8 ms·

Proton wins appeal in Swiss court over surveillance laws

420 points by dane-pgp 5y ago

aborsy 5y ago
ProtonMail needs to come up with technologies such that it’s not in possession of user’s data in the first place. Instead of, being in possession of user’s data and sometimes providing data to governments sometimes appealing. As an example, can you implement a VPN service such that you don’t hold IP or DNS records at all (ie, not both simultaneously)?
- nabla9 5y ago
  >ProtonVPN does not log DNS queries, and by Swiss law cannot be forced to start logging them. We also do not log the IP addresses of our users. https://protonvpn.com/support/dns-leaks-privacy/ https://protonvpn.com/support/dns-leaks-privacy/
- beermonster 5y ago
  > ProtonMail needs to come up with technologies such that it’s not in possession of user’s data in the first place. I believe it has them already? There's no reason they can't put an inline transparent Tor bridge in front of their mail infra to anonymise all inbound traffic i.e. TCP/IP->Tor Node->Tor Node->ProtonMail so it could only ever capture IPs coming from it's own Tor-node if compelled to do so. However it would still have an ability to log on the TCP/IP transparent endpoint. This risk could be mitigated by using their onion address [2] and using someone else's tor nodes. The data-at-rest already is zero-access[1]. There is encryption of data-in-transit but no zero-knowledge network layer.. maybe they could work on this since they have support for tor [2]? [1] https://protonmail.com/blog/zero-access-encryption/ https://protonmail.com/blog/zero-access-encryption/ [2] https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/ https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7... [3] https://protonmail.com/tor https://protonmail.com/tor
  - aborsy 5y ago
    This is exactly what I alluded to. See Apple’s private relay feature. But PM needs to lead the tech world in privacy technologies instead of spending efforts in justifying why it should be trusted. Another thing, data at rest is not quite end to end encrypted. If an email comes from a non-PM account to PM account, it’s received in plaintext and then encrypted. Thus PM has that data.
    - beermonster 5y ago
      My point was I think they have already the ability to do this (cited sources) but they don't. Apple's private relay feature is good but they also suffer from recent trust issues. Regarding the last point, yes if you send PM-Non-PM there will be plaintext email sitting in the Non-PM's inbox/sent items. But you do have the ability to send non-PM recipients password protected email where they have to read the email over at PM in their browser. Only a link to it sent by email and they need to know the password to access it. Obviously it depends on your threat model, but if you're doing anything that sensitive you should probably not be using email as there's no way of truly making it secure to use. Some people will be using protonmail just because they don't want their provider scanning their emails or targeting them with ads. PM do offer a free tier so they're not a bad choice for that use case.
      - aborsy 5y ago
        Just to be clear, if you send an email from a non-PM to PM account, the email is plaintext in BOTH accounts! That’s because, PM servers receive plaintext data. Then, they encrypt it. But there is no proof that plaintext is not logged. It’s same as in VPN: trust us, we don’t log your data. No, invest in zero knowledge technologies please. I can point out to many other possibilities for improvements in their email and VPN service. But they should lead us not other way around.
        beermonster 5y ago
        > That’s because, PM servers receive plaintext data. Then, they encrypt it. But there is no proof that plaintext is not logged. Ah yes this is a good point. The only way to be sure is to client side end-to-end encrypt your data before you send it to any upstream mail service. E.g. using S/MIME or PGP. At this point you can then use any free mail service as you now “only” need to worry about leaked mail header meta-data.
- PeterisP 5y ago
  The law can mandate that ProtonMail is forbidden to use such technologies - if the court ruling would have went in the other direction and asserted that the data retention requirements apply, then it would be illegal for Protonmail to offer their service without explicitly collecting and holding the records, even if they technically could do without them.
- White_Wolf 5y ago
  You can't(as a single company/entity) find a work around something like this. Proton had a court order from the country they operate from. You can fight court orders but you can't usually disclose them(gag orders and all). The only reasonable way(i can think of) to make it a bit harder for this to happen would be to have a second(and maybe a 3rd)unrelated entity/company in an adversarial country that you can use as a relay. In this case use it as a VPN service to access the e-mail on Proton servers. Anonimity is inconvenient these days... and next to impossible if any govt agency is out to get you. The only way you can make it hard(er) is to spread over multiple jurisdiction and rotate accounts/discard them after a few uses. A system similar to one time pads of sorts combined with PGP.
