3 ms·
> It is not their responsibility to anticipate and enumerate every possible way the legal obligations under which they operate could play out in real life. The
by dwild 5y ago
> It is not their responsibility to anticipate and enumerate every possible way the legal obligations under which they operate could play out in real life.
They don't need to enumerate every possible ways. They were misleading in their previous marketing material. They since changed it, but here is what they had on their Security Feature page:
> Anonymous
> No tracking or logging of personally identifiable information
> Unlike competing services, we do not save any tracking information. By default, we do not record metadata such as the IP addresses used to log into accounts. As we have no way to read encrypted emails, we do not serve targeted advertisements. To protect user privacy, ProtonMail does not require any personally identifiable information to register.
They do log IP addresses and do offer them to law enforcement.
Now they only say this:
> Opt out of tracking or logging of personally identifiable information
This is still misleading, as the IP address is definitely an identifiable information, as shown in this case, but also because the section is still called "Anonymous".
> This, though, seems to me to be pretty unambiguously a situation where personal responsibility needs to take over.
I disagree so hard on that. ProtonMail is used in extreme cases. In cases where they have no technology knowledge, even the existence of IP address, in situations where they may not know Swiss laws, nor are aware of some first world countries laws and are only aware of their own countries more fascist laws. They are selling an anonymous service, which isn't...
The biggest issue is that there's way to actually be anonymous (or at least, closer to be), using TOR, and that's how they should sell their service.
So yeah I disagree that it's fine that they are selling a service that they can't sell in theses conditions...
- mumblemumble 5y agoSo, to me, that "by default" is all you need to know. Plus, perhaps, enough awareness of how society works to realize that literally any default configuration can be overruled by a court order. In other jurisdictions, such as the USA, it doesn't even require that. And, while I am not the kind of person who saves these things for later, so perhaps it was different 4 years ago, but the current version has the bog-standard - and therefore completely forgettable - disclaimer about complying with legal obligations that you see in every such policy. And since it is such a bog-standard thing, I would assume it was always there, though, of course, it's not the kind of thing I would have noticed and remarked upon, let alone remembered, when I originally read it. Which has me wondering, what exactly is the ask here? That they include a full copy of the privacy policy on every single marketing page, so that nobody can get up in arms about how they didn't mention every single detail on whatever subset of pages they happened to read while signing up whenever something they didn't anticipate happens?
- crateless 5y ago> I've continuously been quite impressed about how open they are about the limits of what they can offer. If by that you mean "By default, we do not log metadata ...", I would at the very least disagree with your characterisation.
- istingray 5y agoThe ask here is I'm paying $50/year for what amounts to a simple service. I expect Protonmail to lead when it comes to privacy and anti-surveillance online. I've commented elsewhere in this thread with specifics.
- istingray 5y agoGood on your for tracking their changes. Is there any official way to do this? My inbox is open for a Tor-first replacement for Protonmail. Checking out https://tutanota.com/ https://tutanota.com/ now