4 ms·

ProtonMail needs to come up with technologies such that it’s not in possession of user’s data in the first place. Instead of, being in possession of user’s dat

by aborsy 5y ago

ProtonMail needs to come up with technologies such that it’s not in possession of user’s data in the first place. Instead of, being in possession of user’s data and sometimes providing data to governments sometimes appealing. As an example, can you implement a VPN service such that you don’t hold IP or DNS records at all (ie, not both simultaneously)?

nabla9 5y ago
>ProtonVPN does not log DNS queries, and by Swiss law cannot be forced to start logging them. We also do not log the IP addresses of our users. https://protonvpn.com/support/dns-leaks-privacy/ https://protonvpn.com/support/dns-leaks-privacy/
beermonster 5y ago
> ProtonMail needs to come up with technologies such that it’s not in possession of user’s data in the first place. I believe it has them already? There's no reason they can't put an inline transparent Tor bridge in front of their mail infra to anonymise all inbound traffic i.e. TCP/IP->Tor Node->Tor Node->ProtonMail so it could only ever capture IPs coming from it's own Tor-node if compelled to do so. However it would still have an ability to log on the TCP/IP transparent endpoint. This risk could be mitigated by using their onion address [2] and using someone else's tor nodes. The data-at-rest already is zero-access[1]. There is encryption of data-in-transit but no zero-knowledge network layer.. maybe they could work on this since they have support for tor [2]? [1] https://protonmail.com/blog/zero-access-encryption/ https://protonmail.com/blog/zero-access-encryption/ [2] https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/ https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7... [3] https://protonmail.com/tor https://protonmail.com/tor
- aborsy 5y ago
  This is exactly what I alluded to. See Apple’s private relay feature. But PM needs to lead the tech world in privacy technologies instead of spending efforts in justifying why it should be trusted. Another thing, data at rest is not quite end to end encrypted. If an email comes from a non-PM account to PM account, it’s received in plaintext and then encrypted. Thus PM has that data.
  - beermonster 5y ago
    My point was I think they have already the ability to do this (cited sources) but they don't. Apple's private relay feature is good but they also suffer from recent trust issues. Regarding the last point, yes if you send PM-Non-PM there will be plaintext email sitting in the Non-PM's inbox/sent items. But you do have the ability to send non-PM recipients password protected email where they have to read the email over at PM in their browser. Only a link to it sent by email and they need to know the password to access it. Obviously it depends on your threat model, but if you're doing anything that sensitive you should probably not be using email as there's no way of truly making it secure to use. Some people will be using protonmail just because they don't want their provider scanning their emails or targeting them with ads. PM do offer a free tier so they're not a bad choice for that use case.
    - aborsy 5y ago
      Just to be clear, if you send an email from a non-PM to PM account, the email is plaintext in BOTH accounts! That’s because, PM servers receive plaintext data. Then, they encrypt it. But there is no proof that plaintext is not logged. It’s same as in VPN: trust us, we don’t log your data. No, invest in zero knowledge technologies please. I can point out to many other possibilities for improvements in their email and VPN service. But they should lead us not other way around.
      - beermonster 5y ago
        > That’s because, PM servers receive plaintext data. Then, they encrypt it. But there is no proof that plaintext is not logged. Ah yes this is a good point. The only way to be sure is to client side end-to-end encrypt your data before you send it to any upstream mail service. E.g. using S/MIME or PGP. At this point you can then use any free mail service as you now “only” need to worry about leaked mail header meta-data.
        b112 5y ago
        We must be fair. Citing that plain text is readable before proton mail encryption is.... unfair. A bad actor could place a proxy upstream, the problem has nothing to do with protonmail. What protonmail tries to solve is your mail being encrypted at rest. It succeeds there. Statements about "but they can read it" or "they can capture everything before..." is a separate issue, one of trust and different methods of state interference.
- YetAnotherNick 5y ago
  That will just hide the IP, but not user's authentication and data. There are more simpler ways to proxy if you assume that the proxy front end is secure.
PeterisP 5y ago
The law can mandate that ProtonMail is forbidden to use such technologies - if the court ruling would have went in the other direction and asserted that the data retention requirements apply, then it would be illegal for Protonmail to offer their service without explicitly collecting and holding the records, even if they technically could do without them.
White_Wolf 5y ago
You can't(as a single company/entity) find a work around something like this. Proton had a court order from the country they operate from. You can fight court orders but you can't usually disclose them(gag orders and all). The only reasonable way(i can think of) to make it a bit harder for this to happen would be to have a second(and maybe a 3rd)unrelated entity/company in an adversarial country that you can use as a relay. In this case use it as a VPN service to access the e-mail on Proton servers. Anonimity is inconvenient these days... and next to impossible if any govt agency is out to get you. The only way you can make it hard(er) is to spread over multiple jurisdiction and rotate accounts/discard them after a few uses. A system similar to one time pads of sorts combined with PGP.
- nix23 5y ago
  > can't usually disclose them(gag orders and all). Switzerland has no "gag orders", that's a exclusive US-open-democracy-thing ;-)
  - White_Wolf 5y ago
    :) I didn't know that. I though most/all countries in the west have an equivalent. In UK we have something like that(can't remember the name of it though). The courts can forbid all parties involved to have any public discussions, They can ban topics from reaching the public through normal mass media means. To make it even worse, they can prevent individuals to do this sort of thing too. Prison time and/or fines if you don't comply. Democracy at it's finest.
    - nix23 5y ago
      >I though most/all countries in the west have an equivalent. Well there is no direct gag-thing (because it would undermine free speech) BUT it could be interpreted ~sometimes and in "theory" as "obstruction of a police investigation", so it's a case to case thing and not direct law.
      - White_Wolf 5y ago