  - nix23 5y ago
    > can't usually disclose them(gag orders and all). Switzerland has no "gag orders", that's a exclusive US-open-democracy-thing ;-)
    - White_Wolf 5y ago
      :) I didn't know that. I though most/all countries in the west have an equivalent. In UK we have something like that(can't remember the name of it though). The courts can forbid all parties involved to have any public discussions, They can ban topics from reaching the public through normal mass media means. To make it even worse, they can prevent individuals to do this sort of thing too. Prison time and/or fines if you don't comply. Democracy at it's finest.
      - nix23 5y ago
        >I though most/all countries in the west have an equivalent. Well there is no direct gag-thing (because it would undermine free speech) BUT it could be interpreted ~sometimes and in "theory" as "obstruction of a police investigation", so it's a case to case thing and not direct law.
        White_Wolf 5y ago
dane-pgp 5y ago
> The court confirmed that email services can’t be considered telecommunications providers in Switzerland, and therefore are not subject to data retention requirements. That's a great development. I think I read previously that their VPN service was also not covered by the data retention requirement, which meant that they were in the odd position of hiding your IP address from themselves. Bootstrapping the sign-up process for that using Tor and cryptocurrency might have been a bit difficult though.
- infogulch 5y ago
  > email services can’t be considered telecommunications providers It's nice that they won the case, but now I wonder if this ruling may deprive them of other rights, that seems like a broad category that may be used in other laws.
- southerntofu 5y ago
  It's good to see even if they're not willing to take risks for their users, they're still dedicating some resources to fight unjust laws (in court not in real life, but that's still something).
xaduha 5y ago
For someone who wasn't really buying in into the whole secure email thing and wasn't that surprised they caved in initially this was a net positive for me now that it was tested in court. Not massively so, but still.
- kataklasm 5y ago
  Calling that "caving in" is problematic, even defamation. They had a legal order from the court to log the IP next time that user logged in. If they hadn't complied who knows what the swiss government would've done to Proton. Proton is a company afterall and has to adhere to jts legal boundaries, if it doesnt it soon won't have legak boundaries because the government uses its tools to make sure there is no Proton anymore.
  - throwawayswede 5y ago
    No it’s not, caved in is the exact perfect word that should be used. Specifically considering the language they used in their promotional material. It is exactly because they’re a company and they must know that they will have to comply with laws that apply on them that they should’ve either not used that wording in their promos or not cave in to legal requirements. Saying they caved in is putting it mildly. You can even say the purposely misled their customers, and as of now, have not exactly owned up to it yet. Edit: I’m also sick of the usage of the word problematic. Using problematic is problematic itself.
    - EE84M3i 5y ago
      What action would you have not considered "caving in"?
      - throwawayswede 5y ago
        Stick by their supposed principles, or at least spend money to defend the dude they exposed. Basically they fucked up majorly regarding this specific person and they should spend however much to fight the chaos they have caused.
beebeepka 5y ago
Call me anything you want but I feel this is little more than a feel good ruling. We know for a fact that the CIA operated Crypto AG for more than 30 years. No way the Swiss government wasn't on it from the very start. And we know every government with ability the spy on its subjects had been doing it for as long as it's been possible/affordable. Now, I am not saying this ruling is meaningless. It's not. But if "they" really want your data, they will get it, legally or not. In other words, I think they are simply trying to attract some new business
- kataklasm 5y ago
  If your threat actor is the CIA, or any three-letter agency for that matter, you ought to be bright enough not to trust a company. Companies are inherently focused on profit and growth, nothing bad about that, that's what companies do. However, companies also still operate within political and legal environments which means they have to adhere to the laws of the jursidiction they reside in. A company won't risk going bankrupt or being shut down to save a customer's privacy and anonymity, which it would if it just denied the government its legal processes. If your threat actor is a nation-state intelligence community you might want to consider using higher level security systems like PGP. For ever other threat actor, this ruling is a great win for privacy. As long as your threat actor is your ISP, (anti-) social media as I've begun to call it, or your employer, ProtonMail (or Proton services) are really at the forefront of digital privacy. Again, if you're up against the government, use PGP to communicate securely.
  - throwawayswede 5y ago
