6 ms·

They claim this is not possible under Swiss law, fwiw. We’ve recently seen that it is possible under German law, with a competitor (Tutanota) building a server-

They claim this is not possible under Swiss law, fwiw. We’ve recently seen that it is possible under German law, with a competitor (Tutanota) building a server-side backdoor for one user.

caeril 5y ago
...but we know it's possible under Swiss law, from this case, for them to be compelled to start logging specific account accesses, that they by default were not previously. How is that any different from them being compelled to disable or weaken clientside encryption? In both cases they're being compelled to make changes to their service. The camel's nose is clearly already under the tent. Everybody needs to start diffing javascript served by them.
- feu 5y ago
  [Deleted]
  - pessimizer 5y ago
    That's not the claim. The claim is that we don't know if X is possible under Swiss law. You seem to be the one claiming that because they said it's not possible, then it's not possible. If not, I don't know what you're claiming. The GP says that it's possible under German law. Is it "FUD" to say that it could end up being possible under Swiss law? Shouldn't there be fear, uncertainty, and doubt about any channel that activists use to communicate with each other?
- dane-pgp 5y ago
  > Everybody needs to start diffing javascript served by them. It would be nice if there were something like Perspectives[0] or Binary Transparency / Sigstore[1] to raise the alarm when something like this happened, but the threat would also be avoided if ProtonMail was available as a SecureBookmark[2]. [0] https://www.techrepublic.com/blog/data-center/ssl-tls-certificates-perspectives-helps-authentication/ https://www.techrepublic.com/blog/data-center/ssl-tls-certif... [1] https://security.googleblog.com/2021/03/introducing-sigstore-easy-code-signing.html https://security.googleblog.com/2021/03/introducing-sigstore... [2] https://coins.github.io/secure-bookmark/ https://coins.github.io/secure-bookmark/

They claim this is not possible under Swiss law, fwiw. We’ve recently seen that it is possible under German law, with a competitor (Tutanota) building a server-side backdoor for one user.

caeril 5y ago

...but we know it's possible under Swiss law, from this case, for them to be compelled to start logging specific account accesses, that they by default were not previously. How is that any different from them being compelled to disable or weaken clientside encryption? In both cases they're being compelled to make changes to their service. The camel's nose is clearly already under the tent. Everybody needs to start diffing javascript served by them.

feu 5y ago
[Deleted]
- pessimizer 5y ago
  That's not the claim. The claim is that we don't know if X is possible under Swiss law. You seem to be the one claiming that because they said it's not possible, then it's not possible. If not, I don't know what you're claiming. The GP says that it's possible under German law. Is it "FUD" to say that it could end up being possible under Swiss law? Shouldn't there be fear, uncertainty, and doubt about any channel that activists use to communicate with each other?
dane-pgp 5y ago
> Everybody needs to start diffing javascript served by them. It would be nice if there were something like Perspectives[0] or Binary Transparency / Sigstore[1] to raise the alarm when something like this happened, but the threat would also be avoided if ProtonMail was available as a SecureBookmark[2]. [0] https://www.techrepublic.com/blog/data-center/ssl-tls-certificates-perspectives-helps-authentication/ https://www.techrepublic.com/blog/data-center/ssl-tls-certif... [1] https://security.googleblog.com/2021/03/introducing-sigstore-easy-code-signing.html https://security.googleblog.com/2021/03/introducing-sigstore... [2] https://coins.github.io/secure-bookmark/ https://coins.github.io/secure-bookmark/