34 ms·

Climate activist arrested after ProtonMail provided his IP address

• deleted 5y ago
  [deleted]
• josephcsible 5y ago
  Has ProtonMail done anything wrong themselves, or is this just a case of them existing in the wrong country? If they refused to cooperate, could the government have just seized their servers and collected the data they wanted themselves?
  • bawolff 5y ago
    I think the argument is that their advertising is misleading (i.e. if they really didn't keep logs, there would be nothing to hand over)
    • deleted 5y ago
      [deleted]
    • deleted 5y ago
      [deleted]
    • dogma1138 5y ago
      They never advertised that they don’t keep logs they just said they aren’t permanent, in fact you can view your own connection logs if you enable it in which case they are maintained forever. https://protonmail.com/privacy-policy https://protonmail.com/privacy-policy They also provide a report of all warrants received https://protonmail.com/blog/transparency-report/ https://protonmail.com/blog/transparency-report/
      • tromp 5y ago
        That begs the question which of the warrants listed there relates to this climate activist.
      • kdunglas 5y ago
        They claim that they don’t keep logs on their French homepage. The climate activist is French: https://twitter.com/onestlatech/status/1434596410977030155?s=21 https://twitter.com/onestlatech/status/1434596410977030155?s... And even on their English website, the marketing is misleading. They say that the service is "anonymous" and also: "By default, we do not keep any IP logs which can be linked to your anonymous email account".
        • kafkaIncarnate 5y ago
          REALLY misleading. They created this feature for Mr. Robot, the TV show, too: https://protonmail.com/blog/protonmail-mr-robot-secure-email/ https://protonmail.com/blog/protonmail-mr-robot-secure-email... Scroll down to comment: > Liam, October 14, 2015 at 10:30 PM > But https://protonmail.com/security-details https://protonmail.com/security-details page says “No tracking or logging of personally identifiable information. Unlike competing services, we do not save any tracking information. We do not record metadata such as the IP addresses used to log into accounts.” So, now it turns to be that you introduced tracking and logging? Is this data encrypted as well? > Admin, October 17, 2015 at 9:14 PM > We don’t save any of this data by default, the user must explicitly turn it on for us to save it. There should be a reasonable assumption that given they have end-to-end encryption for the service, they just encrypt the logging for the user and store it encrypted without the key themselves like they do the emails. Also to note, they at least have an onion link to use their email service.
        • gregsadetsky 5y ago
          The CEO's position on Twitter is that "by default" (from the sentence you're quoting) means when there is no criminal investigation, but when there is a legal order in place, Protonmail will collect the IP... https://twitter.com/andyyen/status/1434600373059297284 https://twitter.com/andyyen/status/1434600373059297284 "As described in the link above, under Swiss law, we can be forced to collect info on accounts belonging to users under criminal investigation. This is obviously not done by default, but only if we get a legal order." Activists beware.
          • civilized 5y ago
      • u_r_dumb 5y ago
        Literally on their front page: > No personal information is required to create your secure email account. By default, we do not keep any IP logs which can be linked to your anonymous email account. Your privacy comes first.
        • bombcar 5y ago
          Privacy comes first. Then comes the warrant. Then comes the IP in the report printout.
        • chrononaut 5y ago
          > No personal information is required to create your secure email account. Except your phone number? That's highly personal. https://news.ycombinator.com/item?id=28428092 https://news.ycombinator.com/item?id=28428092 (I recall encountering this too when creating an account a few months ago.)
          • deleted 5y ago
            [deleted]
      • hex4def6 5y ago
        In their blog they mention cases in which they enabled logging after the swiss government requested it.
    • ramesh31 5y ago
      Anyone who ever says "we don't log" is definitely logging, and that statement alone should tell you that they are untrustworthy. No one is stupid enough to take on that kind of liability. The same applies for VPNs. If you need trust, theres no way around rolling your own service.
      • drexlspivey 5y ago
        Logging is the liability not the other way around. You can’t be forced to hand over something you don’t have
        • Raed667 5y ago
          You can be forced to log though. I'm not sure how your tech-stack has to look like for you to claim that you can't log IP addresses and user-agents etc...
          • drexlspivey 5y ago
            Some VPN providers run their servers without hard drives.
            • luckylion 5y ago
              Thank god their servers aren't on a network where they could simply send the log entries to a different server. That's a cute idea, but it won't get them out of complying with a warrant.
              • chrononaut 5y ago
                Yeah, that seems more a mechanism to prevent forensics analysis of a hard disk to retrieve transient logs that might've been briefly written to disk (?). I hope it isn't being as a means to prevent the means to log for future connections, for the reasons you state.
        • kazen44 5y ago
  • goldcd 5y ago
    Legally nothing wrong - but they've maybe been a bit disingenuous to their users. However, better than most (both by jurisdiction and their own rules) than other email providers - and I'd have thought any of their users who were serious about anonymity would have used Tor/Tails etc to connect anyway and used pgp for their messages. Details of connections to the account (IP and connection fingerprint) shouldn't matter if you were taking your privacy seriously. Basically just signing up for protonmail doesn't make you secure and there's nothing they could do to help if you just rely on that.
• dlvktrsh 5y ago
  I knew they were snitch
• deleted 5y ago
  [deleted]
• gigel82 5y ago
  So with FastMail under Australian privacy-bashing laws and now this, what are our options for secure, private e-mail?
  • CameronNemo 5y ago
    Protonmail and fastmail are different offerings. Proton offers encryption features, while fastmail makes no effort to promote encryption. So tutanota would be a good alternative to protonmail. And mailbox.org is a good alternative to fastmail. Both are based in Germany.
    • superflit 5y ago
      Occupied Germany is worse[1] Germany will handle your data as fast as you can order an hans schnitzel. [1] - https://militarybases.com/overseas/germany/ https://militarybases.com/overseas/germany/
      • merb 5y ago
        well posteo didn't. they tried to fight it as long as possible.
        • superflit 5y ago
          There is no fighting. When you have 21 bases in your land.
    • ranguna 5y ago
      From tutanota: > Storage only takes place for IP addresses made anonymous which are therefore not personal data any more. What the heck does "IP addresses made anonymous" mean?
  • krono 5y ago
    Email from any serviceprovider can be considered as secure and private as public conversations.
  • 5y ago
• doc_gunthrop 5y ago
  It seems the lesson here is to always use a VPN (or Tor) if you're under such threat.
