7 ms·

The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happe

• segfaultbuserr 5y ago
  > I think there is a market for datacenters in open seas. Sealand's HavenCo tried it back in the 2000s. As it turned out, it didn't work well. https://en.wikipedia.org/wiki/HavenCo https://en.wikipedia.org/wiki/HavenCo See: Death of a data haven: cypherpunks, WikiLeaks, and the world’s smallest nation https://arstechnica.com/tech-policy/2012/03/sealand-and-havenco/ https://arstechnica.com/tech-policy/2012/03/sealand-and-have...
  • vmception 5y ago
    one company in the cloud sector failed 20 years ago, before people were even using the word cloud in this context
  • nvarsj 5y ago
    I find Sealand fascinating. Imagine founding an off-grid location as a data haven, and it got popular. What would happen? I can see covert operations from foreign governments happening for example, driven by copyright lobbyists. Would they then need to hire security forces or train their own armed forces? Would it eventually join global political organizations to influence and protect its position? It gets really interesting to think about. There's no doubt in my mind there would be huge demand for such a thing. People hate that the government can spy on anything you do. The chilling effect is exhausting.
    • underseacables 5y ago
      Let us suppose for a moment that you could put a ship out in the sea, using solar panels and wind power, and satellites, you could provide a service. It might not be a service that’s always available, or all that fast, but it is technically feasible.
      • wasmitnetzen 5y ago
        A ship is way too easily intercepted by any country with a navy. And your flag bearing country probably won't care, if you even have one. You need to go to space!
        • underseacables 5y ago
          But it is technically feasible! I hear your point, but even in space, you are not safe. https://en.m.wikipedia.org/wiki/2007_Chinese_anti-satellite_missile_test https://en.m.wikipedia.org/wiki/2007_Chinese_anti-satellite_...
    • segfaultbuserr 5y ago
      Another major challenge is communication. Even when you have a data haven, how do you plug into the Internet backbone? How do you get Tbps bandwidth to serve the world? The Cypherpunks did some related research in the 90s, nearly all communication lines are controlled by the major ISP or the state, and they are extremely expensive to build. > The dot-com crash not only cut the bottom out from colocation pricing, but also took out HavenCo's fiber-optic link when the company providing it went bankrupt. That left the entire operation with a pokey 128 Kbps satellite link, which staggered badly under denial-of-service attacks. In Neal Stephenson's novel Cryptonomicon, the data haven is a main theme in its plot.
    • OJFord 5y ago
      I think the Republic of Rose Island is more interesting in that respect. Sealand is in British waters, and not recognised by HMG or any other state. https://en.wikipedia.org/wiki/Republic_of_Rose_Island https://en.wikipedia.org/wiki/Republic_of_Rose_Island https://en.wikipedia.org/wiki/Principality_of_Sealand https://en.wikipedia.org/wiki/Principality_of_Sealand
• teekert 5y ago
  Or you protect your own IP, I wonder if ProtonVPN could have done that? Would have been a nice test of those claims as well. All in all, I still trust ProtonMail, they are handling this quite well and transparently. Their original messaging was probably a compromise between getting the message out there and leaving some room for things like this. Arguably that was a mistake, or maybe with the whole truth in bold on the front page, people would have flocked less to ProtonMail? I still don't agree with that original messaging though, as they don't themselves anymore. Still pretty great free service if you ask me. If a family plan was cheaper I'd have migrated everyone there a long time ago.
  • lindenstark 5y ago
    ProtonVPN or a similar service would have helped that. They are only required to provide the IP Addresses from ProtonMail but ProtonVPN gets different treatment legally speaking, were they cannot (currently) force logging [0][1]. [0] https://protonvpn.com/support/no-logs-vpn/ https://protonvpn.com/support/no-logs-vpn/ [1] checked with Andy Yen (CEO/Founder)
  • dsign 5y ago
    I agree that they are a great email provider, the lesser evil, and I myself use a paid plan. But I believe that, as a society, we are rolling down a slippery slope where digital privacy becomes more difficult everyday. A couple of weeks ago, it was Apple announcing that they will spy by default in all of their customers via the iPhones because of child pornography. Apple has spent galleons of gold marketing itself as a privacy-first company and they are not a pushover; for them to do that, whatever is going on behind the curtains must be grim. I thought it would be a few years before somebody wanted to use something like that technology for something less serious. Then yesterday the news broke that courts had forced ProtonMail to break their business just so the French police could find a climate activist. In my view, we are heading to a world where our electronic devices and services will be used to prosecute petty crimes, like drinking alcohol in Arab countries or even parking over the line anywhere else.
