7 ms·
TBH in 2021 people engaging in potentially dangerous activities should be literate enough to understand, that no business will guarantee them full security and
by ivan_gammel 5y ago
TBH in 2021 people engaging in potentially dangerous activities should be literate enough to understand, that no business will guarantee them full security and decline all requests from authorities to disclose their identity. The wording you suggest is equivalent of „do not dry your cat in microwave“ instruction - a legal protection from dumb customers, that does not contribute meaningfully to safety.
For the non-Swiss customers working with a Swiss provider can be a good enough protection to avoid inconvenience of Tor. After all, even in the mentioned case it required review and approval of 3 agencies before request came to Proton - from French police, from Europol, and then from Swiss authorities. If this is not enough barriers to protect from politically motivated prosecutions and corruption, then we have much bigger problem in Europe.
- akimball 5y agoIt’s not protection FROM your customers. It is protection FOR your customers. Most customers are not technically astute
- shadowgovt 5y agoA corporation is a power centralization, and government authority can lean on power centralization. In general, regardless of what their TOS say, never believe that a corporation can't be compelled by the law to do anything they could physically do. CEOs can be jailed; when's the last time we heard of one actually going to jail over user privacy?
- pessimizer 5y agoThe point being made agrees with you, and is just saying that since protonmail can't help but obey sometimes, they should make the effort to educate their customers about that fact and whatever their customers can personally do to mitigate the risks of that fact.
- bigiain 5y ago> CEOs can be jailed; when's the last time we heard of one actually going to jail over user privacy? Ladar Levison from Lavabit came close. But even he admits that was because the FBI wanted to subvert every single Lavabit user's account (attempting vast overreach on the brazen assumption that "we are after Snowden" was going to pull the wool over everybody's eyes). Levison admits though, to having "responded to" at least two dozen subpoenas and complied with at least one warrant before. https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_order https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...
- andrepd 5y ago> CEOs can be jailed; when's the last time we heard of one actually going to jail, period.
- msh 5y agoThe CEO of the phone company qwest claims that the insider trading charges he got prison for was only brought to court because he refused to allow the installation of NSA surveillance equipment. https://en.wikipedia.org/wiki/Joseph_Nacchio https://en.wikipedia.org/wiki/Joseph_Nacchio
- ivan_gammel 5y agoA customer that specifically chooses Proton for privacy, must read and agree to privacy policy, which explicitly states, that Proton may in fact keep temporary IP logs and that user may opt in for login IP logs. Requests from authorities may ask for this kind of information and Proton will have to provide it. The „opt-in“ part for login logs is particularly interesting, because in fact Proton recommends this as a security best practice. Whether it’s in the best interest of the customer or not, it’s an open question. I would say, in a risk model, where threat of human rights violation by Swiss government is much lower than risks of unauthorized party accessing the account, it makes sense. Tough luck for the criminals that followed this advice. https://protonmail.com/privacy-policy https://protonmail.com/privacy-policy
- YLYvYkHeB2NRNT 5y agoAnyone that uses ANY electronic device to plan and arrange clandestine opetations - IS AN IDIOT.
- istingray 5y agoDo tell, how do you plan your clandestine operations?
- zwayhowder 5y agoBy using the classics of course. https://en.wikipedia.org/wiki/Histiaeus#Ionian_revolt_(499-494_BC) https://en.wikipedia.org/wiki/Histiaeus#Ionian_revolt_(499-4... Sure the bitrate is a bit slow and it's UDP only but our governments have proved over and over again that they can't learn from history.
- thaumasiotes 5y ago> In 499 BC, he shaved the head of his most trusted slave, tattooed a message on his head, and then waited for his hair to grow back. The slave was then sent to Aristagoras, who was instructed to shave the slave's head again and read the message, which told him to revolt against the Persians. Since this was a trusted slave, the tattoo seems unnecessary. The slave could just tell Aristagoras "Histiaeus says to revolt against the Persians".
- OrvalWintermute 5y agoIf the tech. companies involved have monetized surveillance, and no I am not talking about the kind they do for advertising, but instead the $ for data on users/portal, all that jazz, fees for LE levels of access, cost for responses, etc the LE are also the customers too then?
- istingray 5y agoI'm fine with Proton treating my data as a liability. Give me the tools to take away that liability by only sending them noise through an anonymous email address. I will pay for that.
- Thorrez 5y agoSure, the wording istingray suggested is a bit over the top. But the existing wording "By default, we do not keep any IP logs" is misleading. Why even say it? They should simply delete it.