  • vmception 5y ago
    and the lesson here is that everyone who called out Protonmail for being sus (suspect) on signup was correct. try using Tor to create a protonmail account and they require both javascript and a phone number. yeh yeh client side encryption requires javascript, but seems better to just have an unlinked email that can be read server side and there are plenty of Tor-only email providers for that. phone number under an "anti-spam" guise is just suspect.
• istingray 5y ago
  Protonmail customer here. Sigh. This is why I keep my own domain and can point it wherever I need. Dear Protonmail, email is fucking cheap and easy, I pay you $58 a year to solve stupid shit like this. Vendors really need to figure out how to thread the needle of "No don't trust us" but still encourage customers to buy. Protonmail failed here. Apple's still very much in the "trust no one but us!" vibe, and it's just not sustainable. I'll be switching my Protonmail use to default to Tor now. Open to Tor-first vendors...are there any? I like how Brave has "open in Tor" displayed on Tor-mirrored sites. There's even an option for "Automatically redirect .onion" sites too. Makes it easy to switch over. What if Protonmail pushed their Tor services more? "Guide to using Protonmail as privately as possible", have a switch for "Private Mode" that kicks you over to Tor/download Tor.
  • pphysch 5y ago
    Tor is a State Dept/DARPA project, so at best a sidegrade from Proton if your concern is being surveilled by Western governments.
    • sneak 5y ago
      Tor is open source. Point to the vulnerability you are claiming, or stop spreading FUD.
      • arglebarglegar 5y ago
        it’s been known for a while that the NSA runs tor nodes, right?
      • cortesoft 5y ago
        https://nusenu.medium.com/tracking-one-year-of-malicious-tor-exit-relay-activities-part-ii-85c80875c5df https://nusenu.medium.com/tracking-one-year-of-malicious-tor...
        • pessimizer 5y ago
          Tor has known limitations. Pretending like all communication channels with limitations are equal is like saying X minus Y always equals five.
• 1vuio0pswjnm7 5y ago
  Is Javascript required to sign up or use ProtonMail. https://www.wired.com/2015/10/mr-robot-uses-protonmail-still-isnt-fully-secure/ https://www.wired.com/2015/10/mr-robot-uses-protonmail-still...
  • codetrotter 5y ago
    No, you can use any SMTP/IMAP/POP3 capable client instead of using their web interface. https://protonmail.com/support/knowledge-base/imap-smtp-and-pop3-setup/ https://protonmail.com/support/knowledge-base/imap-smtp-and-... But you are still making an IP connection. JS/no JS is not relevant to this discussion.
    • deleted 5y ago
      [deleted]
• deleted 5y ago
  [deleted]
• mikl 5y ago
  I guess there isn’t much Protonmail can do if the prosecutor shows up with an ~Interpol~ Europol warrant. I wonder what this “activist” did to earn himself Europol attention. At least before the world went insane, that would only happen for serious crimes.
  • ficklepickle 5y ago
    The terrible crime of squatting, according to some comments in that thread
    • BrandoElFollito 5y ago
      Has your home in France been squatted? No? Or maybe you do not own a house in France? If so, on which basis do you ironically call squatting a "terrible crime"? Squatters in your house in France means that you you have zero rights on this place until a lengthy process gives it back to you, ruined. You are then expected to be grateful and can forget about any reimbursement from the poor people who stole your property.
      • deleted 5y ago
        [deleted]
      • deleted 5y ago
        [deleted]
      • sodality2 5y ago
        ficklepickle is poking fun at the fact that the crime is minor, relative to the weight behind the warrant. It would be like if the FBI put you on their website and the news stations aired your photo, for driving without a license. Sure, it's a crime, but it's a relatively minor one. I suppose if you were the victim you'd have a different point of view.
      • bromuro 5y ago
        Squatting is about occupying uninhabited places. It should be welcomed or at least tolerated.
• blub 5y ago
  If you think that's bad, Tutanota was forced by the court to change their SW, so that all incoming e-mails for a specific account would be intercepted before encryption: https://news.ycombinator.com/item?id=27303712 https://news.ycombinator.com/item?id=27303712
  • freshhawk 5y ago
    Hushmail had a similar warrant, they changed their login form so it would send the password in the clear to the server, which they used to decrypt the mail and logged all the traffic to help trace the user. If you get targeted these "anonymous" email services aren't going to be good for much in practice.
• keewee7 5y ago
  Why is a "Climate activist" being arrested?
  • jokoon 5y ago
    I don't really know but eco terrorism is something that is more than likely to increase, with all the floods, forest fires, hurricanes, Greta thunberg, ipcc reports, and recently Biden authorizing some oil contract thing. Something is going to move.
  • mytailorisrich 5y ago
    In this case it seems that they are a far left group that has decided to squat a restaurant for good old 'class struggle' reasons and vowed not to back down... It also seems that it is not any restaurant but one of the 'victims' of the 2015 terrorist attacks [1] Basically political extremists trying to disguise themselves as environmental activists. Not interesting people, to say the least. [1] https://www.tellerreport.com/news/2021-01-04-%0A---justice-orders-the-end-of-the-le-petit-cambodge-restaurant-squat%0A--.HJGBY3gRv.html https://www.tellerreport.com/news/2021-01-04-%0A---justice-o...
    • pessimizer 5y ago
      Ah, they're sitting in a restaurant in protest. Clearly insane terrorists.
      • keewee7 5y ago
        No, they are just criminals who violently take over other people's property and vandalize it.
      • mytailorisrich 5y ago
        Don't trivialize extremism, please.
• AdmiralAsshat 5y ago
  "We won't store your IP, except when its sought by the government, which is the only reason you'd ever realistically pay for a service that doesn't store your IP." Brilliant!
  • sweetbitter 5y ago
    Even if ProtonMail had not stored these data, it could have easily been, legally or not, collected from the ISP(s) providing Proton with their internet access.
• COGlory 5y ago
  Disclaimer: I have a ProtonMail account that I pay for. I have seen a ton of disturbing pieces about ProtonMail. Every time I've looked into them, they seem to be maliciously motivated and usually not true, or otherwise twisting of the truth. This has been a confusing thing for me because why is there a small subset of people so vehemently against them? In this case, I'm not surprised. They say quite clearly they can be compelled to collect IP addresses - including in the linked tweet. This seems like a pretty clear cut case of them being compelled to provide an IP address. What the authorities can't do, is read that person's email. And that's what I and others pay for. I'm not sure what there is to be upset about here? Other than perhaps France prosecuting this individual to begin with? If we had faith that ProtonMail wouldn't hand over anything to the government, why would anyone even care about having encrypted emails?
