type in "from scratch".
There was a nice list of those that I can't find right now, but you could look at
https://bootstrappable.org/projects/mes.html
as one example in this direction.
I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…
But the concept certainly doesn't mean that a business is going to help you cover your tracks in regards to data you've already shared. (in this case, the recovery email address)
If you give out your personal information, commit a crime, and ask that person to help you hide, you're not asking for anonymity, you're asking for an accomplice.
Earlier quoted context omitted.
you can be required to keep logs - they need to design a system that cannot collect logs - You cannot share what you cannot have.
I’d be more interested in a system that can prove to me that it’s not collecting logs. Hard, but not impossible.
Go try to create a ProtonMail account with Tor. It will ask you to confirm your account with a phone number. It skips this if you’re using a non-proxy IP. They want to know who you are, and it’s been this way for years. I think they’ve long been a honeypot.
Unfortunately, it can and has been abused.
> Proton provided us with an explanation that inbox contents remain secure. Yup, until they receive a court order asking them to mitm an inbox, if they haven't already... This entire system of "receive email in clear text but store it encrypted at rest" is smokes and shadows, really.
The heart of the issue is this: > Under Swiss law, Proton Mail was compelled to collect and provide information on the individual’s IP address to Swiss authorities, who then shared it with French police. They can claim all the privacy guarantees they want, but unless the privacy is guaranteed by cryptography, it's an empty gesture. Nobody is willing to do prison time to protect your privacy.