8 ms·

Throwaway. As the manager of various accounts used by environmental and social activists on Protonmail, this is really bad. I understand they have to follow S

Throwaway. As the manager of various accounts used by environmental and social activists on Protonmail, this is really bad. I understand they have to follow Swiss law, but surely there are higher standard and processes than: police forward foreign request. Don't challenge or question, just do task required. Interpol requests are not as universally recognized as what some people here are alluding to. Countries can file these requests with interpol but it's up each country to determine if they act or recognize the request. If the Chinese government files 500 requests via interpol and the swiss police merely pass them on the proton, will proton mail automatically comply and install malware on their client on targeted accounts? I hope this is not the case but I expect this to be clarified. On th face of it, organizing an occupy protest hardly seems to pas the bar of "serious criminal cases"

tlogan 5y ago
Sadly, it is impossible hide your identity from gov and legal enforcement (from US to China) if you use any commercial service. As far as I know, FBI knows identity of all “ransomware” hackers. But they just cannot get them.
- shadowprofile76 5y ago
  Could you explain or substantiate this claim in a bit more detail? How is it absolutely impossible to find anonymity using any commercial service? and where did you hear that all the ransomware hackers are known?
windthrown 5y ago
Your concerns are valid but I think you are downplaying this by characterizing it as "swiss police merely pass them to proton". Protonmail recieved a legally binding order from the Swiss Federal Department of Justice. I'm not saying Swiss laws are infallible but this request was not simply "forwarded": "Swiss authorities will only approve requests which meet Swiss legal standards (the only law that matters is Swiss law)" As they mentioned in the blog post, they do challenge many of these requests but it was not legally possible in this case.
- naranha 5y ago
  Replace "Swiss" with "US" and Protonmail with GMail and the sentence remains equally true. So I guess the question remains, what does Protonmail offer in terms of privacy that is better than GMail or Outlook, given that USA and Swiss are both adhere to democratic standards.
  - raziel2p 5y ago
    The difference, I guess, is that someone wouldn't start protonmail in the US precisely because of this. If Swiss laws changed for the worse, they might consider changing their country of operations.
    - basedrum 5y ago
      Because of what? The US has fairly good privacy protections. Certainly, they are a five-eyes member, but for example it is not required by law that you keep logs. In many places in europe, it is required.
  - dngray 5y ago
    > what does Protonmail offer in terms of privacy that is better than GMail or Outlook, given that USA and Swiss are both adhere to democratic standards. Well for a start the privacy policy of Gmail allows them to use your data for advertising purposes. Secondly, emails encrypted at rest, are still encrypted, so at least the body is protected. Unless you were receiving emails that were encrypted prior to being sent that wouldn't be the case with Gmail. The threat model for Protonmail is fairly clearly defined under the "ProtonMail recommended use cases". https://protonmail.com/blog/protonmail-threat-model/ https://protonmail.com/blog/protonmail-threat-model/ The fact still remains email was probably not the right tool for these people as there is a lot of data stored server side.
    - jjcon 5y ago
      > Well for a start the privacy policy of Gmail allows them to use your data for advertising purposes. This is false - google stopped doing this for personal accounts many years ago (and never did for paid corporate). > emails encrypted at rest Google also encrypts at rest
cocoggu 5y ago
It's up to the local authorities as you said. If the Chinese government files 500 requests on interpol and the Swiss authority recognizes the requests, ProtonMail will just have to comply. But usually interpol rejects many requests from the Chinese government (to track uyghurs for example). The real scandal here is why the French authority is making such request on an activist, why Interpol processed it (as far as I understand there are no crimes in play here?), and why the Swiss authority recognizes the request? Perhaps we don't have the full story, but, with only the information we have, it sounds like an abuse of the protocol on 3 different entities. And double standards from Interpol (not okay to track down chinese activists, but ok for french activists?)
- lima 5y ago
  > The real scandal here is why the French authority is making such request on an activist, why Interpol processed it (as far as I understand there are no crimes in play here?), and why the Swiss authority recognizes the request? This seems easy to answer - according to French media[1], they were activists illegally occupying[2] buildings to protest rising real estate prices. This is illegal in Switzerland, too. What's the scandal? Authorities using their powers? [1]: https://www.lesnumeriques.com/vie-du-net/protonmail-a-fourni-des-donnees-ayant-conduit-a-l-arrestation-de-militants-francais-n167959.html https://www.lesnumeriques.com/vie-du-net/protonmail-a-fourni... [2]: https://www.lefigaro.fr/societes/a-paris-un-local-du-restaurant-le-petit-cambodge-squatte-par-des-militants-20201227 https://www.lefigaro.fr/societes/a-paris-un-local-du-restaur...
  - cocoggu 5y ago
    Illegal, okay, but is it a crime? I mean, after WWII interpol asked countries to not fill requests on nazis criminals because they did crimes of political nature and interpol needs to stay politically neutral [0]. But now, for an anti-capitalist activist it's not political? [0]: https://en.wikipedia.org/wiki/Interpol#cite_ref-14 https://en.wikipedia.org/wiki/Interpol#cite_ref-14
    - lima 5y ago
cybrox 5y ago
> but surely there are higher standard and processes than: police forward foreign request. Don't challenge or question, just do task required. There are, which they specifically described. This also goes for your second described case. The chinese government is only one of the two required.
willis936 5y ago
In your job as an intermediary would it be reasonable to roll your own email servers? If done properly then you wouldn't have to trust anyone and could give instructions to your clients on how to produce and use their own private keys. Commercial mail providers don't offer this option for some (likely legal) reason, but if you're willing to share risk with the activists then I think it would be worthwhile.
