top 95 comments

sorted by: hot top controversial new old
[–] 39 points 10 months ago (13 children)

I using proton more as a middle finger to google than anything else and at that it works fine.

  • source
  • hideshow 13 child comments
  • [+] -6 points 10 months ago (11 children)

    The best middle finger is not relying on commercial platforms, go libre and self host

  • source
  • parent
  • hideshow 11 child comments
  • [–] 22 points 10 months ago (10 children)

    Self hosting email is impractical. The tech titans already ruined that.

  • source
  • parent
  • hideshow 10 child comments
  • [–] 1 point 10 months ago (3 children)

    There are much better and cheaper email hosts than Proton, and they give you better control.

    But you're not entirely right. Self hosting email is very possible, there are a few details to learn, but its not dead.

  • source
  • parent
  • hideshow 3 child comments
  • [–] 5 points 10 months ago (2 children)

    They have a point, you have one chance to get your self-hosted emails config correct. If you fail or mess up somewhere your domain will get added to a bunch of anti-spam lists that major providors use and cross-reference. If that happens your domain will just be branded as spam and will never be able to effectivly use your fancy service email.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 10 months ago (1 child)

    That's true, but getting the config right is not that hard nowadays. At least not harder than setting up a Jellyfin server for the first time.

    I used to do custom email solutions for outreach agencies, people who needed to send 500 emails a day without getting flagged as spam. That's was difficult. Your personal email? Not even an afternoon and its done and warmed.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 10 months ago

    Honestly, something I would like to take a crack at, but fearing getting my domain black-listed has prevented me from attempting it.

    If the wizard wishes to share their wisdom, im all ears.

    Ill add it to the goals for 2026.

  • source
  • parent
  • [–] 1 point 10 months ago (5 children)

    Self hosting email is impractical. The tech titans already ruined that.

    …when was that memo released? Looking back at the last quarter-century-plus of self-hosting, and it’s damn obvious I missed it.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 6 points 10 months ago (3 children)
  • load more comments (1 reply)
    [–] 192 points 10 months ago (25 children)

    Once again - Proton is legally obligated to comply with the laws of the country in which they are based. This isn't specific to Proton, and they are not going behind your back to do this. In case it's not clear, this data is directly from Proton.

  • source
  • hideshow 25 child comments
  • [–] 47 points 10 months ago (9 children)

    Yeah, this is not really an own against Proton... There's other actual issues with the services and leadership that are more serious

  • source
  • parent
  • hideshow 9 child comments
  • [–] 11 points 10 months ago (8 children)

    The one comment by one person on the 5-person board who was supportive of one singular person that Trump had picked? That one?

    I'm not a fanboy here. I just hate misinformation.

  • source
  • parent
  • hideshow 8 child comments
  • [–] 25 points 10 months ago (2 children)

    And thanked Trump for their effort against BigTech.

    You hate misinformation but you sure know how to cherry pick.

  • source
  • parent
  • hideshow 2 child comments
  • [–] -1 points 10 months ago (3 children)

    What's your motivation to downplay it, fanboyism?

  • source
  • parent
  • hideshow 3 child comments
  • [–] 7 points 10 months ago* (2 children)

    Who said anything about downplaying? This is how law works. If you are a company operating in any particular country, you have a legal obligation to follow the laws of said country. And if that means handing over data because you were subpoenaed? Tough titties, cough it up. Or get arrested for failing to comply. And this includes your own data if you choose to self-host your own email.

    Don't mistake me understanding the law for agreeing with the law.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 5 points 10 months ago (1 child)

    You downplayed the positive remarks towards Trump by claiming it was "one of five" instead of a co-founder and CEO.

    To give the full X post that you seemed to not be aware of when claiming "misinformation" through others;

    (First sentence is what you've claimed people pull out of context) Great pick by @realDonaldTrump

    The rest of his post was:

    . 10 years ago, Republicans were the party of big business and Dems stood for the little guys, but today the tables have completely turned. People forget that the current antitrust actions against Big Tech were started under the first Trump admin.

    Now if this is enough to dislike proton is up to debate, especially after their announcement back and forth afterwards. Claiming. Like you did, that it's "just praising the choice for one role by one of five board members" though ... Sounds like "downplaying" to me.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 11 points 10 months ago* (last edited 10 months ago) (2 children)

    Imagine the Orange government demanding some delicate data for some political or pretty reason - should provider still comply? What if Chinese government does the same? Also I might be mistaken, but doesn't US force providers not to disclose the request to affected party, at least they can?

