6 ms·

Big PR win for Proton in the aftermath of https://www.swissinfo.ch/eng/protonmail-scandal-tarnishes-swiss-privacy-reputation-/46952640 https://www.swissinfo.ch/

by gvv 5y ago

Big PR win for Proton in the aftermath of https://www.swissinfo.ch/eng/protonmail-scandal-tarnishes-swiss-privacy-reputation-/46952640 https://www.swissinfo.ch/eng/protonmail-scandal-tarnishes-sw...

froh 5y ago
To save you a click: > Encrypted email service ProtonMail has been at the centre of a social media storm ever since a police report revealed that the company shared the IP address of one of its users as part of a French investigation that led to the arrest of climate activists.
throwawayswede 5y ago
Hardly. The company still has not owned up to their major fuck up in my book. They are willing to save themselves on the account of their customers. Dead company in the world of security, but might drag on in the scam world.
- xcambar 5y ago
  What should have been their policy, according to you? Which service or solution (if any) has your favour?
  - maccolgan 5y ago
    What Lavabit did should be followed as an example imho.
    - Sebb767 5y ago
      > The court documents stated that on July 13 Levison sent an open letter to the assistant US attorney, offering to give email metadata (without email content, usernames or passwords) to the FBI if it paid him $2,000 "to cover the cost of the development time and equipment necessary to implement my solution" and $1,500 to give data "intermittently during the collection period". So what Protonmail did wrong was to not ask for payment while handing out the metadata? Source: https://en.m.wikipedia.org/wiki/Lavabit https://en.m.wikipedia.org/wiki/Lavabit
    - Root_Denied 5y ago
      That doesn't answer the question of what currently available service is an acceptable alternative if Protonmail isn't palatable.
      - maxwell 5y ago
        No email provider seems palatable.
    - shapefrog 5y ago
      Lavabit gave the feds the decryption key, and contents to every email for every user on their server. I disagree with your position that this is what protonmail should have done.
      - YetAnotherNick 5y ago
        From wikipedia: > The court records show that the FBI sought Lavabit's Transport Layer Security (TLS/SSL) private key. Levison objected, saying that the key would allow the government to access communications by all 400,000 customers of Lavabit. He also offered to add code to his servers that would provide the information required just for the target of the order. The court rejected this offer because it would require the government to trust Levison and stated that just because the government could access all customers' communication did not mean they would be legally permitted to do so. Lavabit was ordered to provide the SSL key in machine readable format by noon, August 5 or face a fine of $5000 per day.[28] Levison closed down Lavabit 3 days later.
        shapefrog 5y ago
        From wikipedia: >Before the Snowden incident, Lavabit had complied with previous search warrants. For example, in June 2013 a search warrant was executed against a Lavabit account for suspected possession of child pornography. From the register: > After much wrangling, Levison eventually handed over Lavabit's cryptographic key in digital form, after earlier trying to satisfy a court order by printing out and handing over a copy of the key in 4-point type, a move that irked the judge handling the case. From vice / the US Attorneys Office / Eastern District of Virginia: > At approximately 1:30pm CDT on August 2, 2013, Mr. Levison gave the FBI a printout of what he represented to be the encryption keys needed to operate the pen register," a motion for sanctions signed by James L. Trump from the US Attorney's Office reads. According to the case docket, the documents were unsealed on March 4.
- spinax 5y ago
  > ProtonMail, in fact, had to comply with a Swiss court order, which came after the French police had requested Swiss cooperation through Europol, making use of international judicial assistance. What exactly did / do you expect Proton to do here? They were given a legal mandate to comply and they complied. Did you have a fantasy that they would fight the Swiss and French governments (and apparently Europol) when given a valid court order and risk their entire existence?
  - maxwell 5y ago
    You're really making the Nuremberg defense? https://en.m.wikipedia.org/wiki/Superior_orders https://en.m.wikipedia.org/wiki/Superior_orders By complying they also risked their entire existence. Their brand seems destroyed already.
    - spinax 5y ago
      Since we're tossing around wikipedia links, https://en.wikipedia.org/wiki/False_equivalence https://en.wikipedia.org/wiki/False_equivalence
      - Cycl0ps 5y ago
        See also, https://en.wikipedia.org/wiki/Godwin%27s_law https://en.wikipedia.org/wiki/Godwin%27s_law
      - throwawayswede 5y ago
        Lol, dude, you're missing the entire point. I understand it hurts to learn that a company you've been paying turned out not to be what it claims to be, but no one is "tossing around" wikipedia links other than you. And you're doing it sort of badly, the link you tossed is equivalent to just throwing: https://en.wikipedia.org/wiki/Security https://en.wikipedia.org/wiki/Security in an argument.
  - dskloet 5y ago
    They could and should have communicated more honestly about it. https://news.ycombinator.com/item?id=28427996 https://news.ycombinator.com/item?id=28427996
- alfalfasprout 5y ago
  Swiss courts are not something to be taken likely... since ProtonMail and its founders are based in Switzerland the employees themselves could have faced criminal charges for non-compliance. A different argument could be made that they could be using more privacy-preserving tech that would make compliance not possible... but even then a court order + gag order could compel them to start logging. Why this ruling is so important is it sets legal precedent that Protonmail is in the right to not turn over user data to the government. The Swiss legal system tends to be pretty firm about things and this will likely make it next to impossible for a repeat of their past fiasco to happen.
  - throwawayswede 5y ago
    Again, for the millionth time, the issue is not that they had to comply with the law. Stop pretending to misunderstand, all this bullshit is quite obvious. Proton mail lied, and then pretended like they didn’t. They decided it makes sense to sacrifice a customer on the account of their own fuck up and false promise. Proton mail is a shit company, and more and more I’m convinced they’ve bought shills to go out and divert attention. In the world of security, proton mail is a less than a zero. Their main clientele will be in the same scam business they are.

