7 ms·

One of the first sentence on their website is "By default, we do not keep any IP logs". If as soon as police show up (Which is almost the only case that people

by polote 5y ago

One of the first sentence on their website is "By default, we do not keep any IP logs". If as soon as police show up (Which is almost the only case that people would want their IP hidden) they give IP logs, it is clearly false advertising. The fact that only the anonymous feature is important to you will not change the fact that they do the opposite of what they advertise regarding IP logs

COGlory 5y ago
>If as soon as police show up (Which is almost the only case that people would want their IP hidden) they give IP logs, it is clearly false advertising Is there any evidence this is what happened? An alternate scenario is that they were not keeping logs, and were then compelled by the authorities to start keeping them on that user.
- bdibs 5y ago
  Wouldn't "any" include authority compelled logging?
  - COGlory 5y ago
    Perhaps, but I'd imagine that semantically, "by default" negates that since this is clearly not a default situation.
    - hh3k0 5y ago
      Stop trying to defend indefensible behavior by getting hung up on semantics. I, for one, will not renew my ProtonMail account if that's their status quo.
      - kazen44 5y ago
        what other status quo do you expect from them? Having to provide IP logs after a warrant has been issued is the law in switserland (and most if not all of the EU). Sure, the law would (hopefully) be changed, but at the moment, this is the best they can legally do?
        ipaddr 5y ago
        Tell users you are being logged on website. Put alert warning that account has logging enabled Change the service so collecting logs is not possible Stop adding captcha to tor users login because you want to identify users
        COGlory 5y ago
        >Tell users you are being logged on website. Frequently not legal >Put alert warning that account has logging enabled See above. Gag orders a problem with government in general. They do have a warrant canary page though, as well as a transparency report. https://protonmail.com/blog/transparency-report/ https://protonmail.com/blog/transparency-report/ >Change the service so collecting logs is not possible You mean stop serving HTTP and MX requests? >Stop adding captcha to tor users login because you want to identify users You mean let bots brute-force my password?
      - COGlory 5y ago
        I'm extremely confused by this. Unless you are naive enough to assume that ProtonMail is incapable of logging IP addresses (in which case they'd be incapable of serving HTTP requests...see the problem?) then they can log. And they most certainly aren't going to declare independence from Switzerland and refuse to turn on IP logging when required to by law. Whereas with E2E-E, they actually are incapable of turning over readable emails.
- polote 5y ago
  The end result is the same either way
  - COGlory 5y ago
    No, if they were not collecting logs by default, then it is clearly not false advertising.
    - polote 5y ago
      So the default is when nobody ask for the logs? What the point of not collecting IP unless for the time it is useful?
      - Sebb767 5y ago
        No history of when you logged in from where and, possibly, plausible deniability about about you being the only user of that account (through you'd probably need to prepare for this to be believable).
      - Aachen 5y ago
        I mean it's either this or traffic analysis. If you use your clearnet IP address to do illegal things, it's nothing more than reasonable that you can get in trouble for it. This is also why I don't get protonmail in the first place. Unless you use pgp or equivalent, you'll always be subject to law enforcement. Just that protonmail cares more and caters more to activists and so might not give it out without checking that the asker is really legit and then give the minimal amount possible. But they'll always be able to turn over your emails and log IPs, it's not protonmail's fault the laws were voted into action like this.
    - lelandfe 5y ago
      Technically correct but misleading. They tout that off-by-default statement on their homepage, underneath the header of "Anonymous Email," with the closing sentence of "Your privacy comes first." So why even market that? It provides no meaningful security.
tephra 5y ago
So also a proton customer here. "By default we do not keep any IP logs" and this case does not seem like the default? Seems like they were required to by law to log and turn over this specific IP? (Of course I haven't seen the actual case but I would assume that meant a warrant.)
- polote 5y ago
  We do not kill people except the people we kill I see that you want to protect Protonmail, but if they want to stop being misleading they can just remove the IP log sentence
  - istingray 5y ago
    Put "By default we don't keep IP, but may be required to by local laws. We suggest you connect through Protonmail through Tor". I would much prefer this, as a Protonmail paying customer.
    - dredmorbius 5y ago
      Tor helps, but is not especially robust against state-level actors / APTs. An actor running a sufficient number of entry/exit nodes could perform at least some traffic analysis. Tor is an improvement. It's still a limited tool.
      - seg_lol 5y ago
        It would have absolutely prevented this person from getting identified. It looks like some kids doing a climate protest. I can't but help read your post in comic book guys voice.
        dredmorbius 5y ago