  • source
  • parent
  • hideshow 2 child comments
  • [–] 12 points 10 months ago*

    Imagine the Orange government demanding some delicate data for some political or pretty reason - should provider still comply?

    Believe it or not - when legally obligated, even providers like Google and Apple can and do comply.

    What if Chinese government does the same?

    See above. If a company is operating in China, that company (or branch) has to comply with the local laws. There are no ifs, ands, or buts about it.

    Also I might be mistaken, but doesn’t US force providers not to disclose the request to affected party, at least they can?

    I wouldn't be surprised in the slightest if that was the case.

  • source
  • parent
  • [+] 17 points 10 months ago* (last edited 10 months ago) (8 children)
  • [–] 22 points 10 months ago (1 child)
  • [–] 2 points 10 months ago

    Link, for most of the people in this thread surprised that Proton does what it's pretty clear in saying they'll do.

    And people getting into trouble for using proton for stuff they are saying not to do.

    https://proton.me/blog/protonmail-threat-model

    Not recommended

    If you are attempting to leak state secrets (as was the case of Edward Snowden) or going up against a powerful state adversary, email may not be the most secure medium for communications. The Internet is generally not anonymous, and if you are breaking Swiss law, a law-abiding company such as Proton Mail can be legally compelled to log your IP address. A powerful state adversary will also be better positioned to launch one of the attacks described above against you, which may negate the privacy protection provided by Proton Mail. While we can offer more protection and security, we cannot guarantee your safety against a powerful adversary.

  • source
  • parent
  • [–] 16 points 10 months ago* (1 child)

    I just want a low cost VPN to get around in-state censorship and the occasional bit of piracy. I'm not running a Wikileaks fork or trying to do OpSec for The Revolution.

    If you're spinning up your own version of Silk Road, maybe consider a home lab instead of relying on untrusted third parties.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 17 points 10 months ago* (1 child)

    No it doesn't contradict their advertising. They've been completely open about this the entire time.

    And they're not providing anything other than account details per the infographic. Account data remains encrypted

    It's on you if you thought a business would break the law for you.

  • source
  • parent
  • hideshow 1 child comment
  • [+] -4 points 10 months ago* (last edited 10 months ago) (1 child)
  • [–] 23 points 10 months ago* (last edited 10 months ago)

    It is safe; your data is still encrypted. They only provide account metadata.

    You're confusing privacy with anonymity.

    Edit: and furthermore, Proton does have the ability for you to set up your account anonymously. You can use a burner recovery email and pay with Bitcoin.

  • source
  • parent
  • load more comments (-1 replies)
  • [–] 2 points 10 months ago

    They continue to convey a different impression; even though they provide such data, they still advertise with certainty, etc…

    Is there any information about what kind of data they shared?

  • source
  • parent
  • load more comments (-1 replies)
    [–] 23 points 10 months ago

    Granted, it’s been awhile since I read this, but don’t their subpoenas driven info essentially say yes, this is so and so’s email account with no discourse content due to encryption?

  • source
  • [–] 55 points 10 months ago (15 children)

    "From time to time, Proton may be legally compelled to disclose certain user information to Swiss authorities, as detailed in our Privacy Policy. This can happen if Swiss law is broken. As stated in our Privacy Policy, all emails, files and invites are encrypted and we have no means to decrypt them. "

  • source
  • hideshow 15 child comments
  • [+] 12 points 10 months ago* (2 children)
  • [–] 0 points 10 months ago (1 child)

    it was claimed that there were no logs, no IP addresses, etc.

    ...by default. They never claimed that they would defy court orders.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 10 points 10 months ago*

    That doesn't mean anything.

    If you "by default" don't log, then when receiving a court order, there is nothing to hand over which is the entire point. If,magically, logs from the past 5 years when they said there were "no logs" show up, that means they were lying about no logs.

    Just like they now advertise that your data is fully end to end encrypted and even they can't see it.

    If, with a court order, they are able to decrypt and hand over your data, then they were lying in the first place that they couldn't read your data and it isn't end to end encrypted

    Court orders aren't some magical thing that go back in time and redo history. The entire point of these heavily advertised precautions is exactly against court orders by corrupt, tyrannical governments using the law as a political or fascist blunt weapon against citizens.