    • teekert 5y ago
• WhyNotHugo 5y ago
  The premise of "we'll never log your IPs" is something that no company can hold. - Local law enforcement can force the to do so. - Locals laws can change. - Guys with guns might barge in and demand it. Mostly, you can understand that they don't _intend_ to log IPs, and aren't in the business of collecting and redistributing data. But that doesn't mean you can count on absolute and unconditional secrecy.
  • indymike 5y ago
    Add to your list: - engineer troubleshooting might do so temporarily.
    • OJFord 5y ago
      Including accidentally - `log(locals())` or `log(user)` or similar.
  • rossmohax 5y ago
    Same for end to end encryption, no? Law enforcement can force them to serve backdoored JS client payload.
    • cf_ 5y ago
      Well, yes and no. Currently, Swiss law doesn't support this and providing the IP is based on specific requirements for telecommunication providers as far as I know. But yes, the law could be changed. However, keep in mind that Switzerland is a direct democracy and people here frequently actually vote on such issues directly (if one can gather enough support from the public).
  • NmAmDa 5y ago
    I think signal approach is the best. You can't be forced to turn in something you don't have.
    • charbonneau 5y ago
      You can be forced to collect the data.
• indigomm 5y ago
  The problem is that someone always controls that service. So they can always go after that person (irrespective of where the service is) and force them to modify it. I was thinking you could have some sort of satellite service with data stored on the satellite. Allow multiple authorised ground stations to connect and store/retrieve emails for users. But again, the person that controls the software and operation would be a target.
  • _wldu 5y ago
    One would need to operate the service as a Tor Location Hidden service and have no presence on the Clear Net. They would also need, very good operational security and careful configuration in order to stay hidden.
• jasode 5y ago
  >I think there is a market for datacenters in open seas. The idea of having a isolated sovereign floating platform in the ocean doesn't doesn't really solve the problem of escaping the rules of national governments because it still needs network connections into those countries. Whether it's underseas fiber optic cables or bouncing signals off of satellites, the datacenter will be rendered useless if nations' citizens get a "This site can’t be reached. [...] ERR_CONNECTION_TIMED_OUT" It addition to the physical network topology challenges, the ip address space allocation is controlled by IANA ... which is a government entity.
  • ghaff 5y ago
    Exactly. Sealand/HavenCo could Play their micronation thing right up until the UK cut their supply and comms links. Does it raise the bar for bothering to do that? Sure. But it’s certainly not absolute protection.
    • bluGill 5y ago
      The trick is to grow big enough that by the time anyone thinks cutting your links you are big enough that you can't fail. I have no idea how to pull that off.
      • ghaff 5y ago
        I would think being bigger makes you more of a target not less.
        • TheOtherHobbes 5y ago
          Indeed. A better idea might be to use custom in-house tech and avoid all public protocols and service providers. (Except TCP/IP. Maybe.) The premise that you can buy secure comms from a commercial third party is... unconvincing.
        • bluGill 5y ago
          There is a limit to that. North Korea does a lot of things that no government likes, but so far they are okay. There are a lot of bigger countries that have even more immunity to targeting.
• Sebb767 5y ago
  > So it was bound to happen. And this was quite obvious for someone who actually looked into staying anonymous (or gave the Protonmail threat model page a deeper read). > What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of their customers. That's a big simplification. It took quite a few authorities to wave through a very draconian request for (what appears to be) a minor crime. As Protonmail themselves pointed out, they never promised to protect the IPs and they could explicitly not promise that. In fact, they even stated very clearly that they could not. Expecting them to print that on the frontpage is quite unreasonable when their marketing has to compete with shady VPNs that promise the sky. > From there, all it takes is for somebody to change a law in Switzerland and end-to-end encryption of the messages themselves will only be "by default." While this is a reasonable threat, it's not like one could do this in an afternoon.
