top 94 comments

sorted by: hot top controversial new old
[–] 191 points 1 year ago (23 children)

It’s also worth clarifying that ProtonMail doesn’t collect IP addresses by default. Instead, the monitoring/ logging starts after ProtonMail gets a legal request.

They still have to adhere to legal requests.

  • source
  • hideshow 23 child comments
  • [–] 47 points 1 year ago (2 children)

    they should inform the victim about it

  • source
  • parent
  • hideshow 2 child comments
  • [–] 90 points 1 year ago*

    Under Swiss law, ProtonMail should notify the user if a third party makes a request for their private data and if the data is for a criminal proceeding. However, there’s a big catch/ loophole here. On its law enforcement page, ProtonMail highlights that the notification can be delayed in the following cases:

    Where providing notice is temporarily prohibited by the Swiss legal process itself, by Swiss court order, or applicable Swiss law;

    Where, based on information supplied by law enforcement, we, in our absolute discretion, believe that providing notice could create a risk of injury, death, or irreparable damage to an identifiable individual or group of individuals;

    As a general rule though, targeted users will eventually be informed and afforded the opportunity to object to the data request, either by ProtonMail or by Swiss authorities.

    This incident seems to fall under the first case, and that’s why ProtonMail didn’t notify the user. “Some orders are final and cannot be appealed, that’s just how the legal system works, not everything can be appealed. The user wasn’t notified for the same reason that you don’t notify a suspect before arresting them,” says ProtonMail founder Andy Yen.

  • source
  • parent
  • load more comments (1 reply)
  • [+] 14 points 1 year ago* (19 children)
  • [–] 34 points 1 year ago (8 children)

    if you’ve done nothing wrong

    Through who's lens?

    When a person is raped and seeking an abortion from Texas, do they deserve to be stripped of privacy? What about countries that see being gay a crime?

    I don't particularly care about proton outing people, but they should absolutely be restricted from advertising that they're more private or secure than any other provider out there.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 4 points 1 year ago (1 child)

    In the US right now, we're seeing this unfold. With the talk about classifying transgender folks as nihilistic violent extremists, who fucking knows.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    When freedom of speech breaks down, and the government is logging / tracking all social media on the front end and back end AND private communication tools are under attack, nothing is really safe anymore. Most disturbingly, once they deem X or Y to be unlawful, if you've EVER talked about X or Y, you're at risk.

  • source
  • parent
  • [+] -8 points 1 year ago (5 children)
  • [–] 11 points 1 year ago (4 children)

    that probably isn’t worth breaking down.

    I could say the same about your comment.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 26 points 1 year ago (9 children)

    should be a right, absolutely if you've done nothing wrong.

    The loss of privacy happens before the determination whether that person has done anything wrong. If the person's criminal case goes well, do you have a time machine to go back and not invade privacy?

  • source
  • parent
  • hideshow 9 child comments
  • [–] 1 point 1 year ago (7 children)

    I'm from the US and we have a system in place for search warrants. It's not a great system if I'm being honest, but I believe something of the sort will likely always be necessary. Do you have an alternative suggestion? I'm legitimately interested in different options.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 3 points 1 year ago (4 children)

    At the very least have controls in place ensuring disposal of data when court cases are fully processed to the full extent of appeals possibilities. Not allowing broad requests such as « everyone that connected to a given antenna for a month » or even « all connections toward NET or ASN whatever ». Additionally have the data fully isolated, removing all possibilities to cross use data initially granted for a purpose. I could go on for a while… It’s all a balance though, sometimes reuse leads to solving unrelated cases but it’s bound to the imperfections of local authorities everywhere one’s data can be requested.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 1 point 1 year ago (3 children)

    Agreed on all counts, and that's mostly how warrants should work, but that does not address the persons point. They seem to suggest full privacy should exist until found guilty of a crime.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 1 point 1 year ago (2 children)

    That’s definitively not how they work in Europe and even though I’m not expert in other regions I assume that it’s absolutely not the case in USA either. Technologically there’s no solutions fully preserving everyone’s privacy hence the importance of the local culture. But if the current practices improve with the likes of the controls I mentioned I would say that it would be good enough.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 1 year ago* (last edited 1 year ago) (1 child)

    I have added the text and a generic online summary below, but generally the issue is that judges are becoming more and more lenient and are unwilling to put their foot down when there are requests that are actual overreach. This is for a variety of reasons, and the law might need to be more clear/strict, but according to the letter and interpretation of the law they need to be specific about what they are looking for and it should minimize intrusion in general. Judges have just stopped caring in many cases, and of course the people carrying them out are trigger happy jackboots.

