4 ms·

Disclaimer: Paying Protonmail customer here Waiting on someone inspired to build something better. I spend $50/year with Protonmail. I expect Proton to commun

Disclaimer: Paying Protonmail customer here Waiting on someone inspired to build something better. I spend $50/year with Protonmail. I expect Proton to communicate differently about what they offer. And to educate users about what surveillance is, and what Proton can and cannot protect from. Train the future generation to expect trustless, adversarial systems but still thrive. Promote Tor. Don't just put up with Tor. Educate users about Tor. Defend Tor. I appreciate that Protonmail specifically addressed this in the headline of their response "Important clarifications regarding arrest of climate activist". Rather than "Updates on our privacy policy" or some bs. I don't expect Proton to behave differently to law enforcement or warrants. I believe they did whatever here. No company can resist the law. You can see my response here in the other thread: https://news.ycombinator.com/item?id=28427259 https://news.ycombinator.com/item?id=28427259

mumblemumble 5y ago
I don't generally like to be the one to blithely trumpet about personal responsibility, in part because I tend to be more of a "civic responsibility" kid of person. This, though, seems to me to be pretty unambiguously a situation where personal responsibility needs to take over. There must be a limit to how much responsibility we try to foist off on others. As someone who's been using Proton for years, I've continuously been quite impressed about how open they are about the limits of what they can offer. As a company selling me a product, they do a great job. But they are still, at the end of the day, a company selling a product, and not my life coach or personal attorney. It is not their responsibility to anticipate and enumerate every possible way the legal obligations under which they operate could play out in real life. At some point, it's on the customer to have enough of a grasp of civics to understand what court orders are and how they happen.
- istingray 5y ago
  Disclaimer: Paying Protonmail customer I hear you. But in that case, why not just use Gmail? For $50/year I do expect Protonmail to be more like a life coach for privacy and surveillance. Not for me personally, but for the people who really need protection. It's just email, I can get it cheap anywhere. For example, their one and only blog post about Tor is from 2017. I expect better. Promote Tor on the homepage. Publish about what percentage of your users use Tor. Fight to change norms not just pass the buck. Get with the times, Protonmail. Or someone else will do it for you.
  - mumblemumble 5y ago
    > But in that case, why not just use Gmail? Well, just for starters, GMail is hosted in a different and more authoritarian jurisdiction where you don't even need a court order and due process of law to be compelled to share information with the authorities. I think that sitting in the frying pan and whatabouting the fire is self-evidently a better course of action than jumping into it. But it's still not a good one, and risks inspiring others to jump into it.
- dwild 5y ago
  > It is not their responsibility to anticipate and enumerate every possible way the legal obligations under which they operate could play out in real life. They don't need to enumerate every possible ways. They were misleading in their previous marketing material. They since changed it, but here is what they had on their Security Feature page: > Anonymous > No tracking or logging of personally identifiable information > Unlike competing services, we do not save any tracking information. By default, we do not record metadata such as the IP addresses used to log into accounts. As we have no way to read encrypted emails, we do not serve targeted advertisements. To protect user privacy, ProtonMail does not require any personally identifiable information to register. They do log IP addresses and do offer them to law enforcement. Now they only say this: > Opt out of tracking or logging of personally identifiable information This is still misleading, as the IP address is definitely an identifiable information, as shown in this case, but also because the section is still called "Anonymous". > This, though, seems to me to be pretty unambiguously a situation where personal responsibility needs to take over. I disagree so hard on that. ProtonMail is used in extreme cases. In cases where they have no technology knowledge, even the existence of IP address, in situations where they may not know Swiss laws, nor are aware of some first world countries laws and are only aware of their own countries more fascist laws. They are selling an anonymous service, which isn't... The biggest issue is that there's way to actually be anonymous (or at least, closer to be), using TOR, and that's how they should sell their service. So yeah I disagree that it's fine that they are selling a service that they can't sell in theses conditions...
  - mumblemumble 5y ago
    So, to me, that "by default" is all you need to know. Plus, perhaps, enough awareness of how society works to realize that literally any default configuration can be overruled by a court order. In other jurisdictions, such as the USA, it doesn't even require that. And, while I am not the kind of person who saves these things for later, so perhaps it was different 4 years ago, but the current version has the bog-standard - and therefore completely forgettable - disclaimer about complying with legal obligations that you see in every such policy. And since it is such a bog-standard thing, I would assume it was always there, though, of course, it's not the kind of thing I would have noticed and remarked upon, let alone remembered, when I originally read it. Which has me wondering, what exactly is the ask here? That they include a full copy of the privacy policy on every single marketing page, so that nobody can get up in arms about how they didn't mention every single detail on whatever subset of pages they happened to read while signing up whenever something they didn't anticipate happens?
blub 5y ago
You’re paying 50 per year? Judging by the amount of complaining in this and the other thread I would have guessed you must be paying at least a few thousands per month and/or were are one or more of a) an activist from Afghanistan b) a whistleblower from the US c) a human rights activist from China. With customers like these who needs enemies.
- oblio 5y ago
  > You’re paying 50 per year? Judging by the amount of complaining in this and the other thread I would have guessed you must be paying at least a few thousands per month and/or were are one or more of a) an activist from Afghanistan b) a whistleblower from the US c) a human rights activist from China. d) building the proverbial nuclear submarine in your basement :-p

