unexposedhazard comments on ProtonMail Logged IP Address of French Activist; Should You Be Worried About Your Privacy?

[–] unexposedhazard@discuss.tchncs.de 14 points 1 year ago (36 children)

Oh ffs. We have known for years that Proton is just a for profit company like any other. They dont give a fuck about you or your privacy. They never have and they never will.

permalink

fedilink

source

hideshow 36 child comments

[–] TuxEnthusiast@sopuli.xyz 37 points 1 year ago (25 children)

They complied with laws. Where is the issue?

permalink

fedilink

source

parent

hideshow 25 child comments

[–] Dojan@pawb.social 18 points 1 year ago (17 children)

Authoritarian regime decides that being critical of the regime is illegal and makes laws to support this.
Activists use Proton for privacy.
Regime demands that they give up data on activists.
Proton complies with the laws.

That’s the issue.

permalink

fedilink

source

parent

hideshow 17 child comments

[+] ook@discuss.tchncs.de 24 points 1 year ago (14 children)

[deleted]

permalink

fedilink

source

parent

hideshow 14 child comments

[–] Dojan@pawb.social 7 points 1 year ago* (13 children)

What data? Here it is the IP address and only under order by authorities.

Whatever they gather. It says as much in the article; they started recording IPs once a request by the Swiss government came through.

ProtonMail can’t directly share data with foreign governments. In fact, doing so is illegal under Article 271 of the Swiss Criminal code. The police gained access to the IP address because Swiss authorities chose to cooperate with the French government. ProtonMail also points out how Swiss authorities will only approve requests that meet Swiss legal standards.

Under Swiss law, ProtonMail should notify the user if a third party makes a request for their private data and if the data is for a criminal proceeding. However, there’s a big catch/ loophole here. On its law enforcement page, ProtonMail highlights that the notification can be delayed in the following cases:

That's based on the currently available laws. So if a law gets drafted that says "if we suspect someone to be complicit in criminal activity we want you to gather more data" we should just be fine with that because the authorities say so? Because the authorities are always infallible and incorruptible, right?

The details of this individual case isn't the problem, it's the precedent it sets that is. When Mullvad got raided for their logs there was nothing recovered because they don't store anything. Proton stores things based on if the authorities ask them to, and when they find out that it wasn't a terrorist or child-trafficker they go "woops we had no idea the account belonged to a climate activist."

The authorities aren't infallible. Some years back here in Sweden we had police raid, physically abuse, and kidnap a guy they suspected was a pedophile because he'd sent images of him and his 30 year old boyfriend having sex via Yahoo Mail. There's no reality where this man should've been fucking beaten up and traumatised the way he was, but it happened, and there was no recourse for him. Nowhere down the chain of responsibility did anyone get reprimanded or investigated for misconduct.

Complying with the law is such a bullshit fucking excuse.

permalink

fedilink

source

parent

hideshow 13 child comments

[–] Wildmimic@anarchist.nexus 13 points 1 year ago (3 children)

ProtonMail does not log things by default, but they can still be court ordered to do so by swiss authorities - if you want to run any business at all, you have to submit to a jurisdiction, you can only choose which one to run under. And even if your chosen authority is alright by itself, it can still be misled by other jurisdictions like the French did, using the terror-cudgel against climate activists.

I can also recall that in this case Proton said that had their user actually bothered to use any VPN, even Proton's, there wouldn't have been anything to give to authorities except for an exit node IP.

permalink

fedilink

source

parent

hideshow 3 child comments

[–] Dojan@pawb.social -1 points 1 year ago* (2 children)

Proton said that had their user actually bothered to use any VPN, even Proton’s, there wouldn’t have been anything to give to authorities except for an exit node IP.

"She shouldn't have dressed that way."

Proton could do better, and it's ridiculous that there are people out here okay with them not doing better.

permalink

fedilink

source

parent

hideshow 2 child comments

[–] Arcka@midwest.social 3 points 1 year ago (1 child)

Our legal entity is in Sweden, where the law does not allow for any government to force us to spy on our users.

You'll agree that Proton doing better would require them to move to a different country, right?