  • source
  • parent
  • [–] -3 points 10 months ago (11 children)

    If they (proton) have the keys, doesn't matter if they encrypted your data. They must have the keys because I can log into mail from different clients and read all emails without having to insert my key.

  • source
  • parent
  • hideshow 11 child comments
  • [–] 13 points 10 months ago* (9 children)

    Proton stores your encrypted private key . An encrypted private key does not allow them to read your email or files.

    When you log into a new device:
    Proton sends the encrypted private key to your device.
    You type your password.
    ** Your device** (not Proton's server) uses the password to decrypt the private key locally in your browser or app memory.

    That decrypted key is then used to decrypt your emails on your device. Proton mail sends you just the encrypted text.

    There is one potential security issue:

    Since Proton serves the website code (HTML/JavaScript) that performs the encryption, you have to trust that they serve you honest code. Proton could theoretically alter their website code to capture your password the next time you log in, which theoretically a government can force them to do.

    However, this is a different threat than "they have the keys." Currently, they possess the keys only in a form they mathematically cannot unlock.

  • source
  • parent
  • hideshow 9 child comments
  • [–] -5 points 10 months ago* (last edited 10 months ago) (8 children)

    If the key is the same password you use to login, then they already have the key. They may not store it unhashed, but you transmit it to them every time you login. If law enforcement forces Proton, or if Proton turns evil (or gets infiltrated by a three letter agency), they can use it from the auth to decrypt your key and your data.
    Plus, a bad actor having access to the encrypted key is free to brute force it. It may be hard but not guaranteed to stay hard forever.

    Edit: didn't realize I was in a Proton fanboy community where you can't criticize or ponder the service security...

  • source
  • parent
  • hideshow 8 child comments
  • [–] 9 points 10 months ago (7 children)

    You don't send them the password. The password never leaves your device. The password is the decryption key to decrypt your encrypted private key, which is what they send to your device. This is why, for Proton Mail, and others that use this technique, it is imperative to have a strong password to protect your private key.

  • source
  • parent
  • hideshow 7 child comments
  • [–] 1 point 10 months ago* (last edited 10 months ago) (6 children)

    How do they authenticate* you? They just send the encrypted key and if you can decrypt it then it's you?
    If so I can request any account encrypted key and try to brute force it offline

  • source
  • parent
  • hideshow 6 child comments
  • [–] 4 points 10 months ago (5 children)

    How do they authenticate* you?

    I'm also interested in that, but

    I can request any account encrypted key and try to brute force it offline

    This is likely wrong, any password would allow you to produce a valid key from an encrypted key, it will not be a correct key, so you will fail during decryption, but it will take a lot of time to check and may not be easy to automate.

    Regarding the auth, they may provide you with a challenge that is encrypted with your public key, and if you have decrypted it correctly, authenticate you, but I don't know how it's done or should be done.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 10 months ago (4 children)

    it will not be a correct key, so you will fail during decryption, but it will take a lot of time to check and may not be easy to automate.

    If you have any way to check the key validity offline (for example, you subpoena the encrypted data) then it's trivial to check and automate.
    Of course not everybody is capable of this, but it's becoming less and less difficult to brute force it, and renting a few hours of GPU time to do it is within the means of small bad actors.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 10 months ago* (last edited 10 months ago) (1 child)

    If you have any way to check the key validity offline (for example, you subpoena the encrypted data) then it's trivial to check and automate.

    Trivial to automate, yes. The rest is a question of how long it takes to compute, that’s the basic rules of cryptography:

    • good algorithms are computationally more expensive to solve in one direction than the other
    • the hardware of tomorrow will more easily solve the cryptography of today, making it important to rotate your bits into new algorithms as old ones become more solvable
    • big business and big government have more power to throw at the problem, but not infinitely so; where will you fall on their wait list?

    Lack of physical access to your files protects you against casual inquiries by businesses and local governments. If you’re a person of interest, they are breaking down your door and getting your bits unless they self destruct or are in a country they can’t bully.