- shapefrog 5y ago
  > could give instructions to your clients on how to produce and use their own private keys PGP has been around since 1991, if it was as easy as writing a catchy how to, then some people might use it. Now 30 years in, basically nobody uses it. Got to wonder why ... > don't offer this option for some (likely legal) reason Not at all, they dont do it because it is a terrible customer experience. It is confusing, it is hard, if you lose a key, your data is garbage. If you make a copy of your key, you are not secure. Some people are happy to go that path, most are not. If only it was so simple. Imagine a world where Gmail launched, but if you forgot your password, boom, all your email is gone as is access to your email address. The next company that came along and offered 'password resets' would have wiped them out.
  - listenallyall 5y ago
    > if you forgot your password, boom, all your email is gone as is access to your email address Replace "email" with "Bitcoin"
  - willis936 5y ago
    Those are all benefits when your goal is discrete communication: which is exactly what we're discussing.
    - deleted 5y ago
      [deleted]
pyuser583 5y ago
Interpol is simply a way for law enforcement to communicate across borders. If the Chinese government files a request by means of Interpol, it’s very dishonest to say “an Interpol request.” It’s a Chinese request.
- raziel2p 5y ago
  Interpol won't tell you it's a Chinese request though. You can claim it's dishonest by Interpol, but not by the party receiving the request at the end of the line.
malka 5y ago
IMO the problem is that France use anti-terrorists law against environmental activist. It is not the first time it happens, and I bet that it will happen again. If I were an environmental activist, I would definitely step up my operational security.
- shapefrog 5y ago
  > use anti-terrorists law against environmental activist I have seen this commented a lot by people, that specifically anti-terrorist laws were used? But from what I have found, they used regular laws. Any chance you can point me in the right direction?
  - malka 5y ago
    I am not sure about this specific case, but France has done it multiple times in the past: https://www.liberation.fr/france/2015/11/27/l-etat-d-urgence-utilise-contre-les-militants_1416795/ https://www.liberation.fr/france/2015/11/27/l-etat-d-urgence... https://www.climatechangenews.com/2019/04/03/french-police-tap-counter-terrorism-unit-quell-climate-activists/ https://www.climatechangenews.com/2019/04/03/french-police-t...
- formerly_proven 5y ago
  Reminder that France literally bombed and sunk a moored Greenpeace ship (killing one person) not that long ago to prevent further protests against their nuclear weapon tests.
  - kook_throwaway 5y ago
    For anyone else wondering: https://en.m.wikipedia.org/wiki/Sinking_of_the_Rainbow_Warrior https://en.m.wikipedia.org/wiki/Sinking_of_the_Rainbow_Warri...
  - brendoelfrendo 5y ago
    While this is true, I wouldn't call 36 years ago "not that long ago." That is a literal lifetime ago for many users of this site.
basedrum 5y ago
Why don't you use riseup.net, they have been providing similar services specifically for activists for more than 20 years. While they are based in the US, the idea that Switzerland = privacy is bull. In the US, you are not required to keep logs. If you have them, you can be forced to turn them over, but if you don't they cannot force you to enable them. I have been a riseup user for years. They have received foreign legal requests, and they do not simply do the task requested. They've also received US-based legal requests, and challenge them, but in the end, they do not have the data that is being requested, so ultimately they can respond saying exactly that. (throwaway aswell)
- keewee7 5y ago
  >riseup.net They are based in the US and only provide their services to radical leftist activists. That combination seriously smells like FBI honeypot.
  - jjcon 5y ago
    The great thing about no trust models is that even if they were comprimised it wouldnt matter
    - e12e 5y ago
      Hardly. They get your password on login, and decrypt your mail. They don't (theoretically) even need a code change, just root/kernel level access/tracing to dump the password. Unless of course you were using PGP - but then you would be about as well off with Gmail? I mean, they provide a great service, and the stack is open - but I would hesitate to call it "secure" (that goes for ProtonMail too BTW). https://0xacab.org/liberate/trees https://0xacab.org/liberate/trees
    - tgsovlerkhgsel 5y ago
      Where is the no trust model there though? If riseup were a trap, they could do all the logging (in secret), find the activist, then do parallel construction for the actual evidence presented in court.
avodonosov 5y ago
Why do the climate activists hiding, I can not understand? Climate is fashionable and respected today, they would got medals maybe if not hiding? I can openly say that I am for good climate and ecology. Greta Thunberg is also not hiding. And about this specific activist, do you know what he is accused of? (It must be something other than activism, right? Difficult to imagine climate activism is illegal in France). PS: I understand this topic is mostly about Proton failing the privacy expectations, but curious to know what can activist be charged with.
- avodonosov 5y ago
  > For the past year, a group of people have taken over a handful of commercial premises and apartments near Place Sainte Marthe in Paris. They want to fight against gentrification, real estate speculation, Airbnb and high-end restaurants. While it started as a local conflict, it quickly became a symbolic campaign. They attracted newspaper headlines when they started occupying premises rented by Le Petit Cambodge — a restaurant that was targeted by the November 13th, 2015 terrorist attacks in Paris. https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/ https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre... Still strange, how could they anonymously occupy the places, if they were physically present there.
belorn 5y ago
In yesterday thread there were comment if I remember right that included more details. The squatters in question has already been sentenced and given suspended sentences. The request to ProtonMail was about other members of the same group that is suspected of home invasion and theft. If that qualify as serious crime is still up to debate and it could just be a excuse to go after the organizers. I do however find the case a bit more nuanced after reading those details.