        In comic-book voice, then: what would an intelligence agency or police force's response to a suspect known to be using Tor be? Traffic analysis, at a cost, could establish that the suspect is using Tor. TorMetrics shows slightly more than 1,250 currently-running Tor exit nodes. I'll presume this is typical, history shows it's pretty consisten over the past 3 months. https://metrics.torproject.org/relayflags.html?start=2021-06-08&end=2021-09-06&flag=Exit https://metrics.torproject.org/relayflags.html?start=2021-06... I'm going to presume that a court could conceivably issue an order to log all Tor-based traffic. A state actor / APT might then be able to correlate a known IP and traffic at a given point in time with other data to identify a source IP. This might be combined with other measures to encourage circuit-jumping until the suspect is on a specific known or monitored Tor circuit. Yes, costs increase. I don't see this as technically infeasible, however. Might not be rolled out just for a house-squatter, however.
jcrites 5y ago
Not necessarily. It's possible that their statement is true that they don't keep IP logs, but the Swiss police showed up with a court order for the equivalent of a US wiretap or pen register, requiring them to begin logging the IP address for that account when it signed in. I think trusting your security or privacy to website-based email is a bad idea. If the email is being displayed in your browser, then the authorities can coerce the company that owns the website to include JavaScript in that page that sends the plaintext content to them too -- or demand the website's TLS key and start intercepting the traffic that you see. The only encryption-based security that you can reliably trust is encryption that happens locally on a device you control, and that doesn't involve a web page or website loaded from a 3rd party. If you want privacy protection with real end-to-end encryption that the government can't get past trivially with court orders, use services where the decryption happens on devices that you own, such as WhatsApp or Signal or iMessage. If you must use email, do the encryption yourself on a hardened Linux distribution like Tails using PGP for email encryption; but this is much harder to set up than the above secure messengers. I wouldn't say ProtonMail is a scam, but a trivial software change on their server-side would let the authorities see your email every time you do. If they can be compelled to make that change then the "encryption" you're paying for is worth nothing. The next time you sign in, a court-required modified version of their server software can capture your password, and then use whatever key derivation function gives them your encryption key. This might not even require the company to actively participate. In the case of Snowden and LavaBit email, the US Government demanded LavaBit's TLS certificate so as to intercept the communications themselves at the ISP layer when LavaBit refused to comply with narrower court orders to provide information about his account. What could police do with ProtonMail's TLS certificate and court authority to intercept and MITM traffic for your account? They can probably capture your password, use that to read all of your old email, and at minimum read your email as you read it. Even if decryption is happening in the browser somehow with JavaScript, that JavaScript is coming from the origin server that the government now controls by virtue of MITMing the traffic with the site's TLS cert, and so they can insert JavaScript that logs a plaintext copy of either the emails or the encryption key needed to decrypt them. There is no security with web-based communications if the companies involved can be coerced with a court order. US based firms would be required to hand over their TLS cert if they weren't willing to help track someone, and at that point the government could do anything to your traffic. The only secure encryption happens on your device with no browser involved. By comparison, if you're using an iPhone, in theory the US Government could try to force Apple to modify WhatsApp/Signal on your phone, or force the App developers to do so. These companies would all fight tooth-and-nail in court against doing so. Plus, you can configure your iPhone to disable automatically updating apps, so once you have a working version of WhatsApp installed, unless Apple has some backdoor-ability to push an update of it to your phone anyway, you could turn off app update and be cautious & picky about when you choose to update WhatsApp or Signal. What I don't know how to do is verify the integrity of their binaries: to confirm that what you're getting is the same app distributed to everyone. Facebook would appeal to SCOTUS before allowing a government to install a backdoor into WhatsApp; so would Apple, based on their response to the government's request to unlock the San Bernadino shooter's phone. All that being said, if the government's goal is simply to discover your identity, which was the case here, then Signal and WhatsApp won't help you. Their accounts are based on a phone number. If the govt has your phone number then unless it's a burner acquired with no name registration then they'll know who you are, and regardless will be able to find out approximately where you are, if you continue to use that phone number. They can triangulate where you are fairly rapidly with modern technology, and this is assuming that the cell company can't simply send a signal asking the phone for its GPS-based location; but even if the govt only knows your nearest cell towers, narrowing that down to a building is a matter of minutes once they're in the area. If you need to communicate in a way that keeps your identity a secret then you're probably best off using a free email service over Tor from a machine running Tails Linux, accessed from various locations that provide public wifi.

