11 ms·
Proton is trying to become Google without your data
- fsflover 4y agoSee also: https://news.ycombinator.com/item?id=31522082 https://news.ycombinator.com/item?id=31522082.
- hammock 4y ago
- junon 4y agoHahahahahahaha. This can't be serious.
- PeterWhittaker 4y agoSource? Citation?
- loufe 4y agoObviously it's not been exposed, yet. That said, I think it's pretty safe to assume in the post-lavabit world that these companies are fronts for Western intelligence. We clearly don't live in a world that respects privacy anymore, take the recent "anti-csm" bullshit the EU is pushing. Personally, I won't need proof to seriously doubt this, tutanota, etc. Yes, your data may be more hidden, but it would be used as evidence in a parallel-construction case based on what they "illegally" siphon from your data.
- kobieyc 4y agoI think this is a safe assumption. Guilty until proven innocent, by making your code open source.
- ziddoap 4y ago>Obviously it's not been exposed, yet. Then it should not be stated as fact.
- kromem 4y agoDo you think the same thing about Signal?
- kobieyc 4y agoYes, especially since Moxi cashed out and bought a big mansion after they released their spy-coin cryptocurrency.
- qualudeheart 4y agoWhat do you mean by spy-coin?
- glerk 4y agoNo idea if it's a "front", but if your threat model is state level actors Protonmail is not gonna cut it.
- edgyquant 4y agoIf your threat model is state level actors the only thing that will cut it is another state level actor
- stingraycharles 4y agoWhat do you mean with that? From what I understand, there are legitimate issues around Protonmail and its affiliation with government agencies [1]. It’s not as if it’s impossible to find a different provider that does better in this regard. [1] This provides a decent summary: https://encryp.ch/blog/disturbing-facts-about-protonmail/ https://encryp.ch/blog/disturbing-facts-about-protonmail/
- edgyquant 4y agoI’m responding to a person saying protonmail wouldn’t cut it against a state level actor. The point is even if there were zero issues with agency affiliation state level actors v an individual is always a losing battle for the individual.
- notriddle 4y agoWhat can be asserted without proof can be denied without proof.
- newfonewhodis 4y ago> The safety of Protonmail has been discussed many times on HN. Lol what are you talking about specifically?
- uoaei 4y agoProbably the whole "oops we actually DO share IP addresses despite our ToS" followed by a rushed revision of the ToS to include that fact, among other recent news stories.
- ziddoap 4y agoThis is such a disingenuous retelling of what happened. Terms of Service don't trump lawful orders issued by a government. Never have, never will, for any service or company. They were issued a lawful order, did you expect them to just close the company instead? Whether or not you use Proton before or afterwards is of no matter, but please at least try to be honest with what happened.
- uoaei 4y ago> Terms of Service don't trump lawful orders issued by a government. No, obviously they do not. But misrepresenting your policies (i.e., lying) to your users ("we don't track IP addresses" was understood literally at the time) is a serious error and, especially if you're marketing to a privacy-aware crowd, one of your top priorities should be to maintain their trust or else your customer base is going to fall out from under you. What's disingenuous is implying that lawful orders trump the ethics of lying to your customer base, when saying "we don't track IPs..." but meaning "...until the government asks us to".
- ziddoap 4y agoTo be clear, the part of the original post that I took issue with is this: >Probably the whole "oops we actually DO share IP addresses despite our ToS" Which conveniently left out the fact that they shared it when required to by lawful order. The way this is phrased (more, the intentional omission of that detail) implies that Proton is continuously sharing IP addresses with whomever asks for it. If you don't think that is a disingenuous way to relay the incident, I don't know what to say, we're probably at an impasse. They way you've relayed it is a more honest characterization of the incident, and one I don't take much issue with. I would note that a small amount of networking knowledge would make the "until the government asks us to" part implied. A quick look at the user settings (specifically, the "Advanced logs" toggle) would also make it abundantly clear that Proton has the ability to track IP addresses upon request. Does that mean Proton is entirely off the hook? Of course not. But people should make decisions and come to their own conclusions based on all of the facts, not statements that omit material details.
- Klonoar 4y agoEeeehhhhh, I interviewed and was offered a role there a few years ago. Talked with a number of teams and employees, they were very candid about what they were working on during every step of the interview. I never saw anything to indicate either of these claims. The safety of encryption/decryption in browser-JS payloads is a different discussion entirely, but you can't make wild claims about it being a front for state-level actors without some reasonable sourcing.
