5 ms·

Try to register a new Protonmail email address normally and you can do so without supplying too much information. Try to do so through Tor, and you will not be

Try to register a new Protonmail email address normally and you can do so without supplying too much information. Try to do so through Tor, and you will not be able to proceed without “verifying” the account with a phone number. This pattern (they want either your IP or a phone number) tells me they’re likely interested in tying accounts to real identities and shouldn’t be trusted with anything private. I would even go so far as to suspect Protonmail of being a honeypot. Oh…I’ll just leave this here: https://privacy-watchdog.io/truth-about-protonmail/ https://privacy-watchdog.io/truth-about-protonmail/

deleted 5y ago
[deleted]
secfirstmd 5y ago
Yep noticed this a long time ago and am very suspicious
- jimmaswell 5y ago
  A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it.
  - vmception 5y ago
    I’ve always found it weird how people jump hoops to be apologists for Protonmail Does anybody else find that weird? “I completely misunderstood Swiss privacy laws and fell for a sales pitch from an email and VPN company that goes out of its way to track every user no matter how they sign up! Its to avoid email abuse, exclusively!”
    - jimmaswell 5y ago
      I've never even heard of Protonmail. I just think it's silly to fault anyone for blocking/limiting TOR connections.
  - cookiengineer 5y ago
    > A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it. And why is that again? I want to understand that argument. In case of DDoS scenario: Well, too late, traffic already served and server already done the workload. In case of password brute forcing: Well, then implement a latency, or cryptographical challenge to delay it more efficiently. In case of "evil" human: Well, if a human can get past your security so easily, then your approach to security through obfuscation might be wrong. So, again, what is the scenario where a captcha helps you to avoid being "attacked" by malicious actors?
    - darkhorse22 5y ago
      The mindset is basically: Programming is hard so we're going to block as many non-paying customers as possible to limit the blast radius when we inevitably fuck up. And inconvenience those paying users too, because we can't figure out how to mitigate DoS attacks at the edge. And then we'll give a talk at a Next.js conference or something.
    - mannerheim 5y ago
      What about the case of someone signing up for thousands of accounts?
      - cookiengineer 5y ago
        > What about the case of someone signing up for thousands of accounts? My question is related to the specific /login page, not the registration page. I understand the benefit for blocking spammer signups, but not for the current case of the login page where users have an account already, were verified that the account/password was correct (captcha appears in second step), and then have to enter a second decryption password manually. In that scenario there's no argument on the "WHY" a captcha helps. It simply doesn't.
        drivebycomment 5y ago
gloriousternary 5y ago
I'm not saying you're wrong, but that particular source is well known for making big claims with insufficient evidence, and it reads like it was written by a conspiracy theorist. Many of the author's claims have already been (imo, pretty solidly) refuted by Proton. Disclaimer: using protonmail until my current subscription runs out, then selfhosting
- antiterra 5y ago
  Doesn’t self-hosting also have privacy downsides, being that all the hardware is tied to you? I’d imagine whatever minor resistance to wiretapping a multiuser site gave regarding privacy of non-investigated individuals would disappear.
  - RussianCow 5y ago
    It depends on your threat model. If you’re worried about big companies like Google harvesting your data, self-hosting is a great solution because you remove them from the equation entirely. On the other hand, if you’re worried about three-letter government agencies, you need to go through much more extreme measures. Most people aren’t as concerned with the latter, though.
    - caymanjim 5y ago
      This is why I self-host. I'm not trying to hide from the government, as I know they don't care about me. Sure, in principle I don't want them snooping me, but it's not a concern. I self-host because I don't want companies snooping all my data.
  - BostonEnginerd 5y ago
    The 1986 electronic privacy act consider emails older than 180 days old to be “abandoned” and do not require a warrant to access. Self-hosting at least means that this should not apply, I think.
    - artificial 5y ago
nexuist 5y ago
> they’re likely interested in tying accounts to real identities I don't think it means they're interested in tying accounts to a specific identity, just an identity, to prevent bots or bad actors from signing up for thousands of accounts. This is a necessary reality of being an email provider. If you do not police your outbound mail then other mail servers will block or auto-junk your users' messages. There is no way to preserve privacy while also not becoming a festering ground for Viagra spam mail.
- mannerheim 5y ago
  Perhaps a way to solve it would be to accept a nominal fee of cryptocurrency. Even a one-time fee of e.g. $5 would probably put a damper in someone trying to sign up for thousands of accounts while preserving privacy for real users.
  - caymanjim 5y ago
    Alas this is a business-ending barrier. Despite its popularity, in the grand scheme of things, not many people have a crypto account. It's also only semi-anonymous, depending on how you fund it. It'd be nice if more businesses accepted crypto, but it isn't viable as a requirement or primary payment mechanism.
    - mannerheim 5y ago
      I think it would be useful enough in the context of anti-spam while preserving anonymity, not necessarily as a source of generating revenue. There are cryptocurrencies that preserve anonymity as well.
    - fvv 5y ago
      No mannerheim is correct , you are saying yeah but some people can't.. but his solution solve the issue , if you want to register under tor over anonymous and secure mail system having 5$ Monero is the easiest thing to procure.. there are communities that trade for cash or you can even mine anonymous there may be other alternatives.. but one solution to avoid bots doesn't exclude others you as subscriber should be able to choose the one that fits to you so saying some may find it difficult doesn't say that this solution is invalid . Just that maybe must not be the only option available
protonmail 5y ago
We don't like the term, but that link is actually fake news, and has been refuted before, for example here: https://serpentsec.1337.cx/i-was-asked-to-review-an-article-from https://serpentsec.1337.cx/i-was-asked-to-review-an-article-...