mumblemumble 5y ago

I don't generally like to be the one to blithely trumpet about personal responsibility, in part because I tend to be more of a "civic responsibility" kid of person. This, though, seems to me to be pretty unambiguously a situation where personal responsibility needs to take over. There must be a limit to how much responsibility we try to foist off on others. As someone who's been using Proton for years, I've continuously been quite impressed about how open they are about the limits of what they can offer. As a company selling me a product, they do a great job. But they are still, at the end of the day, a company selling a product, and not my life coach or personal attorney. It is not their responsibility to anticipate and enumerate every possible way the legal obligations under which they operate could play out in real life. At some point, it's on the customer to have enough of a grasp of civics to understand what court orders are and how they happen.

istingray 5y ago
Disclaimer: Paying Protonmail customer I hear you. But in that case, why not just use Gmail? For $50/year I do expect Protonmail to be more like a life coach for privacy and surveillance. Not for me personally, but for the people who really need protection. It's just email, I can get it cheap anywhere. For example, their one and only blog post about Tor is from 2017. I expect better. Promote Tor on the homepage. Publish about what percentage of your users use Tor. Fight to change norms not just pass the buck. Get with the times, Protonmail. Or someone else will do it for you.
- mumblemumble 5y ago
  > But in that case, why not just use Gmail? Well, just for starters, GMail is hosted in a different and more authoritarian jurisdiction where you don't even need a court order and due process of law to be compelled to share information with the authorities. I think that sitting in the frying pan and whatabouting the fire is self-evidently a better course of action than jumping into it. But it's still not a good one, and risks inspiring others to jump into it.
dwild 5y ago
> It is not their responsibility to anticipate and enumerate every possible way the legal obligations under which they operate could play out in real life. They don't need to enumerate every possible ways. They were misleading in their previous marketing material. They since changed it, but here is what they had on their Security Feature page: > Anonymous > No tracking or logging of personally identifiable information > Unlike competing services, we do not save any tracking information. By default, we do not record metadata such as the IP addresses used to log into accounts. As we have no way to read encrypted emails, we do not serve targeted advertisements. To protect user privacy, ProtonMail does not require any personally identifiable information to register. They do log IP addresses and do offer them to law enforcement. Now they only say this: > Opt out of tracking or logging of personally identifiable information This is still misleading, as the IP address is definitely an identifiable information, as shown in this case, but also because the section is still called "Anonymous". > This, though, seems to me to be pretty unambiguously a situation where personal responsibility needs to take over. I disagree so hard on that. ProtonMail is used in extreme cases. In cases where they have no technology knowledge, even the existence of IP address, in situations where they may not know Swiss laws, nor are aware of some first world countries laws and are only aware of their own countries more fascist laws. They are selling an anonymous service, which isn't... The biggest issue is that there's way to actually be anonymous (or at least, closer to be), using TOR, and that's how they should sell their service. So yeah I disagree that it's fine that they are selling a service that they can't sell in theses conditions...
- mumblemumble 5y ago
  So, to me, that "by default" is all you need to know. Plus, perhaps, enough awareness of how society works to realize that literally any default configuration can be overruled by a court order. In other jurisdictions, such as the USA, it doesn't even require that. And, while I am not the kind of person who saves these things for later, so perhaps it was different 4 years ago, but the current version has the bog-standard - and therefore completely forgettable - disclaimer about complying with legal obligations that you see in every such policy. And since it is such a bog-standard thing, I would assume it was always there, though, of course, it's not the kind of thing I would have noticed and remarked upon, let alone remembered, when I originally read it. Which has me wondering, what exactly is the ask here? That they include a full copy of the privacy policy on every single marketing page, so that nobody can get up in arms about how they didn't mention every single detail on whatever subset of pages they happened to read while signing up whenever something they didn't anticipate happens?

blub 5y ago

You’re paying 50 per year? Judging by the amount of complaining in this and the other thread I would have guessed you must be paying at least a few thousands per month and/or were are one or more of a) an activist from Afghanistan b) a whistleblower from the US c) a human rights activist from China. With customers like these who needs enemies.

oblio 5y ago
> You’re paying 50 per year? Judging by the amount of complaining in this and the other thread I would have guessed you must be paying at least a few thousands per month and/or were are one or more of a) an activist from Afghanistan b) a whistleblower from the US c) a human rights activist from China. d) building the proverbial nuclear submarine in your basement :-p