5 ms·

Your concerns are valid but I think you are downplaying this by characterizing it as "swiss police merely pass them to proton". Protonmail recieved a legally b

Your concerns are valid but I think you are downplaying this by characterizing it as "swiss police merely pass them to proton". Protonmail recieved a legally binding order from the Swiss Federal Department of Justice. I'm not saying Swiss laws are infallible but this request was not simply "forwarded": "Swiss authorities will only approve requests which meet Swiss legal standards (the only law that matters is Swiss law)" As they mentioned in the blog post, they do challenge many of these requests but it was not legally possible in this case.

naranha 5y ago
Replace "Swiss" with "US" and Protonmail with GMail and the sentence remains equally true. So I guess the question remains, what does Protonmail offer in terms of privacy that is better than GMail or Outlook, given that USA and Swiss are both adhere to democratic standards.
- raziel2p 5y ago
  The difference, I guess, is that someone wouldn't start protonmail in the US precisely because of this. If Swiss laws changed for the worse, they might consider changing their country of operations.
  - basedrum 5y ago
    Because of what? The US has fairly good privacy protections. Certainly, they are a five-eyes member, but for example it is not required by law that you keep logs. In many places in europe, it is required.
- dngray 5y ago
  > what does Protonmail offer in terms of privacy that is better than GMail or Outlook, given that USA and Swiss are both adhere to democratic standards. Well for a start the privacy policy of Gmail allows them to use your data for advertising purposes. Secondly, emails encrypted at rest, are still encrypted, so at least the body is protected. Unless you were receiving emails that were encrypted prior to being sent that wouldn't be the case with Gmail. The threat model for Protonmail is fairly clearly defined under the "ProtonMail recommended use cases". https://protonmail.com/blog/protonmail-threat-model/ https://protonmail.com/blog/protonmail-threat-model/ The fact still remains email was probably not the right tool for these people as there is a lot of data stored server side.
  - jjcon 5y ago
    > Well for a start the privacy policy of Gmail allows them to use your data for advertising purposes. This is false - google stopped doing this for personal accounts many years ago (and never did for paid corporate). > emails encrypted at rest Google also encrypts at rest
    - neltnerb 5y ago
      Can Google decrypt without your permission? Honest question, because that's the obvious difference (if you believe ProtonMail claims).
      - tgsovlerkhgsel 5y ago
        Can you access your e-mail if you lose your phone, forget your password, get a new SIM card, and successfully go through account recovery? There is your answer.
        neltnerb 5y ago
        I know that I cannot access my protonmail email under a wide variety of circumstances that I make efforts to avoid. Two of them involve forgetting complicated passwords, either of which would render my entire (historical) email vault unreadable. But it could absolutely be security theater. What I have no idea about is Google. Do they even need to do anything targeting you in order to decrypt the data or not? Obviously they can modify your software with a remote update such that they can capture your decryption password, but that's a lot more work than querying a database and using a master key that Google has on hand for this sort of thing.
        tgsovlerkhgsel 5y ago
        For Google (and almost every provider that isn't very specifically targeting the highest levels of security at the expense of usability), the answer to the rhetorical question I posed is "yes", which implies that they can read your mail, without having to target you or anything you have. While (as you correctly pointed out) the fact that you lose access to the data if you lose your passphrase doesn't prove that the data is completely inaccessible without it, the opposite (being able to access the data even if you forget/lose all your secrets/keys) conclusively proves that such access is possible.
- woko 5y ago
  > what does Protonmail offer in terms of privacy that is better than GMail or Outlook Encryption. That was always the point. Your emails are stored encrypted, and nobody can read their content except you. Not sure why some people expected ProtonMail to act as a magical VPN, both truly anonymous and not obeying to any court order, to an unencrypted email account like Gmail.
  - naranha 5y ago
    But you can also send encrypted E-mail using GMail with Thunderbird...
    - e12e 5y ago
      Or cut'n'paste ascii armored PGP data in any web mail. It's not very convenient, though.
- elzbardico 5y ago
  Comparing the USA to Switzerland is truly naive. The Switzerland doesn’t have a permanent occupation of another sovereign country where Switzerland subjected prisoners to “enhanced interrogation techniques”, not to mention other routine human rights abuse violations. And let’s not forget that proton doesn’t have the same record of customer abuse as google.
- int_19h 5y ago
  Countries override democratic standards for vaguely defined "national interests" all the time. It so happens that US, with its sprawling global empire, has a lot more "national interests" than the generally MYOB Swiss, and so is more prone to such abuse.
basedrum 5y ago
Switzerland is a grouping of "Cantons" and each has very distinct autonomy. Some of them are far more conservative than others, and are going to have judges who are going to make decisions accordingly. As much as we might like to believe it, law is not universally applied in a fair manner. Swiss authorities will approve requests that are total garbage requests. I happen to be on the receiving end of one of those, which was eventually, after significant time, effort and money thrown out for prejudice.
OrvalWintermute 5y ago
I think we are long past the point where we can trust all governments to use interpol notices only when required, and for the local law enforcement agencies not to take nuclear actions based on something that is clearly contrived, or political in nature. Now, I don't support squatting, but launching an interpol notice, and attacking privacy under color of law seems like a misuse of the law, and abuse of the Swiss legal system. We may need to attack this problem differently since it appears the Swiss do not have the vaunted protections they claim. Also, we need Protonmail to look into offshoring, and obtaining independence of a potentially abusive legal system. Sealand had at least a few good ideas around immunities from State power.