- coffeeblack 4y agoThen the only explanation is that you are in on it11 *adjusts tinfoil hat*
- imwillofficial 4y ago
- lawrenceyan 4y agoEverything is a front for state-level actors. I think we can still appreciate technology for what it is.
- coffeeblack 4y agoAnd every time it was discussed, the conclusion was the exact opposite of what you are claiming.
- deleted 4y ago[deleted]
- k__ 4y agoThey should take some hints from the Gmail UI. The last Protonmail UI update was just new styles, but still as clunky as before.
- coffeeblack 4y agoThe one they rolled out yesterday was pretty good. Including phone apps. Now just waiting for the the iOS calendar to finally be released.
- k__ 4y agoIt looked nice, but it was essentially the same UI. But I didn't try the new phone apps, they were really bad in the past.
- _xoo 4y agoI'm on android.. phone app is great
- coffeeblack 4y agoBoth, phone and web feel much snappier.
- ptero 4y agoProton is not perfect, but nothing is. We need more competition on the internet, and if Proton has a chance to provide an email and storage for an upfront price without trying to distract me with ads or pimp my data to advertisers, I want to support them. As a data point, I have been a very happy user of their plus service for the last 3 years.
- almet 4y agoThe only thing that bugs me with Proton is that it's still very complicated to integrate with thunderbird (or any mail app?), which makes it practically unusable for my needs. Having a tab always open in my browser for my mail seems so wrong.
- adamhearn 4y agoGenuine question, how is a browser tab different than thunderbird? Besides storing a local copy of mail (which is obviously a huge win), I don't see a big difference. If anything I like the web UI better. However, for my uses I simply installed proton bridge + apple mail. It just works with all email services I use.
- mr_toad 4y ago> Genuine question, how is a browser tab different than thunderbird? Different protocols for one thing - HTTP vs IMAP and/or POP/SMTP. Each webmail app does things it’s own way. Webmail conflates the app and the protocol and the provider. Some people prefer to have mail from different providers in a unified app.
- blangk 4y agoI find it works very well using the bridge on my Manjaro desktop, and was fine on Debian before that.
- ptero 4y agoI have the same experience, for me it works flawlessly with the bridge, but the bridge itself is a complication. I would prefer a straight imap option (in addition to the bridge option). My 2c.
- imwillofficial 4y agoBut they'll give your data away if asked.
- cowtools 4y agoI mean, they are legally obligated to. At least they are not selling my data to advertisers or arbitrarily locking me out of my account like google. Hell, i'd pay for their premium service if wasn't so expensive and they accepted anonymous payments through monero or something. I mean, this is what email has basically come to. I've tried to host my own email server, all my outbound mail ends up in spam. If you want privacy, use PGP Edit: please don't downvote this parent comment, I think it is still a pretty reasonable concern
- yupper32 4y ago> At least they are not selling my data to advertisers That's almost never what actually happens, though. They sell access to you and use your data internally to target ads. A law enforcement request does literally release your data.
- cowtools 4y agoIt doesn't matter to me whether or not they only use the advertising data internally. Google is such a large monopoly at this point that I am basically forced to deal with them on a daily basis through the businesses and institutions I work with. It's not even the surveillance that I am concerned with at this point. I just am trying to disentangle all these services that I use that demand to become linked in difficult ways. Like let's say you have a gmail account linked to a youtube account, and you upload a video or like something that sets off google's automated spam heuristic. Boom, your google account is deleted and you can no longer access your email or sign into your accounts that require email verification. All this extra surveillance is just going to increase the odds of my account getting falsely flagged as a bot or something. Let's say you lose your phone. You have to use your phone to login to some institution's service, so you get a new phone and try to reset the 2FA with your email. However you need access to your phone as a 2FA to access your email. (this exact scenario happened to a family member the other day, just goes to show you should NEVER link your accounts with a cell number).
- deleted 4y ago[deleted]
- photochemsyn 4y agoThis is a rather interesting interview style, it seems as if the interviewer is presenting the viewpoints of the national security state complex ("we need total access to all data to prevent terrorism and child abuse") and of the major tech conglomerates ("competition reduces privacy"), aka Big MAMAA (FAANG is obsolete), but it does provide the interviewee with opportunity to counter those points, so I guess it's a decent interview approach. I'd add that the solution to child abuse and terrorism is the same it has ever been, i.e. targeted investigations relying on tactics like infiltration of criminal rings with undercover officers. There's no justification for Gestapo/NKVD authoritarianism and mass surveillance tactics. However, there doesn't seem to be any plausible way to communicate with others using any infrastructure-type system (from postal mail to fiber optic cable) that doesn't reveal the network of communication (i.e. metadata), and Tor is hardly an exception. Tor seems to have been designed to allow remote government agents (aka spies) operating in hostile environments a means to communicate with a known base of operations without revealing their actual remote locations or identity. Similarly it could be used by individuals to communicate with journalists (as Edward Snowden did) without revealing their identity or location, but only if they take a lot of precautions (i.e. not using their device for any other online activity that could be traced to them). I imagine NSA has backdoors into almost all Tor nodes anyway. The content can be securely encrypted, but location/identity? Probably not.