- ivan_gammel 5y agoHow do you understand „by default“ and „keep“ in this phrase? Does it actually mean that they do not collect the logs?
- lelandfe 5y agoMy first reading of "by default" here is that I can optionally enable it through my account. Really, it's a phrase that means 3 things: I can enable it, ProtonMail can enable it[0], or the authorities can compel ProtonMail to enable it. Saying any of that, or at least linking to a page that does, would be a smart move. [0] https://protonmail.com/privacy-policy https://protonmail.com/privacy-policy - "IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions"
- asdfasgasdgasdg 5y agoIt is in contrast to the immediately following paragraph, which discusses a user-controllable setting that does cause ip logs to be retained permanently.
- Thorrez 5y agoWhat immediately following paragraph? This is what I see: https://i.imgur.com/6sZFn78.png https://i.imgur.com/6sZFn78.png
- asdfasgasdgasdg 5y agoIn the twitter screenshot linked to in this post, there is a discussion of the authentication logging feature in the immediately following paragraph (the screenshot discussing IP logging). https://twitter.com/OnEstLaTech/status/1434576598418796549?t=VN3Hnat5gwho459cEmQwUg&s=19 https://twitter.com/OnEstLaTech/status/1434576598418796549?t...
- istingray 5y agoThe problem is that engaging in "potentially dangerous activities" includes such a wide range of people. Think about a journalist in Afghanistan, a whisteblower in the USA, or a human rights activist in China. They're all engaging in potentially dangerous activities. Are they "dumb" because they don't understand all the ins and outs of surveillance? How about some empathy for them as users? The proposed statement above is intended to help people like that. Do I have such activities? Nope. But I believe that those activities should be enabled, whether for me in the future or others around the world. I advocate on behalf such "dumb" people by supporting simple services like Protonmail with my money. If Protonmail isn't supporting these users, why should I bother supporting Protonmail?
- jelling 5y agoAlso ProtonMail's only reason for being is that they are supposed to provide some higher level of privacy. If they don't, how are they any different than a commodity grade SMTP/IMAP provider? I will withhold judgement until I know more about the case but the early context does not look good for ProtonMail's value proposition, which is the least of things.
- lavabiopsy 5y agoIs it though? I don't know much about this company but their main selling point seems to be end to end encryption for mail messages. That's not a "privacy" feature by itself. Now it is a tool that you can use it to gain more privacy, but you could also have people who use it to cc all their emails to their entire facebook list. So it seems it all depends on how you use it and what type of privacy you try to achieve.
- blululu 5y agoEnd to end encryption is a privacy feature by itself. The example of using an email service to send a mass email to a dislist is irrelevant to the possibility that it would also be able to preserve privacy in other communications. You could send an email directly to the local police chief if you wanted but that does not preclude wanting privacy elsewhere.
- 2OEH8eoCRo0 5y agoWhat kind of "climate activist" draws this much heat?
- arvinsim 5y agoProbably one that threatens corporate interests.
- 2OEH8eoCRo0 5y agoProbably? Do you know anything about why they were arrested?
- Bigpet 5y agoSeems like it was not strictly climate related in this case. https://paris-luttes.info/communique-sur-l-affaire-de-la-14578 https://paris-luttes.info/communique-sur-l-affaire-de-la-145... Looks like your run of the mill radical left occupation of housing (the stuff you see in big European cities like Berlin and Paris where they have that tradition). Their bouts with law enforcement trying to evict them could be the reason for the arrests. If the google translate is not completely misleading then they refused to give their names or fingerprints when initially arrested.
- ClumsyPilot 5y agoUK has been arresting climate activists by the hundreds, it's pretty surreal here. https://twitter.com/MetPoliceEvents/status/1434227665679142912?t=ZEo4MOEFuF3HGz-N-May4w&s=19 https://twitter.com/MetPoliceEvents/status/14342276656791429...
- Brian_K_White 5y agoReview and approval of 3 agencies is apparently not even a speed bump.
- TomSwirly 5y ago> people engaging in potentially dangerous activities These seem to have been climate activists engaging in sit-ins. Surely these are the very sorts of people that secure accounts are intended to protect?
- simiones 5y ago> If this is not enough barriers to protect from politically motivated prosecutions and corruption, then we have much bigger problem in Europe. Well, in this case isn't it clear that these barriers were in fact not enough? Or do you think anti-squatting is a major enough problem that it warranted this level of international cooperation, without any politically motivated thinking?