    While what you say is correct, it’s not the main point here. I’m sick of seeing blind Proton defenders on HN, has the company bought some shills to defend them by diluting and misdirecting the community’s attention? I wonder! The issue is that Proton lied. Plain and simple. Their marketing and promos were targeting everyone, specifically non tech savvy people, aka those who don’t know or can’t use pgp. It’s not the end of the world, and mistakes happen, but Proton purposefully mislead their customers, and they should own up to it to even recover a tiny bit of their reputation. Otherwise the company is dead in my book and I would never ever recommend them.
gvv 5y ago
Big PR win for Proton in the aftermath of https://www.swissinfo.ch/eng/protonmail-scandal-tarnishes-swiss-privacy-reputation-/46952640 https://www.swissinfo.ch/eng/protonmail-scandal-tarnishes-sw...
- froh 5y ago
  To save you a click: > Encrypted email service ProtonMail has been at the centre of a social media storm ever since a police report revealed that the company shared the IP address of one of its users as part of a French investigation that led to the arrest of climate activists.
- throwawayswede 5y ago
  Hardly. The company still has not owned up to their major fuck up in my book. They are willing to save themselves on the account of their customers. Dead company in the world of security, but might drag on in the scam world.
  - xcambar 5y ago
    What should have been their policy, according to you? Which service or solution (if any) has your favour?
    - maccolgan 5y ago
      What Lavabit did should be followed as an example imho.
      - Sebb767 5y ago
        > The court documents stated that on July 13 Levison sent an open letter to the assistant US attorney, offering to give email metadata (without email content, usernames or passwords) to the FBI if it paid him $2,000 "to cover the cost of the development time and equipment necessary to implement my solution" and $1,500 to give data "intermittently during the collection period". So what Protonmail did wrong was to not ask for payment while handing out the metadata? Source: https://en.m.wikipedia.org/wiki/Lavabit https://en.m.wikipedia.org/wiki/Lavabit
rdpintqogeogsaa 5y ago
For anyone wanting to read the actual court decision (in French): http://links.weblaw.ch/BVGer-A-5373/2020 http://links.weblaw.ch/BVGer-A-5373/2020 The judgments are customarily anonymized, but everything points to this being the correct one. Note that this decision is not final; an appeal to the Swiss Federal Tribunal may still be filed.
pmarreck 5y ago
Can anyone provide any additional info on what exactly these "climate activists" were responsible for doing?
- woko 5y ago
  From what I remember, the suspect is believed to be the leader of an anarchist group responsible for squatting places, to struggle against the move of wealthy people to North-Eastern Paris. They have made the news for squatting one place in particular: the restaurant "Le Petit Cambodge", as it is one of the restaurants targetted by terrorists on November 13, 2015. Here is an article in French about them: https://www.lefigaro.fr/societes/a-paris-un-local-du-restaurant-le-petit-cambodge-squatte-par-des-militants-20201227 https://www.lefigaro.fr/societes/a-paris-un-local-du-restaur...
riwsky 5y ago
Here I was, thinking that the Large Hadron Collider violated the plaintiff’s GDPR rights
- deleted 5y ago
  [deleted]
jimnotgym 5y ago
Watch HN turn this into a negative because the hard-core ProtonMail haters going to hate
- Bizarro 5y ago
  This gets turned into a negative because HN is chock full of leftist authoritarians that don't like privacy from government prying eyes.
  - consumer451 5y ago
    Oooo edgy straw man.... delicious. What do you mean by "leftist authoritarian" exactly? Can you give some examples of notable American "leftist authoritarians?"
  - randomswede 5y ago
    I am arguably a leftist, but probably not an authoritarian. I am all for privacy. In fact, one could argue that Proton could have gone further in basic system architecture to provide that than they seem to have to. But, the flip side of that is that the more complicated you make your tech stack, the longer it takes to getting it running, and to fix it when it inevitably breaks. On the other hand, they seem to have recommended using a VPN to access them, if you were concerned about IP metadata being disclosed. On the gripping hand, they were also served with a subpoena, and depending on exactly how it was formulated, it may well have been no scope to fight the subpoena in court, and as I think that "follow the law" is generally a good thing, I think that on the balance Proton may be culpable of negligence, but not actual malice here.
    - deleted 5y ago
      [deleted]
  - antifa 5y ago
    Yeah you can't even go one thread on HN without some Maoist telling you to let your employees unionize /s
stereoradonc 5y ago
It will lead to people blindly trusting the Swiss honeypot to store all information.
1cvmask 5y ago
The Swiss government and police, with unchecked limitless powers, can use the new anti-terrorism laws where they can target Proton employees without charge or trial (even 12 year olds): https://www.fedlex.admin.ch/eli/fga/2020/2004/fr https://www.fedlex.admin.ch/eli/fga/2020/2004/fr

