3 ms·

LifeLock only advertises in media channels popular with the ignorant, vulnerable, and/or paranoid. People who don't know that story and definitely don't know be

LifeLock only advertises in media channels popular with the ignorant, vulnerable, and/or paranoid. People who don't know that story and definitely don't know better.

vmception 5y ago
Just like Protonmail if we're being fair Except with that one, a lot of otherwise tech savvy people just refuse to acknowledge the limitations and inability to verify privacy claims at any given point in time
- simias 5y ago
  Has protonmail's advertising been misleading? I'm a happy user myself, but I don't think I've ever looked into their marketing.
  - vmception 5y ago
    People believe it is private and uncompromisable because of their use of client side encryption and claims of server side encryption and that their Switzerland location means they exist in a land where intelligence agencies won't coerce them or find a way to leak data. The reality is that they are forcing users to use client side javascript which can have anything in it. And Swiss privacy laws do not do what users claim. There is no way to verify the claims of privacy.
    - arthurcolle 5y ago
      Not contradicting you in any way, but you can check out the javascript. Javascript deobfuscation is pretty sophisticated nowadays (maybe not) from my naive perception.
      - dane-pgp 5y ago
        I think the complaint is that it takes a lot of work to check, each time you visit the site, that the JavaScript your browser downloads is really the same as the published (and assumed secure) source code (plus obfuscation, as you mention). Ideally there would be a mechanism in browsers to pin a specific version of a web app, and only let that app update (to a version with a specific hash) if the user explicitly gives it permission to. The nearest thing we have to that right now is the SRI-bookmarklet trick: https://news.ycombinator.com/item?id=17776456 https://news.ycombinator.com/item?id=17776456
        commoner 5y ago
        EteSync (an open source, end-to-end encrypted contact and calendar syncing service) developed a browser extension called Signed Pages to validate the integrity of its web app. This mechanism also works for any other website that implements it. https://github.com/tasn/webext-signed-pages https://github.com/tasn/webext-signed-pages HTML pages are PGP-signed by the website developer, and all of the resources embedded in the pages are validated by the browser using the Subresource Integrity feature: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
    - simias 5y ago
      Oh I see. Yeah the "Swiss" thing is probably more folklore than anything, but admittedly for the client-side encryption you can use their IMAP bridge that's open source and therefore technically auditable and not quite as easy to modify on-the-fly. But any claim of security for emails will be contingent to a huge number of factors anyway lest you use end-to-end encryption so I see where you're coming from. Less technical people would probably have a hard time understanding the true security and privacy implications of protonmail.
  - Spooky23 5y ago
    A lot of the implied security benefits are like the “100% fat free” labels on Swedish Fish. True, but of dubious value. People equate it with Swiss bank accounts, based on what they learned from James Bond movies.
- walrus01 5y ago
  anecdotal, of a number of people I know who run the SMTP (and IMAP, etc) infrastructure for some mid to large sized ISPs, none of them are protonmail customers. email was never meant to be secure in the way that they market it as.
- deckard1 5y ago
  the worst offenders by far are VPNs. Their advertising is usually shady and litters youtube, and there is simply no way of verifying their privacy claims. They don't log or monitor traffic? Okay fine I'll just take your word for it I guess.
  - vmception 5y ago
    exactly, they are all just internet resellers, and every single review site is affiliate marketing. "oh wow the blogger disclosed that they're paid to advertise them, that makes me trust the service even more!" people just need to understand there are just limitations with that concept. don't rely on them for doing anything criminal anonymously. but its fine to hide activity from the people in your house and ISP and circumvent geofenced streaming services.
  - walrus01 5y ago
    If I see one more freakin' nordvpn sponsored youtube video... grrrrrrr
    - ChainOfFools 5y ago
      the one started by the guy who is now the crowm prince of the defunct Joseon dynasty?
walrus01 5y ago
It can be very informative (and slightly scary, if you know how some of this stuff really works) to look at print magazines targeted at the age 65+ crowd to see how certain categories of technology products are marketed and sold to a certain demographic.