    In summary:

    • Don’t be a person of interest if you can avoid it.
    • If you live somewhere that hurting a politician’s feelings (or having the wrong demographic) will make you a person of interest, assume they will get physical access to your bits unless those bits are in an unfriendly country. What country do you want them in?
    • Assume they will get their hands on your bits anyway. How easy are they to decrypt, and will the juice be worth the squeeze?
  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 10 months ago*

    Still, the idea is that Proton has everything they need to access your data (your encrypted bits, your encrypted key, and your password you send them every time you login). You have no guarantee that they don't have something (intentionally or not) that can catch this and extract data about you.
    You also (and more importantly) have no guarantee that the Swiss government can't or won't force them to implement such systems, and hand over your data.
    They already lied about not storing your IP until a judge ordered Proton to produce it for a French national. They have since redacted their privacy policy to say they may store such data about you if requested. They can do the same to get your key.

    No matter how, if they possess the keys, it's not your crypto not secure.

  • source
  • parent
  • [–] 1 point 10 months ago (1 child)

    Renting a few hours of GPU may not cut it, depending on how long the key is, but you're right, getting some data offline would help in breaking the encryption

  • source
  • parent
  • hideshow 1 child comment
  • load more comments (-1 replies)
    [–] 61 points 10 months ago (7 children)

    I don’t think that’s bad on Proton’s part. They are obeying the law they are obliged to obey.

  • source
  • hideshow 7 child comments
  • [+] 9 points 10 months ago* (1 child)
  • [–] 23 points 10 months ago

    Privacy is not anonymity. In this case they were required to supply IP addresses of users logging into a certain account in an active investigation.

    As usual, the devil is in the details—ProtonMail’s original policy simply said that the service does not keep IP logs “by default.” However, as a Swiss company itself, ProtonMail was obliged to comply with a Swiss court’s injunction demanding that it begin logging IP address and browser fingerprint information for a particular ProtonMail account.

  • source
  • parent
  • [–] 2 points 10 months ago (2 children)

    If you think all 30k plus were for legitimate reasons and not government control, I have a bridge to sell you in Brooklyn.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 4 points 10 months ago (1 child)

    I didn’t say that. I said they’re obeying the law they are obliged to obey. In other words, they’re not defying the courts. In a perfect world, they could defy the courts and get away with it in the interest of user privacy, but this is not a perfect world.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 10 months ago*

    You are right, they can argue that the government does not have sufficient reason. Many companies push back, but Proton is not one of them. I.e. Proton will not fight for you at all and they will follow court orders from other countries that are often questionable at best because "Interpol".

    I think my original point stands which should make most people seriously reconsider using them as they are not in the business of protecting their customers. In other words it is bad on their part and hand waving that away is pretty gross.

  • source
  • parent
  • load more comments (-1 replies)
    [–] 37 points 10 months ago

    Um...obviously, yeah? The alternative to complying with the authorities is to challenge it in court, which is extremely expensive. The important question is not how much information they do hand over, but how much information they have themselves. For example, if your keys are private, proton has nothing useful to share. This is why end-to-end encryption matters, the only avenue to real privacy is to make sure Proton has nothing useful to share. They're not going to host their servers on international waters.

  • source
  • [–] 41 points 10 months ago

    Proton threads are where the leftists equivalents to sovereign citizens pop up. Learn the technology a bit and about legal systems. That's what you have to operate within. If you want to feel more in control, encrypt everything yourself and only communicate/share in encrypted channels. At least then the primary sources of leaks is you and the receiver. If not, you're whining about streamlined performant services that will never be perfect enough for your standards because they operate legally rather than the user unfriendly solutions that you aren't willing to operate yourself for your life (maybe to be passed on) and/or won't run/can't afford to operate the illegal operation

  • source
  • [–] 4 points 10 months ago

    Have they also handed over private keys?

  • source
  • [–] -2 points 10 months ago (2 children)

    This view might be controversial but here goes. If someone is suspected of a major crime (rape, serious assault, murder, major theft), maybe it's okay for law enforcement to gain access to that person's online accounts.

    People might say "but if the government has the power to do that, one day they could do it to you, or they could use those powers to oppress anybody who criticises the government". But isn't that like saying "if you build prisons then one day an authoritarian government might put any critic of the government in those prisons"?

  • source
  • hideshow 2 child comments
  • load more comments (1 reply)
    [–] -1 points 10 months ago (21 children)

    Dang! So what's the preferred email app? The preferred email provider?