• ur-whale 5y ago
  > I think there is a market for datacenters in open seas. That's what the Sealand [1] dudes thought. Until a bunch of boats showed up loaded with men carrying rifles who simply took over the country. And when that happens, who/where do you turn to to whine that someone took your thing? That's what sovereignty means: you're on your effing own. For real this time. One thing most people tend to forget about governments: they have the monopoly on physical violence. That's the first, most important and probably only useful thing you pay taxes to your government for: physical security. If you want to run a DC in open seas: - buy a bunch of gunboats - hire a small army to provide physical security - try and not piss off any of the real countries lest they be the one showing up with many more gunboats than you may muster and take over the "open sea DC". - your services won't be cheap: gunboats must be maintained, armies paid and fed. [1] https://en.wikipedia.org/wiki/Principality_of_Sealand https://en.wikipedia.org/wiki/Principality_of_Sealand
• dathinab 5y ago
  > can't even protect the IP address of their customers. Why even the IP address is both technically and law-wise on of the hardest thinks to protect. The only way to get anywhere close to it is by using a VPN, Tor or similar additionally to whatever protection the service provides, and surprise, they do have a onion site (I think).
  • simonsaidit 5y ago
    Their Tor have issues as i understand it.. eg redirecting to clearnet anf Old version and requiring phone number. But they say vpn would have solved it… To quote “ There's an important distinction here. Under Swiss law, email providers fall into a category which requires us to comply with certain legal requests. Swiss law does not have a provision which could force a VPN provider to log.” “ With VPN the legal principle is different. Thousands of users might be using the same server, logging them all would be assuming everybody is guilty until proven innocent. This is considered to be disproportionate. In the email case, it is possible to request information on a specific user, and that is considered to be proportionate.” https://www.reddit.com/r/ProtonMail/comments/pil6xi/climate_activist_arrested_after_protonmail/ https://www.reddit.com/r/ProtonMail/comments/pil6xi/climate_...
• arpanetus 5y ago
  Some men with guns can easily change the case of sealand. Technology itself has to be law-prone && gun-prone.
• dathinab 5y ago
  > I think there is a market for datacenters in open seas You might escape the laws constraining you, but you will also escape the laws protecting you. So if there is a datacenter in the open seas either: - It's operated by some government, potentially indirectly through some straw mans. - It's undermined by some goverment using it as a honypot or similar. - It's so small that no-one cares about it. - It's gone. So IMHO, realistically speaking there is no such marked, if you want to escape the law it's properly easier to do so inside of an country instead of escaping onto the sea and then trying to somehow connect internet.
• micromacrofoot 5y ago
  Data centers at sea lowers the bar from "government with a warrant" to "guy with a gun and a boat"
• shapefrog 5y ago
  > all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open We must be living on alternate time lines - try reading their transparency report. This is not even the first time this week, let alone the first time ever. https://protonmail.com/blog/transparency-report/ https://protonmail.com/blog/transparency-report/
• dylan604 5y ago
  >I think there is a market for datacenters in open seas. This will never happen. There are too many clandestine ways for this to suddenly no longer be there in ways that would be totally deniable for anyone doing the deed. Whether it's just "cut a cable" supplying the data streams or physical destruction of the vessel housing the data center.
• bengale 5y ago
  I would assume you'd also need to have some sort of armed forces too, otherwise whichever country wants you data can sail over with their Navy and take it.
  • after_care 5y ago
    If you have a navy capable causing halt to EU, CN, US, AU, etc you should go ahead and claim an entire island. Maybe collect some taxes, try to get UN recognition… Operating outside of national protection requires either extremely small scale and high risk or it requires becoming a quasi-nation.
• collaborative 5y ago
  If quantum communication becomes a possibility you could imagine an invisible network that provides a type of ultimate privacy