- uoaei 4y agoWhat was that in the news a year or so back about the FBI having a significant number of Tor endpoints, making the routing effectively transparent? I would imagine if the FBI pulled that off, so did many other state actors.
- unboxingelf 4y agoBig MAMAA Microsoft, Alphabet, Meta, Apple, ?
- deleted 4y ago[deleted]
- shemtay 4y ago
- floren 4y ago> The analogy to terrorism is interesting because, during the Bush-era War on Terror, there was a sense of literally anything being justified in the name of stopping terrorism. The US government was secretly spying on its own citizens. Yeah, Wired, they only did the spying during the Bush era... edit: I guess it was less secret after the Bush era > It's even harder to say, look, we've got to accept that some amount of child exploitation is going to happen and people are going to use digital tools to spread it. But at some point, I think you do have to defend the principle that we have to tolerate a certain amount of even the very worst things if we want to have meaningful civil liberties. Not a very popular argument at this particular instant in time / news, bold of them to write this without a giant asterisk.
- _jal 4y ago> we've got to accept that some amount of child exploitation is going to happen Funny, that's the exact deal with have with guns - we accept some amount of mass child murder as the cost of the 2nd Amendment. Another datapoint that the 2nd is now considered more absolute the 1st.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- bsder 4y ago> It's even harder to say, look, we've got to accept that some amount of child exploitation is going to happen Except that every big kiddie porn case was cracked by old-fashioned policework--"Get someone inside". And, most of the time, it isn't even that difficult to pull off. It particularly grinds my gears because the powers that be only trot out kiddie porn when they want to shove legislation down our throats. The rest of the time enforcement against kiddie porn stays heavily underfunded.
- r3trohack3r 4y ago> Yeah, Wired, they only did the spying during the Bush era... edit: I guess it was less secret after the Bush era I don’t understand - it never ended. In fact, Obama ran on a platform of protecting whistleblowers and cracking down on government overreach. But, once he took office, he legalized the Presidential Surveillance Program that Snowden whistleblew and doubled down on pursuing Snowden.
- drcongo 4y agoEmail and calendar aren't the things that keep people on Google, it's Docs etc. You can get good email and calendar anywhere. If their plan is really to take on Google, that's the bits they need to target.
- brewdad 4y agoMeh. Different users have different needs. GDocs could go away tomorrow and I would hardly miss it. I don't think I've created anything new on the service in over a year. I use email and calendar every day and need them available and accessible.
- greazy 4y agoI don't agree. The reason why people use Google products is varies. Some rely on docs heavily, others need (like myself) just email + cal + drive
- Havoc 4y agoDefinitely plan to stick to proton for the long run. Don't think they'll keep me private & safe...but I do think they'll try harder & more earnestly than the rest of the gang attempting it.
- 0daystock 4y ago> I do think they'll try harder & more earnestly than the rest of the gang attempting it. Why, though? What do people base this assertion on, other than clever marketing materials which extol virtually meaningless controls like "it's hosted abroad" (which is actually much worse for foreign nationals' privacy, for example)?
- Havoc 4y ago>Why, though? Not US based for starters - definitely willing to pay a premium for that. Nor five eyes or any of the other [0] eyes. > extol virtually meaningless controls like "it's hosted abroad" There is no value in abroad in itself, what matters is how trigger happy countries are with warrants etc. I'd like to be in a jurisdiction where it is possible for law enforcement to get to the data...but I'd like the logistically/legal hurdles to be rather high so that it is only done for serious concerns not trawler net catch all surveilance operations. Switzerland seems to tick those boxes [0] https://protonvpn.com/blog/5-eyes-global-surveillance/ https://protonvpn.com/blog/5-eyes-global-surveillance/
- 0daystock 4y agoA US Citizen has more legal and practical safeguards with their data hosted in the US than abroad, but unfortunately the widespread privacy anti-marketing has obscured this critical concept entirely in exchange for "Swiss are probably good at privacy stuff".