    Edit to add: we have a pretty open legal and recordkeeping system here in the US, so the removal from public record is pretty against that. I don't know enough about the particulars to state whether I think that would be a wholly good or bad thing. I think a transparent judicial process is important, and things submitted to the court generally have a high degree of specificity and do involve redactions when relevant. I don't know the benefits necessarily, but if proposed I would not necessarily be against sealing cases where the party was not found guilty.

    From Cornell law school: Amdt4.5.4 Particularity Requirement Fourth Amendment:

    The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.

    “The requirement that warrants shall particularly describe the things to be seized makes general searches under them impossible and prevents the seizure of one thing under a warrant describing another. As to what is to be taken, nothing is left to the discretion of the officer executing the warrant.” 1 This requirement thus acts to limit the scope of the search, as the executing officers should be limited to looking in places where the described object could be expected to be found.2 The purpose of the particularity requirement extends beyond prevention of general searches; it also assures the person whose property is being searched of the lawful authority of the executing officer and of the limits of his power to search. It follows, therefore, that the warrant itself must describe with particularity the items to be seized, or that such itemization must appear in documents incorporated by reference in the warrant and actually shown to the person whose property is to be searched.3

    Footnotes 1 Marron v. United States, 275 U.S. 192, 196 (1927). See Stanford v. Texas, 379 U.S. 476 (1965). Of course, police who are lawfully on the premises pursuant to a warrant may seize evidence of crime in “plain view” even if that evidence is not described in the warrant. Coolidge v. New Hampshire, 403 U.S. 443, 464–71 (1971). back 2 In Terry v. Ohio, 392 U.S. 1, 17–19, (1968), the Court wrote: “This Court has held in the past that a search which is reasonable at its inception may violate the Fourth Amendment by virtue of its intolerable intensity and scope. Kremen v. United States, 353 U.S. 346 (1957); Go-Bart Importing Co. v. United States, 282 U.S. 344, 356–58 (1931); see United States v. Di Re, 332 U.S. 581, 586–87 (1948). The scope of the search must be ‘strictly tied to and justified by’ the circumstances which rendered its initiation permissible. Warden v. Hayden, 387 U.S. 294, 310 (1967) (Fortas, J., concurring); see, e.g., Preston v. United States, 376 U.S. 364, 367–368 (1964); Agnello v. United States, 269 U.S. 20, 30–31 (1925).” See also Andresen v. Maryland, 427 U.S. 463, 470–82 (1976), and id. at 484, 492–93 (Brennan, J., dissenting). In Stanley v. Georgia, 394 U.S. 557, 569 (1969), Justices Potter Stewart, William Brennan, and Byron White would have based the decision on the principle that a valid warrant for gambling paraphernalia did not authorize police upon discovering motion picture films in the course of the search to project the films to learn their contents. back 3 Groh v. Ramirez, 540 U.S. 551 (2004) (a search based on a warrant that did not describe the items to be seized was “plainly invalid” ; particularity contained in supporting documents not cross-referenced by the warrant and not accompanying the warrant is insufficient); United States v. Grubbs, 547 U.S. 90, 97, 99 (2006) (because the language of the Fourth Amendment “specifies only two matters that must be ‘particularly describ[ed]’ in the warrant: ‘the place to be searched’ and ‘the persons or things to be seized[,]’ . . . the Fourth Amendment does not require that the triggering condition for an anticipatory warrant be set forth in the warrant itself.” back

    Here's so generic information about the above: Requirements for a Valid Search Warrant

    The police who submit an affidavit supporting a warrant must attach a sworn, detailed statement. The officer must then appear before a neutral judge or magistrate. The judge will check to see if the officer has probable cause to execute the search.

