7 ms·
Truth about ProtonMail
- ushakov 5y agoearlier discussion: https://news.ycombinator.com/item?id=28652978 https://news.ycombinator.com/item?id=28652978 i'd like to emphasise, apart from claims made, ProtonMail actually sent abuse letter trying to get the personal details of the author that's not something one would expect a privacy-focused company to be doing more on that story here: https://news.ycombinator.com/item?id=29102776 https://news.ycombinator.com/item?id=29102776
- protomyth 5y agoIf you feel someone is committing slander/libel against you, it is your right to face your accuser and you need their identity to do that.
- grayhatter 5y agoWhat? No! That's a legal requirement for legal accusations. Primarily criminal in the US. It has nothing to do with being allowed to doxx someone saying mean things about you on the internet. Not legally, and not ethically.
- ushakov 5y ago> getting butthurt of a random blogpost on the internet > want to take it down so badly > waste their lawyers time to send letters idk, but i find it funny
- deleted 5y ago[deleted]
- blitzar 5y agoThe author of the article has the following expectations when it comes to reqests for information re: ips scanning port 22 on their machine. > I expect to hear who (and why) generates that kind of traffic from cloudflare owned subnets.
- jjcon 5y agoWhile i think most of this is sensationalist, there are a couple valid crtiques here. More interesting IMO is this cease and desist letter they have sent. That surprises me.
- woodruffw 5y ago> More interesting IMO is this cease and desist letter they have sent. A C&D letter is not itself evidence of anything. Most companies will send you one if you make egregious claims about their business.
- smsm42 5y agoThey didn't send it to the author. They sent it to their domain host to try and shut them down and dox them.
- jjcon 5y ago>A C&D letter is not itself evidence of anything. I didn't mean to suggest it was. It is still surprisingly hostile/corporate behavior from a company that markets itself as an anti-authoritarian actor.
- blitzar 5y agoIf I sent an email to every person you work with claiming that you are a pedofile, based on my extensive research with proof to back it up, would you think it is hostile to ask me to stop?
- TedDoesntTalk 5y agoThey could, you know, just ignore it and get on with life. There’s no reason to defend itself against every claim made on the Internet but any yahoo. Instead, they are choosing to aggressively silence the author. That raises eyebrows.
- woodruffw 5y ago> Instead, they are choosing to aggressively silence the author. That raises eyebrows. Somewhere along the road, we've gone and conflated "someone sends you a scary letter" with "I'm being silenced." The author is clearly anonymous and apparently (correctly) scoffs at the letter, so it feels like a distortion to call this "aggressive silenc[ing]."
- Rd6n6 5y agoI’ve read posts like this about ProtonMail for years and found lengthy, detailed write ups debunking them every time. If ProtonMail is getting short tempered about this, I can understand why. If they sent a cease and desist letter to somebody who is publicly, confidently, and repeatedly making untrue claims, that only makes sense
- vmception 5y agoImagine distorting reality so much to accept this reality
- jcims 5y agoImagine a world without this weird passive-aggressive linguistic device.
- Rd6n6 5y ago> Imagine distorting reality so much to accept this reality What do you mean?
- vmception 5y agoBoth things you observe happen, but that doesn’t absolve proton of its suspiciously misleading advertising They act like a honeypot. They redirect onion users to an exit node undermining the point of having an onion service, they require a phone number for onion users instead of actually offering privacy. They rely in their fans to shield them from criticism while doing these privacy counterintuitive things. The same thing happened at a swiss encryption company for 50 years. Employees kept finding flaws in the encryption and kept getting told to work on anything else and it turned out to be a CIA front intentionally selling backdoored encrypted communication devices worldwide [1]. When proton is doing the same thing and has an even more obvious ownership structure incentivized to keep a charade up, there is no reason to use proton for any of the reasons they advertise. [1] https://www.bbc.com/news/world-europe-51487856 https://www.bbc.com/news/world-europe-51487856 (BBC, find a source you happen to respect that corroborates the same thing)
- doomrobo 5y agoThis might have valid critiques but it's overall unhinged
- ravenstine 5y agoStill would rather trust Proton than Google.