  • source
  • hideshow 21 child comments
  • [–] 10 points 10 months ago (5 children)

    Any legal service has too give away what they save to the authorities by law. So you need to find an email service that saves nothing about you.

  • source
  • parent
  • hideshow 5 child comments
  • [–] 1 point 10 months ago (4 children)

    My nose keeps pointing towards selfhosting. TY!

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 10 months ago (2 children)

    If anything, self-hosting puts you more at risk, since in that case the government will know exactly who to lock up, or $5 wrench, until they get the information they want

  • source
  • parent
  • hideshow 2 child comments
  • [–] 10 points 10 months ago (13 children)

    For all questions: your own.

    Every company has to comply with the laws of the country in which they operate, and no company is going to go to jail for you. There's other encrypted email providers, but they will still have to abide by their local laws. The best you can hope for is that they have minimal data on you and that anything potentially incriminating is encrypted and can only be decrypted by you.

  • source
  • parent
  • hideshow 13 child comments
  • [–] 4 points 10 months ago (10 children)

    My nose keeps pointing towards selfhosting. TY!

  • source
  • parent
  • hideshow 10 child comments
  • [–] 7 points 10 months ago (8 children)

    I mean, you need to abide by laws even when you self host. I'm not saying it's likely, but if you self host and the authorities legally demand records from you, are you prepared to go to court or prison over it?

  • source
  • parent
  • hideshow 8 child comments
  • [–] 0 points 10 months ago (7 children)

    Lol what?

    If I am in control of the data and I have a reason to don't disclose said data, guess what's gonna happen as soon as they demand it?

  • source
  • parent
  • hideshow 7 child comments
  • [–] 6 points 10 months ago (6 children)

    Destruction of evidence is also a crime in most places.

  • source
  • parent
  • hideshow 6 child comments
  • [–] 1 point 10 months ago (5 children)
  • [–] 5 points 10 months ago (4 children)

    Evidence: "We know you had this data based on emails between you and X entity, who already gave us emails and confirmed it was with you who they were communicating. We know you destroyed hard drives based on the fact that we found hard drive remains in your trash within 24 hours of receiving the subpoena. Cough up the data or face prison time."

    It's not hard to solve for X when you know the rest of the equation.

  • source
  • parent
  • hideshow 4 child comments
  • [–] 4 points 10 months ago (2 children)

    It very much depends on your local laws. Despite the current administration, the law in the US, for example, is that you do not have to divulge passwords (a Fifth Amendment right to silence). You can hand over your entire encrypted database intact, no destruction needed, and unless the authorities can decrypt it, it's useless evidence in court. Prosecutors may still try to build a case without that evidence (as you pointed out by getting decrypted correspondence with an accomplice), but it's not illegal to hand over encrypted data, even if they demand that you decrypt it; you are under no legal obligation to help incriminate yourself.

    That right may not exist in other countries, so as always, one should know their individual rights and threat model.

  • source
  • parent
  • hideshow 2 child comments
  • [–] 2 points 10 months ago (1 child)

    In Belgium, a judge can order you to give your phone password (and I would guess a decryption key too) and not complying with it risks imprisonment and a fine.
    So like you say it entirely depends on the local laws. Most of the discussion around Proton here should focus on Swiss laws instead of projecting based on their own local laws

  • source
  • parent
  • hideshow 1 child comment
  • [–] 1 point 10 months ago

    LMAO

    We know you destroyed hard drives based on the fact that we found hard drive remains in your trash within 24 hours of receiving the subpoena

    Why should I have to destroy the hard drives and throw them in the trash? 🤣

  • source
  • parent
  • [–] 4 points 10 months ago (1 child)

    , and no company is going to go to jail for you.

    Assnuts. They'd not go to jail anyway. Companies pay fines at most, you might arrest a specific legal representative (one of 123456789 employees of the company) for three days while the lawyer comes up with better papers, but companies never, meaningfully go to jail.

  • source
  • parent
  • hideshow 1 child comment
  • [–] 5 points 10 months ago

    Right. The point is that they're not going to do you any favors with regard to the law. They have zero incentive to fight the law on your behalf, because your relationship is purely transactional.

    Another way to say it is, "No company is going to break the law for you."

  • source
  • parent
  • load more comments
    view more: next ›