5 ms·

It is fucking straight up evil to disguise your marketing blog posts as "security guides" for at risk people. It is really sad that stuff like this is making it

It is fucking straight up evil to disguise your marketing blog posts as "security guides" for at risk people. It is really sad that stuff like this is making it to the HN front page. The advice given here is largely NOT good. There are only a few extremely limited scenarios where you might want to choose Protonmail over Gmail. Do not use Protonmail. And for gods sake, whatever you do don't follow the advice from this "guide" and use their "Secure VPN" service. Here's a much better guide, which wasn't written with the sole intention of selling you things https://techsolidarity.org/resources/basic_security.htm https://techsolidarity.org/resources/basic_security.htm EDIT: This is just way too good to not include in here https://protonvpn.com/secure-vpn https://protonvpn.com/secure-vpn >ProtonVPN comes with Tor support built-in. Through our selected Tor servers, you can route all your traffic through the Tor anonymity network and also access dark web sites. This provides a convenient way to access Onion sites with just a single click. These guys are trying to convince people to access .onion sites through their VPN using Tor nodes ran by them...

bgcollins 9y ago
Yeah, I never got protonmail. Perhaps the are legit, perhaps they are the Crypto AG of the 21st century. No way to tell.
ComodoHacker 9y ago
Do you have anything besides unfounded claims? >The advice given here is largely NOT good It may be insufficient, I agree, but what's particularly wrong with it? >don't follow the advice from this "guide" and use their "Secure VPN" service Again, do you have anything substantial? Known vulnerabilities? Negative experience? It's OK to sell things and write marketing blog posts. I'm pretty sure your company does it as well. And thanks for the link.
- ryanlol 9y ago
  >Again, do you have anything substantial? Known vulnerabilities? Negative experience? Since when is "public VPN services are bad" a claim which needs substantiating? As tptacek put it: VPN services. For when you want coffee-shop wireless network security, but in the comfort of your own home or hotel room. But these guys go further than most providers. These guys try to bait you into ditching Tor and relying on their Tor-as-a-service instead, which is nothing but malicious. >It may be insufficient, I agree, but what's particularly wrong with it? They tell you to use a VPN to avoid "government surveillance agencies. They try to get you to use their Tor-as-a-service, which is insane and completely defeats the purpose of using Tor. They recommend that you use their products instead of objectively better products by competitors, they don't even bother to mention the competing products. They suggest that using Protonmail to talk to non-protonmail users over email is at least somewhat secure, it is not. All the advice that doesn't amount to "use our product" is extremely limited. Key advice such as Don't use an Android phone is nowhere to be found. >It's OK to sell things and write marketing blog posts. I'm pretty sure your company does it as well. The critical difference is that my marketing blog posts do not pretend to be security guides for people who could literally get killed for following bad advice. We should absolutely be condemning Protonmail for putting this out. They can't claim to be a great provider for at-risk users while simultaneously putting them in further danger by giving them bad security advice.
  - ComodoHacker 9y ago
    >Since when is "public VPN services are bad" a claim which needs substantiating? You assume there are good VPN services. What are they? Private ones, self-maintained, run by a friend? For journalists, who are mostly not seasoned sysadmins and crypto experts, self-run VPN is worse. >But these guys go further than most providers. These guys try to bait you into ditching Tor and relying on their Tor-as-a-service instead, which is nothing but malicious. No, they don't. The say: "for ultimate anonymity you can also run Tor locally on your machine". >They tell you to use a VPN to avoid "government surveillance agencies. It's all about your threat model. For many journalists, their adversaries are not US TLAs, but less competent nation states TLAs. Using a service outside of their jurisdiction may be acceptable. >They try to get you to use their Tor-as-a-service, which is insane and completely defeats the purpose of using Tor. It's not more insane then trusting your email provider. But yes, you have to trust Proton, this should have been stressed more. And let me remind again, this is a guide for journalists, not for crypto-nerds. "Tor... can be tricky to set up, and can sometimes attract attention to yourself", which is true. >They recommend that you use their products instead of objectively better products by competitors, they don't even bother to mention the competing products. This is not a product comparison. >They suggest that using Protonmail to talk to non-protonmail users over email is at least somewhat secure, it is not. It is, for some scenarios. When both parties use providers who protect mail in transit and one of them also protects mail at rest, an attacker's options are very limited. >All the advice that doesn't amount to "use our product" is extremely limited. Key advice such as Don't use an Android phone is nowhere to be found. This doesn't make them "bad", but insufficient.