- Havoc 4y ago>A US Citizen has more legal and practical safeguards Indeed. I'm part of the 96% of the world that is not though and I'm very wary of US tendencies to trawler net data collection. >"Swiss are probably good at privacy stuff". I think you missed my point if that is what you got from my post. I don't attribute any special merit to Switzerland in the Swiss banking sense...they just aren't in any of the major data sharing agreement from what I can tell. My data needs to be somewhere...so I'm just picking this on a lesser evil basis not perfect basis.
- vzaliva 4y agoI have been a ProtonMail user for a long time but have yet to make it my default email provider. The main problem is that I keep an email archive of all my emails: all sent and most received since 1995. It is 17Gb. I've imported it into Gmail, and it is instantly searchable. With ProtonMail, such a search must happen on the client-side due to encryption. I suspect it will not work very well.
- metadat 4y agoThe searching encrypted content problem goes away once you build an MS Outlook-ish standalone desktop (or otherwise offline-first, in the case of mobile) email client app which builds local-only indexes. The real cost (or long-term benefit) is you'll need a bit more local storage to have your cake and eat it privately.
- Nathanael_M 4y ago“have your cake and eat it privately” has now permanently entered my lexicon, thank you.
- glitchc 4y agoThe most private option is to delete (most of) that email. Then no one has it and your secrets are safe forever.
- _xoo 4y ago
- hammock 4y agoProton is mired in shenanigans. Evidence points to ProtonVPN being a white-labeled version of Nord VPN. Source: https://news.ycombinator.com/item?id=23571653 https://news.ycombinator.com/item?id=23571653 and https://archive.is/iZ2l2 https://archive.is/iZ2l2 (archive of relevant but broken [2] link @ HN thread) Protonmail has its own issues that have been discussed on HN. Source: https://encryp.ch/blog/disturbing-facts-about-protonmail/ https://encryp.ch/blog/disturbing-facts-about-protonmail/ Obviously Gmail and such are piped directly into global intelligence databases, but Proton is not a panacea, and no guarantee they aren't compromised themselves.
- deleted 4y ago[deleted]
- dimensionc132 4y agoProton .... the Fed honeypot that nobody wants to talk about, except, some sane and rational people who have looked at the evidence.
- DashAnimal 4y ago"Obviously Gmail and such are piped directly into global intelligence databases" Wait --- 'obviously'?!? Do you have any info on this because that is a wild claim.
- hosteur 4y agoSnowden docs
- charles_kaw 4y ago>Do you have any info on this because that is a wild claim. Not only has the concept and implementation of automated law enforcement portals been around since the 90s, the Snowden docs revealed that major providers were providing such portals. AND that their inter-datacenter communications were being piped directly into global intelligence databases without. These portals, NSLs, and other mechanisms have also been codified into law for over a decade, and their existence is extremely well documented as well as reinforced. It sounds like a wild claim, but unfortunately, it is extremely based in reality. And, it's so well documented that to be ignorant of it at this point is akin to incompetence.
- pete_nic 4y ago> We believe the best way to protect user data is to not have it in the first place I like the exchange of value that comes from paying money for a service. With free products from companies like Google you do not pay for the service and there is no exchange of value. This results in the myriad of HN threads discussing how Google Docs did them wrong (locked out, privacy violation, etc.)
- 0daystock 4y agoAsserting "private email" is a modern litmus test for someone's technical understanding and capabilities, or lack thereof. Snake oil companies will always hide behind "it's encrypted" and "it's hosted in Switzerland" tropes that mean nothing to anyone who has done a modicum of research. Real privacy is not the result of some product, especially not when its so desperately and obviously shilled.
- tediousdemise 4y agoCouldn't have said it better myself! Privacy is first and foremost a discipline and a practice, just like security. It's a form of self-respect, in my eyes. Some would say it's even a natural human right. Commoditizing it is a recipe for disaster. Edit: Expansion of the self-respect tidbit. Lack of privacy enables others to have control over you. Feeling like you are not in control, or actually being controlled by someone (shame, blackmail, etc.) can be very damaging to your mental health. Respect yourself, strive for privacy. You deserve it as much as anyone else.
- randomhodler84 4y agoI don’t know. I don’t think all “commoditization” of privacy is a bad thing. WhatsApp commoditized it, Signal; SSL/TLS; Tor; Privacy Coins; these all vastly improved the privacy of comms on the planet. One needs to determine outcomes rather than declaring it app disasters. maybe democratizing privacy is a better way to phrase than commoditization — which implies some cost savings rather than the just consumer availability.