420 points by dane-pgp 5y ago

ProtonMail needs to come up with technologies such that it’s not in possession of user’s data in the first place. Instead of, being in possession of user’s data and sometimes providing data to governments sometimes appealing. As an example, can you implement a VPN service such that you don’t hold IP or DNS records at all (ie, not both simultaneously)?

nabla9 5y ago
>ProtonVPN does not log DNS queries, and by Swiss law cannot be forced to start logging them. We also do not log the IP addresses of our users. https://protonvpn.com/support/dns-leaks-privacy/ https://protonvpn.com/support/dns-leaks-privacy/
beermonster 5y ago
> ProtonMail needs to come up with technologies such that it’s not in possession of user’s data in the first place. I believe it has them already? There's no reason they can't put an inline transparent Tor bridge in front of their mail infra to anonymise all inbound traffic i.e. TCP/IP->Tor Node->Tor Node->ProtonMail so it could only ever capture IPs coming from it's own Tor-node if compelled to do so. However it would still have an ability to log on the TCP/IP transparent endpoint. This risk could be mitigated by using their onion address [2] and using someone else's tor nodes. The data-at-rest already is zero-access[1]. There is encryption of data-in-transit but no zero-knowledge network layer.. maybe they could work on this since they have support for tor [2]? [1] https://protonmail.com/blog/zero-access-encryption/ https://protonmail.com/blog/zero-access-encryption/ [2] https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/ https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7... [3] https://protonmail.com/tor https://protonmail.com/tor
- aborsy 5y ago
  This is exactly what I alluded to. See Apple’s private relay feature. But PM needs to lead the tech world in privacy technologies instead of spending efforts in justifying why it should be trusted. Another thing, data at rest is not quite end to end encrypted. If an email comes from a non-PM account to PM account, it’s received in plaintext and then encrypted. Thus PM has that data.
  - beermonster 5y ago
    My point was I think they have already the ability to do this (cited sources) but they don't. Apple's private relay feature is good but they also suffer from recent trust issues. Regarding the last point, yes if you send PM-Non-PM there will be plaintext email sitting in the Non-PM's inbox/sent items. But you do have the ability to send non-PM recipients password protected email where they have to read the email over at PM in their browser. Only a link to it sent by email and they need to know the password to access it. Obviously it depends on your threat model, but if you're doing anything that sensitive you should probably not be using email as there's no way of truly making it secure to use. Some people will be using protonmail just because they don't want their provider scanning their emails or targeting them with ads. PM do offer a free tier so they're not a bad choice for that use case.
    - aborsy 5y ago
      Just to be clear, if you send an email from a non-PM to PM account, the email is plaintext in BOTH accounts! That’s because, PM servers receive plaintext data. Then, they encrypt it. But there is no proof that plaintext is not logged. It’s same as in VPN: trust us, we don’t log your data. No, invest in zero knowledge technologies please. I can point out to many other possibilities for improvements in their email and VPN service. But they should lead us not other way around.
      - beermonster 5y ago
        > That’s because, PM servers receive plaintext data. Then, they encrypt it. But there is no proof that plaintext is not logged. Ah yes this is a good point. The only way to be sure is to client side end-to-end encrypt your data before you send it to any upstream mail service. E.g. using S/MIME or PGP. At this point you can then use any free mail service as you now “only” need to worry about leaked mail header meta-data.
PeterisP 5y ago
The law can mandate that ProtonMail is forbidden to use such technologies - if the court ruling would have went in the other direction and asserted that the data retention requirements apply, then it would be illegal for Protonmail to offer their service without explicitly collecting and holding the records, even if they technically could do without them.
White_Wolf 5y ago
You can't(as a single company/entity) find a work around something like this. Proton had a court order from the country they operate from. You can fight court orders but you can't usually disclose them(gag orders and all). The only reasonable way(i can think of) to make it a bit harder for this to happen would be to have a second(and maybe a 3rd)unrelated entity/company in an adversarial country that you can use as a relay. In this case use it as a VPN service to access the e-mail on Proton servers. Anonimity is inconvenient these days... and next to impossible if any govt agency is out to get you. The only way you can make it hard(er) is to spread over multiple jurisdiction and rotate accounts/discard them after a few uses. A system similar to one time pads of sorts combined with PGP.
- nix23 5y ago
  > can't usually disclose them(gag orders and all). Switzerland has no "gag orders", that's a exclusive US-open-democracy-thing ;-)
  - White_Wolf 5y ago
    :) I didn't know that. I though most/all countries in the west have an equivalent. In UK we have something like that(can't remember the name of it though). The courts can forbid all parties involved to have any public discussions, They can ban topics from reaching the public through normal mass media means. To make it even worse, they can prevent individuals to do this sort of thing too. Prison time and/or fines if you don't comply. Democracy at it's finest.
    - nix23 5y ago
      >I though most/all countries in the west have an equivalent. Well there is no direct gag-thing (because it would undermine free speech) BUT it could be interpreted ~sometimes and in "theory" as "obstruction of a police investigation", so it's a case to case thing and not direct law.
      - White_Wolf 5y ago