  • istingray 5y ago
    I'm also a Protonmail customer. Tor solves this. Protonmail's Tor support is lukewarm. They have a Tor based login without captchas. It's mentioned on their homepage in the bottom menu under "Onion Site", (/tor). And there's one blog post from 2017 that still promotes their v2/shorter onion address. I expect Protonmail to push its users to login through Tor. "Don't trust us, trust math". Embed Tor support in their apps as well. Rebuild their iOS app to offer to drive all connections through Tor. And frankly, for $50 a year for email, I expect Protonmail to be thinking ahead about this, rather than me coming up with dumb ideas on a forum. Protonmail was neat in 2018 but 3 years later it's stagnant.
    • Aachen 5y ago
      How is that lukewarm? Sounds like first class support if they have a dedicated onion address and not just let you connect to the regular clearnet. Or is that address only in that old blog post and not mentioned in places you'd usually look? It's a bit unclear to me.
      • istingray 5y ago
        It's lukewarm because what less could you do besides not support Tor? Tor is mentioned on their homepage in the bottom menu under "Onion Site". However, this menu link redirects to their Tor placeholder page, rather than directly to the Tor service: https://protonmail.com/tor https://protonmail.com/tor There's one blog post from 2017 that still promotes their old v2 onion address: https://protonmail.com/blog/tor-encrypted-email/ https://protonmail.com/blog/tor-encrypted-email/ Protonmail's Tor service is located at: https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/ https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7...
• leipert 5y ago
  Happy user of posteo here which claims to strip IP addresses and there IS no relation between accounts and payments. All government requests are transparently documented. The web interface is roundcube, but if you just use IMAP, it could work for you. No custom domains though for sending stuff, catch all redirects obviously work. https://posteo.de/en/site/transparency_report https://posteo.de/en/site/transparency_report
• m-p-3 5y ago
  For those using Tor, the Onion v3 address is protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion
• skarz 5y ago
  We know that PM saves all kind of metadata and happily provides it to any kind of agency. You have to use an anonymous VPN service (obviously not ProtonVPN) in combination with ProtonMail, if you want to avoid exposure by PM. ProtonMail lost it's essence to be honest. As soon as my subscription runs out I'm gonna host my own mailserver instead. There are no advantages in using ProtonMail snymore.
  • muixoozie 5y ago
    >As soon as my subscription runs out I'm gonna host my own mailserver instead. I might end up doing the same. I think I'm stubborn enough to pull it off. Personally I got my eye on https://gitlab.com/simple-nixos-mailserver/nixos-mailserver https://gitlab.com/simple-nixos-mailserver/nixos-mailserver I've been in the market for a service like protonmail because I'm trying to degoogle. Reading news like this and looking at the price of these services for two accounts has me thinking twice.
• vmoore 5y ago
  You can disable the recording of login sessions in Protonmail's settings dashboard. I do that, not only to avoid Protonmail learning of the logs, but by a hacker who, once upon breaching your account; also gets to learn the IP you use to login with.
  • istingray 5y ago
    Thanks, I had "Basic" on and turned it completely off. This should be Disabled by default. I created a new account to see what the default is (it's Basic): https://news.ycombinator.com/item?id=28428092 https://news.ycombinator.com/item?id=28428092
• istingray 5y ago
  Disclaimer: Paying Protonmail customer Their homepage says "By default, we do not keep any IP logs" In 2021, any soft language like this should be a red flag for anyone who is against surveillance. Maybe in 2018 it was good enough. But in 2021 it's not. Come on, Protonmail, you're supposed to be leading the way -- don't make me figure it out myself. Replace immediately with "By default we don't log IP, but may be required to by local law enforcement. We recommend everyone connect through Protonmail through Tor. This month, 60% of our users connected through Tor".
  • sigmoid10 5y ago
    People really don't seem to understand that Protonmail is a western company in a western country with pretty generous surveillance laws. Yes, your email text may be encrypted, but everything else is free game to the authorities unless you use additional protection.
    • istingray 5y ago
      Protonmail should be pushing more of this messaging in their branding. "Don't trust us further than you can throw us. We're doing our best, and here's what we recommend, use Tor, etc."
      • winrid 5y ago
        This is just not realistic, though.
        • pseudalopex 5y ago
          Why not?
          • umvi 5y ago
            "we aren't much better than Gmail from a privacy standpoint, but please still give us money"
• S_A_P 5y ago
  Also a ProtonMail user. While I would prefer that ProtonMail never captures or divulged my ip and or logged my access I pay because I was a long time gmail user and am trying to ween myself off of alphabet in general. I don’t want my mail skimmed for ads or worse.
• istingray 5y ago
  Disclaimer: Paying Protonmail customer I wanted to test how Protonmail is doing for new users I created an account from scratch just now over Tor. 1. Am asked to verify new account by entering a cell phone (edit: this is horrible. They lie and say account creation is anonymous, as pointed out by the poster below) 2. Upon login, "Basic" logs are selected which do not display IP. You can enable "Advanced" logs to log IP. I would suggest Protonmail make it crystal clear that these "Basic" logs do not store IP. In 2021, lies by omission are not good enough. Get rid of the soft language. 3. Their help page [1] says that "Advanced" (IP stored) logs are enabled by default. However, I created the account and it's just the Basic (no IP) logs. https://protonmail.com/support/knowledge-base/authentication-logs/ https://protonmail.com/support/knowledge-base/authentication...
  • chrononaut 5y ago
    > 1. Am asked to verify new account by entering a cell phone (bogus) Interestingly the sentence on their front page, right before the most commonly quoted snippet in this thread, is: > No personal information is required to create your secure email account. A phone number is quite a personal, unique identifier.
    • istingray 5y ago
      That's a great point. This should be better publicized. Protonmail requires a phone number to register through Tor.
      • sodality2 5y ago
        This is completely false. I have created accounts (for others) over tor, without ever divulging a number. The exit node is a factor here. Sometimes email is required; if the need is there, throwaway emails work. I hate to tragedy-of-the-commons a good service, though, which is why I have a subscription.
        • TylerLives 5y ago
          Can you do it now?
• Kenji 5y ago
  If you're a criminal and use email, especially email paid for in your name, you're an idiot. Switzerland has been tightening its laws just like every other country, all of them are fascist.
