6 ms·

They say "cannot be compromised by legal orders" and they say they are bound by and only by swiss laws. Maybe what they mean is that the swiss authorities have

They say "cannot be compromised by legal orders" and they say they are bound by and only by swiss laws. Maybe what they mean is that the swiss authorities have no legal basis on which to force them to serve a modified, backdoored, client like the one you're talking about.

FootballMuse 5y ago
$5 wrench is pretty effective
- gruez 5y ago
  $5 wrench does not fall under "legal orders"
  - FootballMuse 5y ago
    Yes, probably not. The point is that there are other ways to "force them to serve a modified, backdoored, client"
    - cto_of_antifa 5y ago
      I suppose in that case your threat actor is... The mafia? Is lucky Luciano trying to take your ethereum?
    - blitzar 5y ago
      My $5 wrench goes a lot further if I skip the backdoor, and go 'talk' to the target directly. The end of the encryption is always the simplest vulnerability to exploit.
panarky 5y ago
Their marketing copy still says "Anonymous. Opt out of tracking or logging of personally identifiable information". And "Unlike competing email services, we do not track you." Nowhere does it say "Unless your government asks the Swiss government then we'll capture, log and report every IP address you use". Source: https://protonmail.com/security-details https://protonmail.com/security-details Screenshot: https://imgur.com/a/gfUcYme https://imgur.com/a/gfUcYme And this marketing copy was rewritten after this incident. Before this incident it didn't say "opt out of tracking". How does one "opt out", by using Tor? It used to say, in bold print, "No tracking or logging of personally identifiable information". No weasel words about requiring the user to take some unspecified action to "opt out". No asterisks or caveats or warnings of any kind. It also used to explicitly promise: "we do not record metadata such as the IP addresses used to log into accounts". Now that part is mysteriously gone. Pretty shitty to quietly flush this down the memory hole, then pretend nothing's changed, blaming and gaslighting users for not understanding. Source: https://web.archive.org/web/20210607023937/https://protonmail.com/security-details https://web.archive.org/web/20210607023937/https://protonmai... Screenshot: https://imgur.com/a/R1muChN https://imgur.com/a/R1muChN
- luckylion 5y ago
  This point is weird. No reasonable person would understand that sentence to include "and we won't even comply with court orders".
  - panarky 5y ago
    Seems reasonable to understand "no tracking or logging" to mean that in the event of a government demand to produce records, they could honestly reply that no records exist. Other email providers keep logs that they provide to governments when there's a legal order. What's the point of bragging about "no tracking or logging" if you're just going to track and log like every other email provider if the government asks for it?
    - luckylion 5y ago
      > Seems reasonable to understand "no tracking or logging" to mean that in the event of a government demand to produce records, they could honestly reply that no records exist. And they would. They don't keep those records. However, when a government agency shows up with a court order that states they have to cooperate and provide those records going forward they must comply. > What's the point of bragging about "no tracking or logging" if you're just going to track and log like every other email provider if the government asks for it? Again: a reasonable person would not assume that their email provider is a criminal enterprise that does not comply with the law.
    - lordlimecat 5y ago
      >Seems reasonable to understand "no tracking or logging" to mean that in the event of a government demand to produce records, they could honestly reply that no records exist. No one with the least understanding of the internet could suppose that Protonmail could not be forced to provide the IP address associated with a user's login, which I assume is what happened here.
      - orestarod 5y ago
        They did promise that, though. One lie leads to infinite more.
AniseAbyss 5y ago
I would not be surprised if Swiss intelligence agency does have the legal power to hack whomever they want. The idea that someone can just pay €60 per year and expect to be safe from State prosecution seems so naive.

FootballMuse 5y ago

$5 wrench is pretty effective

gruez 5y ago
$5 wrench does not fall under "legal orders"
- FootballMuse 5y ago
  Yes, probably not. The point is that there are other ways to "force them to serve a modified, backdoored, client"
  - cto_of_antifa 5y ago
    I suppose in that case your threat actor is... The mafia? Is lucky Luciano trying to take your ethereum?
  - blitzar 5y ago
    My $5 wrench goes a lot further if I skip the backdoor, and go 'talk' to the target directly. The end of the encryption is always the simplest vulnerability to exploit.

panarky 5y ago

Their marketing copy still says "Anonymous. Opt out of tracking or logging of personally identifiable information". And "Unlike competing email services, we do not track you." Nowhere does it say "Unless your government asks the Swiss government then we'll capture, log and report every IP address you use". Source: https://protonmail.com/security-details https://protonmail.com/security-details Screenshot: https://imgur.com/a/gfUcYme https://imgur.com/a/gfUcYme And this marketing copy was rewritten after this incident. Before this incident it didn't say "opt out of tracking". How does one "opt out", by using Tor? It used to say, in bold print, "No tracking or logging of personally identifiable information". No weasel words about requiring the user to take some unspecified action to "opt out". No asterisks or caveats or warnings of any kind. It also used to explicitly promise: "we do not record metadata such as the IP addresses used to log into accounts". Now that part is mysteriously gone. Pretty shitty to quietly flush this down the memory hole, then pretend nothing's changed, blaming and gaslighting users for not understanding. Source: https://web.archive.org/web/20210607023937/https://protonmail.com/security-details https://web.archive.org/web/20210607023937/https://protonmai... Screenshot: https://imgur.com/a/R1muChN https://imgur.com/a/R1muChN

luckylion 5y ago
This point is weird. No reasonable person would understand that sentence to include "and we won't even comply with court orders".
- panarky 5y ago
  Seems reasonable to understand "no tracking or logging" to mean that in the event of a government demand to produce records, they could honestly reply that no records exist. Other email providers keep logs that they provide to governments when there's a legal order. What's the point of bragging about "no tracking or logging" if you're just going to track and log like every other email provider if the government asks for it?
  - luckylion 5y ago
    > Seems reasonable to understand "no tracking or logging" to mean that in the event of a government demand to produce records, they could honestly reply that no records exist. And they would. They don't keep those records. However, when a government agency shows up with a court order that states they have to cooperate and provide those records going forward they must comply. > What's the point of bragging about "no tracking or logging" if you're just going to track and log like every other email provider if the government asks for it? Again: a reasonable person would not assume that their email provider is a criminal enterprise that does not comply with the law.
  - lordlimecat 5y ago
    >Seems reasonable to understand "no tracking or logging" to mean that in the event of a government demand to produce records, they could honestly reply that no records exist. No one with the least understanding of the internet could suppose that Protonmail could not be forced to provide the IP address associated with a user's login, which I assume is what happened here.
    - orestarod 5y ago
      They did promise that, though. One lie leads to infinite more.

AniseAbyss 5y ago

I would not be surprised if Swiss intelligence agency does have the legal power to hack whomever they want. The idea that someone can just pay €60 per year and expect to be safe from State prosecution seems so naive.