Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Proton Mail discloses user data leading to arrest in Spain

restoreprivacy.com

Post reply on HN
Print view View original

71–80 of 283 posts

Re: Proton Mail discloses user data leading to arrest in Spain

#71

Post by littlestymaar »

betaby wrote: post #37
oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

> Privacy does not protect you from the state. Privacy is good enough to protect you from the public. Public doesn't care mostly. Governments on the other hand...

The “public” also means the private industrial sector, and nowadays they are by far the biggest threat for people living in the Western world.

Re: Proton Mail discloses user data leading to arrest in Spain

#72

Post by schoen »

kube-system wrote: post #55
schoen wrote: post #44

Earlier quoted context omitted.

There's lots of work on that problem! https://dwheeler.com/trusting-trust/ There are also a number of people making minimal OSes, interpreters, and compilers that you can, for example, assemble by hand and type in "from scratch". There was a nice list of those that I can't find right now, but you could look at https://bootstrappable.org/projects/mes.html as one example in this direction.

The rabbit hole goes further with UEFI, components embedded in PCBs, microcode, HDL synthesizers, etc. To make a perfectly secure system, the first step is to obtain high purity sand.

Yes, you can definitely get very severe attacks from backdoored hardware. Some of them appear almost impossible to defend against with software alone.

On the bright side, it's hard to imagine that many of these attacks will be self-propagating, which is the particularly insidious thing about the Trusting Trust attack. Yes, hardware is used to design hardware, but typically in a more indirect and heterogeneous way than the "compiler compiling itself" scenario. To be concrete, I'd say Microsoft or Canonical has much more to fear from a Trusting Trust sort of attack than Intel does, but the software developers also have better options to contain or detect such an attack.

Re: Proton Mail discloses user data leading to arrest in Spain

#73

Post by habitue »

betaby wrote: post #37
oooyay wrote: post #31

I dislike that a website with privacy in the name collides privacy and anonymity. Privacy does not protect you from the state. Privacy is good enough to protect you from the public . If you are doing battle with or an enemy of the state, much less an agent of the state acting in bad faith simple privacy will do nothing for you. Worse your misunderstanding of it is actually a vector, like in this case. The measures fo…

> Privacy does not protect you from the state. Privacy is good enough to protect you from the public. Public doesn't care mostly. Governments on the other hand...

The public includes online mobs who send you death threats. It definitely matters to protect your identity from the public

Re: Proton Mail discloses user data leading to arrest in Spain

#74

Post by trog »

ta988 wrote: post #67
matheusmoreira wrote: post #63

Earlier quoted context omitted.

Some interesting facts about Proton Mail. It generates OpenPGP keys on their own servers, and if you want to use your own keys their instructions show users how to upload upload their entire OpenPGP secret keychain to Proton Mail. Not just encryption/signing subkeys, the master key also needs to be included. I've emailed them to ask that they fix this. I also created a post on their user voice thing about it. https:/…

Of course they will not. If you look at everything they propose there is always that one thing that makes them control everything. Their IMAP bridge, key generation etc

I don't know much about Proton Mail but presumably they want that so they can actually provide you with a more complete service, other than just being a mail gateway?

I would assume that any technically sophisticated users who just want an SMTP/IMAP server would never let their keys leave their control, but there might be other users for whom a "middle layer" service which has their keys is good enough. (I guess this is especially evident in cryptoassets where people seem to cheerfully let third parties manage their tokens, so it's not really surprising to me that there are a bunch of people willing to do it with their PGP keys for email purposes.)

I guess there's an argument about whether or not they're being responsible in providing such an option at all, which is fair enough.

Re: Proton Mail discloses user data leading to arrest in Spain

#75

Post by underlogic »

matheusmoreira wrote: post #63
dathinab wrote: post #43

Earlier quoted context omitted.