LifeLock only advertises in media channels popular with the ignorant, vulnerable, and/or paranoid. People who don't know that story and definitely don't know better.

vmception 5y ago

Just like Protonmail if we're being fair Except with that one, a lot of otherwise tech savvy people just refuse to acknowledge the limitations and inability to verify privacy claims at any given point in time

simias 5y ago
Has protonmail's advertising been misleading? I'm a happy user myself, but I don't think I've ever looked into their marketing.
- vmception 5y ago
  People believe it is private and uncompromisable because of their use of client side encryption and claims of server side encryption and that their Switzerland location means they exist in a land where intelligence agencies won't coerce them or find a way to leak data. The reality is that they are forcing users to use client side javascript which can have anything in it. And Swiss privacy laws do not do what users claim. There is no way to verify the claims of privacy.
  - arthurcolle 5y ago
    Not contradicting you in any way, but you can check out the javascript. Javascript deobfuscation is pretty sophisticated nowadays (maybe not) from my naive perception.
    - dane-pgp 5y ago
      I think the complaint is that it takes a lot of work to check, each time you visit the site, that the JavaScript your browser downloads is really the same as the published (and assumed secure) source code (plus obfuscation, as you mention). Ideally there would be a mechanism in browsers to pin a specific version of a web app, and only let that app update (to a version with a specific hash) if the user explicitly gives it permission to. The nearest thing we have to that right now is the SRI-bookmarklet trick: https://news.ycombinator.com/item?id=17776456 https://news.ycombinator.com/item?id=17776456
      - commoner 5y ago
        EteSync (an open source, end-to-end encrypted contact and calendar syncing service) developed a browser extension called Signed Pages to validate the integrity of its web app. This mechanism also works for any other website that implements it. https://github.com/tasn/webext-signed-pages https://github.com/tasn/webext-signed-pages HTML pages are PGP-signed by the website developer, and all of the resources embedded in the pages are validated by the browser using the Subresource Integrity feature: https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity https://developer.mozilla.org/en-US/docs/Web/Security/Subres...
  - simias 5y ago
    Oh I see. Yeah the "Swiss" thing is probably more folklore than anything, but admittedly for the client-side encryption you can use their IMAP bridge that's open source and therefore technically auditable and not quite as easy to modify on-the-fly. But any claim of security for emails will be contingent to a huge number of factors anyway lest you use end-to-end encryption so I see where you're coming from. Less technical people would probably have a hard time understanding the true security and privacy implications of protonmail.
- Spooky23 5y ago
  A lot of the implied security benefits are like the “100% fat free” labels on Swedish Fish. True, but of dubious value. People equate it with Swiss bank accounts, based on what they learned from James Bond movies.
walrus01 5y ago
anecdotal, of a number of people I know who run the SMTP (and IMAP, etc) infrastructure for some mid to large sized ISPs, none of them are protonmail customers. email was never meant to be secure in the way that they market it as.
deckard1 5y ago
the worst offenders by far are VPNs. Their advertising is usually shady and litters youtube, and there is simply no way of verifying their privacy claims. They don't log or monitor traffic? Okay fine I'll just take your word for it I guess.
- vmception 5y ago
  exactly, they are all just internet resellers, and every single review site is affiliate marketing. "oh wow the blogger disclosed that they're paid to advertise them, that makes me trust the service even more!" people just need to understand there are just limitations with that concept. don't rely on them for doing anything criminal anonymously. but its fine to hide activity from the people in your house and ISP and circumvent geofenced streaming services.
- walrus01 5y ago
  If I see one more freakin' nordvpn sponsored youtube video... grrrrrrr
  - ChainOfFools 5y ago
    the one started by the guy who is now the crowm prince of the defunct Joseon dynasty?

walrus01 5y ago

It can be very informative (and slightly scary, if you know how some of this stuff really works) to look at print magazines targeted at the age 65+ crowd to see how certain categories of technology products are marketed and sold to a certain demographic.