> They still don’t get to hand over your emails This gets at the key tech question: what's the most they could do? (either in response to a legal order or for

> They still don’t get to hand over your emails This gets at the key tech question: what's the most they could do? (either in response to a legal order or for any other reason) ProtonMails answer here is "not much"; they can log IPs and access times. Signal has a great write up about how they respond to warrants, and it's similar: just IP and last access time. But is that really all? Protonmail has a web app. This time, a court said "you must add server side logging for these specific accounts". Could a court also say "you must add client side logging for this specific account"? If so, could that come w a gag order such that only that one user gets served different code, almost impossible to detect? That would let a user read their mail. I am very curious whether the App Stores have ever served modified versions of apps to specific users in order to, for example, extract Signal messages. Software update is a key problem, closely related to the Ken Thompson "Reflections on Trusting Trust" thought experiment. I'm using a tool: how can I know for sure that I'm using the same copy everyone else has, not one that's been compromised?