5 ms·

They claim that they don’t keep logs on their French homepage. The climate activist is French: https://twitter.com/onestlatech/status/1434596410977030155?s=21 h

They claim that they don’t keep logs on their French homepage. The climate activist is French: https://twitter.com/onestlatech/status/1434596410977030155?s=21 https://twitter.com/onestlatech/status/1434596410977030155?s... And even on their English website, the marketing is misleading. They say that the service is "anonymous" and also: "By default, we do not keep any IP logs which can be linked to your anonymous email account".

kafkaIncarnate 5y ago
REALLY misleading. They created this feature for Mr. Robot, the TV show, too: https://protonmail.com/blog/protonmail-mr-robot-secure-email/ https://protonmail.com/blog/protonmail-mr-robot-secure-email... Scroll down to comment: > Liam, October 14, 2015 at 10:30 PM > But https://protonmail.com/security-details https://protonmail.com/security-details page says “No tracking or logging of personally identifiable information. Unlike competing services, we do not save any tracking information. We do not record metadata such as the IP addresses used to log into accounts.” So, now it turns to be that you introduced tracking and logging? Is this data encrypted as well? > Admin, October 17, 2015 at 9:14 PM > We don’t save any of this data by default, the user must explicitly turn it on for us to save it. There should be a reasonable assumption that given they have end-to-end encryption for the service, they just encrypt the logging for the user and store it encrypted without the key themselves like they do the emails. Also to note, they at least have an onion link to use their email service.
gregsadetsky 5y ago
The CEO's position on Twitter is that "by default" (from the sentence you're quoting) means when there is no criminal investigation, but when there is a legal order in place, Protonmail will collect the IP... https://twitter.com/andyyen/status/1434600373059297284 https://twitter.com/andyyen/status/1434600373059297284 "As described in the link above, under Swiss law, we can be forced to collect info on accounts belonging to users under criminal investigation. This is obviously not done by default, but only if we get a legal order." Activists beware.
- civilized 5y ago
  "We won't keep logs on you, except if you're in trouble with The Authorities, then we'll definitely keep logs on you and rat you out" Weird definition of privacy we've got going these days
  - rossdavidh 5y ago
    If you thought that Protonmail (or any other company) was going to go to break the law in order to avoid keeping logs on you despite a Swiss-backed warrant saying they had to do so, then you had the wrong impression. But I never got the impression Protonmail was saying that.
    - civilized 5y ago
      I have never used the service and don't know or care a thing about it. But their advertising is laughably inconsistent with the reality of the service provided. If it's illegal to provide a completely anonymous email service, then you should not claim to provide a completely anonymous email service.
      - freshhawk 5y ago
        I think everyone has gotten used to this particular lie, because it's so widespread and all the "privacy" email providers say things like this. Except maybe Lavabit, that guy apparently shut everything down to avoid doing something along these lines. So maybe he wasn't actually lying.
  - istingray 5y ago
    "We don't keep IP addresses. (we keep PI addresses which are tooooootally different and you didn't ask about those)"
- salawat 5y ago
  Once again: if you can't see their server software, you should assume they are FOS, and are capable of recording anything. Also: One more reason NAT was a good thing over IPv6. The closer we get to the platonic ideal of "UUID per person" the more likely justice systems will use it that way. The day everyone learns how to self-host mail on ephemeral compute instances is the day law enforcement starts requiring MX domain logs to be maintained in a historical manner. Work around that magically, and some law'll go on the books to try to tame the super spooky criminal communicators hiding from law enforcement. This is why we can't have nice things.

kafkaIncarnate 5y ago

REALLY misleading. They created this feature for Mr. Robot, the TV show, too: https://protonmail.com/blog/protonmail-mr-robot-secure-email/ https://protonmail.com/blog/protonmail-mr-robot-secure-email... Scroll down to comment: > Liam, October 14, 2015 at 10:30 PM > But https://protonmail.com/security-details https://protonmail.com/security-details page says “No tracking or logging of personally identifiable information. Unlike competing services, we do not save any tracking information. We do not record metadata such as the IP addresses used to log into accounts.” So, now it turns to be that you introduced tracking and logging? Is this data encrypted as well? > Admin, October 17, 2015 at 9:14 PM > We don’t save any of this data by default, the user must explicitly turn it on for us to save it. There should be a reasonable assumption that given they have end-to-end encryption for the service, they just encrypt the logging for the user and store it encrypted without the key themselves like they do the emails. Also to note, they at least have an onion link to use their email service.

gregsadetsky 5y ago

The CEO's position on Twitter is that "by default" (from the sentence you're quoting) means when there is no criminal investigation, but when there is a legal order in place, Protonmail will collect the IP... https://twitter.com/andyyen/status/1434600373059297284 https://twitter.com/andyyen/status/1434600373059297284 "As described in the link above, under Swiss law, we can be forced to collect info on accounts belonging to users under criminal investigation. This is obviously not done by default, but only if we get a legal order." Activists beware.

civilized 5y ago
"We won't keep logs on you, except if you're in trouble with The Authorities, then we'll definitely keep logs on you and rat you out" Weird definition of privacy we've got going these days
- rossdavidh 5y ago
  If you thought that Protonmail (or any other company) was going to go to break the law in order to avoid keeping logs on you despite a Swiss-backed warrant saying they had to do so, then you had the wrong impression. But I never got the impression Protonmail was saying that.
  - civilized 5y ago
    I have never used the service and don't know or care a thing about it. But their advertising is laughably inconsistent with the reality of the service provided. If it's illegal to provide a completely anonymous email service, then you should not claim to provide a completely anonymous email service.
    - freshhawk 5y ago
      I think everyone has gotten used to this particular lie, because it's so widespread and all the "privacy" email providers say things like this. Except maybe Lavabit, that guy apparently shut everything down to avoid doing something along these lines. So maybe he wasn't actually lying.
- istingray 5y ago
  "We don't keep IP addresses. (we keep PI addresses which are tooooootally different and you didn't ask about those)"
salawat 5y ago
Once again: if you can't see their server software, you should assume they are FOS, and are capable of recording anything. Also: One more reason NAT was a good thing over IPv6. The closer we get to the platonic ideal of "UUID per person" the more likely justice systems will use it that way. The day everyone learns how to self-host mail on ephemeral compute instances is the day law enforcement starts requiring MX domain logs to be maintained in a historical manner. Work around that magically, and some law'll go on the books to try to tame the super spooky criminal communicators hiding from law enforcement. This is why we can't have nice things.