    In Carroll v. United States, the U.S. Supreme Court held that probable cause exists when a police officer has facts and circumstances that provide a reasonably trustworthy basis to believe a suspect has committed or is about to commit a crime.

    If the police request a search warrant to search a location, the police must provide probable cause that evidence of a crime exists at that location. The officer must also state, with specificity, the items they are looking for.

    Reasonableness Requirement

    Even if the police have a warrant, their search must still be reasonable. Although the facts of the case dealt with a warrantless seizure, the court in Brinegar v. United States reiterated that the presence of a warrant does not give the police the power to conduct an unreasonable search.

    The police officer’s search must be reasonable, or the prosecutor won’t be able to use the evidence they find in court. For example, if the police are looking for a large suitcase that contains drugs, it wouldn’t be reasonable for them to look in your bedroom drawers. A large suitcase or duffel bag could not fit in a nightstand drawer.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 2 points 1 year ago

    And what I shared was based on my personal involvement on the topic. As I said somewhere in the thread my expertise is limited to one country in Europe so the legal framework is vastly different but the more human and technological considerations are likely very transferable. And indeed there are criteria for warrants but that would be subject to interpretation at all steps plus not everything goes via warrants. Judge being lenient isn’t also accounting for their own metrics and perspectives. And additionally a whole lot of my personal issues would be related to how data, even when acquired both legitimately and with some regard for ethics, is handled. And that needs to be addressed by police forces and their providers.

  • source
  • parent
  • [–] 1 point 1 year ago (1 child)

    It's an atrocious system, innocent people get killed every year over it.

  • source
  • parent
  • hideshow 1 child comment
  • I don't think the concept is inherently flawed, but the execution is obviously terribly flawed. If several people credibly report seeing someone burry a body in their yard, the description of which corresponds to a missing person, I understand how getting a warrant to at least visually inspect their property would be necessary to fully investigate this claim. I don't think this requires the kind of force we often see, but I don't see people offering alternatives to warrants in general. I understand that privacy is a fundamental right, but presumably that's where a judge would come in to decide if there was probable cause to partially suspend that right.

    I am open and interested in hearing alternatives, but I do not see them posed. I think what underlies the system would function fine with a less militarized group enforcing it.

  • source
  • parent
  • load more comments (1 reply)
  • [–] 40 points 1 year ago (6 children)

    The lesson here is despite what a service says, don't trust it and take the appropriate measures to cover your tracks.

    You can create an access the inbox through Tor at protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion

    The important thing is to always access it through Tor.

  • source
  • hideshow 6 child comments
  • [–] 22 points 1 year ago (2 children)

    Also pay attention to what the service says and what it doesn’t. We get into this spot regularly because of things people assumed about Protonmail without being told.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 1 year ago (2 children)

    You can create an access the inbox through Tor at protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion

    That's just such an easy link to memorise, isn't it? Just like the New Emergency Number

  • source
  • parent
  • hideshow 2 child comments
  • [–] 12 points 1 year ago

    Onion TLDs are inherently not human readable for many well documented reasons of varying levels of legitimacy.

    The idea is that you write it down ahead of time (bookmarks and password managers are a thing) and paste it into your TOR browser or bake it into your privacy oriented live USB.

  • source
  • parent
  • [+] 29 points 1 year ago (4 children)
  • [–] 7 points 1 year ago (3 children)

    There seems to be no suggestion yet that any crime was committed on/using ProtonMail itself. Just that it was a tool to track someone accused of offline crimes. So this comment feels like misdirection because there are probably options between being liable and effectively telling the cops where users are.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 4 points 1 year ago (2 children)

    They have to abide by court orders.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 16 points 1 year ago

    The IP isn't even that important. They straight gave up that person's phone number and identified them.

