4 ms·

>Since when is "public VPN services are bad" a claim which needs substantiating? You assume there are good VPN services. What are they? Private ones, self-main

>Since when is "public VPN services are bad" a claim which needs substantiating? You assume there are good VPN services. What are they? Private ones, self-maintained, run by a friend? For journalists, who are mostly not seasoned sysadmins and crypto experts, self-run VPN is worse. >But these guys go further than most providers. These guys try to bait you into ditching Tor and relying on their Tor-as-a-service instead, which is nothing but malicious. No, they don't. The say: "for ultimate anonymity you can also run Tor locally on your machine". >They tell you to use a VPN to avoid "government surveillance agencies. It's all about your threat model. For many journalists, their adversaries are not US TLAs, but less competent nation states TLAs. Using a service outside of their jurisdiction may be acceptable. >They try to get you to use their Tor-as-a-service, which is insane and completely defeats the purpose of using Tor. It's not more insane then trusting your email provider. But yes, you have to trust Proton, this should have been stressed more. And let me remind again, this is a guide for journalists, not for crypto-nerds. "Tor... can be tricky to set up, and can sometimes attract attention to yourself", which is true. >They recommend that you use their products instead of objectively better products by competitors, they don't even bother to mention the competing products. This is not a product comparison. >They suggest that using Protonmail to talk to non-protonmail users over email is at least somewhat secure, it is not. It is, for some scenarios. When both parties use providers who protect mail in transit and one of them also protects mail at rest, an attacker's options are very limited. >All the advice that doesn't amount to "use our product" is extremely limited. Key advice such as Don't use an Android phone is nowhere to be found. This doesn't make them "bad", but insufficient.

ryanlol 9y ago
>You assume there are good VPN services. What are they? Private ones, self-maintained, run by a friend? For journalists, who are mostly not seasoned sysadmins and crypto experts, self-run VPN is worse. I do not assume that there are good public VPN services. Presumably a journalist would be using one provided by their employer or none at all. >No, they don't. The say: "for ultimate anonymity you can also run Tor locally on your machine". Yes, they do mention the possibility of running Tor locally. So what? They're still trying to push people to use their Tor gateway which is simply indefensible. >It's all about your threat model. For many journalists, their adversaries are not US TLAs, but less competent nation states TLAs. Using a service outside of their jurisdiction may be acceptable. Remember your username, don't think too little of "less competent nation states TLAs". :) Choosing to follow Protonmails advice involves taking stupid risks, you should not be taking stupid risks if you are worried about any TLAs. >It's not more insane then trusting your email provider. But yes, you have to trust Proton, this should have been stressed more. With email you hardly get a choice. There's no legitimate reason to ever have someone else run your Tor client for you. And we can already establish that Protonmail cannot be trusted. A trustworthy organization would never have released this "SECURITY GUIDE", nor would they ever try to get you to use their Tor client to access hidden services. >And let me remind again, this is a guide for journalists, not for crypto-nerds. "Tor... can be tricky to set up, and can sometimes attract attention to yourself", which is true. The first part is not true, Tor browser and Tor messenger are both very easy to use. The second part is true, but Tor isn't going to draw significantly more attention than Protonvpn. >This is not a product comparison. No, this claims to be a SECURITY GUIDE but is actually an ADVERTISEMENT. A legitimate SECURITY GUIDE would never recommend Protonmail over Gmail. A legitimate SECURITY GUIDE would never recommend ProtonVPN. A legitimate SECURITY GUIDE would never ever suggest taking advantage of ProtonVPNs "Tor VPN support". >This doesn't make them "bad", but insufficient. I strongly disagree with you. Posting this was absolutely unethical on protonmails part.
- Gogogogirl 9y ago
  "Presumably a journalist would be using one provided by their employer or none at all." It doesn't look like you have very deep knowledge about how journalism works today. I assume you have the '70s model in your head.

ryanlol 9y ago

>You assume there are good VPN services. What are they? Private ones, self-maintained, run by a friend? For journalists, who are mostly not seasoned sysadmins and crypto experts, self-run VPN is worse. I do not assume that there are good public VPN services. Presumably a journalist would be using one provided by their employer or none at all. >No, they don't. The say: "for ultimate anonymity you can also run Tor locally on your machine". Yes, they do mention the possibility of running Tor locally. So what? They're still trying to push people to use their Tor gateway which is simply indefensible. >It's all about your threat model. For many journalists, their adversaries are not US TLAs, but less competent nation states TLAs. Using a service outside of their jurisdiction may be acceptable. Remember your username, don't think too little of "less competent nation states TLAs". :) Choosing to follow Protonmails advice involves taking stupid risks, you should not be taking stupid risks if you are worried about any TLAs. >It's not more insane then trusting your email provider. But yes, you have to trust Proton, this should have been stressed more. With email you hardly get a choice. There's no legitimate reason to ever have someone else run your Tor client for you. And we can already establish that Protonmail cannot be trusted. A trustworthy organization would never have released this "SECURITY GUIDE", nor would they ever try to get you to use their Tor client to access hidden services. >And let me remind again, this is a guide for journalists, not for crypto-nerds. "Tor... can be tricky to set up, and can sometimes attract attention to yourself", which is true. The first part is not true, Tor browser and Tor messenger are both very easy to use. The second part is true, but Tor isn't going to draw significantly more attention than Protonvpn. >This is not a product comparison. No, this claims to be a SECURITY GUIDE but is actually an ADVERTISEMENT. A legitimate SECURITY GUIDE would never recommend Protonmail over Gmail. A legitimate SECURITY GUIDE would never recommend ProtonVPN. A legitimate SECURITY GUIDE would never ever suggest taking advantage of ProtonVPNs "Tor VPN support". >This doesn't make them "bad", but insufficient. I strongly disagree with you. Posting this was absolutely unethical on protonmails part.

Gogogogirl 9y ago
"Presumably a journalist would be using one provided by their employer or none at all." It doesn't look like you have very deep knowledge about how journalism works today. I assume you have the '70s model in your head.