tlogan 5y ago

Sadly, it is impossible hide your identity from gov and legal enforcement (from US to China) if you use any commercial service. As far as I know, FBI knows identity of all “ransomware” hackers. But they just cannot get them.

shadowprofile76 5y ago
Could you explain or substantiate this claim in a bit more detail? How is it absolutely impossible to find anonymity using any commercial service? and where did you hear that all the ransomware hackers are known?

windthrown 5y ago

Your concerns are valid but I think you are downplaying this by characterizing it as "swiss police merely pass them to proton". Protonmail recieved a legally binding order from the Swiss Federal Department of Justice. I'm not saying Swiss laws are infallible but this request was not simply "forwarded": "Swiss authorities will only approve requests which meet Swiss legal standards (the only law that matters is Swiss law)" As they mentioned in the blog post, they do challenge many of these requests but it was not legally possible in this case.

naranha 5y ago
Replace "Swiss" with "US" and Protonmail with GMail and the sentence remains equally true. So I guess the question remains, what does Protonmail offer in terms of privacy that is better than GMail or Outlook, given that USA and Swiss are both adhere to democratic standards.
- raziel2p 5y ago
  The difference, I guess, is that someone wouldn't start protonmail in the US precisely because of this. If Swiss laws changed for the worse, they might consider changing their country of operations.
  - basedrum 5y ago
    Because of what? The US has fairly good privacy protections. Certainly, they are a five-eyes member, but for example it is not required by law that you keep logs. In many places in europe, it is required.
- dngray 5y ago
  > what does Protonmail offer in terms of privacy that is better than GMail or Outlook, given that USA and Swiss are both adhere to democratic standards. Well for a start the privacy policy of Gmail allows them to use your data for advertising purposes. Secondly, emails encrypted at rest, are still encrypted, so at least the body is protected. Unless you were receiving emails that were encrypted prior to being sent that wouldn't be the case with Gmail. The threat model for Protonmail is fairly clearly defined under the "ProtonMail recommended use cases". https://protonmail.com/blog/protonmail-threat-model/ https://protonmail.com/blog/protonmail-threat-model/ The fact still remains email was probably not the right tool for these people as there is a lot of data stored server side.
  - jjcon 5y ago
    > Well for a start the privacy policy of Gmail allows them to use your data for advertising purposes. This is false - google stopped doing this for personal accounts many years ago (and never did for paid corporate). > emails encrypted at rest Google also encrypts at rest