Also Mullvad doesn't offer email accounts, does it? Seems that they couldn't have a 'no user data' policy if they did since the emails would be exactly that.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] Dojan@pawb.social -1 points 1 year ago*

You’ll agree that Proton doing better would require them to move to a different country, right?

I'm okay with this. Sweden isn't exactly known as a bastion of freedom. Our current minister of equality (Liberals) is pushing for a porn ban. The EU proposal colloquially called "Chat Control" was originally put forth by the Swedish EU Commissioner Ylva Johansson who belongs to the Social Democrats.

Also Mullvad doesn’t offer email accounts, does it? Seems that they couldn’t have a ‘no user data’ policy if they did since the emails would be exactly that.

You'll forgive me if I don't feel like it's productive to repeat myself, but if you genuinely care for a response you can view it here: https://pawb.social/comment/18804733

Have a good one.

permalink

fedilink

source

parent

[+] _cryptagion@anarchist.nexus 7 points 1 year ago (8 children)

[deleted]

permalink

fedilink

source

parent

hideshow 8 child comments

[–] Dojan@pawb.social -5 points 1 year ago (7 children)

Right, because corporations are widely known for going to prison when they break the law. Where exactly did they imprison Facebook for interfering in elections? Running illegal experiments on people? Pirating books and pornography? Surveilling children and selling their data?

Look at Mullvad. They've denied access to their data multiple times, they got raided, and nothing of use was recoverable. That's what respect for privacy looks like. Proton could set their infrastructure up in this fashion, but instead they've chosen to just hand out user data freely.

permalink

fedilink

source

parent

hideshow 7 child comments

[+] _cryptagion@anarchist.nexus 5 points 1 year ago (6 children)

[deleted]

permalink

fedilink

source

parent

hideshow 6 child comments

[–] Dojan@pawb.social -2 points 1 year ago (5 children)

So Proton's no-log policy is an apple and Mullvad's no-log policy is an orange, is what you're saying?

permalink

fedilink

source

parent

hideshow 5 child comments

[+] _cryptagion@anarchist.nexus 3 points 1 year ago (4 children)

[deleted]

permalink

fedilink

source

parent

hideshow 4 child comments

[–] Dojan@pawb.social -1 points 1 year ago* (3 children)

I'm comparing Mullvad (a company) to Proton (a company) not their products. They both have a no-log policy (that's a company policy) only one is actually no logs, and the other is "we sometimes log." I don't think you're stupid either, so I don't get what's not getting through.

permalink

fedilink

source

parent

hideshow 3 child comments

[+] _cryptagion@anarchist.nexus 2 points 1 year ago (2 children)

[deleted]

permalink

fedilink

source

parent

hideshow 2 child comments

[–] Dojan@pawb.social 0 points 1 year ago (1 child)

But like Proton, their VPN is incapable of logging access.

Mullvad's VPN is incapable of doing so because their infrastructure is entirely built on volatile memory. This obviously doesn't work with email because the emails need to persist, but this is isn't a very big problem as that storage is encrypted.

My problem here is that access logs don't need to be stored permanently. That could definitely be stored on a volatile medium, and then authorities could come over and confiscate it as much as they want. That sort of software architecture is entirely possible to set up, but Proton has made a decision not to.

“No personal information is required to create your secure email account. By default, we do not keep any IP logs which can be linked to your anonymous email account. Your privacy comes first.” ~Protonmail.com

That is a choice. They could've chosen to not comply, they could've chosen to let the authorities raid their servers, and had their servers been set up in such a fashion that no data could be obtained, there wouldn't be a problem.

They've chosen instead to log and give up information on a climate activist; not a ring of traffickers, or a terrorist group, but some dude or dudette that thinks that climate change is a bit of a problem and that the people in charge aren't doing enough about it.

You’re being dishonest, is what’s not getting through.

I guess we'll have to agree to disagree. Do I realise that this creates legal problems for Proton? Yeah. So what? They're a corporation, they get to deal with it. What this incident has shown is that their word doesn't mean a thing. What happens when the fascist American regime starts demanding information on dissenters? Are they just going to fold and serve up whatever they ask on a silver platter, too?