naranha 5y ago

Replace "Swiss" with "US" and Protonmail with GMail and the sentence remains equally true. So I guess the question remains, what does Protonmail offer in terms of privacy that is better than GMail or Outlook, given that USA and Swiss are both adhere to democratic standards.

raziel2p 5y ago
The difference, I guess, is that someone wouldn't start protonmail in the US precisely because of this. If Swiss laws changed for the worse, they might consider changing their country of operations.
- basedrum 5y ago
  Because of what? The US has fairly good privacy protections. Certainly, they are a five-eyes member, but for example it is not required by law that you keep logs. In many places in europe, it is required.
dngray 5y ago
> what does Protonmail offer in terms of privacy that is better than GMail or Outlook, given that USA and Swiss are both adhere to democratic standards. Well for a start the privacy policy of Gmail allows them to use your data for advertising purposes. Secondly, emails encrypted at rest, are still encrypted, so at least the body is protected. Unless you were receiving emails that were encrypted prior to being sent that wouldn't be the case with Gmail. The threat model for Protonmail is fairly clearly defined under the "ProtonMail recommended use cases". https://protonmail.com/blog/protonmail-threat-model/ https://protonmail.com/blog/protonmail-threat-model/ The fact still remains email was probably not the right tool for these people as there is a lot of data stored server side.
- jjcon 5y ago
  > Well for a start the privacy policy of Gmail allows them to use your data for advertising purposes. This is false - google stopped doing this for personal accounts many years ago (and never did for paid corporate). > emails encrypted at rest Google also encrypts at rest
  - neltnerb 5y ago
    Can Google decrypt without your permission? Honest question, because that's the obvious difference (if you believe ProtonMail claims).
    - tgsovlerkhgsel 5y ago
      Can you access your e-mail if you lose your phone, forget your password, get a new SIM card, and successfully go through account recovery? There is your answer.
      - neltnerb 5y ago
        I know that I cannot access my protonmail email under a wide variety of circumstances that I make efforts to avoid. Two of them involve forgetting complicated passwords, either of which would render my entire (historical) email vault unreadable. But it could absolutely be security theater. What I have no idea about is Google. Do they even need to do anything targeting you in order to decrypt the data or not? Obviously they can modify your software with a remote update such that they can capture your decryption password, but that's a lot more work than querying a database and using a master key that Google has on hand for this sort of thing.
        tgsovlerkhgsel 5y ago
        For Google (and almost every provider that isn't very specifically targeting the highest levels of security at the expense of usability), the answer to the rhetorical question I posed is "yes", which implies that they can read your mail, without having to target you or anything you have. While (as you correctly pointed out) the fact that you lose access to the data if you lose your passphrase doesn't prove that the data is completely inaccessible without it, the opposite (being able to access the data even if you forget/lose all your secrets/keys) conclusively proves that such access is possible.
woko 5y ago
> what does Protonmail offer in terms of privacy that is better than GMail or Outlook Encryption. That was always the point. Your emails are stored encrypted, and nobody can read their content except you. Not sure why some people expected ProtonMail to act as a magical VPN, both truly anonymous and not obeying to any court order, to an unencrypted email account like Gmail.
- naranha 5y ago
  But you can also send encrypted E-mail using GMail with Thunderbird...
  - e12e 5y ago
    Or cut'n'paste ascii armored PGP data in any web mail. It's not very convenient, though.
elzbardico 5y ago
Comparing the USA to Switzerland is truly naive. The Switzerland doesn’t have a permanent occupation of another sovereign country where Switzerland subjected prisoners to “enhanced interrogation techniques”, not to mention other routine human rights abuse violations. And let’s not forget that proton doesn’t have the same record of customer abuse as google.
int_19h 5y ago
Countries override democratic standards for vaguely defined "national interests" all the time. It so happens that US, with its sprawling global empire, has a lot more "national interests" than the generally MYOB Swiss, and so is more prone to such abuse.

basedrum 5y ago

Switzerland is a grouping of "Cantons" and each has very distinct autonomy. Some of them are far more conservative than others, and are going to have judges who are going to make decisions accordingly. As much as we might like to believe it, law is not universally applied in a fair manner. Swiss authorities will approve requests that are total garbage requests. I happen to be on the receiving end of one of those, which was eventually, after significant time, effort and money thrown out for prejudice.

OrvalWintermute 5y ago

I think we are long past the point where we can trust all governments to use interpol notices only when required, and for the local law enforcement agencies not to take nuclear actions based on something that is clearly contrived, or political in nature. Now, I don't support squatting, but launching an interpol notice, and attacking privacy under color of law seems like a misuse of the law, and abuse of the Swiss legal system. We may need to attack this problem differently since it appears the Swiss do not have the vaunted protections they claim. Also, we need Protonmail to look into offshoring, and obtaining independence of a potentially abusive legal system. Sealand had at least a few good ideas around immunities from State power.