14
Why aren't non-selfhosed AI models/apps private? (fedia.io)
submitted 6 months ago by to c/technology@beehaw.org
27 comments fedilink hide all child comments
you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 6 months ago* (14 children)

Not the real world. Just your imagination.

Corporations lie for profit. Where's the profit for Proton in keeping peoples AI queries, when they've been proven to not keep any other data? Literally they have nothing to gain, and everything to loose.

Skepticism and pessimism aren't the same thing. And baseless pessimism is just jaded. Jaded is the dark equivalent of naivety. They're both equally simplistic ignorance.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 14 child comments
    •
  • [–] 5 points 6 months ago* (6 children)

    there has been in the news several instances where proton has given to law enforcements information that have hold onto. in some cases regarding journalists.

    their answer is always "ah, yeah. we do keep that one, but not the other data"

    before you ask...an example https://privacyradar.com/news/privacy/proton-mail-payment-data-stop-cop-city-activist-identified/

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 3 points 6 months ago* (last edited 6 months ago) (5 children)

    Of course they have to keep some basic account data. And I think the last IP you logged in from. Also email data outside the BODY can't be encrypted. That's just how email works. So law enforcement can get all of that if they convince a Swiss court to order Proton.

    But no they don't keep or turn over anything that isn't technically required for the service to work. I don't know what you'd expect.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 2 points 6 months ago (4 children)

    in that particular case the people involved were identified through their recovery email which they did not hash like 'safe' other providers do. they have positioned themselves as safe even for activist and journalists and have failed to deliver in that account consistently.

    no surprise since their CEO is a MAGA guy

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 2 points 6 months ago (2 children)

    recovery email which they did not hash

    How do you recover an account on the other providers? Do you have to provide the same recovery email you set before during account recovery? If you hash the email, you have no way of reading it anymore, so someone has to provide it to you again.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 2 points 6 months ago

    you ask the user for it if they want to recover the account and hash it. if the hash matches your previously stored hash then you send the email

    other providers that position themselves as secure for activists or journalists do exactly that and they cannot handle that information

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 6 months ago*

    That's the only way I can imagine it working.

    People frequently confuse privacy with anonymity. Proton never claims you can't be identified. Only that your communications are as private a possible. Though they provide tools for you to ensure your anonymity if that's important to you.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 0 points 6 months ago

    When you say MAGA guy, do you mean that one time he said a single little policy of Rumps, might possibly not be terrible for everyone? Does that make him MAGA?

    Am I MAGA for not hating the Space Force, because it gave us 2 seasons of a fun comedy show?

  • permalink
  • fedilink
  • source
  • parent
  • [–] 2 points 6 months ago (6 children)

    can you link me your source about Proton being "proven to not keep any other data"?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 1 point 6 months ago* (last edited 6 months ago) (5 children)

    All the various 3rd party audits can be found here.

    Can you give me to a link to your source they're lying about it?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 5 child comments
    •
  • [–] 4 points 6 months ago (4 children)

    have you ever checked them?

    could you point me to where any of them proves that Proton isn't actually collecting any data?

    because I am only reading about penetration tests and such, which only tell me that their software is reliable against attackers, but that is not the point of the discussion.

    also it seems there is no audit for their AI assistant at the link you provided.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 4 child comments
    •
  • [–] 1 point 6 months ago (3 children)

    No, I haven't felt the need.

    Again, do you have any links with evidence to the contrary?

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 3 child comments
    •
  • [–] 5 points 6 months ago (2 children)

    then why did you link them?

    anyway, the point here is that they are the ones making claims, so they have the burden of proof.

    as I told you already, corporations lie to their customers all the time, so it is always better to be safe and wait for the actual proof before trusting any of them.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 2 child comments
    •
  • [–] 1 point 6 months ago* (1 child)

    You're not saying "I don't know". If you assume they're lying, you're also making a claim. One you can't back up in this case.

    And another place your confused, Proton isn't a typical corporate structure. It's owned by a non-profit, almost charity, effectively. One who's board of trustees is entirely scientists and engineers. Assuming they'll operate the same way a publicly traded corporation would is a big category error.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 6 months ago

    i don't assume they are lying, I simply don't blindly believe their advertising claims without tangible evidence.

    for example your claim of "no logging" is at best partially false, since their own privacy policy clearly states that IP addresses are at least temporarily collected, always and without exceptions.

    who is the owner and how the company is funded is not important here, they are selling products and advertising them through claims that need verification.

  • permalink
  • fedilink
  • source
  • parent