    - ryanlol 9y ago
      >You assume there are good VPN services. What are they? Private ones, self-maintained, run by a friend? For journalists, who are mostly not seasoned sysadmins and crypto experts, self-run VPN is worse. I do not assume that there are good public VPN services. Presumably a journalist would be using one provided by their employer or none at all. >No, they don't. The say: "for ultimate anonymity you can also run Tor locally on your machine". Yes, they do mention the possibility of running Tor locally. So what? They're still trying to push people to use their Tor gateway which is simply indefensible. >It's all about your threat model. For many journalists, their adversaries are not US TLAs, but less competent nation states TLAs. Using a service outside of their jurisdiction may be acceptable. Remember your username, don't think too little of "less competent nation states TLAs". :) Choosing to follow Protonmails advice involves taking stupid risks, you should not be taking stupid risks if you are worried about any TLAs. >It's not more insane then trusting your email provider. But yes, you have to trust Proton, this should have been stressed more. With email you hardly get a choice. There's no legitimate reason to ever have someone else run your Tor client for you. And we can already establish that Protonmail cannot be trusted. A trustworthy organization would never have released this "SECURITY GUIDE", nor would they ever try to get you to use their Tor client to access hidden services. >And let me remind again, this is a guide for journalists, not for crypto-nerds. "Tor... can be tricky to set up, and can sometimes attract attention to yourself", which is true. The first part is not true, Tor browser and Tor messenger are both very easy to use. The second part is true, but Tor isn't going to draw significantly more attention than Protonvpn. >This is not a product comparison. No, this claims to be a SECURITY GUIDE but is actually an ADVERTISEMENT. A legitimate SECURITY GUIDE would never recommend Protonmail over Gmail. A legitimate SECURITY GUIDE would never recommend ProtonVPN. A legitimate SECURITY GUIDE would never ever suggest taking advantage of ProtonVPNs "Tor VPN support". >This doesn't make them "bad", but insufficient. I strongly disagree with you. Posting this was absolutely unethical on protonmails part.
ekianjo 9y ago
> Here's a much better guide, which wasn't written with the sole intention of selling you things https://techsolidarity.org/resources/basic_security.htm https://techsolidarity.org/resources/basic_security.htm This contains good advices but also very doubtful ones. such as "use Whatsap", like something proprietary that is not decentralized? And use Apple devices/Chromebooks (where everything you do works/syncs in the cloud) as your primary device, you must be kidding... The only good security device would be "don't even own a smartphone" if you care about security at all. > Chrome as your browser. What a bad advice, since the code added by Google on top of Chromium can't be audited at all.
- ryanlol 9y ago
  >This contains good advices but also very doubtful ones. such as "use Whatsap", like something proprietary that is not decentralized? How is this "doubtful" advice? Whatsapp and Signal are literally the state of the art of encrypted messaging apps. There simply are no better options. What would you recommend instead? >And use Apple devices/Chromebooks (where everything you do works/syncs in the cloud) as your primary device, you must be kidding.. So what would you tell people to use instead? This is advice for "journalists" not "unemployed people". Google and Apple only have the best security teams in the world, why do you believe their services to be insecure? >The only good security device would be "don't even own a smartphone" if you care about security at all. What if you are a person who is actually trying to do something with their life? >What a bad advice, since the code added by Google on top of Chromium can't be audited at all. Why is that? Have you audited Chromium? Since when can't binary blobs be audited? What is the realistic worst case scenario here?
  - craftyguy 9y ago
    > Google and Apple only have the best security teams in the world, why do you believe their services to be insecure? As US-based companies, they are answerable to the US government. That makes them inherently insecure because your data and privacy is one shitty court order away from being released, at best.
    - 9y ago