  • source
  • [–] 44 points 1 year ago

    Apart from it's an old story, discussed already back and forth, Proton's claims regarding privacy are really weak. Especially when it comes to presenting Switzerlamd as a privacy safehaven. Switzerland is a tax evasion savehaven, not a privacy safehaven, Proton. How Proton puts it: we provide world class privacy (but have to break our claims and comply with Swiss law immediately once there is a legitimate or not request from law enforcement, oepsie sorreyy!)

  • source
  • [–] 36 points 1 year ago* (5 children)

    Why is this a surprise? IP Logging is pretty normal for any service.

    2.5 IP logging: by default, we do not keep permanent IP logs in relation with your Account. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our Terms of Service (e.g. spamming, DDoS attacks against our infrastructure, brute force attacks). The legal basis of this processing is our legitimate interest to protect our service against non-compliant or fraudulent activities. If you enable authentication logging for your Account or voluntarily participate in Proton's advanced security program, the record of your login IP addresses is kept for as long as the feature is enabled. This feature is off by default, and all the records are deleted upon deactivation of the feature. The legal basis of this processing is consent, and you are free to opt in or opt out of that processing at any time in the security panel of your Account. The authentication logs feature records login attempts to your Account and does not track product-specific activity, such as VPN activity.

    Source: Their privacy policy.

  • source
  • hideshow 5 child comments
  • [–] 17 points 1 year ago (4 children)

    That’s some funny language around “May be obtained permanently” though. Is this minority report? Do they know ahead of time that someone is going to violate their TOS?

    That said, I’m not totally against proton mail. It’s a lot better than other free alternatives. Of which there are few left. I’m sure Gmail tracks the IP of your rectum.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 12 points 1 year ago (2 children)

    This seems necessary if they're to maintain an IP ban list. You shouldn't just be able to unban yourself by submitting an information deletion request.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 9 points 1 year ago

    I would rather they have funny language in their privacy policy opposed to mandatory logging, they have to cover themselves legally as well so they got to utilize legal-ise so they aren’t sued into the dirt.

    I’m sure Gmail tracks the IP of your rectum.

    I bet Google predicted you would say that!

  • source
  • parent
  • [–] 24 points 1 year ago* (2 children)

    So Protonmail was required to log the IP of the user after being ordered to via the proper international Swiss legal channeks, per Swiss/Europol law. And at some point recently, Protonmail thus removed the copy from their frontpage that advertised never tracking IPs.

    What the article doesn't really explain, is what exactly changed about Swiss or euro law? And when? What rules or acts have sprung up that made this possible? Or, was this always something that was possible that has only just now made precedent?

    It's important to hold accountable the named individuals who are harming individual security, safety, and trust in this manner so that they can be prevented from continuing to do so.

  • source
  • hideshow 2 child comments
  • [–] 7 points 1 year ago (1 child)

    Then what makes a privacy oriented service different from others when they can open a backdoor for government? The thing is government wants control and they will change laws for exactly that. What Proton should have done was to eliminate the chance of this happening in the first place. Why are they having a logging mechanism? Why don't they use RAM only servers or something like that? Privacy services should have the infrastructure and legal power to say "No", or they are lying.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 8 points 1 year ago

    Just switch over to a privacy focused mail service like... uh... like... well shit.

  • source
  • [–] 26 points 1 year ago (5 children)

    Proton are very open about what they do and don't provide.

    They're not going to protect you and they will turn on you the second they get a letter in the mail or a text from the cops.

    But what they DO provide is the ability to register an email address (with a domain that isn't blocked by most services) without providing any other information. And, from there, you can encrypt it yourself if it is a particularly sensitive message.

    As for IP logging? if only there were tools like VPNs and Tor to negate that.

  • source
  • hideshow 5 child comments
  • [–] 5 points 1 year ago (2 children)

    IMO if proton can change their stance and their policies (like their website no longer says emails are anonymous), then I don't think they are a good private service provider. The only thing going for proton now is that their emails are encrypted and can't be read by them.

    Who knows if a request came from a specific channel of the government that deals with crime, may be they will decrypt the content for them?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 year ago* (1 child)

    No.