• blondin 5y ago
  okay. so today we are redefining what "not logging data" means. it changes meaning when used in the same sentence as the expression "by default". so by default, not logging data is not really not logging data. we've redefined quite a few things in the past few months. will be interesting to see where we go from here.
  • throwawayswede 5y ago
    It has not really changed meaning. Asshole companies blatantly lying and using dark patterns only means one thing: that the company is a piece of trash and does not respect their customers.
• rad_gruchalski 5y ago
  Question: is it possible they do not log any of the data but were required to capture it on the next login? All the talk here implicitly assumes ProtonMail provided historical information.
  • kazen44 5y ago
    As far as i understand from the article, this is roughly what happened. Protonmail got a warrant, and thus enabled logging for the user (as is required by law).
• newbie789 5y ago
  I’m aware that this is a very silly sounding question, but I’m very confused about what’s going on here. If the subject of this investigation had been using ProtonVPN to connect to ProtonMail, would this have (in a marginal way) protected their anonymity? If ProtonMail can be compelled to begin logging, surely the same must be said of ProtonVPN right? It’s interesting how many “privacy focused” companies tout being based in Switzerland as some big badge of honor, which a layman consumer such as myself is supposed to be really impressed by due to the overall reputation of “Swiss privacy laws.” In practice, I’ve never been to Switzerland. I don’t know any person that has had any legal issues there, let alone someone that’s litigated a digital privacy case there. I do not speak German or French, and don’t know where to start when it comes to looking up specific cases or court proceedings, so I’d be extremely slow on the uptake of the actual ins and outs of how the Swiss privacy model works from a practical standpoint. The “based in Switzerland” thing strikes me as a bit of a black box bit of marketing speak. How much time, energy and money did ProtonMail expend fighting this surreptitious logging mandate? Does “Swiss privacy” actualy mean anything if ProtonMail is happy to hand over your IP address when spooked?
  • H8crilA 5y ago
    Shhh, the entire country runs on similar myths, most prominently banking. But then, all that the common man is capable of understanding is myths, sooo ...
  • llampx 5y ago
    > It’s interesting how many “privacy focused” companies tout being based in Switzerland as some big badge of honor, which a layman consumer such as myself is supposed to be really impressed by due to the overall reputation of “Swiss privacy laws.” I believe it comes about due to the old trope of Swiss banks being the most secure places to hide money, which of course is not true and hasn't been for a long time. Even in that period, I am sure they complied with Interpol/Europol requests to divulge account details of evil masterminds with a beeellion dollars hidden away in a Swiss vault.
  • shantara 5y ago
    I used to work for a now defunct Swiss company that had “Swiss quality, security and privacy” plastered all over the website and marketing materials. The number of actual Swiss people on the team could be counted on one hand, the rest of developers being from every European country out there, with the most represented ones being Ukraine and Romania. And from talking with my coworkers, the situation is the same across other Swiss IT companies. I would not pay any attention to the “Swiss X” marketing.
• dredmorbius 5y ago
  Also mentioned in another submitted tweet: https://nitter.eu/OnEstLaTech/status/1434575322465382404 https://nitter.eu/OnEstLaTech/status/1434575322465382404 Translation: "The company @ProtonMail delivered IPs of climate activists to the police, after which the activists were arrested and searched. ProtonMail claims on its website, however, that it does not store the IP addresses of its users." Source (in French): https://secoursrouge.org/france-suisse-securite-it-protonmail-a-communique-a-la-police-ladresse-ip-de-militant%c2%b7es-anti-gentrification/ https://secoursrouge.org/france-suisse-securite-it-protonmai... Translation (via Google Translate): The year 2020 and 2021 was marked by the establishment and repression of a series of occupations in the district of Place Sainte Marthe, in Paris, in order to fight against its gentrification. Some 20 people were arrested, three searches were carried out and several people were sentenced to suspended prison sentences or to fines of several thousand euros (more info here and here). In addition, seven people are on trial in early 2022 for “theft and degradation in assembly and home invasion” following the occupation of a with a file of more than 1000 pages. During the investigation, the police focused on the collective “Youth For Climate”. In particular, they were able to use photos published on Instagram, even if they were blurred because of the clothes. The police also noticed that the collective communicated via a protonmail email address. They therefore sent a requisition (via EUROPOL) to the Swiss company managing the messaging system in order to find out the identity of the creator of the address. Protonmail responded to this request by providing the IP address and the fingerprint of the browser used by the collective. It is therefore imperative to go through the tor network (or at least a VPN) when using a Protonmail mailbox (or another secure mailbox) if you want to guarantee sufficient security. (Disclaimer, Protonmail user.)
  • Thankless 5y ago
    Avoid proton mail like the plague.
• throwawayswede 5y ago
  This is seriously messed up. Purely because their marketing has been very aggressive to promote total and complete anonymity, directly sometimes and mostly indirectly. If it’s true that the French wording makes it seem like they don’t keep logs at all whatsoever, then I believe the person arrested has grounds to sue them, and I would hope they do. But even if not, I consider their marketing is a total and complete dark pattern from now on imo. Tremendously disappointed. What’s next? Is ddg selling search data to google?
  • sweetbitter 5y ago
    Generally speaking, it is wise to assume that any entity under which trust is centralized is far easier for a government to persuade. At least DuckDuckGo is friendly to Tor.
  • atok1 5y ago
    Don't trust DDG.
• londons_explore 5y ago
  Cryptographers and developers need to step up their game... There needs to be a messaging service where as well as the messages being encrypted, the graph of who is talking to who and when must be encrypted. I'm imagining a system where your device forwards hundreds of messages for other people, hiding your own message flow. I perhaps send a few hundred messages per day, and even multiplying that by 1000, and the typical message length of a few words, it's still a tiny amount of data transfer.
  • bickeringyokel 5y ago
    Interesting idea, but is that not a liability to yourself if nefarious or illegal messages are passing through your device?
    • SV_BubbleTime 5y ago
      Isn’t this what Section 320 was intended for? But yes, the problem with an encrypted tor-for-email would be the exit node would get all the emails and probably be responsible for the final content.
  • istingray 5y ago
    I'm interested. Currently spending ~$58/year with Protonmail including a custom domain.