- tediousdemise 4y agoThanks for chiming in. I've been having some difficulty expressing my thoughts lately so sometimes I don't make the most sense. Yes, I definitely agree with you--democratization is a much better way to put it.
- randomhodler84 4y ago
- charcircuit 4y agoThe privacy of GMail is good enough, if not better than ProtonMail. Client side encryption also comes with downsides since they can't allow third party email clients to work and you have to do all processing client side.
- ziddoap 4y ago>The privacy of GMail is good enough, if not better than ProtonMail. How do you figure? Google actively scans both email and drive for CSAM. If they can scan it for CSAM, they can scan it for whatever the hell they want.
- jacooper 4y agoAnd they already do, google and Microsoft both scan emails for ADs and tracking.
- charcircuit 4y ago>We do not scan or read your Gmail messages to show you ads https://support.google.com/mail/answer/10434152 https://support.google.com/mail/answer/10434152
- charcircuit 4y agoJust because they can violate your privacy that doesn't mean that they do. By that logic you can say ProtonMail processes your unencrypted email to encrypt it. If they can process your unencrypted email they can process it in any way they want.
- ziddoap 4y agoPoster said Google provided better privacy. Your hypothetical puts them at equal footing, so I'm still not seeing how Google provides better privacy.
- thomond 4y agoThere are too many technology products called Proton.
- minsc_and_boo 4y agoThere's already a ton named Electron too - what about Neutron?
- verisimi 4y agoyeah! And what's wrong with plain old Ron too?!
- Ansil849 4y agoIt's kind of disingenuous to keep touting "Swiss privacy laws" as some sort of selling point on their homepage, when shit like this happens https://techcrunch.com/2021/09/06/protonmail-logged-ip-address-of-french-activist-after-order-by-swiss-authorities/ https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre... Why's a privacy-first service logging IPs in the first place?
- emendation 4y agoAs the article states, they were forced to by Swiss authorities. They tried to fight against it, but in the end no reputable provider is going to put the whole company on the line for 1 user against a lawful order from their government.
- Ansil849 4y agoUh-huh. Then perhaps they shouldn't be touting Swiss privacy laws like they're some holy golden shield. And once again: > Why's a privacy-first service logging IPs in the first place?
- emendation 4y agoDid you read the article you yourself linked? > French police sent a request to Swiss police via Europol to force the company to obtain the IP address of one of its users They weren't logging until they were forced to.
- CyanBird 4y agoAnd since then they have been logging thousands upon thousands of other addresses A while back on the very hackernews thread when the news of the French activist being jailed it was highly discussed, the source of the data being ProtonMail themselves
- rusk 4y agoYou always have the option of connecting to PM over tor [0] if you are concerned about this. You can also use any of the VPN services that are available. Get yourself an anonymous mulvad account, and pay with some laundered btc good luck to anyone that wants to track down your IP. [0] https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7...
- tlogan 4y agoThe problem with Proton email is that is full of fraudulent accounts this they domain and emails send via proton are blocked by many companies, ISPs and firewalls. I tried it and it was unable to send email to my wife’s work. In short alot of dickheads use it for spam/scam and ruin it for the rest of us. I do not know how they can overcome that…
- rusk 4y agoI have never once in nearly 10 years had any problem with my emails getting through to anyone from PM
- tristan957 4y agoI use a custom domain and have never once had a problem with delivery.
- dgellow 4y agoYou should see the @protonmail.com adresses as a demo, people use them for spam so the domain has a bad reputation. If you decide to pay for the service then it’s better to use your own domain, you should have no problem with delivery.
- Night_Thastus 4y agoLenovo fully rejects any Protonmail addresses. They won't tell you so, but they won't let you order or make an account with them under one.
- ralston3 4y agoLongtime Proton fan and happy customer. Would love to see data-conscious products "go mainstream".
- stereoradonc 4y agoVPN is decent (not as good as Mullvad). I haven't tried "Drive", but am not willing to shift from Dropbox. Email and Calendar from Proton are "perpetually in beta", but I prefer Fastmail (over a decade with them). They are trying to spin debate around "privacy" and overselling the "Swiss experience". Nothing prevents them from changing the privacy policy tomorrow (to "conform" to the rules and regulations). As it is, Proton VPN's credentials are shrouded in controversy.
- thepra 4y agowhen you can't add more accounts on the android app without a subscription is where it is still annoying on mobile