Privacy is also meant to protect you from the state, or more specifically state abuse. It's an essential aspect of privacy. Like privacy is also meant to e.g. not disclose topics you have communicated about so that it can't be abused against you. For example there is a long history of states persecuting people for idk. being gay, believing in a certain religion or being a journalist which was involved in a unpleasant…

Some interesting facts about Proton Mail. It generates OpenPGP keys on their own servers, and if you want to use your own keys their instructions show users how to upload upload their entire OpenPGP secret keychain to Proton Mail. Not just encryption/signing subkeys, the master key also needs to be included. I've emailed them to ask that they fix this. I also created a post on their user voice thing about it. https:/…

fix it? are you kidding!

that they demanded the private key tells you _everything_ you need to know about protonmail.

Re: Proton Mail discloses user data leading to arrest in Spain

#76

Post by underlogic »

IAmGraydon wrote: post #19

Go try to create a ProtonMail account with Tor. It will ask you to confirm your account with a phone number. It skips this if you’re using a non-proxy IP. They want to know who you are, and it’s been this way for years. I think they’ve long been a honeypot.

[flagged]

Re: Proton Mail discloses user data leading to arrest in Spain

#77

Post by arp242 »

IAmGraydon wrote: post #19

Go try to create a ProtonMail account with Tor. It will ask you to confirm your account with a phone number. It skips this if you’re using a non-proxy IP. They want to know who you are, and it’s been this way for years. I think they’ve long been a honeypot.

Try setting up an email service without these protections and report back to me how well that went. Oh no you can't, as you won't be able to email anyone as everyone will mark your emails as spam as you'll be a humongous source of it. Running an email service is like being flypaper for dickheads. Evidence-free accusations of being a "honeypot" is ridiculous.

Re: Proton Mail discloses user data leading to arrest in Spain

#78

Post by tsimionescu »

lordofgibbons wrote: post #8

The heart of the issue is this: > Under Swiss law, Proton Mail was compelled to collect and provide information on the individual’s IP address to Swiss authorities, who then shared it with French police. They can claim all the privacy guarantees they want, but unless the privacy is guaranteed by cryptography, it's an empty gesture. Nobody is willing to do prison time to protect your privacy.

Expeacting a lawful corporation to shield you from the law is absurd. The state has the right to obtain this information - so, if you want it hidden, you need to find a provider that doesn't operate under the bounds of the law. You'll soon find out that A LOT of niceties go away once you're not dealing with legal matters: you can't guarantee that you'll get the service you payed for, you can't re-gain access if you lost your main security, etc.

Re: Proton Mail discloses user data leading to arrest in Spain

#79

Post by BobFromEnzyte »

IAmGraydon wrote: post #19

Go try to create a ProtonMail account with Tor. It will ask you to confirm your account with a phone number. It skips this if you’re using a non-proxy IP. They want to know who you are, and it’s been this way for years. I think they’ve long been a honeypot.

You can create anonymous accounts with Tuta through Tor and they don't ask for a phone number or contact email address. They even made a tutorial video on YouTube a few weeks ago for how to do it: https://youtu.be/oXv3llPIfvo

If you continued using the account only through Tor, there wouldn't be any traceable info.

Re: Proton Mail discloses user data leading to arrest in Spain

#80

Post by emptysongglass »

matheusmoreira wrote: post #63
dathinab wrote: post #43

Earlier quoted context omitted.

Privacy is also meant to protect you from the state, or more specifically state abuse. It's an essential aspect of privacy. Like privacy is also meant to e.g. not disclose topics you have communicated about so that it can't be abused against you. For example there is a long history of states persecuting people for idk. being gay, believing in a certain religion or being a journalist which was involved in a unpleasant…

Some interesting facts about Proton Mail. It generates OpenPGP keys on their own servers, and if you want to use your own keys their instructions show users how to upload upload their entire OpenPGP secret keychain to Proton Mail. Not just encryption/signing subkeys, the master key also needs to be included. I've emailed them to ask that they fix this. I also created a post on their user voice thing about it. https:/…

Proton Mail also still doesn't detect WIKD keys on the other side despite reporting it over 5 years ago.
Post reply on HN