- vmception 5y agoThe problem is that people rely on proton’s claims to discuss things they normally wouldnt discuss The lies are very harmful
- PikachuEXE 5y agoI agree with both. Any "better" alternatives with some comparisons? Thanks :)
- andrecarini 5y ago> Any "better" alternatives with some comparisons? GPG + RFC 1149
- jesterswilde 5y agoRFC 1149 is old, I'd suggest RFC 2549 (an updated version to 1149). The updated quality controls are worthwhile if you're going this route. Though this method is only viable if you're ok with high latency.
- vmception 5y agoAny email service that lets you sign up over tor without javascript, without a phone number and without a credit card. they're around. It doesnt matter then that the stored data is not encrypted. You can upgrade file sharing and communication elsewhere and also signup to services under an unlinked identity. The limits are much more clear.
- woodruffw 5y agoThe idea of end-to-end encrypted email is ridiculous (and ProtonMail's business model is effectively built on a marketing lie/false advertising), but come on: > Protonmail has an Onion domain that allows users to visit their site using the TOR browser. Protonmail even has an SSL cert for that onion address even though it’s completely unnecessary. When a user makes a new account with Protonmail on TOR they are re-directed from Protonmail’s “.onion” to “.com” address. This breaks your secure encrypted connection to their onion address, enabling your identification. There are absolutely no technical reasons for this feature. In fact, the only other websites that operate like this are suspected NSA/CIA Honeypots. Why in the world are you trusting them to host your email if your threat model doesn't include connecting to them over HTTPS? Your endpoint is still a globally identifiable email address that you're going to use their webmail UI to view. What privacy, exactly, is TOR providing in this use pattern?
- woodruffw 5y agoI should have read further, because there's this kicker: > Leaked documents at Wikileaks show that the CIA requires emails to be stored as an EML filetype. There are several ways to store emails, and Protonmail has selected the format that the CIA requires. Everybody uses the EML format! It's a raw dump of the RFC 822 message[1] that the protocol itself uses! [1]: https://www.loc.gov/preservation/digital/formats/fdd/fdd000388.shtml https://www.loc.gov/preservation/digital/formats/fdd/fdd0003...
- nimbius 5y agothe rest of the articles seem to have a rather sophmoric feel to them as well...perhaps someone is just beginning their journey into infosec? The author rails against Cloudflare originated SSH traffic assuming its immediately malicious, and decrying how carriers are ignoring his legitimate calls for their blacklist as well.
- willis936 5y agoIt's truly an absurd statement. There aren't even straws to grasp, it's just air. "Can you believe they're storing text files using ASCII? It's exactly what the CIA wants you to do!"
- andrecarini 5y agoProtonMail shines when you just want a disposable address (that isn't dropped after a few months of inactivity) without having to provide a phone number or other sensitive info for registration. I wouldn't depend on it however for E2EE of communication data. Or any third-party service where I'm not the one managing myself the key pair and locally en/decrypting data. EDIT: as pointed out below, it seems that they do recycle your account under certain conditions (never happened with me) and they do require identification when registering via Tor (never done it through Tor). I don't think there are many scenarios left where choosing ProtonMail is the best option.
- vmception 5y agoWhen connecting to proton over tor they require a phone number and credit card payment
- dane-pgp 5y agoI don't understand why they couldn't accept a crypto-currency payment in lieu of personal details. Even accepting a "proof of burn" transaction (if they are worried about money laundering regulations) would be enough to rate-limit / disincentivise the spammers.
- vbezhenar 5y agoProton mail Twitter: “ We have a 3 months inactivity policy, so if the account is not a paid account, and if another user requests it, and if the account doesn't have any activity, sometimes the username will be released.”
- johndoe42377 5y agoThis is russian propaganda bullshit. The claim that SSL is not necessary is also bullshit, since traffic will be unencrypted after leaving an exit node. Fuck off, Ivan, back to your ghetto.
- niftylettuce 5y agoIf you just need email forwarding... without logs and no storage to disk... here's something I made: https://forwardemail.net https://forwardemail.net
- TedDoesntTalk 5y agoThis might be cool and something I would use, but I’ll never know because apparently I have to watch and listen to a video in order to get details.