dane-pgp 5y ago

> The court confirmed that email services can’t be considered telecommunications providers in Switzerland, and therefore are not subject to data retention requirements. That's a great development. I think I read previously that their VPN service was also not covered by the data retention requirement, which meant that they were in the odd position of hiding your IP address from themselves. Bootstrapping the sign-up process for that using Tor and cryptocurrency might have been a bit difficult though.

infogulch 5y ago
> email services can’t be considered telecommunications providers It's nice that they won the case, but now I wonder if this ruling may deprive them of other rights, that seems like a broad category that may be used in other laws.
southerntofu 5y ago
It's good to see even if they're not willing to take risks for their users, they're still dedicating some resources to fight unjust laws (in court not in real life, but that's still something).

xaduha 5y ago

For someone who wasn't really buying in into the whole secure email thing and wasn't that surprised they caved in initially this was a net positive for me now that it was tested in court. Not massively so, but still.

kataklasm 5y ago
Calling that "caving in" is problematic, even defamation. They had a legal order from the court to log the IP next time that user logged in. If they hadn't complied who knows what the swiss government would've done to Proton. Proton is a company afterall and has to adhere to jts legal boundaries, if it doesnt it soon won't have legak boundaries because the government uses its tools to make sure there is no Proton anymore.
- throwawayswede 5y ago
  No it’s not, caved in is the exact perfect word that should be used. Specifically considering the language they used in their promotional material. It is exactly because they’re a company and they must know that they will have to comply with laws that apply on them that they should’ve either not used that wording in their promos or not cave in to legal requirements. Saying they caved in is putting it mildly. You can even say the purposely misled their customers, and as of now, have not exactly owned up to it yet. Edit: I’m also sick of the usage of the word problematic. Using problematic is problematic itself.
  - EE84M3i 5y ago
    What action would you have not considered "caving in"?
    - throwawayswede 5y ago
      Stick by their supposed principles, or at least spend money to defend the dude they exposed. Basically they fucked up majorly regarding this specific person and they should spend however much to fight the chaos they have caused.

beebeepka 5y ago

Call me anything you want but I feel this is little more than a feel good ruling. We know for a fact that the CIA operated Crypto AG for more than 30 years. No way the Swiss government wasn't on it from the very start. And we know every government with ability the spy on its subjects had been doing it for as long as it's been possible/affordable. Now, I am not saying this ruling is meaningless. It's not. But if "they" really want your data, they will get it, legally or not. In other words, I think they are simply trying to attract some new business

kataklasm 5y ago
If your threat actor is the CIA, or any three-letter agency for that matter, you ought to be bright enough not to trust a company. Companies are inherently focused on profit and growth, nothing bad about that, that's what companies do. However, companies also still operate within political and legal environments which means they have to adhere to the laws of the jursidiction they reside in. A company won't risk going bankrupt or being shut down to save a customer's privacy and anonymity, which it would if it just denied the government its legal processes. If your threat actor is a nation-state intelligence community you might want to consider using higher level security systems like PGP. For ever other threat actor, this ruling is a great win for privacy. As long as your threat actor is your ISP, (anti-) social media as I've begun to call it, or your employer, ProtonMail (or Proton services) are really at the forefront of digital privacy. Again, if you're up against the government, use PGP to communicate securely.
- throwawayswede 5y ago
  While what you say is correct, it’s not the main point here. I’m sick of seeing blind Proton defenders on HN, has the company bought some shills to defend them by diluting and misdirecting the community’s attention? I wonder! The issue is that Proton lied. Plain and simple. Their marketing and promos were targeting everyone, specifically non tech savvy people, aka those who don’t know or can’t use pgp. It’s not the end of the world, and mistakes happen, but Proton purposefully mislead their customers, and they should own up to it to even recover a tiny bit of their reputation. Otherwise the company is dead in my book and I would never ever recommend them.

