7 ms·

The premise of "we'll never log your IPs" is something that no company can hold. - Local law enforcement can force the to do so. - Locals laws can change. -

The premise of "we'll never log your IPs" is something that no company can hold. - Local law enforcement can force the to do so. - Locals laws can change. - Guys with guns might barge in and demand it. Mostly, you can understand that they don't _intend_ to log IPs, and aren't in the business of collecting and redistributing data. But that doesn't mean you can count on absolute and unconditional secrecy.

indymike 5y ago
Add to your list: - engineer troubleshooting might do so temporarily.
- OJFord 5y ago
  Including accidentally - `log(locals())` or `log(user)` or similar.
rossmohax 5y ago
Same for end to end encryption, no? Law enforcement can force them to serve backdoored JS client payload.
- cf_ 5y ago
  Well, yes and no. Currently, Swiss law doesn't support this and providing the IP is based on specific requirements for telecommunication providers as far as I know. But yes, the law could be changed. However, keep in mind that Switzerland is a direct democracy and people here frequently actually vote on such issues directly (if one can gather enough support from the public).
NmAmDa 5y ago
I think signal approach is the best. You can't be forced to turn in something you don't have.
- charbonneau 5y ago
  You can be forced to collect the data.
  - MichaelZuo 5y ago
    Bingo. And if the stakes were high enough many jurisdictions have laws that allow for it to happen under wraps. i.e. being forced to lie about collecting data.
  - gnramires 5y ago
    I'm not sure it applies here? Signal uses an OTR variant (I believe OTR masks the identity of the sender/receiver) -- not sure how thorough their implementation and protocol are[1]. Although if authorities already have the IP of one user they might gather a list of contacts. [1] https://en.wikipedia.org/wiki/Signal_Protocol https://en.wikipedia.org/wiki/Signal_Protocol
- philipov 5y ago
  https://xkcd.com/538/ https://xkcd.com/538/
  - lijogdfljk 5y ago
    That's good though, no? They're collecting the information from you. I know it's a joke, but it's the difference between watching my home insides without me knowing - and showing up to my home with a warrant.
    - philipov 5y ago
      The joke is made at the expense of people who are naively saying that you can't be forced to turn over something you don't have, as if that's a defense that will work. They can mandate that you collect the thing they want you to turn over, then put you in prison and seize your assets if you don't comply.
- NotEvil 5y ago
dexen 5y ago
>"we'll never log your IPs" is something that no company can hold. Four words: The Intercept, Secure Drop. A one-way mail (content submission) system that runs exclusively on Tor, and thus can't be supboenated for users' IP address. While I get your premise due to concerns of law, I think it is entirely feasible - and hinges on execution, marketing ability. We already have IP-hiding technology, whether Tor or Freenet or other such. The concern is "are we good enough yet to make it a sustainable business?" For sake of example: if a hypothetical competitor to ProtonMail was to offer sign-up and email access only over Tor protocol, it would effectively be safe from police's demands to start logging IPs - thanks to technical measures. The actual difficulty is in the business side: getting enough paying customers to install & enable relevant browser or browser plugin. Granted, the police could try to force the hypothetical competitor to install malicious JavaScript that would try to gather & leak users' IP address or other identifying information through other means, but that's solvable in the longer run just as well.
- dhimes 5y ago
  I also have to wonder if the market size for this a truly anonymous email truly is. Who would go out of their way to pay for more expensive email that was untraceable? How many reporters? How many "freedom fighters"? How many large-scale criminal organizations? And does the very fact of using it bring unwanted attention?
  - dexen 5y ago
    Excellent contention, and I don't have a ready-made answer yet. Curiously enough, we've seen anonymous services succeed for results unrelated to privacy-from-government: places like Omegle & ChatRoulette use anonymity for fun; places like 4chan use anonymity both for fun and also to avoid certain problems common to name-posting. Anonymity has long been a viable alternative put to good use in literature, arts, and entertainment. Perhaps the proper marketing would be along those lines?
  - staplers 5y ago
    At this point, creating an entirely new protocol would be easier. Something like Bitmessage.
denton-scratch 5y ago
Indymedia UK didn't log the IPs of website visitors. They used an Apache module that stripped IPs from Apache log messages. I know this, because I had root on the server. Indymedia was widely infiltrated, I think; certainly there were some infiltrators, and they often trolled that Indymedia loggeed IP addresses. There was a tool we could use to capture addresses; they were captured to memory only, and the tool could only be switched on for a limited time; it usually got switched on for less than an hour - long enough to find and block the addresses of particularly egregious spammers and trolls. An SMTP server could be run without address logging; but a commercial SMTP server would be damned hard to administer without IP addresses in the logs. [Edit] Indymedia had two servers seized in the UK; one was the property of Bristol Indymedia, and didn't run Apache. The other was run by Indy UK, and didn't log addresses. There was therefore no fallout from the seizure, except that the cops hung onto it for about 5 years. When we finally got it back, we retired it - we couldn't trust it, and it was by then obsolete kit anyway.
- luckylion 5y ago
  > Indymedia UK didn't log the IPs of website visitors. They used an Apache module that stripped IPs from Apache log messages. I know this, because I had root on the server. I believe you're confusing "is not actively logging" with "will not log, even when law enforcement takes over the server" (which a court order essentially comes down to, if you don't comply). The former is what ProtonMail also does. The latter is what no company can offer.
  - denton-scratch 5y ago
    Our server was seized by the police. Nobody was arrested (well, they didn't really know who we were). We weren't even asked to make the server start up for them; we certainly weren't asked to circumvent the logging suppression; and had we been asked, we would have declined. But then we weren't a corporation. Between us, we had little to lose. We didn't have to help the cops. Protonmail is a business, so I suppose they are much more likely to roll over. Still, I'm pretty disappointed; their whole sctick is security, and they pitch to the likes of whistleblowers. It looks pretty bad to me. The IndyUK server was seized from Rackspace, under the directions of the FBI (this was in Manchester, UK; I guess Rackspace US were leaned on by the feds, and HQ leaned on the Manchester datacenter). I think the feds kept the disks, which were encrypted.
asdfasgasdgasdg 5y ago
Not just no company: no person can make such a promise. There is no one who is outside the reach of government power, should a government develop sufficient interest in that person's doings. The only way to really avoid this is to remain completely anonymous throughout the development process, and that's a tall order.
samstave 5y ago
Whats the corollary with brick-and-mortar: Assume you're an all cash business - can governments require that you take and log every customer's ID?
- stjohnswarts 5y ago
  Of course they can, at least in the US, however if someone asks for my ID while paying cash I will say "fuck that" and turn around and leave their brick building.
  - dredmorbius 5y ago
    Whilst security cameras and mobile trackers note your presence (or that of your less-opsec-obsessed companions). Good tradecraft is hard.
    - stjohnswarts 5y ago
      Eh it was more about the affront than security. I know there are eyes in the sky just about everywhere :) . Especially with things like cops tapping into porch cameras.