What's dishonest is saying "we don't log, except when we do, and only when they're serious criminals, or climate activists."

permalink

fedilink

source

parent

hideshow 1 child comment

[–] Cabbage_Pout61@lemmy.world 2 points 1 year ago

To be fair, the IP is basically the only thing they can get, due their encryption they have access to the email body, which complies with privacy, but not anonymity.

permalink

fedilink

source

parent

[–] lauha@lemmy.world 5 points 1 year ago (1 child)

Legal entity that doesn't comply with the law is simply not possible. If you think otherwise, you're being really naive

permalink

fedilink

source

parent

hideshow 1 child comment

[–] mjr@infosec.pub 0 points 1 year ago

And yet, legal entities are often found guilty of not complying with the law. I think people were expecting Proton to at least try to fight a morally-questionable court order.

permalink

fedilink

source

parent

[–] mjr@infosec.pub 3 points 1 year ago* (last edited 1 year ago) (6 children)

They said things that led the unwary to trust they wouldn't. Remember, this isn't some terrorist mass-murderer they handed over, but apparently an anti-gentrification youth activist linked to Greta Thunberg's campaign groups.

Edit to add: in particular, Proton used to claim 'your privacy comes first' but this case suggests in reality, the Swiss government's help for French police comes first.

permalink

fedilink

source

parent

hideshow 6 child comments

[+] _cryptagion@anarchist.nexus 13 points 1 year ago (5 children)

[deleted]

permalink

fedilink

source

parent

hideshow 5 child comments

[–] village604@adultswim.fan 4 points 1 year ago (4 children)

In fact, they frequently say that they'll comply with orders from the Swiss government.

permalink

fedilink

source

parent

hideshow 4 child comments

[+] _cryptagion@anarchist.nexus 3 points 1 year ago (3 children)

[deleted]

permalink

fedilink

source

parent

hideshow 3 child comments

[–] village604@adultswim.fan 2 points 1 year ago (2 children)

I meant Proton is pretty open about complying with the Swiss government

permalink

fedilink

source

parent

hideshow 2 child comments

[+] _cryptagion@anarchist.nexus 3 points 1 year ago (1 child)

[deleted]

permalink

fedilink

source

parent

hideshow 1 child comment

[–] village604@adultswim.fan 3 points 1 year ago

Not to mention that if proton refused to comply and got shut down, they'd be screwing over all of their customers.

permalink

fedilink

source

parent

[–] Goodlucksil@lemmy.dbzer0.com 6 points 1 year ago (1 child)

Please tell me a mail client that doesn't comply with national laws.

permalink

fedilink

source

parent

hideshow 1 child comment

[–] unexposedhazard@discuss.tchncs.de 2 points 1 year ago

I never said anything about complying with laws, people just interpreted it that way. Of course everyone will comply with local laws or secret government orders that come with threats of imprisonment. I dont know if Proton was required to log this data in the first place, but if they were then this specific situations is not their fault.

The issue with Proton isnt that they follow laws, but that they portray themselves like they are better or more private than others when they are just not. Bigger = worse in the tech world. Whenever too many people are using services of a single company, it becomes an attractive surveillance target.

What im also annoyed about is people being surprised by this and these headlines that make it look like its some sort of betrayal. You should always be worried about your privacy when you put data on a computer that isnt in your physical possession. Proton isnt trustworthy because nobody is trustworthy except yourself.

permalink

fedilink

source

parent

[–] rozodru@pie.andmc.ca -1 points 1 year ago (6 children)

it's always disappointing when people all about FOSS and shit suggest Proton to people looking to switch from google. no, don't do that. use Tuta or self host or ANYTHING other than Proton. it's such a shit company that does not deserve the praise they receive.

permalink

fedilink

source

parent

hideshow 6 child comments

[–] mjr@infosec.pub 5 points 1 year ago

Tuta are also a for-profit company, aren't they? Just one that currently has better published positions than most. Use them, but make sure you keep a path to the exit door in view.