    The "only thing going for" them is the ability to sign up with zero personal information. You can encrypt your emails with ANY service because it is you exchanging keys ahead of time and doing it locally before you even look up Job on usenet.

    Do not trust a third party to encrypt your sensitive communications for you. Do not trust a third party to protect you. Instead, look at what the the third party actually offers you and figure out how you can take advantage of that.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 1 year ago

    Do not trust a third party to encrypt your sensitive communications for you. Do not trust a third party to protect you. Instead, look at what the the third party actually offers you and figure out how you can take advantage of that.

    This is the kind of person that isn't worried about incognito market black mailing them.

  • source
  • parent
  • [–] 28 points 1 year ago

    Proton needs to get its head out of its ass and fire Andy already, grow a pair and get off Reddit and back onto Mastodon and face the backlash like actual adults.

  • source
  • proton is arm in arm with the us government and republicans, so it should be expected that they'll track and sell you out.

  • source
  • [–] 8 points 1 year ago (2 children)

    Nothing unexpected from a company that openly espouses fascism.

  • source
  • hideshow 2 child comments
  • [–] 7 points 1 year ago (5 children)

    I dont really blame Proton for this. Accessing anything on the internet on a clear connection and not through a VPN or TOR makes it your own damn fault when you get identified.

  • source
  • hideshow 5 child comments
  • [–] 0 points 1 year ago (4 children)

    Victim blaming at its finest!

  • source
  • parent
  • hideshow 4 child comments
  • [–] 3 points 1 year ago (3 children)

    I mean, I understand where you're coming from, they absolutely shouldn't log IPs. BUT, if you're committing crimes or even doing legal things the government doesn't like, it would behoove you to put in the absolute bare minimum of OPSEC at least.

    Like, some people know they have STDs and don't warn people and spread them, right? And while the spreader is obviously the problem there, some commonly accepted advice to the victim is "you should have worn a condom anyway." And they should have worn a condom to protect themselves (and also the spreader should be held liable.)

    Like the previous example, anyone using any online service (for secrety things) should know to put a VPN condom on before they put their data inside that sexy, slutty server rack. And like how contraceptives were that knowledge needs to be spread.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 14 points 1 year ago (36 children)

    Oh ffs. We have known for years that Proton is just a for profit company like any other. They dont give a fuck about you or your privacy. They never have and they never will.

  • source
  • hideshow 36 child comments
  • [–] 37 points 1 year ago (25 children)

    They complied with laws. Where is the issue?

  • source
  • parent
  • hideshow 25 child comments
  • [–] 18 points 1 year ago (17 children)
    1. Authoritarian regime decides that being critical of the regime is illegal and makes laws to support this.
    2. Activists use Proton for privacy.
    3. Regime demands that they give up data on activists.
    4. Proton complies with the laws.

    That’s the issue.

  • source
  • parent
  • hideshow 17 child comments
  • [+] 24 points 1 year ago (14 children)
  • [–] 7 points 1 year ago* (13 children)

    What data? Here it is the IP address and only under order by authorities.

    Whatever they gather. It says as much in the article; they started recording IPs once a request by the Swiss government came through.

    ProtonMail can’t directly share data with foreign governments. In fact, doing so is illegal under Article 271 of the Swiss Criminal code. The police gained access to the IP address because Swiss authorities chose to cooperate with the French government. ProtonMail also points out how Swiss authorities will only approve requests that meet Swiss legal standards.

    Under Swiss law, ProtonMail should notify the user if a third party makes a request for their private data and if the data is for a criminal proceeding. However, there’s a big catch/ loophole here. On its law enforcement page, ProtonMail highlights that the notification can be delayed in the following cases:

    That's based on the currently available laws. So if a law gets drafted that says "if we suspect someone to be complicit in criminal activity we want you to gather more data" we should just be fine with that because the authorities say so? Because the authorities are always infallible and incorruptible, right?

    The details of this individual case isn't the problem, it's the precedent it sets that is. When Mullvad got raided for their logs there was nothing recovered because they don't store anything. Proton stores things based on if the authorities ask them to, and when they find out that it wasn't a terrorist or child-trafficker they go "woops we had no idea the account belonged to a climate activist."