by polote 5y ago

COGlory 5y ago

>If as soon as police show up (Which is almost the only case that people would want their IP hidden) they give IP logs, it is clearly false advertising Is there any evidence this is what happened? An alternate scenario is that they were not keeping logs, and were then compelled by the authorities to start keeping them on that user.

bdibs 5y ago
Wouldn't "any" include authority compelled logging?
- COGlory 5y ago
  Perhaps, but I'd imagine that semantically, "by default" negates that since this is clearly not a default situation.
  - hh3k0 5y ago
    Stop trying to defend indefensible behavior by getting hung up on semantics. I, for one, will not renew my ProtonMail account if that's their status quo.
    - kazen44 5y ago
      what other status quo do you expect from them? Having to provide IP logs after a warrant has been issued is the law in switserland (and most if not all of the EU). Sure, the law would (hopefully) be changed, but at the moment, this is the best they can legally do?
      - ipaddr 5y ago
        Tell users you are being logged on website. Put alert warning that account has logging enabled Change the service so collecting logs is not possible Stop adding captcha to tor users login because you want to identify users
        COGlory 5y ago
        >Tell users you are being logged on website. Frequently not legal >Put alert warning that account has logging enabled See above. Gag orders a problem with government in general. They do have a warrant canary page though, as well as a transparency report. https://protonmail.com/blog/transparency-report/ https://protonmail.com/blog/transparency-report/ >Change the service so collecting logs is not possible You mean stop serving HTTP and MX requests? >Stop adding captcha to tor users login because you want to identify users You mean let bots brute-force my password?
    - COGlory 5y ago
      I'm extremely confused by this. Unless you are naive enough to assume that ProtonMail is incapable of logging IP addresses (in which case they'd be incapable of serving HTTP requests...see the problem?) then they can log. And they most certainly aren't going to declare independence from Switzerland and refuse to turn on IP logging when required to by law. Whereas with E2E-E, they actually are incapable of turning over readable emails.
polote 5y ago
The end result is the same either way
- COGlory 5y ago
  No, if they were not collecting logs by default, then it is clearly not false advertising.
  - polote 5y ago
    So the default is when nobody ask for the logs? What the point of not collecting IP unless for the time it is useful?
    - Sebb767 5y ago
      No history of when you logged in from where and, possibly, plausible deniability about about you being the only user of that account (through you'd probably need to prepare for this to be believable).
    - Aachen 5y ago
      I mean it's either this or traffic analysis. If you use your clearnet IP address to do illegal things, it's nothing more than reasonable that you can get in trouble for it. This is also why I don't get protonmail in the first place. Unless you use pgp or equivalent, you'll always be subject to law enforcement. Just that protonmail cares more and caters more to activists and so might not give it out without checking that the asker is really legit and then give the minimal amount possible. But they'll always be able to turn over your emails and log IPs, it's not protonmail's fault the laws were voted into action like this.
  - lelandfe 5y ago
    Technically correct but misleading. They tout that off-by-default statement on their homepage, underneath the header of "Anonymous Email," with the closing sentence of "Your privacy comes first." So why even market that? It provides no meaningful security.

tephra 5y ago

So also a proton customer here. "By default we do not keep any IP logs" and this case does not seem like the default? Seems like they were required to by law to log and turn over this specific IP? (Of course I haven't seen the actual case but I would assume that meant a warrant.)

polote 5y ago
We do not kill people except the people we kill I see that you want to protect Protonmail, but if they want to stop being misleading they can just remove the IP log sentence
- istingray 5y ago
  Put "By default we don't keep IP, but may be required to by local laws. We suggest you connect through Protonmail through Tor". I would much prefer this, as a Protonmail paying customer.
  - dredmorbius 5y ago
    Tor helps, but is not especially robust against state-level actors / APTs. An actor running a sufficient number of entry/exit nodes could perform at least some traffic analysis. Tor is an improvement. It's still a limited tool.
    - seg_lol 5y ago
      It would have absolutely prevented this person from getting identified. It looks like some kids doing a climate protest. I can't but help read your post in comic book guys voice.
      - dredmorbius 5y ago
        In comic-book voice, then: what would an intelligence agency or police force's response to a suspect known to be using Tor be? Traffic analysis, at a cost, could establish that the suspect is using Tor. TorMetrics shows slightly more than 1,250 currently-running Tor exit nodes. I'll presume this is typical, history shows it's pretty consisten over the past 3 months. https://metrics.torproject.org/relayflags.html?start=2021-06-08&end=2021-09-06&flag=Exit https://metrics.torproject.org/relayflags.html?start=2021-06... I'm going to presume that a court could conceivably issue an order to log all Tor-based traffic. A state actor / APT might then be able to correlate a known IP and traffic at a given point in time with other data to identify a source IP. This might be combined with other measures to encourage circuit-jumping until the suspect is on a specific known or monitored Tor circuit. Yes, costs increase. I don't see this as technically infeasible, however. Might not be rolled out just for a house-squatter, however.

