4 ms·

If your threat actor is the CIA, or any three-letter agency for that matter, you ought to be bright enough not to trust a company. Companies are inherently focu

If your threat actor is the CIA, or any three-letter agency for that matter, you ought to be bright enough not to trust a company. Companies are inherently focused on profit and growth, nothing bad about that, that's what companies do. However, companies also still operate within political and legal environments which means they have to adhere to the laws of the jursidiction they reside in. A company won't risk going bankrupt or being shut down to save a customer's privacy and anonymity, which it would if it just denied the government its legal processes. If your threat actor is a nation-state intelligence community you might want to consider using higher level security systems like PGP. For ever other threat actor, this ruling is a great win for privacy. As long as your threat actor is your ISP, (anti-) social media as I've begun to call it, or your employer, ProtonMail (or Proton services) are really at the forefront of digital privacy. Again, if you're up against the government, use PGP to communicate securely.

throwawayswede 5y ago
While what you say is correct, it’s not the main point here. I’m sick of seeing blind Proton defenders on HN, has the company bought some shills to defend them by diluting and misdirecting the community’s attention? I wonder! The issue is that Proton lied. Plain and simple. Their marketing and promos were targeting everyone, specifically non tech savvy people, aka those who don’t know or can’t use pgp. It’s not the end of the world, and mistakes happen, but Proton purposefully mislead their customers, and they should own up to it to even recover a tiny bit of their reputation. Otherwise the company is dead in my book and I would never ever recommend them.
- kataklasm 5y ago
  Fair point. I am not a shill... They advertised themselves with a 'no-log policy'. This policy however used the phrase "by default, [...]" and and said that they don't store IP data. This is true, that statement was never breached as far as we know. The court requested Proton to start logging data for this single account in question for the investigation, because the account owners had broken swiss national law. "[Proton] could not appeal because a Swiss law had actually been broken and because "legal tools for serious crimes" were used. ProtonMail does not believe the tools were appropriate for the case at hand, but the company was legally responsible to comply with their use nonetheless." [0] What would you want Proton to do in this case? Close down shop and not give out PII or rather comply and keep operating? You can't just discard an entire operation of this size bcause one of one account. We are on the same side here, we both want Proton to do better and to have an email service that is actually secure. As long as any company or organization operating an email service is inside any jurisdiction it will face these issues. But the jurisdiction is also the enabler to these companies or organizations like this. I don't think we are ever going to get the perfectly secure mail service that protects our privacy, resists governments and threat actors to an absolute degree, and operates servers and services at the same time like Proton does. If anything, FOSS self-hosted options are probably the closest to the above we are going to get. edit: If Proton designed their services to not collect data from the start, like a lot of commenters here are proposing, that could be a real opportunity. This strategy however only works in very stable democratic systems, as unstable ones are always at the mercy of their governments and as such are vulnerable to privacy intrusions. [0] https://arstechnica.com/information-technology/2021/09/privacy-focused-protonmail-provided-a-users-ip-address-to-authorities/ https://arstechnica.com/information-technology/2021/09/priva...
rubin55 5y ago
Whilst you're completely right (don't trust companies, pgp if you need to), I feel obliged to point out Lavabit [1] and Silent Circle [2]. Of course, you should still not trust companies, but exceptions to the rule have existed. [1]: https://en.wikipedia.org/wiki/Lavabit https://en.wikipedia.org/wiki/Lavabit [2]: https://en.wikipedia.org/wiki/Silent_Circle_(software) https://en.wikipedia.org/wiki/Silent_Circle_(software)

throwawayswede 5y ago

While what you say is correct, it’s not the main point here. I’m sick of seeing blind Proton defenders on HN, has the company bought some shills to defend them by diluting and misdirecting the community’s attention? I wonder! The issue is that Proton lied. Plain and simple. Their marketing and promos were targeting everyone, specifically non tech savvy people, aka those who don’t know or can’t use pgp. It’s not the end of the world, and mistakes happen, but Proton purposefully mislead their customers, and they should own up to it to even recover a tiny bit of their reputation. Otherwise the company is dead in my book and I would never ever recommend them.

kataklasm 5y ago
Fair point. I am not a shill... They advertised themselves with a 'no-log policy'. This policy however used the phrase "by default, [...]" and and said that they don't store IP data. This is true, that statement was never breached as far as we know. The court requested Proton to start logging data for this single account in question for the investigation, because the account owners had broken swiss national law. "[Proton] could not appeal because a Swiss law had actually been broken and because "legal tools for serious crimes" were used. ProtonMail does not believe the tools were appropriate for the case at hand, but the company was legally responsible to comply with their use nonetheless." [0] What would you want Proton to do in this case? Close down shop and not give out PII or rather comply and keep operating? You can't just discard an entire operation of this size bcause one of one account. We are on the same side here, we both want Proton to do better and to have an email service that is actually secure. As long as any company or organization operating an email service is inside any jurisdiction it will face these issues. But the jurisdiction is also the enabler to these companies or organizations like this. I don't think we are ever going to get the perfectly secure mail service that protects our privacy, resists governments and threat actors to an absolute degree, and operates servers and services at the same time like Proton does. If anything, FOSS self-hosted options are probably the closest to the above we are going to get. edit: If Proton designed their services to not collect data from the start, like a lot of commenters here are proposing, that could be a real opportunity. This strategy however only works in very stable democratic systems, as unstable ones are always at the mercy of their governments and as such are vulnerable to privacy intrusions. [0] https://arstechnica.com/information-technology/2021/09/privacy-focused-protonmail-provided-a-users-ip-address-to-authorities/ https://arstechnica.com/information-technology/2021/09/priva...

rubin55 5y ago

Whilst you're completely right (don't trust companies, pgp if you need to), I feel obliged to point out Lavabit [1] and Silent Circle [2]. Of course, you should still not trust companies, but exceptions to the rule have existed. [1]: https://en.wikipedia.org/wiki/Lavabit https://en.wikipedia.org/wiki/Lavabit [2]: https://en.wikipedia.org/wiki/Silent_Circle_(software) https://en.wikipedia.org/wiki/Silent_Circle_(software)