  • sweetbitter 5y ago
    Basically, you want to run a messaging service over an onion routing network (Tor, I2P), or even better, a mix network. You should check out Nym (https://nymtech.net/ https://nymtech.net/) and come back with what you think about it. It is very suitable to what you want, and Loopix is resistant to global adversaries. https://arxiv.org/abs/1703.00536 https://arxiv.org/abs/1703.00536 (Loopix's paper)
  • mhitza 5y ago
    You're describing exactly I2P (darknet similar to Tor but more focused on internal services). There's also a builtin I2P-Bote messaging system (bundled with the official I2P client) that is in a sense a substitute to email. The tech is there, what the I2P ecosystem needs is a lot more users and a lot of UX improvements to make it 1-click accessible.
• SavantIdiot 5y ago
  Do we still like Runbox? Based in Norway. They claim to be the most secure email provider due to Norwegian laws: https://runbox.com/why-runbox/privacy-protection/email-privacy-regulations/ https://runbox.com/why-runbox/privacy-protection/email-priva...
• JohnJamesRambo 5y ago
  What does Youth for Climate do that required arrest? I’m unfamiliar with them.
  • jimbob45 5y ago
    Same but it’s not out of the realm of possibility that they’re a Greenpeace-like organization that jeopardizes human life and property. Or they’re just some college students spouting inconvenient truths ¯\_(ツ)_/¯
  • keewee7 5y ago
    They are far-left extremists who use climate change as an excuse to vandalize small businesses. This dude was arrested for occupying and vandalizing a restaurant.
• elmo2you 5y ago
  I don't think that ProtonMail complying with the law here is in any way the problem. They simply have to. However, in this case just as in a few other ones before this one, it has become pretty clear to me that ProtonMail's marketing is deceptive at best an in a few cases some of their claims just blatantly not true. What surprised me most is that when I pointed this out in the past, I was immediately attacked by what appeared to be like Apple-style fanboys, whole would not stand by anyone criticizing ProtonMail. To this day I'm not so sure if that was just the genuinely zealous behavior of a few deranged individuals, or if it might have been a concerted commercial effort at damage control. Either way, to me ProtonMail certainly is not what it claims to be (if not explicitly than at least implied). To me it's just another commercial entity trying to make a profit by tapping a relative niche market while convincing gullible people they are something they actually are not, in any way that will make them a bigger profit. Nothing really shocking about that, and mostly just standard behavior for any other modern commercial entity operating within a capitalistic economy.
• gtsop 5y ago
  Paying customer I do not trust protonmail with my privacy. I only use them to sign up for various services, trying to escape the data mining google does. Not sure I want to support a company that is dishonest however. I'm reaching the bye-bye point myself slowly but surely.
• CraneWorm 5y ago
  I read here ProtonMail were compelled to log the IP by the authorities... Could they have done anything else? Could any sort of malicious compliance have been an out? Like: "if we hear there is an investigation on you then we want nothing to do with your shit and we'll delete your account"? I suppose this would land them in hot water, but there might be something else really clever?
• kazen44 5y ago
  for those who are curious, this seems to be the reply from protonmail on reddit[0] >Hi everyone, Proton team here. We are also deeply concerned about this case. In the interest of transparency, here's some more context. In this case, Proton received a legally binding order from the Swiss Federal Department of Justice which we are obligated to comply with. Details about how we handle Swiss law enforcement requests can found in our transparency report: https://protonmail.com/blog/transparency-report/ https://protonmail.com/blog/transparency-report/ Transparency with the user community is extremely important to us and we have been publishing a transparency report since 2015. As detailed in our transparency report, our published threat model, and also our privacy policy, under Swiss law, Proton can be forced to collect info on accounts belonging to users under Swiss criminal investigation. This is obviously not done by default, but only if Proton gets a legal order for a specific account. Under no circumstances however, can our encryption be bypassed. Our legal team does in fact screen all requests that we receive but in this case, it appears that an act contrary to Swiss law did in fact take place (and this was also the determination of the Federal Department of Justice which does a legal review of each case). This means we did not have grounds to refuse the request. Thus Swiss law gives us no possibility to appeal this particular request. The prosecution in this case seems quite aggressive. Unfortunately, this is a pattern we have increasingly seen in recent years around the world (for example in France where terror laws are inappropriately used). We will continue to campaign against such laws and abuses. to me this seems like they did all the could in regards to handling this request. [0]https://www.reddit.com/r/ProtonMail/comments/pil6xi/climate_activist_arrested_after_protonmail/ https://www.reddit.com/r/ProtonMail/comments/pil6xi/climate_...
  • alternatetwo 5y ago
    So Switzerland is evidently not a democracy anymore. Sad to hear.
    • nemo44x 5y ago
      What does being a democracy or not have to do with this order?
    • IanSanders 5y ago
• regnull 5y ago
  The only good answer to this is end-to-end encryption, keys held by the individuals, and full decentralization. You must not put your private communications into the hands of any company, as great as they are.
• FpUser 5y ago
  Proble is not with ProtonMail. Problem is with the government arresting people for this type of action.
• alfiedotwtf 5y ago
  I'm looking forward to the day where email is not mistakenly used for clandestine communication. Why hasn't there been made a Tor-only, store-and-forward, text-only communication app? You'd think this would be a no-brainer for communities that need real private communications.
• atok1 5y ago
  I've always said never trust PM. See Cryptome for more info. Also, their VPN...
• melbourne_mat 5y ago
  I'm also a proton mail user. It sounds like you have privacy as long as you don't break any European law. That's certainly not the "Swiss bunker" style of service I was expecting
  • Mandatum 5y ago
    I think Mullvad's approach is best. Choose a solid provider, handle encryption yourself. Mullvad use Gmail. https://mullvad.net/en/help/using-encrypted-email/ https://mullvad.net/en/help/using-encrypted-email/
• sharklazer 5y ago
  Honestly, as soon as I saw ProtonMail was all implemented in JS, I ran for the hills.
• cinquemb 5y ago
  metadata, metadata, metadata… things we all like to ignore, especially those selling privacy in a bottle…
• France_is_bacon 5y ago
  For me, I NEVER expect protection from any governmemnt authorities. They have unlimited resources (compared to a regular person), and you can't fight city hall, as the saying goes. The reason I use tutamota (similar to protonmail) is to stop the Googles and Yahoos and hotmails from scanning all of my emails, using them to advertise to me, selling the information to advertisers. Could you imagine if the US post office opened up all your mail, read it, and sold this information to anyone who asked? Preposterous. And keep track and sell who you send stuff to and who you receive info from? Of course, if the government decided to monitor you regular mail, they could. Fine. Nothing anyone can do about that. But at least the USPS doesn't read everything you send and sell that info to commercial entities. So, that is why I use those types of services. I don't want to be anywhere near Googlemail, or Yahoomail, or Hotmail, etc.