jcrites 5y ago

Not necessarily. It's possible that their statement is true that they don't keep IP logs, but the Swiss police showed up with a court order for the equivalent of a US wiretap or pen register, requiring them to begin logging the IP address for that account when it signed in. I think trusting your security or privacy to website-based email is a bad idea. If the email is being displayed in your browser, then the authorities can coerce the company that owns the website to include JavaScript in that page that sends the plaintext content to them too -- or demand the website's TLS key and start intercepting the traffic that you see. The only encryption-based security that you can reliably trust is encryption that happens locally on a device you control, and that doesn't involve a web page or website loaded from a 3rd party. If you want privacy protection with real end-to-end encryption that the government can't get past trivially with court orders, use services where the decryption happens on devices that you own, such as WhatsApp or Signal or iMessage. If you must use email, do the encryption yourself on a hardened Linux distribution like Tails using PGP for email encryption; but this is much harder to set up than the above secure messengers. I wouldn't say ProtonMail is a scam, but a trivial software change on their server-side would let the authorities see your email every time you do. If they can be compelled to make that change then the "encryption" you're paying for is worth nothing. The next time you sign in, a court-required modified version of their server software can capture your password, and then use whatever key derivation function gives them your encryption key. This might not even require the company to actively participate. In the case of Snowden and LavaBit email, the US Government demanded LavaBit's TLS certificate so as to intercept the communications themselves at the ISP layer when LavaBit refused to comply with narrower court orders to provide information about his account. What could police do with ProtonMail's TLS certificate and court authority to intercept and MITM traffic for your account? They can probably capture your password, use that to read all of your old email, and at minimum read your email as you read it. Even if decryption is happening in the browser somehow with JavaScript, that JavaScript is coming from the origin server that the government now controls by virtue of MITMing the traffic with the site's TLS cert, and so they can insert JavaScript that logs a plaintext copy of either the emails or the encryption key needed to decrypt them. There is no security with web-based communications if the companies involved can be coerced with a court order. US based firms would be required to hand over their TLS cert if they weren't willing to help track someone, and at that point the government could do anything to your traffic. The only secure encryption happens on your device with no browser involved. By comparison, if you're using an iPhone, in theory the US Government could try to force Apple to modify WhatsApp/Signal on your phone, or force the App developers to do so. These companies would all fight tooth-and-nail in court against doing so. Plus, you can configure your iPhone to disable automatically updating apps, so once you have a working version of WhatsApp installed, unless Apple has some backdoor-ability to push an update of it to your phone anyway, you could turn off app update and be cautious & picky about when you choose to update WhatsApp or Signal. What I don't know how to do is verify the integrity of their binaries: to confirm that what you're getting is the same app distributed to everyone. Facebook would appeal to SCOTUS before allowing a government to install a backdoor into WhatsApp; so would Apple, based on their response to the government's request to unlock the San Bernadino shooter's phone. All that being said, if the government's goal is simply to discover your identity, which was the case here, then Signal and WhatsApp won't help you. Their accounts are based on a phone number. If the govt has your phone number then unless it's a burner acquired with no name registration then they'll know who you are, and regardless will be able to find out approximately where you are, if you continue to use that phone number. They can triangulate where you are fairly rapidly with modern technology, and this is assuming that the cell company can't simply send a signal asking the phone for its GPS-based location; but even if the govt only knows your nearest cell towers, narrowing that down to a building is a matter of minutes once they're in the area. If you need to communicate in a way that keeps your identity a secret then you're probably best off using a free email service over Tor from a machine running Tails Linux, accessed from various locations that provide public wifi.