Live data from Hacker News

Proton Mail discloses user data leading to arrest in Spain

restoreprivacy.com

61–70 of 283 posts

Re: Proton Mail discloses user data leading to arrest in Spain

#61
post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

You seem to be confusing privacy with practicality. In practice, nothing is ever secure, nothing is ever private and nothing is ever safe. What matters here is what Proton promises and advertises to users/potential users vs. what it can actually deliver. I don’t know if Proton is more open about this, but hopefully this isn’t just buried in some long Terms of Service that almost nobody reads.

> Proton is incorporated and headquartered in Switzerland, meaning your data is protected by some of the world's strictest privacy laws.

This is the main statement from Proton about their privacy protection. They say they obey Swiss privacy laws. So if one has a problem with Protonmail complying with Swiss law, maybe one should complain to Switzerland.

Re: Proton Mail discloses user data leading to arrest in Spain

#62
post #42

Go try to create a ProtonMail account with Tor. It will ask you to confirm your account with a phone number. It skips this if you’re using a non-proxy IP. They want to know who you are, and it’s been this way for years. I think they’ve long been a honeypot.

> It skips this if you’re using a non-proxy IP Get one from your neighborhood coffee shop Wi-Fi, and pay cash for your coffee.

Terrible advice, being that "neighborhood" means you live close by. Go to a coffee shop in another city, state or country and do so! (Although flights leave paper trails too)

Also make sure to avoid CCTV...

Re: Proton Mail discloses user data leading to arrest in Spain

#63
post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

Privacy is also meant to protect you from the state, or more specifically state abuse. It's an essential aspect of privacy. Like privacy is also meant to e.g. not disclose topics you have communicated about so that it can't be abused against you. For example there is a long history of states persecuting people for idk. being gay, believing in a certain religion or being a journalist which was involved in a unpleasant…

Some interesting facts about Proton Mail. It generates OpenPGP keys on their own servers, and if you want to use your own keys their instructions show users how to upload upload their entire OpenPGP secret keychain to Proton Mail. Not just encryption/signing subkeys, the master key also needs to be included.

I've emailed them to ask that they fix this. I also created a post on their user voice thing about it.

https://protonmail.uservoice.com/forums/284483-proton-mail/s...

TLDR; Proton Mail tells users to do this:

  gpg --armor --export-secret-keys "${USER_ID}" | import-into-proton-mail
They should support this instead:

  gpg --armor --export-secret-subkeys "${PROTON_ENCR_SUBKEY_ID}!" | import-into-proton-mail
  gpg --armor --export-secret-subkeys "${PROTON_SIGN_SUBKEY_ID}!" | import-into-proton-mail
First one leaks the user's master key to them.

Re: Proton Mail discloses user data leading to arrest in Spain

#64
post #5
post #2

Switzerland has laws? Did Proton lie to us?

Lawless wasteland!

Switzerland famously known for anarchism, utter chaos, irresponsible tinkering with time, space (disregarding mountains, tunnels everywhere) and spacetime (at CERN)!

Re: Proton Mail discloses user data leading to arrest in Spain

#65

    This case is particularly noteworthy because it involves a series of
    requests across different jurisdictions and companies, highlighting the
    complex interplay between technology firms, user privacy, and law
    enforcement.  The requests were made under the guise of anti-terrorism
    laws, despite the primary activities of the Democratic Tsunami involving
    protests and roadblocks, which raises questions about the proportionality
    and justification of such measures.

Re: Proton Mail discloses user data leading to arrest in Spain

#66
post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

You seem to be confusing privacy with practicality. In practice, nothing is ever secure, nothing is ever private and nothing is ever safe. What matters here is what Proton promises and advertises to users/potential users vs. what it can actually deliver. I don’t know if Proton is more open about this, but hopefully this isn’t just buried in some long Terms of Service that almost nobody reads.

> In practice, nothing is ever secure,

Well that's clearly not true.

Re: Proton Mail discloses user data leading to arrest in Spain

#67

Earlier quoted context omitted.

Privacy is also meant to protect you from the state, or more specifically state abuse. It's an essential aspect of privacy. Like privacy is also meant to e.g. not disclose topics you have communicated about so that it can't be abused against you. For example there is a long history of states persecuting people for idk. being gay, believing in a certain religion or being a journalist which was involved in a unpleasant…

Some interesting facts about Proton Mail. It generates OpenPGP keys on their own servers, and if you want to use your own keys their instructions show users how to upload upload their entire OpenPGP secret keychain to Proton Mail. Not just encryption/signing subkeys, the master key also needs to be included. I've emailed them to ask that they fix this. I also created a post on their user voice thing about it. https:/…

Of course they will not. If you look at everything they propose there is always that one thing that makes them control everything. Their IMAP bridge, key generation etc

Re: Proton Mail discloses user data leading to arrest in Spain

#68

Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address. In this case the email address was the lead, but I wonder what other info would be enough to get the phone provider to spill the beans. For instance would an IP address used at a specific time be uniquely identifying if it was…

Why are ProtonMail keeping this IP and email information in their logs?

Re: Proton Mail discloses user data leading to arrest in Spain

#70
post #68

Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address. In this case the email address was the lead, but I wonder what other info would be enough to get the phone provider to spill the beans. For instance would an IP address used at a specific time be uniquely identifying if it was…

Why are ProtonMail keeping this IP and email information in their logs?

The identification came from the recovery email.
Post reply on HN