  • Penguinx628 5y ago
    FYI: https://en.m.wikipedia.org/wiki/Mail_Isolation_Control_and_Tracking https://en.m.wikipedia.org/wiki/Mail_Isolation_Control_and_T...
    • France_is_bacon 5y ago
      Does not negate what I said. I said that the USPS does not open your mail, scan it, and sell it to the highest bidder. And, actually, the article you linked to only gives that information to government entities, which, in my post, I said that you should not worry about the government, because they have infinite resources compared to the average person. So not too sure on your point that you're trying to make. Yeah, if there's a subpoena, I'm sure the government could open and read every single piece of mail you send or receive, but that's what I said. But, Google or Yahoo or Facebook is not going to have access to this information. But they will if you use their email system. Why do you think they offer it for free? Through the generosity of Sergey Brinn and Larry Page's black, black hearts?
  • capeterson 5y ago
    Double FYI, the USPS does sell personal data when you do a change-of-address: https://www.forbes.com/sites/adamtanner/2013/07/08/how-the-post-office-sells-your-new-address-with-anyone-who-pays-and-the-little-known-loophole-to-opt-out/ https://www.forbes.com/sites/adamtanner/2013/07/08/how-the-p...
• anonuser123456 5y ago
  Climate activist or general miscreant masquerading under the guise of climate activism?
  • OrvalWintermute 5y ago
    I am fairly law abiding except for when it comes to the intersection of a vehicle and a heavy pedal. But Configuring logging on a user's IP address information on a private email service for what appears to be a fairly petty crime seems rather like dropping a nuke on an ant, both on the side of the French/Europol LE, and also for Swiss authorities, and then Swiss companies to be responsive to something so petty. For something this "Organizing a Climate Camp" [1] involved I'd expect at least a serious felony, or a dramatic terrorist incident with loss of life. If the crimes involved are truly so minor, it raises the spectre of what would they do for an actual serious crime? I hope I am misreading this...... [1] https://www.liberation.fr/terre/2020/09/27/camp-climat-a-paris-on-veut-montrer-que-les-ecolos-savent-etre-fun_1800633/ https://www.liberation.fr/terre/2020/09/27/camp-climat-a-par...
• pathseeker 5y ago
  Arrested for what? "Climate activist" seems like emotional manipulation.
• jacksonkmarley 5y ago
  Would be good to have some other sources for this story. So a Swiss company has been apparently forced to provide details of a user who is under investigation by police in another country? I'm curious about the way that actually works, that a Swiss court receives a request from a foreign police force and a private company has no recourse to refuse or appeal the resulting order. Seems a bit weird to me, although I don't know a lot about the legal system there.
• seg_lol 5y ago
  So ... squating a building and running a punk climate action is enough to de-anonymize a proton mail account? Jesus. https://twitter.com/OnEstLaTech/status/1434661903293423618 https://twitter.com/OnEstLaTech/status/1434661903293423618
• pmtruth 5y ago
  Protonmail is a company that was started by people cashing in on the CERN and Switzerland brands, not a company started by privacy activists.
• upofadown 5y ago
  This same sort of issue came up with Tutanota a while back. What do people expect when law enforcement shows up with a valid warrant? Is the service provider supposed to open fire? Anonymity (which is different than privacy) is something that can only be achieved in very particular circumstances for a limited time. It always involves work on the part of the person involved, usually ongoing. It isn't something you can just go out and buy. Most people have no need of it most of the time.
• hartator 5y ago
  > Now, of course Protonmail has to comply with Swiss law Do they though? What about even less friendly states?
• shp0ngle 5y ago
  And, as with hushmail about a decade ago, people will eventually learn that web mail clients cannot provide magic security.
• hsuduebc2 5y ago
  What are good alternatives?
• deleted 5y ago
  [deleted]
• EGreg 5y ago
  Remember there was this: https://www.forbes.com/sites/kashmirhill/2014/09/16/satoshi-nakamoto-email-hack/?sh=5125aeb41dd9 https://www.forbes.com/sites/kashmirhill/2014/09/16/satoshi-...
• aero-glide2 5y ago
  So what exactly did the activists do which required an interpol notice?
  • DoingIsLearning 5y ago
    I was wondering the same, it's in the twitter thread, they apparently just squatted in protest: > "Where can I read more about this? What was the alleged crime?" >> "Organizing a climate camp. Some links (in French)..." So either something else is missing, or investigations are biasedly heavy handed on these cases?
• hestefisk 5y ago
  Anyone up for creating a competing service? We could host the service in a country with proper privacy laws like Iceland.
  • atok1 5y ago
    If you create, they will come.
• markmark2021 5y ago
  This comment will probably get buried. But I’m a paying ProtonMail customer and I noticed a number of things that seem to indicate the company is doing things to enable user surveillance without it being directly attributed to the company. 1) Malware scanning services. I noticed that links in my email are sent to a third party to be scanned for malicious content. I never signed up for this service. 2) Mobile phone analytics. Using a third party for mobile analytics known to track users. 3) CDN: using a content delivery network in countries that do not have the same privacy requirements as ProtonMail’s corporate domicile. Privacy is a gimmick for the company at the very least, a front at the worst. I still use them because I trust other companies even less.
• deleted 5y ago
  [deleted]
• ogma 5y ago
  LOL, what is the point of using their slow, shit email service then? It's not actually difficult to self-host email. Micro$oft are bitches and will block you, but whatever.
• Ansil849 5y ago
  I'm seeing a lot of comments along the lines of "there's nothing ProtonMail could have done in this case." This is patently false. The first thing they could have done is not hosted their service in a jurisdiction susceptible to these kinds of logging requests, at least not openly. In other words, they could have concealed the location of their services. Instead, ProtonMail is attempting to have their cake and eat it too: on the one hand, they repeatedly publicize the fact that they have 'Swiss privacy laws' as a selling point, but yet on the other hand when a privacy violation such as this occurs, they claim that their hands are tied because of....Swiss laws. It's this two-faced behavior that is deplorable.
  • drivebycomment 5y ago
    > This is patently false. The first thing they could have done is not hosted their service in a jurisdiction susceptible to these kinds of logging requests, at least not openly. In other words, they could have concealed the location of their services. Where is that ? Which country doesn't have a law that allows authorities to request such information ? I'm not aware of any, at least not among any sufficiently developed countries with useful infrastructures.