cocoggu 5y ago

It's up to the local authorities as you said. If the Chinese government files 500 requests on interpol and the Swiss authority recognizes the requests, ProtonMail will just have to comply. But usually interpol rejects many requests from the Chinese government (to track uyghurs for example). The real scandal here is why the French authority is making such request on an activist, why Interpol processed it (as far as I understand there are no crimes in play here?), and why the Swiss authority recognizes the request? Perhaps we don't have the full story, but, with only the information we have, it sounds like an abuse of the protocol on 3 different entities. And double standards from Interpol (not okay to track down chinese activists, but ok for french activists?)

lima 5y ago
> The real scandal here is why the French authority is making such request on an activist, why Interpol processed it (as far as I understand there are no crimes in play here?), and why the Swiss authority recognizes the request? This seems easy to answer - according to French media[1], they were activists illegally occupying[2] buildings to protest rising real estate prices. This is illegal in Switzerland, too. What's the scandal? Authorities using their powers? [1]: https://www.lesnumeriques.com/vie-du-net/protonmail-a-fourni-des-donnees-ayant-conduit-a-l-arrestation-de-militants-francais-n167959.html https://www.lesnumeriques.com/vie-du-net/protonmail-a-fourni... [2]: https://www.lefigaro.fr/societes/a-paris-un-local-du-restaurant-le-petit-cambodge-squatte-par-des-militants-20201227 https://www.lefigaro.fr/societes/a-paris-un-local-du-restaur...
- cocoggu 5y ago
  Illegal, okay, but is it a crime? I mean, after WWII interpol asked countries to not fill requests on nazis criminals because they did crimes of political nature and interpol needs to stay politically neutral [0]. But now, for an anti-capitalist activist it's not political? [0]: https://en.wikipedia.org/wiki/Interpol#cite_ref-14 https://en.wikipedia.org/wiki/Interpol#cite_ref-14
  - lima 5y ago

cybrox 5y ago

> but surely there are higher standard and processes than: police forward foreign request. Don't challenge or question, just do task required. There are, which they specifically described. This also goes for your second described case. The chinese government is only one of the two required.

willis936 5y ago

In your job as an intermediary would it be reasonable to roll your own email servers? If done properly then you wouldn't have to trust anyone and could give instructions to your clients on how to produce and use their own private keys. Commercial mail providers don't offer this option for some (likely legal) reason, but if you're willing to share risk with the activists then I think it would be worthwhile.

shapefrog 5y ago
> could give instructions to your clients on how to produce and use their own private keys PGP has been around since 1991, if it was as easy as writing a catchy how to, then some people might use it. Now 30 years in, basically nobody uses it. Got to wonder why ... > don't offer this option for some (likely legal) reason Not at all, they dont do it because it is a terrible customer experience. It is confusing, it is hard, if you lose a key, your data is garbage. If you make a copy of your key, you are not secure. Some people are happy to go that path, most are not. If only it was so simple. Imagine a world where Gmail launched, but if you forgot your password, boom, all your email is gone as is access to your email address. The next company that came along and offered 'password resets' would have wiped them out.
- listenallyall 5y ago
  > if you forgot your password, boom, all your email is gone as is access to your email address Replace "email" with "Bitcoin"
- willis936 5y ago
  Those are all benefits when your goal is discrete communication: which is exactly what we're discussing.
  - deleted 5y ago
    [deleted]

pyuser583 5y ago

Interpol is simply a way for law enforcement to communicate across borders. If the Chinese government files a request by means of Interpol, it’s very dishonest to say “an Interpol request.” It’s a Chinese request.