deleted 5y ago

[deleted]

secfirstmd 5y ago

Yep noticed this a long time ago and am very suspicious

jimmaswell 5y ago
A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it.
- vmception 5y ago
  I’ve always found it weird how people jump hoops to be apologists for Protonmail Does anybody else find that weird? “I completely misunderstood Swiss privacy laws and fell for a sales pitch from an email and VPN company that goes out of its way to track every user no matter how they sign up! Its to avoid email abuse, exclusively!”
  - jimmaswell 5y ago
    I've never even heard of Protonmail. I just think it's silly to fault anyone for blocking/limiting TOR connections.
- cookiengineer 5y ago
  > A visitor from TOR is extraordinarily more likely to be abusive. It makes total sense to put up extra barriers, which is still short of blocking TOR users altogether, which is also fair for webmasters who don't want to deal with it. And why is that again? I want to understand that argument. In case of DDoS scenario: Well, too late, traffic already served and server already done the workload. In case of password brute forcing: Well, then implement a latency, or cryptographical challenge to delay it more efficiently. In case of "evil" human: Well, if a human can get past your security so easily, then your approach to security through obfuscation might be wrong. So, again, what is the scenario where a captcha helps you to avoid being "attacked" by malicious actors?
  - darkhorse22 5y ago
    The mindset is basically: Programming is hard so we're going to block as many non-paying customers as possible to limit the blast radius when we inevitably fuck up. And inconvenience those paying users too, because we can't figure out how to mitigate DoS attacks at the edge. And then we'll give a talk at a Next.js conference or something.
  - mannerheim 5y ago
    What about the case of someone signing up for thousands of accounts?
    - cookiengineer 5y ago
      > What about the case of someone signing up for thousands of accounts? My question is related to the specific /login page, not the registration page. I understand the benefit for blocking spammer signups, but not for the current case of the login page where users have an account already, were verified that the account/password was correct (captcha appears in second step), and then have to enter a second decryption password manually. In that scenario there's no argument on the "WHY" a captcha helps. It simply doesn't.
      - drivebycomment 5y ago

gloriousternary 5y ago

I'm not saying you're wrong, but that particular source is well known for making big claims with insufficient evidence, and it reads like it was written by a conspiracy theorist. Many of the author's claims have already been (imo, pretty solidly) refuted by Proton. Disclaimer: using protonmail until my current subscription runs out, then selfhosting

antiterra 5y ago
Doesn’t self-hosting also have privacy downsides, being that all the hardware is tied to you? I’d imagine whatever minor resistance to wiretapping a multiuser site gave regarding privacy of non-investigated individuals would disappear.
- RussianCow 5y ago
  It depends on your threat model. If you’re worried about big companies like Google harvesting your data, self-hosting is a great solution because you remove them from the equation entirely. On the other hand, if you’re worried about three-letter government agencies, you need to go through much more extreme measures. Most people aren’t as concerned with the latter, though.
  - caymanjim 5y ago
    This is why I self-host. I'm not trying to hide from the government, as I know they don't care about me. Sure, in principle I don't want them snooping me, but it's not a concern. I self-host because I don't want companies snooping all my data.
- BostonEnginerd 5y ago
  The 1986 electronic privacy act consider emails older than 180 days old to be “abandoned” and do not require a warrant to access. Self-hosting at least means that this should not apply, I think.
  - artificial 5y ago

nexuist 5y ago

> they’re likely interested in tying accounts to real identities I don't think it means they're interested in tying accounts to a specific identity, just an identity, to prevent bots or bad actors from signing up for thousands of accounts. This is a necessary reality of being an email provider. If you do not police your outbound mail then other mail servers will block or auto-junk your users' messages. There is no way to preserve privacy while also not becoming a festering ground for Viagra spam mail.

mannerheim 5y ago
Perhaps a way to solve it would be to accept a nominal fee of cryptocurrency. Even a one-time fee of e.g. $5 would probably put a damper in someone trying to sign up for thousands of accounts while preserving privacy for real users.
- caymanjim 5y ago
  Alas this is a business-ending barrier. Despite its popularity, in the grand scheme of things, not many people have a crypto account. It's also only semi-anonymous, depending on how you fund it. It'd be nice if more businesses accepted crypto, but it isn't viable as a requirement or primary payment mechanism.
  - mannerheim 5y ago
    I think it would be useful enough in the context of anti-spam while preserving anonymity, not necessarily as a source of generating revenue. There are cryptocurrencies that preserve anonymity as well.
  - fvv 5y ago
    No mannerheim is correct , you are saying yeah but some people can't.. but his solution solve the issue , if you want to register under tor over anonymous and secure mail system having 5$ Monero is the easiest thing to procure.. there are communities that trade for cash or you can even mine anonymous there may be other alternatives.. but one solution to avoid bots doesn't exclude others you as subscriber should be able to choose the one that fits to you so saying some may find it difficult doesn't say that this solution is invalid . Just that maybe must not be the only option available

protonmail 5y ago

We don't like the term, but that link is actually fake news, and has been refuted before, for example here: https://serpentsec.1337.cx/i-was-asked-to-review-an-article-from https://serpentsec.1337.cx/i-was-asked-to-review-an-article-...