    • Ansil849 5y ago
      You appear to have missed a significant portion of my post: > at least not openly. In other words, they could have concealed the location of their services. > Instead, ProtonMail is attempting to have their cake and eat it too: on the one hand, they repeatedly publicize the fact that they have 'Swiss privacy laws' as a selling point, but yet on the other hand when a privacy violation such as this occurs, they claim that their hands are tied because of....Swiss laws.
      • drivebycomment 5y ago
        > at least not openly. In other words, they could have concealed the location of their services. You can't provide a paid commercial service while hiding your business entity. And, on top of that, DNS and SMTP make this basically impossible technically as well. So what you're looking for is, at least when it comes to email, something that doesn't and can't exist.
• deleted 5y ago
  [deleted]
• sebyx07 5y ago
  Conclusion, protonmail has lied and they will lose a lot of customers
• devwastaken 5y ago
  Pretty sure it says right on their site that protonmail/vpn cooperate with law enforcement when "something obviously illigal" is claimed. They have thousands of cases they give data on every year. The whole "swedish court system" is marketing. If they were legitimate they'd be talking about data center black boxes, why they were funded by NSA interests, how things actually works. My bet is this, proton can't actually afford to defend against thousands of court cases, so they comply. They can't afford for their service to look insecure, so theyre selective in divulging how much surveillance they have to comply with.
• yunohn 5y ago
  I’m a web developer, and I assume a lot of HNers are too. So I’m really confused by the lack of understanding around IP addresses in the comments here. Everyone realizes that, by default, literally just connecting to another service over the web, will expose your IP address? It’s trivial to monitor and report your IP to the authorities, as soon as you login to ProtonMail, despite lack of “logging”. Logs only matter for historical data. This legal request is impossible to /not comply/ with. Does anyone here have a feasible way to solve this? Or is it just a bunch of ProtonMail hating FUD?
  • raxxorrax 5y ago
    You can just not save the info. Not surprised that web developers have no concept of not saving everything anymore, but it is technically feasible. In many cases the IP wouldn't even reach your service and you only see it in the log of some load balancer or other proxy. How fleeting those logs are is a matter of choice. You can come up with an excuse, depending on the service it might be laborious to get an IP on a running live system that doesn't otherwise care about connection information. Depending on the truthfulness of that you might make yourself guilty of impeding investigations though.
    • yunohn 5y ago
      > Not surprised that web developers have no concept of not saving everything anymore Your contempt for web devs seems to correlate with your lack of understanding of how the web works. Responses like yours make me cringe, in how uninformed they are, despite trying to sound smart. IP addresses can and will be exposed in any situation that a user connects to a service - it’s a fundamental property of the web. You cannot tell Government agencies, esp. when they have a 3-country-approved warrant, that “we don’t know how to”. If you terminate a connection at the load balancer, they will make you monitor it. If that’s not owned by you, they will send the warrant onto your cloud provider or whoever.
      • raxxorrax 5y ago
        I have no contempt for web devs beyond those that implement invasive tracking against their users. I could setup a service that masks any clients IP address towards my service with no problem. If a client connects through TOR or similar network I would not be the wiser either. So apart from just not logging connection attempts, there are other tricks. Of course that doesn't work if law enforcement is knocking on your door and forcing you to do that. But there are still mechanisms that would allow IPs to be hidden. The state cannot know the intricacies of the mechanisms your service employs. protonmail.com could point to a server in Timbuktu that makes any request in delegation for a client to hide IPs. This privacy arms race is pure idiocy though and the problem is legislation and lacking control and supervision of police forces within European countries that decided they should be so afraid to call one emergency legislation after another for more than two decades.
• enriquto 5y ago
  It seems that they were compelled by Swiss authorities to start logging a particular user (i.e., logging their IPs which were not logged by default). ProtonMail seems like a very bad actor in that case. Even if they must have to obey that order, they could have prevented the user explicitly before doing so.
• wiz21c 5y ago
  I'm surprised nobody questions the "why" did the police did that. A climate activist doesn't sound like someone who requires strong police investigation. And, for that matter, not that strong since the police didn't read the content of the emails but merely used one IP address. But here, it's not climate activist. It's people illegally occupying private properties, iow squatting. They do it for political reasons, fine, but it's illegal nonetheless. Also, I'm a bit surprised that these are climate activist at work here since gentrification (the process they fight against by squatting) is not really a climate issue but more a problem (as I read it) of capitalism. (now I understand the whole issue down here revolves around disclosure of expected-to-be-protected information, but well, there's a big picture too...)
• slim 5y ago
  The crime of the person arrested seems to be squatting a building in paris. The title was probably chosen with good intentions, but when I read climate activist, I imagined he committed violence.
• jimnotgym 5y ago
  It always amazes me that there is this hardcore of people on hn who are so anti ProtonMail. If you use gmail, It is my understanding that google ai will routinely read all your messages and add anything interesting to your profile so they can target you for ads. Law enforcement also has open access to everything in your mailbox all of the time. ProtonMail don't read your email but will supply metadata to authorities in response to a lawful warrant. That still feels like a difference between gmail and ProtonMail. I pay for that difference, your money your choice.
  • geewee 5y ago
    Gmail hasn't used email content for ads for years: source: https://www.nytimes.com/2017/06/23/technology/gmail-ads.html https://www.nytimes.com/2017/06/23/technology/gmail-ads.html
    • random_walker 5y ago
      Not for ads but for various kinds of text completion suggestions. Google's AI still reads contents from our email body to suggest text or reminders.
    • ranguna 5y ago
      Moreover, it doesn't matter if they use it for commercial purposes, what matter here is that governments can force protonmail to collect IPs and nothing else. You're on Gmail or outlook ? Well, now governments can have your IP, email contents and anything else you can imagine.
  • aloisdg 5y ago
    Where can I pay to have my provider say "nope" to the french police force a case like this?
    • CyanBird 5y ago
      Set up your own encrypted email server If anyone has specific recommendations for which open source encrypted platforms to set up, I am all ears
• blacklight 5y ago
  I moved from Gmail to ProtonMail exactly because they were promising strong encryption, no logging of IPs and no data leaked outside for whatever reason. I know that every IT company eventually turns into a bunch of creepy and greedy jerks that end up contradicting all of their initial "don't be evil" statements. But please, Proton, don't do this so early in the process. I'm tired of migrating from one jerk company to a we-are-not-jerks-yet company all the time. If it turns out that Proton really leaked the IP and device info of an activist to the authorities I'll just go back to setting up my own mail server like it's 1995 and f*ck all this madness.