indymike 5y ago

Add to your list: - engineer troubleshooting might do so temporarily.

OJFord 5y ago
Including accidentally - `log(locals())` or `log(user)` or similar.

rossmohax 5y ago

Same for end to end encryption, no? Law enforcement can force them to serve backdoored JS client payload.

cf_ 5y ago
Well, yes and no. Currently, Swiss law doesn't support this and providing the IP is based on specific requirements for telecommunication providers as far as I know. But yes, the law could be changed. However, keep in mind that Switzerland is a direct democracy and people here frequently actually vote on such issues directly (if one can gather enough support from the public).

NmAmDa 5y ago

I think signal approach is the best. You can't be forced to turn in something you don't have.

charbonneau 5y ago
You can be forced to collect the data.
- MichaelZuo 5y ago
  Bingo. And if the stakes were high enough many jurisdictions have laws that allow for it to happen under wraps. i.e. being forced to lie about collecting data.
- gnramires 5y ago
  I'm not sure it applies here? Signal uses an OTR variant (I believe OTR masks the identity of the sender/receiver) -- not sure how thorough their implementation and protocol are[1]. Although if authorities already have the IP of one user they might gather a list of contacts. [1] https://en.wikipedia.org/wiki/Signal_Protocol https://en.wikipedia.org/wiki/Signal_Protocol
philipov 5y ago
https://xkcd.com/538/ https://xkcd.com/538/
- lijogdfljk 5y ago
  That's good though, no? They're collecting the information from you. I know it's a joke, but it's the difference between watching my home insides without me knowing - and showing up to my home with a warrant.
  - philipov 5y ago
    The joke is made at the expense of people who are naively saying that you can't be forced to turn over something you don't have, as if that's a defense that will work. They can mandate that you collect the thing they want you to turn over, then put you in prison and seize your assets if you don't comply.
NotEvil 5y ago