- kureikain 5y agoYou can look into mine (https://hanami.run https://hanami.run) very fast to sign up and have a few cool features about webhook or smtp. Also, improvmx.com is a great product as well. If you like open source, https://maddy.email/ https://maddy.email/ is a single binary deployment that can handle everything even IMAP. https://mailcow.github.io/mailcow-dockerized-docs/ https://mailcow.github.io/mailcow-dockerized-docs/ is a dockerize solution with super detail document as well.
- TedDoesntTalk 5y agoThanks! I spent quite some time on your site and am impressed, especially with your transparency as founder. One suggestion: it is clear the content is not written by a native English speaker. At first this created doubts for me, it just feels less professional. Suggest you hire an editor to fix up your content… or contact me and I’ll do it for free.
- wolverine876 5y agoAre you a CIA honeypot?
- Aeolun 5y agoI wonder how many of these points actually are valid, and how many of them are garbage.
- bombcar 5y agoThe CIA uses text files and so do they - this point pretty much makes it clear.
- victorbstan 5y agoEncryption is a double edge sword. It’s obviously also used by criminals and organized crime to hide their actions. And this a bad/negative effect.
- grayhatter 5y agoNo, bad people doing bad things is what's bad. Anyone including them not wanting others to learn about private messages is unrelated to morality. Restricting encryption wont stop bad things from happening, it'll only cause more bad things to happen when something that should be private leaks.
- joshe 5y agoIs there a more coherent version of this? It's hard to separate important from silly in something this rage filled and conspiratorial.
- rovr138 5y ago#2, #7, #8, #10, #11 are the ones that I’m going to search more on. Not that I use them.
- ltbarcly3 5y agoThis is the ravings of a lunatic. >When a user makes a new account with Protonmail on TOR they are re-directed from Protonmail’s “.onion” to “.com” address. This breaks your secure encrypted connection to their onion address, enabling your identification. Nope, whoever wrote this article has absolutely no idea what they are talking about. Onion routing works perfectly well on non onion addresses, and encryption doesn't mean butt for identifying where traffic is coming from.
- rovr138 5y agoOnion routing works, but there’s less security. The end node will have access to what’s being browsed. If it’s an onion site, the last node is the node you’re visiting. No way things can be leaked/intercepted.
- ltbarcly3 5y agoThat is irrelevant to identifying your IP address, which if the CIA is running protonmail (or the exit node, or any router between them) they can do with or without SSL unless you are using TOR, in which case they can't do with or without SSL. You missed the point. 10 seconds of research tells me that going to protonmail.com without ssl immediately just redirects you to https://protonmail.com https://protonmail.com so again the things said in this article are utter bunk, nothing of interest is sent to protonmail without ssl. It's called an 'exit node' not an 'end node'. If the site is using SSL the exit node will not have access to what is browsed, and REGARDLESS of whether you use SSL neither they (nor anyone else) will be able to see your real IP.
- wolverine876 5y agoThis assumes all security is working perfectly, usually a bad assumption in security. TLS (SSL) provides another layer. But I agree that the article is badly misinformed.