  • CyanBird 5y ago
    You should set up your own email server, they can't be trusted If they are announcing this, think of the ones they are under gag orders to not announce /disclose
    • foxfluff 5y ago
      What does setting up your own server solve? Like you can trust your ISP? Chances are tracing your mailserver to you isn't any harder than tracing a protonmail account to you.
  • giansegato 5y ago
    Get ready to fight against anti spam like crazy, with your own server. Email is supposedly decentralized, but under the umbrella of "anti spam" it's really an oligopoly of providers
• pmlnr 5y ago
  Run. Your. Own. Email. Servers. Please. That's the only way to keep this specific part of the decentralised by design, old internet alive.
• junon 5y ago
  This is strike two. ProtonMail went under fire several months back about opting to use Google's reCaptcha for login in a time crunch, rather than setting up hCaptcha even if it took a little extra time. The tradeoff was cost vs. user privacy and they chose cost, which is NOT why a lot of us pay PM to begin with. This is unacceptable, but unfortunately there are no alternatives that hit all the check marks PM has in terms of features. The response of "use Tor to connect" doesn't really help. If you so much as accidentally connect once with a normal IP, that's enough to nab you.
  • Jommi 5y ago
    Read the actual case details here: https://news.ycombinator.com/item?id=28431834 https://news.ycombinator.com/item?id=28431834
    • junon 5y ago
      Thanks. This is quite a different narrative than the Twitter thread and makes a bit more sense. People likening this to exposing the hiding places of Jews to the Nazis is probably the saddest and most infuriating comparison I've seen in recent times. Let's be rational here, folks.
  • tempodox 5y ago
    You cannot expect anyone to openly not comply with the law on your behalf. It looks like ProtonMail had to log and cough up that IP in the context of a criminal investigation. The politics of how it became a criminal investigation in the first place have nothing to do with PM. The submission title doesn't reflect the details.
• Jommi 5y ago
  Everyone in this thread is missing the real context and the information that has been coming out in the past 24h of the case. Read more here: https://www.reddit.com/r/ProtonMail/comments/pil6xi/climate_activist_arrested_after_protonmail/hbqha63/?context=3 https://www.reddit.com/r/ProtonMail/comments/pil6xi/climate_... TLDR: 1. Protonmail received Swiss legal request that was based on proven legal grounds and thus had to comply with. 2. They started monitoring the user's account and informed them that their data was requested. (Informing is required by Swiss law) 3. Only data Protonmail keeps by default is account creation date. Now they also logged the IP of the tracked account. 4. This IP information was given to the Swiss authorities. 5. The Swiss authorities gave this information to Interpol. What should Protonmail have done differently here?
• nabla9 5y ago
  ProtonMail did everything they legally can to protect privacy. The user must do the rest (like use Tor). They don't log IP, but if ordered they have to. They can't choose what criminal cases are sufficient. They have to follow the law.
• deleted 5y ago
  [deleted]
• immmmmm 5y ago
  i'm swiss. i think it's interesting to contemplate that, in 2021, being a pacific climate activist, namely sitting in front of a bank with massive investments in fossil fuels or that sort of things to attract attention on the science, will result in you getting the full treatment reserved to terrorists.
• Fnoord 5y ago
  > IANAL, but I have a hard time seeing how young people squatting buildings in Paris is an extreme criminal case. In any case, I have an issue with this lack of transparency from ProtonMail, if any police service can ask them to log IP addresses, that is not anonymous (Quote from the Twitter thread, by same author.) Yeah, that is the problem. We don't know who, we don't know why, we don't know shit. All we know is that the request took place. We don't know if the request was or is justified. Those who trust police or dislike climate activism might say 'of course' and those who distrust police or like climate activism might say 'of course it wasn't justified'. Meanwhile, police (Europol in this case) are not releasing details for the neutral readers to make up their mind, because they're still fully in the investigation. I'm very much pro-privacy, and actually I find the environment very important, but I also want to give Europol the benefit of the doubt. So I suspect a climate activist, using Protonmail, might've gone a step or two too far. And if Protonmail just runs some VPS in some other countries, they'll have to abide by the law in these, on top of Swiss law. That a Swiss company has to cooperate with Europol because Europol has mandate in Switzerland is also a no-brainer.
• AndrewThrowaway 5y ago
  Cases like this always remind me this XKCD: https://xkcd.com/538/ https://xkcd.com/538/ Technology people always want to imagine that technology will save/deceive them. Imagine a situation where some "enemy of the state" is using some "secure" service like "securomail" or similar. Is it hard to imagine Police/Interpol/KGB coming to the offices of "securomail" and demanding providing IP addresses, no longer encrypting, installing malware for this particular user, etc? Or else all the C-level of "securomail" are "helping the enemy of the state" with all the consequences. There is always this "5$ wrench human layer" which no technology will protect from.
• eterevsky 5y ago
  Is anything actually known about what he is charged with? It seems totally possible that he has committed a crime unrelated or semi-related to his climate activism.
• raxxorrax 5y ago
  Is Europol legitimized to do that? If so, I think there needs to be a discussion because I don't believe they have any mandate whatsoever. It is basically a criminal organisation because there is no accountability.
• baud147258 5y ago
  looking at the original source (in French at https://secoursrouge.org/france-suisse-securite-it-protonmail-a-communique-a-la-police-ladresse-ip-de-militant%c2%b7es-anti-gentrification/ https://secoursrouge.org/france-suisse-securite-it-protonmai...), it seems it's more anti gentrification protesters than climate activists as indicated by the title on HN
• r721 5y ago
  ProtonMail's blog post: https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/
• thysultan 5y ago
  You're better of using some service in China that does log ip's if you're not living in China(not being part of the five eyes anglo sphere is the goal) and vice versa if you are living in China. Security via sovereign obscurity.
• downWidOutaFite 5y ago
  Activists challenging their governments should use services hosted outside the jurisdiction where they live. Europeans should use Russian or maybe American services and vice versa. And encrypt in transit.
• neycoda 5y ago
  "By default, we do not keep any IP logs" is obvious to mean "We MAY keep IP logs"... I don't know how people read it as simply "We do not keep IP logs". It's on you if choose to use it and get busted doing something illegal with it. Protonmail is not or should not be a safehouse for criminals.
• undertheradar_n 5y ago
  Proton’s reply makes sense https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/