raziel2p 5y ago
Interpol won't tell you it's a Chinese request though. You can claim it's dishonest by Interpol, but not by the party receiving the request at the end of the line.

malka 5y ago

IMO the problem is that France use anti-terrorists law against environmental activist. It is not the first time it happens, and I bet that it will happen again. If I were an environmental activist, I would definitely step up my operational security.

shapefrog 5y ago
> use anti-terrorists law against environmental activist I have seen this commented a lot by people, that specifically anti-terrorist laws were used? But from what I have found, they used regular laws. Any chance you can point me in the right direction?
- malka 5y ago
  I am not sure about this specific case, but France has done it multiple times in the past: https://www.liberation.fr/france/2015/11/27/l-etat-d-urgence-utilise-contre-les-militants_1416795/ https://www.liberation.fr/france/2015/11/27/l-etat-d-urgence... https://www.climatechangenews.com/2019/04/03/french-police-tap-counter-terrorism-unit-quell-climate-activists/ https://www.climatechangenews.com/2019/04/03/french-police-t...
formerly_proven 5y ago
Reminder that France literally bombed and sunk a moored Greenpeace ship (killing one person) not that long ago to prevent further protests against their nuclear weapon tests.
- kook_throwaway 5y ago
  For anyone else wondering: https://en.m.wikipedia.org/wiki/Sinking_of_the_Rainbow_Warrior https://en.m.wikipedia.org/wiki/Sinking_of_the_Rainbow_Warri...
- brendoelfrendo 5y ago
  While this is true, I wouldn't call 36 years ago "not that long ago." That is a literal lifetime ago for many users of this site.

basedrum 5y ago

Why don't you use riseup.net, they have been providing similar services specifically for activists for more than 20 years. While they are based in the US, the idea that Switzerland = privacy is bull. In the US, you are not required to keep logs. If you have them, you can be forced to turn them over, but if you don't they cannot force you to enable them. I have been a riseup user for years. They have received foreign legal requests, and they do not simply do the task requested. They've also received US-based legal requests, and challenge them, but in the end, they do not have the data that is being requested, so ultimately they can respond saying exactly that. (throwaway aswell)

keewee7 5y ago
>riseup.net They are based in the US and only provide their services to radical leftist activists. That combination seriously smells like FBI honeypot.
- jjcon 5y ago
  The great thing about no trust models is that even if they were comprimised it wouldnt matter
  - e12e 5y ago
    Hardly. They get your password on login, and decrypt your mail. They don't (theoretically) even need a code change, just root/kernel level access/tracing to dump the password. Unless of course you were using PGP - but then you would be about as well off with Gmail? I mean, they provide a great service, and the stack is open - but I would hesitate to call it "secure" (that goes for ProtonMail too BTW). https://0xacab.org/liberate/trees https://0xacab.org/liberate/trees
  - tgsovlerkhgsel 5y ago
    Where is the no trust model there though? If riseup were a trap, they could do all the logging (in secret), find the activist, then do parallel construction for the actual evidence presented in court.

avodonosov 5y ago

Why do the climate activists hiding, I can not understand? Climate is fashionable and respected today, they would got medals maybe if not hiding? I can openly say that I am for good climate and ecology. Greta Thunberg is also not hiding. And about this specific activist, do you know what he is accused of? (It must be something other than activism, right? Difficult to imagine climate activism is illegal in France). PS: I understand this topic is mostly about Proton failing the privacy expectations, but curious to know what can activist be charged with.

avodonosov 5y ago
> For the past year, a group of people have taken over a handful of commercial premises and apartments near Place Sainte Marthe in Paris. They want to fight against gentrification, real estate speculation, Airbnb and high-end restaurants. While it started as a local conflict, it quickly became a symbolic campaign. They attracted newspaper headlines when they started occupying premises rented by Le Petit Cambodge — a restaurant that was targeted by the November 13th, 2015 terrorist attacks in Paris. https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/ https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre... Still strange, how could they anonymously occupy the places, if they were physically present there.

belorn 5y ago

In yesterday thread there were comment if I remember right that included more details. The squatters in question has already been sentenced and given suspended sentences. The request to ProtonMail was about other members of the same group that is suspected of home invasion and theft. If that qualify as serious crime is still up to debate and it could just be a excuse to go after the organizers. I do however find the case a bit more nuanced after reading those details.