- kureikain 5y agoI think we all know encryption in term of emails is hard to read. Take encryption.Example, when an email failed to deliver and sit in retry queue, where is it on? on Redis, on disk? Is it encrypted or now? If it's encrypted how the search works? One thing that I really appreciate is that I can reach ProtonMail support to asked why they flagged my email as spam. I build an email forwarding service https://hanami.run https://hanami.run and when we first rolled out I reached out to them, they explain to me my entire email looks good and problem is probably by the age of domains. A few weeks later our emails are no longer flagged as spam. I couldn't get that kind of support from gmail or outlook. They also maintain https://github.com/openpgpjs/openpgpjs https://github.com/openpgpjs/openpgpjs so I think ProtonMail still deserve some credits
- nikcub 5y ago> Protonmail even has an SSL cert for that onion address even though it’s completely unnecessary. It is absolutely necessary, especially with the new, longer v3 onion domains[0]. Generating a v2 onion address that begins with "protonmail" takes a few hours of GPU. Given a link to one of these v2 addresses no user is ever going to authenticate it by memorizing the address: protonmailrmez3lotccipshtklggee7olb73fu1rgj7r4o4vfu7ozyd.onion The user knows and authenticates an onion because the endpoint is signed using the same certificate and CA as the .com address and the user can verify this in their browser. > When a user makes a new account with Protonmail on TOR they are re-directed from Protonmail’s “.onion” to “.com” address. This breaks your secure encrypted connection to their onion address This step won't deanonymize you or "break your secure encrypted connection". You are routed via a Tor exit node rather than via a guard node to a hidden service. As to why they do it - offering a free service to anonymous users on Tor is a constant battle with spammers and bots. You only have to look at the absurd lengths darkweb markets go to to authenticate "real" users (multiple CAPTCHA gateways with minute+ wait times) as to how difficult this challenge is with completely anonymous traffic that has absolutely nothing to session/fingerprint a user on to prevent abuse. This entire post is speculative troll-bait, which unfortunately Protonmail fell for. Their response to this type of post only reinforces the views of those who are conspiracy-minded and see links where there are none. It is very reminiscent of the FUD campaign Pando Daily ran against the Tor project itself (any second degree link to anybody even remotely US government means the software is obviously backdoored). [0] The article links to the Protonmail v2 onion - a shorter format address and protocol that has been deprecated.
- generalizations 5y ago> This step won't deanonymize you or "break your secure encrypted connection". You are routed via a Tor exit node rather than via a guard node to a hidden service. There is a huge difference in the anonymity afforded by a tor hidden service, vs. using tor to connect to a clearnet website. You should at least acknowledge that.
- tablespoon 5y ago> 6. Protonmail Follows CIA Email format & Metadata Requirements > Leaked documents at Wikileaks show that the CIA requires emails to be stored as an EML filetype. There are several ways to store emails, and Protonmail has selected the format that the CIA requires. Ummm, what now? It seems to be literally crazy to take that as evidence that ProtonMail is a CIA front. What next? The ProtonMail website is written in English and the CIA speaks English too, leading to the obvious conclusion that the CIA runs ProtonMail (also HN and Noam Chomsky). https://www.loc.gov/preservation/digital/formats/fdd/fdd000388.shtml https://www.loc.gov/preservation/digital/formats/fdd/fdd0003...: > EML, short for electronic mail or email, is a file extension for an email message saved to a file in the Internet Message Format protocol for electronic mail messages. It is the standard format used by Microsoft Outlook Express as well as some other email programs. Since EML files are created to comply with industry standard RFC 5322, EML files can be used with most email clients, servers and applications. See IMF for a description of the message syntax.
- smsm42 5y agoThis may be some guy on the internet making some overblown and sensationalist claims (something in the vein of "if you don't implement my favorite feature, you must be CIA agent because they don't implement my favorite feature too!" and "they use standard formats, and you know who else uses standard formats? CIA!!!"). That doesn't worry me much. What really worries me is that Protonmail has asked their upstream domain provider to not only boot them from the Internet, but also reveal their personal information. Of course, they have no legal right to either - at least not until they obtain a court order - but it doesn't hurt to try, right? That doesn't look like a good guy behavior. I understand they may be pissed for being (likely unfairly) criticized, but we have way too many people that thing the only way to deal with criticism is to suppress the critic and try to ruin their life. We don't need more.
- 5ch4tz1 5y agodoes anybody know how could protonmail or anyone else ever be able to tell iCloud aliases?? it is impossible to register a new PM account using an iCloud alias! I’ve always wondered, how? Especially now with the ability to hide your email on ios, what would be the use of that if there is no distinction? ¯\_(ツ)_/¯
- wolverine876 5y ago> Protonmail Follows CIA Email format & Metadata Requirements > Leaked documents at Wikileaks show that the CIA requires emails to be stored as an EML filetype :D I know a lot of organizations that conspire with the CIA - probably including FSB, Iranian intelligence, and possibly my hair stylist .... The CIA also probably uses UTF-8, TCP/IP, various RFCs, Facebook, 120V power, and RJ-45 ports (actually, a large institution with loads of legacy tech might not be using UTF-8 in many circumstances, on the other hand they do handle a lot of international data ...). I can't tell you how I know that, though.