    The authorities aren't infallible. Some years back here in Sweden we had police raid, physically abuse, and kidnap a guy they suspected was a pedophile because he'd sent images of him and his 30 year old boyfriend having sex via Yahoo Mail. There's no reality where this man should've been fucking beaten up and traumatised the way he was, but it happened, and there was no recourse for him. Nowhere down the chain of responsibility did anyone get reprimanded or investigated for misconduct.

    Complying with the law is such a bullshit fucking excuse.

  • source
  • parent
  • hideshow 13 child comments
  • [–] 13 points 1 year ago (3 children)

    ProtonMail does not log things by default, but they can still be court ordered to do so by swiss authorities - if you want to run any business at all, you have to submit to a jurisdiction, you can only choose which one to run under. And even if your chosen authority is alright by itself, it can still be misled by other jurisdictions like the French did, using the terror-cudgel against climate activists.

    I can also recall that in this case Proton said that had their user actually bothered to use any VPN, even Proton's, there wouldn't have been anything to give to authorities except for an exit node IP.

  • source
  • parent
  • hideshow 3 child comments
  • [–] -1 points 1 year ago* (2 children)

    Proton said that had their user actually bothered to use any VPN, even Proton’s, there wouldn’t have been anything to give to authorities except for an exit node IP.

    "She shouldn't have dressed that way."

    Proton could do better, and it's ridiculous that there are people out here okay with them not doing better.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 3 points 1 year ago (1 child)

    Our legal entity is in Sweden, where the law does not allow for any government to force us to spy on our users.

    You'll agree that Proton doing better would require them to move to a different country, right?

    Also Mullvad doesn't offer email accounts, does it? Seems that they couldn't have a 'no user data' policy if they did since the emails would be exactly that.

  • source
  • parent
  • hideshow 1 child comment
  • [–] -1 points 1 year ago*

    You’ll agree that Proton doing better would require them to move to a different country, right?

    I'm okay with this. Sweden isn't exactly known as a bastion of freedom. Our current minister of equality (Liberals) is pushing for a porn ban. The EU proposal colloquially called "Chat Control" was originally put forth by the Swedish EU Commissioner Ylva Johansson who belongs to the Social Democrats.

    Also Mullvad doesn’t offer email accounts, does it? Seems that they couldn’t have a ‘no user data’ policy if they did since the emails would be exactly that.

    You'll forgive me if I don't feel like it's productive to repeat myself, but if you genuinely care for a response you can view it here: https://pawb.social/comment/18804733

    Have a good one.

  • source
  • parent
  • [+] 7 points 1 year ago (8 children)
  • [–] -5 points 1 year ago (7 children)

    Right, because corporations are widely known for going to prison when they break the law. Where exactly did they imprison Facebook for interfering in elections? Running illegal experiments on people? Pirating books and pornography? Surveilling children and selling their data?

    Look at Mullvad. They've denied access to their data multiple times, they got raided, and nothing of use was recoverable. That's what respect for privacy looks like. Proton could set their infrastructure up in this fashion, but instead they've chosen to just hand out user data freely.

  • source
  • parent
  • hideshow 7 child comments
  • [+] 5 points 1 year ago (6 children)
  • [–] -2 points 1 year ago (5 children)

    So Proton's no-log policy is an apple and Mullvad's no-log policy is an orange, is what you're saying?

  • source
  • parent
  • hideshow 5 child comments
  • [+] 3 points 1 year ago (4 children)
  • [–] -1 points 1 year ago* (3 children)

    I'm comparing Mullvad (a company) to Proton (a company) not their products. They both have a no-log policy (that's a company policy) only one is actually no logs, and the other is "we sometimes log." I don't think you're stupid either, so I don't get what's not getting through.

  • source
  • parent
  • hideshow 3 child comments
  • [+] 2 points 1 year ago (2 children)
  • [–] 0 points 1 year ago (1 child)

    But like Proton, their VPN is incapable of logging access.