gvv 5y ago

Big PR win for Proton in the aftermath of https://www.swissinfo.ch/eng/protonmail-scandal-tarnishes-swiss-privacy-reputation-/46952640 https://www.swissinfo.ch/eng/protonmail-scandal-tarnishes-sw...

froh 5y ago
To save you a click: > Encrypted email service ProtonMail has been at the centre of a social media storm ever since a police report revealed that the company shared the IP address of one of its users as part of a French investigation that led to the arrest of climate activists.
throwawayswede 5y ago
Hardly. The company still has not owned up to their major fuck up in my book. They are willing to save themselves on the account of their customers. Dead company in the world of security, but might drag on in the scam world.
- xcambar 5y ago
  What should have been their policy, according to you? Which service or solution (if any) has your favour?
  - maccolgan 5y ago
    What Lavabit did should be followed as an example imho.
    - Sebb767 5y ago
      > The court documents stated that on July 13 Levison sent an open letter to the assistant US attorney, offering to give email metadata (without email content, usernames or passwords) to the FBI if it paid him $2,000 "to cover the cost of the development time and equipment necessary to implement my solution" and $1,500 to give data "intermittently during the collection period". So what Protonmail did wrong was to not ask for payment while handing out the metadata? Source: https://en.m.wikipedia.org/wiki/Lavabit https://en.m.wikipedia.org/wiki/Lavabit

rdpintqogeogsaa 5y ago

For anyone wanting to read the actual court decision (in French): http://links.weblaw.ch/BVGer-A-5373/2020 http://links.weblaw.ch/BVGer-A-5373/2020 The judgments are customarily anonymized, but everything points to this being the correct one. Note that this decision is not final; an appeal to the Swiss Federal Tribunal may still be filed.

pmarreck 5y ago

Can anyone provide any additional info on what exactly these "climate activists" were responsible for doing?

woko 5y ago
From what I remember, the suspect is believed to be the leader of an anarchist group responsible for squatting places, to struggle against the move of wealthy people to North-Eastern Paris. They have made the news for squatting one place in particular: the restaurant "Le Petit Cambodge", as it is one of the restaurants targetted by terrorists on November 13, 2015. Here is an article in French about them: https://www.lefigaro.fr/societes/a-paris-un-local-du-restaurant-le-petit-cambodge-squatte-par-des-militants-20201227 https://www.lefigaro.fr/societes/a-paris-un-local-du-restaur...

riwsky 5y ago

Here I was, thinking that the Large Hadron Collider violated the plaintiff’s GDPR rights

deleted 5y ago
[deleted]

jimnotgym 5y ago

Watch HN turn this into a negative because the hard-core ProtonMail haters going to hate

Bizarro 5y ago
This gets turned into a negative because HN is chock full of leftist authoritarians that don't like privacy from government prying eyes.
- consumer451 5y ago
  Oooo edgy straw man.... delicious. What do you mean by "leftist authoritarian" exactly? Can you give some examples of notable American "leftist authoritarians?"
- randomswede 5y ago
  I am arguably a leftist, but probably not an authoritarian. I am all for privacy. In fact, one could argue that Proton could have gone further in basic system architecture to provide that than they seem to have to. But, the flip side of that is that the more complicated you make your tech stack, the longer it takes to getting it running, and to fix it when it inevitably breaks. On the other hand, they seem to have recommended using a VPN to access them, if you were concerned about IP metadata being disclosed. On the gripping hand, they were also served with a subpoena, and depending on exactly how it was formulated, it may well have been no scope to fight the subpoena in court, and as I think that "follow the law" is generally a good thing, I think that on the balance Proton may be culpable of negligence, but not actual malice here.
  - deleted 5y ago
    [deleted]
- antifa 5y ago
  Yeah you can't even go one thread on HN without some Maoist telling you to let your employees unionize /s

stereoradonc 5y ago

It will lead to people blindly trusting the Swiss honeypot to store all information.

1cvmask 5y ago

The Swiss government and police, with unchecked limitless powers, can use the new anti-terrorism laws where they can target Proton employees without charge or trial (even 12 year olds): https://www.fedlex.admin.ch/eli/fga/2020/2004/fr https://www.fedlex.admin.ch/eli/fga/2020/2004/fr