by gvv 5y ago

Big PR win for Proton in the aftermath of https://www.swissinfo.ch/eng/protonmail-scandal-tarnishes-swiss-privacy-reputation-/46952640 https://www.swissinfo.ch/eng/protonmail-scandal-tarnishes-sw...

froh 5y ago

To save you a click: > Encrypted email service ProtonMail has been at the centre of a social media storm ever since a police report revealed that the company shared the IP address of one of its users as part of a French investigation that led to the arrest of climate activists.

throwawayswede 5y ago

Hardly. The company still has not owned up to their major fuck up in my book. They are willing to save themselves on the account of their customers. Dead company in the world of security, but might drag on in the scam world.

xcambar 5y ago
What should have been their policy, according to you? Which service or solution (if any) has your favour?
- maccolgan 5y ago
  What Lavabit did should be followed as an example imho.
  - Sebb767 5y ago
    > The court documents stated that on July 13 Levison sent an open letter to the assistant US attorney, offering to give email metadata (without email content, usernames or passwords) to the FBI if it paid him $2,000 "to cover the cost of the development time and equipment necessary to implement my solution" and $1,500 to give data "intermittently during the collection period". So what Protonmail did wrong was to not ask for payment while handing out the metadata? Source: https://en.m.wikipedia.org/wiki/Lavabit https://en.m.wikipedia.org/wiki/Lavabit
  - Root_Denied 5y ago
    That doesn't answer the question of what currently available service is an acceptable alternative if Protonmail isn't palatable.
    - maxwell 5y ago
      No email provider seems palatable.
  - shapefrog 5y ago
    Lavabit gave the feds the decryption key, and contents to every email for every user on their server. I disagree with your position that this is what protonmail should have done.
    - YetAnotherNick 5y ago
      From wikipedia: > The court records show that the FBI sought Lavabit's Transport Layer Security (TLS/SSL) private key. Levison objected, saying that the key would allow the government to access communications by all 400,000 customers of Lavabit. He also offered to add code to his servers that would provide the information required just for the target of the order. The court rejected this offer because it would require the government to trust Levison and stated that just because the government could access all customers' communication did not mean they would be legally permitted to do so. Lavabit was ordered to provide the SSL key in machine readable format by noon, August 5 or face a fine of $5000 per day.[28] Levison closed down Lavabit 3 days later.
      - shapefrog 5y ago
        From wikipedia: >Before the Snowden incident, Lavabit had complied with previous search warrants. For example, in June 2013 a search warrant was executed against a Lavabit account for suspected possession of child pornography. From the register: > After much wrangling, Levison eventually handed over Lavabit's cryptographic key in digital form, after earlier trying to satisfy a court order by printing out and handing over a copy of the key in 4-point type, a move that irked the judge handling the case. From vice / the US Attorneys Office / Eastern District of Virginia: > At approximately 1:30pm CDT on August 2, 2013, Mr. Levison gave the FBI a printout of what he represented to be the encryption keys needed to operate the pen register," a motion for sanctions signed by James L. Trump from the US Attorney's Office reads. According to the case docket, the documents were unsealed on March 4.
spinax 5y ago
> ProtonMail, in fact, had to comply with a Swiss court order, which came after the French police had requested Swiss cooperation through Europol, making use of international judicial assistance. What exactly did / do you expect Proton to do here? They were given a legal mandate to comply and they complied. Did you have a fantasy that they would fight the Swiss and French governments (and apparently Europol) when given a valid court order and risk their entire existence?
- maxwell 5y ago
  You're really making the Nuremberg defense? https://en.m.wikipedia.org/wiki/Superior_orders https://en.m.wikipedia.org/wiki/Superior_orders By complying they also risked their entire existence. Their brand seems destroyed already.
  - spinax 5y ago
    Since we're tossing around wikipedia links, https://en.wikipedia.org/wiki/False_equivalence https://en.wikipedia.org/wiki/False_equivalence
    - Cycl0ps 5y ago
      See also, https://en.wikipedia.org/wiki/Godwin%27s_law https://en.wikipedia.org/wiki/Godwin%27s_law
    - throwawayswede 5y ago
      Lol, dude, you're missing the entire point. I understand it hurts to learn that a company you've been paying turned out not to be what it claims to be, but no one is "tossing around" wikipedia links other than you. And you're doing it sort of badly, the link you tossed is equivalent to just throwing: https://en.wikipedia.org/wiki/Security https://en.wikipedia.org/wiki/Security in an argument.
- dskloet 5y ago
  They could and should have communicated more honestly about it. https://news.ycombinator.com/item?id=28427996 https://news.ycombinator.com/item?id=28427996
alfalfasprout 5y ago
Swiss courts are not something to be taken likely... since ProtonMail and its founders are based in Switzerland the employees themselves could have faced criminal charges for non-compliance. A different argument could be made that they could be using more privacy-preserving tech that would make compliance not possible... but even then a court order + gag order could compel them to start logging. Why this ruling is so important is it sets legal precedent that Protonmail is in the right to not turn over user data to the government. The Swiss legal system tends to be pretty firm about things and this will likely make it next to impossible for a repeat of their past fiasco to happen.
- throwawayswede 5y ago
  Again, for the millionth time, the issue is not that they had to comply with the law. Stop pretending to misunderstand, all this bullshit is quite obvious. Proton mail lied, and then pretended like they didn’t. They decided it makes sense to sacrifice a customer on the account of their own fuck up and false promise. Proton mail is a shit company, and more and more I’m convinced they’ve bought shills to go out and divert attention. In the world of security, proton mail is a less than a zero. Their main clientele will be in the same scam business they are.