by aborsy 5y ago

nabla9 5y ago

>ProtonVPN does not log DNS queries, and by Swiss law cannot be forced to start logging them. We also do not log the IP addresses of our users. https://protonvpn.com/support/dns-leaks-privacy/ https://protonvpn.com/support/dns-leaks-privacy/

beermonster 5y ago

> ProtonMail needs to come up with technologies such that it’s not in possession of user’s data in the first place. I believe it has them already? There's no reason they can't put an inline transparent Tor bridge in front of their mail infra to anonymise all inbound traffic i.e. TCP/IP->Tor Node->Tor Node->ProtonMail so it could only ever capture IPs coming from it's own Tor-node if compelled to do so. However it would still have an ability to log on the TCP/IP transparent endpoint. This risk could be mitigated by using their onion address [2] and using someone else's tor nodes. The data-at-rest already is zero-access[1]. There is encryption of data-in-transit but no zero-knowledge network layer.. maybe they could work on this since they have support for tor [2]? [1] https://protonmail.com/blog/zero-access-encryption/ https://protonmail.com/blog/zero-access-encryption/ [2] https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion/ https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7... [3] https://protonmail.com/tor https://protonmail.com/tor

aborsy 5y ago
This is exactly what I alluded to. See Apple’s private relay feature. But PM needs to lead the tech world in privacy technologies instead of spending efforts in justifying why it should be trusted. Another thing, data at rest is not quite end to end encrypted. If an email comes from a non-PM account to PM account, it’s received in plaintext and then encrypted. Thus PM has that data.
- beermonster 5y ago
  My point was I think they have already the ability to do this (cited sources) but they don't. Apple's private relay feature is good but they also suffer from recent trust issues. Regarding the last point, yes if you send PM-Non-PM there will be plaintext email sitting in the Non-PM's inbox/sent items. But you do have the ability to send non-PM recipients password protected email where they have to read the email over at PM in their browser. Only a link to it sent by email and they need to know the password to access it. Obviously it depends on your threat model, but if you're doing anything that sensitive you should probably not be using email as there's no way of truly making it secure to use. Some people will be using protonmail just because they don't want their provider scanning their emails or targeting them with ads. PM do offer a free tier so they're not a bad choice for that use case.
  - aborsy 5y ago
    Just to be clear, if you send an email from a non-PM to PM account, the email is plaintext in BOTH accounts! That’s because, PM servers receive plaintext data. Then, they encrypt it. But there is no proof that plaintext is not logged. It’s same as in VPN: trust us, we don’t log your data. No, invest in zero knowledge technologies please. I can point out to many other possibilities for improvements in their email and VPN service. But they should lead us not other way around.
    - beermonster 5y ago
      > That’s because, PM servers receive plaintext data. Then, they encrypt it. But there is no proof that plaintext is not logged. Ah yes this is a good point. The only way to be sure is to client side end-to-end encrypt your data before you send it to any upstream mail service. E.g. using S/MIME or PGP. At this point you can then use any free mail service as you now “only” need to worry about leaked mail header meta-data.
      - b112 5y ago
        We must be fair. Citing that plain text is readable before proton mail encryption is.... unfair. A bad actor could place a proxy upstream, the problem has nothing to do with protonmail. What protonmail tries to solve is your mail being encrypted at rest. It succeeds there. Statements about "but they can read it" or "they can capture everything before..." is a separate issue, one of trust and different methods of state interference.
YetAnotherNick 5y ago
That will just hide the IP, but not user's authentication and data. There are more simpler ways to proxy if you assume that the proxy front end is secure.

PeterisP 5y ago

The law can mandate that ProtonMail is forbidden to use such technologies - if the court ruling would have went in the other direction and asserted that the data retention requirements apply, then it would be illegal for Protonmail to offer their service without explicitly collecting and holding the records, even if they technically could do without them.

White_Wolf 5y ago

You can't(as a single company/entity) find a work around something like this. Proton had a court order from the country they operate from. You can fight court orders but you can't usually disclose them(gag orders and all). The only reasonable way(i can think of) to make it a bit harder for this to happen would be to have a second(and maybe a 3rd)unrelated entity/company in an adversarial country that you can use as a relay. In this case use it as a VPN service to access the e-mail on Proton servers. Anonimity is inconvenient these days... and next to impossible if any govt agency is out to get you. The only way you can make it hard(er) is to spread over multiple jurisdiction and rotate accounts/discard them after a few uses. A system similar to one time pads of sorts combined with PGP.

nix23 5y ago
> can't usually disclose them(gag orders and all). Switzerland has no "gag orders", that's a exclusive US-open-democracy-thing ;-)
- White_Wolf 5y ago
  :) I didn't know that. I though most/all countries in the west have an equivalent. In UK we have something like that(can't remember the name of it though). The courts can forbid all parties involved to have any public discussions, They can ban topics from reaching the public through normal mass media means. To make it even worse, they can prevent individuals to do this sort of thing too. Prison time and/or fines if you don't comply. Democracy at it's finest.
  - nix23 5y ago
    >I though most/all countries in the west have an equivalent. Well there is no direct gag-thing (because it would undermine free speech) BUT it could be interpreted ~sometimes and in "theory" as "obstruction of a police investigation", so it's a case to case thing and not direct law.
    - White_Wolf 5y ago