dexen 5y ago

>"we'll never log your IPs" is something that no company can hold. Four words: The Intercept, Secure Drop. A one-way mail (content submission) system that runs exclusively on Tor, and thus can't be supboenated for users' IP address. While I get your premise due to concerns of law, I think it is entirely feasible - and hinges on execution, marketing ability. We already have IP-hiding technology, whether Tor or Freenet or other such. The concern is "are we good enough yet to make it a sustainable business?" For sake of example: if a hypothetical competitor to ProtonMail was to offer sign-up and email access only over Tor protocol, it would effectively be safe from police's demands to start logging IPs - thanks to technical measures. The actual difficulty is in the business side: getting enough paying customers to install & enable relevant browser or browser plugin. Granted, the police could try to force the hypothetical competitor to install malicious JavaScript that would try to gather & leak users' IP address or other identifying information through other means, but that's solvable in the longer run just as well.

dhimes 5y ago
I also have to wonder if the market size for this a truly anonymous email truly is. Who would go out of their way to pay for more expensive email that was untraceable? How many reporters? How many "freedom fighters"? How many large-scale criminal organizations? And does the very fact of using it bring unwanted attention?
- dexen 5y ago
  Excellent contention, and I don't have a ready-made answer yet. Curiously enough, we've seen anonymous services succeed for results unrelated to privacy-from-government: places like Omegle & ChatRoulette use anonymity for fun; places like 4chan use anonymity both for fun and also to avoid certain problems common to name-posting. Anonymity has long been a viable alternative put to good use in literature, arts, and entertainment. Perhaps the proper marketing would be along those lines?
- staplers 5y ago
  At this point, creating an entirely new protocol would be easier. Something like Bitmessage.

denton-scratch 5y ago

Indymedia UK didn't log the IPs of website visitors. They used an Apache module that stripped IPs from Apache log messages. I know this, because I had root on the server. Indymedia was widely infiltrated, I think; certainly there were some infiltrators, and they often trolled that Indymedia loggeed IP addresses. There was a tool we could use to capture addresses; they were captured to memory only, and the tool could only be switched on for a limited time; it usually got switched on for less than an hour - long enough to find and block the addresses of particularly egregious spammers and trolls. An SMTP server could be run without address logging; but a commercial SMTP server would be damned hard to administer without IP addresses in the logs. [Edit] Indymedia had two servers seized in the UK; one was the property of Bristol Indymedia, and didn't run Apache. The other was run by Indy UK, and didn't log addresses. There was therefore no fallout from the seizure, except that the cops hung onto it for about 5 years. When we finally got it back, we retired it - we couldn't trust it, and it was by then obsolete kit anyway.

luckylion 5y ago
> Indymedia UK didn't log the IPs of website visitors. They used an Apache module that stripped IPs from Apache log messages. I know this, because I had root on the server. I believe you're confusing "is not actively logging" with "will not log, even when law enforcement takes over the server" (which a court order essentially comes down to, if you don't comply). The former is what ProtonMail also does. The latter is what no company can offer.
- denton-scratch 5y ago
  Our server was seized by the police. Nobody was arrested (well, they didn't really know who we were). We weren't even asked to make the server start up for them; we certainly weren't asked to circumvent the logging suppression; and had we been asked, we would have declined. But then we weren't a corporation. Between us, we had little to lose. We didn't have to help the cops. Protonmail is a business, so I suppose they are much more likely to roll over. Still, I'm pretty disappointed; their whole sctick is security, and they pitch to the likes of whistleblowers. It looks pretty bad to me. The IndyUK server was seized from Rackspace, under the directions of the FBI (this was in Manchester, UK; I guess Rackspace US were leaned on by the feds, and HQ leaned on the Manchester datacenter). I think the feds kept the disks, which were encrypted.

asdfasgasdgasdg 5y ago

Not just no company: no person can make such a promise. There is no one who is outside the reach of government power, should a government develop sufficient interest in that person's doings. The only way to really avoid this is to remain completely anonymous throughout the development process, and that's a tall order.

samstave 5y ago

Whats the corollary with brick-and-mortar: Assume you're an all cash business - can governments require that you take and log every customer's ID?

stjohnswarts 5y ago
Of course they can, at least in the US, however if someone asks for my ID while paying cash I will say "fuck that" and turn around and leave their brick building.
- dredmorbius 5y ago
  Whilst security cameras and mobile trackers note your presence (or that of your less-opsec-obsessed companions). Good tradecraft is hard.
  - stjohnswarts 5y ago
    Eh it was more about the affront than security. I know there are eyes in the sky just about everywhere :) . Especially with things like cops tapping into porch cameras.