Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail discloses user data leading to arrest in Spain

restoreprivacy.com

Post reply on HN
Print view View original

51–60 of 283 posts

Re: Proton Mail discloses user data leading to arrest in Spain

#51

Post by noodlesUK »

yieldcrv wrote: post #20
fbdab103 wrote: post #10

Earlier quoted context omitted.

I think they should do like Mullvad claims and keep zero logs. You cannot share what you do not have.

gullible vpn fans believe anything or at least their favorite youtuber with the paid ads and zero domain knowledge of network topology serious question I have is whether “internet reseller” is a compelling service. because that's all that VPNs are, and I dont mind paying to use them for that purpose.

I would say that Mullvad seems to be the exception - they know their stuff. You can even pay with cash for even more anonymity.

Re: Proton Mail discloses user data leading to arrest in Spain

#52

Post by mttpgn »

crtasm wrote: post #29
immibis wrote: post #27

Earlier quoted context omitted.

This is different each time you try it. They may use the exit node's country (I doubt they'd be so naive), some other fingerprinting, or just have a limited number of anonymous accounts to give out each day, which is what cockli does. Sometimes you need a phone number, other times an email address, other times just a CAPTCHA.

Yes, I just tested it and was able to register by giving a (disposable) email. It did then prompt me to add an email and/or phone number as recovery methods, but that step was skippable.

I have never found protonmail's signup step asking for phone number verification or a recovery email to be unskippable.

Protonmail can still be the best choice for a pseudonymous mail service so long as it's combined with diligent, consistent IP address obfuscation. Protonmail will continue to allow logins and new account creations over Tor. All the major free email providers have long since disallowed new signups over Tor, and most have some form of degraded user experience when logging in over Tor, if they allow it at all. Small, niche email providers appear and disappear so often that relying on them still to exist even a few months into the future is a big gamble. Hosting one's own email requires payment of some type to the hosting provider, so it is not anonymous. Other privacy-oriented free email providers, such as riseup, will do exactly what protonmail did, because if they refuse, their only option is to go the way of lavabit.

Re: Proton Mail discloses user data leading to arrest in Spain

#53

Post by _heimdall »

kube-system wrote: post #45
oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

Privacy protects some things from the state, which is why the western world has the concepts of warrants and such. But the concept certainly doesn't mean that a business is going to help you cover your tracks in regards to data you've already shared. (in this case, the recovery email address) If you give out your personal information, commit a crime, and ask that person to help you hide, you're not asking for anonymi…

I think that is the GP's point. Privacy means the data is reasonably hidden, though it still exists somewhere in a readable state. Anonymity means the information of who did what really doesn't exist anywhere.

In the case of governments, private data is only hidden until the government decides that it needs to look for it (or ask for it). Anonymity means the data isn't there, regardless of whether the government decides it needs to, and has legal justification to, demand access to the data.

Anyone providing anonymity is only an accomplice if they know your intent. Simply not collecting data doesn't make you an accomplice, not collecting data with the intent of hiding someone else's illegal behavior does.

Re: Proton Mail discloses user data leading to arrest in Spain

#54

Post by newscracker »

oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

You seem to be confusing privacy with practicality. In practice, nothing is ever secure, nothing is ever private and nothing is ever safe.

What matters here is what Proton promises and advertises to users/potential users vs. what it can actually deliver. I don’t know if Proton is more open about this, but hopefully this isn’t just buried in some long Terms of Service that almost nobody reads.

Re: Proton Mail discloses user data leading to arrest in Spain

#55

Post by kube-system »

schoen wrote: post #44
binary132 wrote: post #38

Earlier quoted context omitted.

This is where the security stuff starts going down the rabbit-hole into Wonderland. I’m still trying to figure out how to write a compiler that won’t be subject to the “what if my ur-compiler was infected with a virus that only infects compilers” problem....

There's lots of work on that problem! https://dwheeler.com/trusting-trust/ There are also a number of people making minimal OSes, interpreters, and compilers that you can, for example, assemble by hand and type in "from scratch". There was a nice list of those that I can't find right now, but you could look at https://bootstrappable.org/projects/mes.html as one example in this direction.

The rabbit hole goes further with UEFI, components embedded in PCBs, microcode, HDL synthesizers, etc.

To make a perfectly secure system, the first step is to obtain high purity sand.

Re: Proton Mail discloses user data leading to arrest in Spain

#56

Post by kube-system »

_heimdall wrote: post #53
kube-system wrote: post #45

Earlier quoted context omitted.

Privacy protects some things from the state, which is why the western world has the concepts of warrants and such. But the concept certainly doesn't mean that a business is going to help you cover your tracks in regards to data you've already shared. (in this case, the recovery email address) If you give out your personal information, commit a crime, and ask that person to help you hide, you're not asking for anonymi…

I think that is the GP's point. Privacy means the data is reasonably hidden, though it still exists somewhere in a readable state. Anonymity means the information of who did what really doesn't exist anywhere. In the case of governments, private data is only hidden until the government decides that it needs to look for it (or ask for it). Anonymity means the data isn't there, regardless of whether the government deci…

It is, I am agreeing.

The bottom line is that if you told someone who you are, you're not anonymous.

Re: Proton Mail discloses user data leading to arrest in Spain

#59

Post by blackeyeblitzar »

lordofgibbons wrote: post #8

The heart of the issue is this: > Under Swiss law, Proton Mail was compelled to collect and provide information on the individual’s IP address to Swiss authorities, who then shared it with French police. They can claim all the privacy guarantees they want, but unless the privacy is guaranteed by cryptography, it's an empty gesture. Nobody is willing to do prison time to protect your privacy.

Is the implication that you should use a VPN from a different provider? Like so you’re not getting email and VPN and whatever from the same place?

Re: Proton Mail discloses user data leading to arrest in Spain

#60

Post by matheusmoreira »

fbdab103 wrote: post #12
makeitdouble wrote: post #11

Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address. In this case the email address was the lead, but I wonder what other info would be enough to get the phone provider to spill the beans. For instance would an IP address used at a specific time be uniquely identifying if it was…

While an IP address is not an identity, it can still zero in on a location. I suspect governments and ISPs all keep historical logs of who was assigned what address.

> I suspect governments and ISPs all keep historical logs of who was assigned what address.

They do. It's often required by law.

Post reply on HN