    Mullvad's VPN is incapable of doing so because their infrastructure is entirely built on volatile memory. This obviously doesn't work with email because the emails need to persist, but this is isn't a very big problem as that storage is encrypted.

    My problem here is that access logs don't need to be stored permanently. That could definitely be stored on a volatile medium, and then authorities could come over and confiscate it as much as they want. That sort of software architecture is entirely possible to set up, but Proton has made a decision not to.

    “No personal information is required to create your secure email account. By default, we do not keep any IP logs which can be linked to your anonymous email account. Your privacy comes first.” ~Protonmail.com

    That is a choice. They could've chosen to not comply, they could've chosen to let the authorities raid their servers, and had their servers been set up in such a fashion that no data could be obtained, there wouldn't be a problem.

    They've chosen instead to log and give up information on a climate activist; not a ring of traffickers, or a terrorist group, but some dude or dudette that thinks that climate change is a bit of a problem and that the people in charge aren't doing enough about it.

    You’re being dishonest, is what’s not getting through.

    I guess we'll have to agree to disagree. Do I realise that this creates legal problems for Proton? Yeah. So what? They're a corporation, they get to deal with it. What this incident has shown is that their word doesn't mean a thing. What happens when the fascist American regime starts demanding information on dissenters? Are they just going to fold and serve up whatever they ask on a silver platter, too?

    What's dishonest is saying "we don't log, except when we do, and only when they're serious criminals, or climate activists."

  • source
  • parent
  • hideshow 1 child comment
  • [–] 3 points 1 year ago* (last edited 1 year ago) (6 children)

    They said things that led the unwary to trust they wouldn't. Remember, this isn't some terrorist mass-murderer they handed over, but apparently an anti-gentrification youth activist linked to Greta Thunberg's campaign groups.

    Edit to add: in particular, Proton used to claim 'your privacy comes first' but this case suggests in reality, the Swiss government's help for French police comes first.

  • source
  • parent
  • hideshow 6 child comments
  • [+] 13 points 1 year ago (5 children)
  • [–] 4 points 1 year ago (4 children)

    In fact, they frequently say that they'll comply with orders from the Swiss government.

  • source
  • parent
  • hideshow 4 child comments
  • [+] 3 points 1 year ago (3 children)
  • [–] 2 points 1 year ago (2 children)

    I meant Proton is pretty open about complying with the Swiss government

  • source
  • parent
  • hideshow 2 child comments
  • [–] 6 points 1 year ago (1 child)

    Please tell me a mail client that doesn't comply with national laws.

  • source
  • parent
  • hideshow 1 child comment
  • I never said anything about complying with laws, people just interpreted it that way. Of course everyone will comply with local laws or secret government orders that come with threats of imprisonment. I dont know if Proton was required to log this data in the first place, but if they were then this specific situations is not their fault.

    The issue with Proton isnt that they follow laws, but that they portray themselves like they are better or more private than others when they are just not. Bigger = worse in the tech world. Whenever too many people are using services of a single company, it becomes an attractive surveillance target.

    What im also annoyed about is people being surprised by this and these headlines that make it look like its some sort of betrayal. You should always be worried about your privacy when you put data on a computer that isnt in your physical possession. Proton isnt trustworthy because nobody is trustworthy except yourself.

  • source
  • parent
  • [–] -1 points 1 year ago (6 children)

    it's always disappointing when people all about FOSS and shit suggest Proton to people looking to switch from google. no, don't do that. use Tuta or self host or ANYTHING other than Proton. it's such a shit company that does not deserve the praise they receive.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 5 points 1 year ago

    Tuta are also a for-profit company, aren't they? Just one that currently has better published positions than most. Use them, but make sure you keep a path to the exit door in view.

  • source
  • parent
  • load more comments (5 replies)
  • load more comments (1 reply)
    [–] 2 points 1 year ago* (last edited 1 year ago)

    Journalists, activists and even lawyers on the side of activists should always use something like Tails. No matter what companies like Proton promise or what the law in the country they operate in says.

    https://tails.net/

  • source
  • load more comments
    view more: next ›