bgcollins 9y ago

Yeah, I never got protonmail. Perhaps the are legit, perhaps they are the Crypto AG of the 21st century. No way to tell.

ComodoHacker 9y ago

Do you have anything besides unfounded claims? >The advice given here is largely NOT good It may be insufficient, I agree, but what's particularly wrong with it? >don't follow the advice from this "guide" and use their "Secure VPN" service Again, do you have anything substantial? Known vulnerabilities? Negative experience? It's OK to sell things and write marketing blog posts. I'm pretty sure your company does it as well. And thanks for the link.

ryanlol 9y ago
>Again, do you have anything substantial? Known vulnerabilities? Negative experience? Since when is "public VPN services are bad" a claim which needs substantiating? As tptacek put it: VPN services. For when you want coffee-shop wireless network security, but in the comfort of your own home or hotel room. But these guys go further than most providers. These guys try to bait you into ditching Tor and relying on their Tor-as-a-service instead, which is nothing but malicious. >It may be insufficient, I agree, but what's particularly wrong with it? They tell you to use a VPN to avoid "government surveillance agencies. They try to get you to use their Tor-as-a-service, which is insane and completely defeats the purpose of using Tor. They recommend that you use their products instead of objectively better products by competitors, they don't even bother to mention the competing products. They suggest that using Protonmail to talk to non-protonmail users over email is at least somewhat secure, it is not. All the advice that doesn't amount to "use our product" is extremely limited. Key advice such as Don't use an Android phone is nowhere to be found. >It's OK to sell things and write marketing blog posts. I'm pretty sure your company does it as well. The critical difference is that my marketing blog posts do not pretend to be security guides for people who could literally get killed for following bad advice. We should absolutely be condemning Protonmail for putting this out. They can't claim to be a great provider for at-risk users while simultaneously putting them in further danger by giving them bad security advice.
- ComodoHacker 9y ago
  >Since when is "public VPN services are bad" a claim which needs substantiating? You assume there are good VPN services. What are they? Private ones, self-maintained, run by a friend? For journalists, who are mostly not seasoned sysadmins and crypto experts, self-run VPN is worse. >But these guys go further than most providers. These guys try to bait you into ditching Tor and relying on their Tor-as-a-service instead, which is nothing but malicious. No, they don't. The say: "for ultimate anonymity you can also run Tor locally on your machine". >They tell you to use a VPN to avoid "government surveillance agencies. It's all about your threat model. For many journalists, their adversaries are not US TLAs, but less competent nation states TLAs. Using a service outside of their jurisdiction may be acceptable. >They try to get you to use their Tor-as-a-service, which is insane and completely defeats the purpose of using Tor. It's not more insane then trusting your email provider. But yes, you have to trust Proton, this should have been stressed more. And let me remind again, this is a guide for journalists, not for crypto-nerds. "Tor... can be tricky to set up, and can sometimes attract attention to yourself", which is true. >They recommend that you use their products instead of objectively better products by competitors, they don't even bother to mention the competing products. This is not a product comparison. >They suggest that using Protonmail to talk to non-protonmail users over email is at least somewhat secure, it is not. It is, for some scenarios. When both parties use providers who protect mail in transit and one of them also protects mail at rest, an attacker's options are very limited. >All the advice that doesn't amount to "use our product" is extremely limited. Key advice such as Don't use an Android phone is nowhere to be found. This doesn't make them "bad", but insufficient.
  - ryanlol 9y ago
    >You assume there are good VPN services. What are they? Private ones, self-maintained, run by a friend? For journalists, who are mostly not seasoned sysadmins and crypto experts, self-run VPN is worse. I do not assume that there are good public VPN services. Presumably a journalist would be using one provided by their employer or none at all. >No, they don't. The say: "for ultimate anonymity you can also run Tor locally on your machine". Yes, they do mention the possibility of running Tor locally. So what? They're still trying to push people to use their Tor gateway which is simply indefensible. >It's all about your threat model. For many journalists, their adversaries are not US TLAs, but less competent nation states TLAs. Using a service outside of their jurisdiction may be acceptable. Remember your username, don't think too little of "less competent nation states TLAs". :) Choosing to follow Protonmails advice involves taking stupid risks, you should not be taking stupid risks if you are worried about any TLAs. >It's not more insane then trusting your email provider. But yes, you have to trust Proton, this should have been stressed more. With email you hardly get a choice. There's no legitimate reason to ever have someone else run your Tor client for you. And we can already establish that Protonmail cannot be trusted. A trustworthy organization would never have released this "SECURITY GUIDE", nor would they ever try to get you to use their Tor client to access hidden services. >And let me remind again, this is a guide for journalists, not for crypto-nerds. "Tor... can be tricky to set up, and can sometimes attract attention to yourself", which is true. The first part is not true, Tor browser and Tor messenger are both very easy to use. The second part is true, but Tor isn't going to draw significantly more attention than Protonvpn. >This is not a product comparison. No, this claims to be a SECURITY GUIDE but is actually an ADVERTISEMENT. A legitimate SECURITY GUIDE would never recommend Protonmail over Gmail. A legitimate SECURITY GUIDE would never recommend ProtonVPN. A legitimate SECURITY GUIDE would never ever suggest taking advantage of ProtonVPNs "Tor VPN support". >This doesn't make them "bad", but insufficient. I strongly disagree with you. Posting this was absolutely unethical on protonmails part.

ekianjo 9y ago

> Here's a much better guide, which wasn't written with the sole intention of selling you things https://techsolidarity.org/resources/basic_security.htm https://techsolidarity.org/resources/basic_security.htm This contains good advices but also very doubtful ones. such as "use Whatsap", like something proprietary that is not decentralized? And use Apple devices/Chromebooks (where everything you do works/syncs in the cloud) as your primary device, you must be kidding... The only good security device would be "don't even own a smartphone" if you care about security at all. > Chrome as your browser. What a bad advice, since the code added by Google on top of Chromium can't be audited at all.

ryanlol 9y ago
>This contains good advices but also very doubtful ones. such as "use Whatsap", like something proprietary that is not decentralized? How is this "doubtful" advice? Whatsapp and Signal are literally the state of the art of encrypted messaging apps. There simply are no better options. What would you recommend instead? >And use Apple devices/Chromebooks (where everything you do works/syncs in the cloud) as your primary device, you must be kidding.. So what would you tell people to use instead? This is advice for "journalists" not "unemployed people". Google and Apple only have the best security teams in the world, why do you believe their services to be insecure? >The only good security device would be "don't even own a smartphone" if you care about security at all. What if you are a person who is actually trying to do something with their life? >What a bad advice, since the code added by Google on top of Chromium can't be audited at all. Why is that? Have you audited Chromium? Since when can't binary blobs be audited? What is the realistic worst case scenario here?
- craftyguy 9y ago
  > Google and Apple only have the best security teams in the world, why do you believe their services to be insecure? As US-based companies, they are answerable to the US government. That makes them inherently insecure because your data and privacy is one shitty court order away from being released, at best.
  - 9y ago