4 ms·

But they'll give your data away if asked.

cowtools 4y ago
I mean, they are legally obligated to. At least they are not selling my data to advertisers or arbitrarily locking me out of my account like google. Hell, i'd pay for their premium service if wasn't so expensive and they accepted anonymous payments through monero or something. I mean, this is what email has basically come to. I've tried to host my own email server, all my outbound mail ends up in spam. If you want privacy, use PGP Edit: please don't downvote this parent comment, I think it is still a pretty reasonable concern
- yupper32 4y ago
  > At least they are not selling my data to advertisers That's almost never what actually happens, though. They sell access to you and use your data internally to target ads. A law enforcement request does literally release your data.
  - cowtools 4y ago
    It doesn't matter to me whether or not they only use the advertising data internally. Google is such a large monopoly at this point that I am basically forced to deal with them on a daily basis through the businesses and institutions I work with. It's not even the surveillance that I am concerned with at this point. I just am trying to disentangle all these services that I use that demand to become linked in difficult ways. Like let's say you have a gmail account linked to a youtube account, and you upload a video or like something that sets off google's automated spam heuristic. Boom, your google account is deleted and you can no longer access your email or sign into your accounts that require email verification. All this extra surveillance is just going to increase the odds of my account getting falsely flagged as a bot or something. Let's say you lose your phone. You have to use your phone to login to some institution's service, so you get a new phone and try to reset the 2FA with your email. However you need access to your phone as a 2FA to access your email. (this exact scenario happened to a family member the other day, just goes to show you should NEVER link your accounts with a cell number).
    - yupper32 4y ago
      > It doesn't matter to me whether or not they only use the advertising data internally. Okay, but it does matter when you say something significant that isn't true. Do you understand that?
- charcircuit 4y ago
  >At least they are not selling my data to advertisers No they don't. >We do not scan or read your Gmail messages to show you ads https://support.google.com/mail/answer/10434152 https://support.google.com/mail/answer/10434152
post_break 4y ago
Exactly, which leads me to the spiral of what's the point? If there is nothing truly encrypted, then what do they really offer?
- ziddoap 4y ago
  You're conflating different things. It doesn't help that people who seem to have a bone to pick with companies obeying the laws of the country they operate in continuously leave out the nuance and detail of the event. The court order that Proton complied with released the IP address of the suspect, not the encrypted contents of the emails in the suspects inbox.
- tristan957 4y ago
  The content of your email is encrypted.
yabones 4y ago
The value of proton is not that they'll break the law for you -- they absolutely will not. They are bound by the laws of the land, and when compelled will hand over all the data they are required. The value IS that they simply don't have that much data. All your emails are encrypted at rest with a key they can't read. All your data is stored in such a way that they can't decrypt it on demand. Think about it. When Microsoft gets served a FISMA warrant, everything they have is stored in plaintext, so they have to hand it all over. With Proton, all they have is your IP, the date you created your account, the last login date, potentially the subject lines of any messages in their mail queue, and that's about it. Nobody is going to risk their business to help people hide from law enforcement, and anybody that says they will is probably lying to you.
- tristan957 4y ago
  They also know who you send and receive emails to, but your point still stands.
- distracted_boy 4y ago
  They can't perhaps decrypt emails sent between proton users, but that is not the case if you are communicating with someone using a different email service.
ziddoap 4y ago
If asked via lawful court order, yes. Can you provide me the name of any company who does not comply court orders of the country it operates in and continues to operate freely? Edit: I thought this was a more than fair question, evidently people do not think so.
- metadat 4y ago
  > Can you provide me the name of any company who does not comply court orders of the country it operates in and continues to operate freely? AT&T, Google, Apple, Comcast, Verizon, ... Oh, did you mean companies who refuse to comply specifically to legal inquiries about their users or customers? No company will (or even should) stick their neck out for you personally. With sufficient resources and clout, they will risk it for themselves because $$$ and power.
  - ziddoap 4y ago
    >AT&T, Google, Apple, Comcast, Verizon, ... Really? I understand that they fight court orders when they feel they need to, which Proton at least claims to do as well (have not verified that, though), but they get away with just... ignoring them? Or not complying after losing an appeal? I stand corrected if that is the case. >With sufficient resources and clout Does Proton have the clout to do so? I don't believe they do, which makes me wonder why it's such an unpopular opinion to believe exactly what you said ("No company will (or even should) stick their neck out for you personally.") when it comes to Proton.
    - metadat 4y ago
      tl;dr: The climate is heading towards the best option being to need as little privacy as possible. Corporations and their employees have learned clever techniques to get away with "complying" without really complying in instances where they're sufficiently motivated. It's not always politically feasible, but is in many cases. A quick (and ironic) Google search for "google lawsuit federal compliance" turns up many instances: https://www.dol.gov/newsroom/releases/ofccp/ofccp20170104 https://www.dol.gov/newsroom/releases/ofccp/ofccp20170104 https://www.justice.gov/opa/pr/justice-department-sues-monopolist-google-violating-antitrust-laws https://www.justice.gov/opa/pr/justice-department-sues-monop... These violations are all calculated risks on their part. Internally, they intentionally keep certain communications off of email to ensure it will never be discoverable through a legal process. It's not like Big-G is the only one, do you think this is ubiquitously commonplace across the megacorps in virtually every industry in the United States? Here's what happens when they come for your / our data: https://www.nytimes.com/2006/01/20/technology/google-resists-us-subpoena-of-search-data.html https://www.nytimes.com/2006/01/20/technology/google-resists... > even as three of its competitors agreed to provide information > Rather than seeking data on individuals, it says it is trying to establish a profile of Internet use that will help it defend the Child Online Protection Act, a 1998 law that would impose tough criminal penalties on individuals whose Web sites carried material deemed harmful to minors.

I mean, they are legally obligated to. At least they are not selling my data to advertisers or arbitrarily locking me out of my account like google. Hell, i'd pay for their premium service if wasn't so expensive and they accepted anonymous payments through monero or something. I mean, this is what email has basically come to. I've tried to host my own email server, all my outbound mail ends up in spam. If you want privacy, use PGP Edit: please don't downvote this parent comment, I think it is still a pretty reasonable concern

yupper32 4y ago
> At least they are not selling my data to advertisers That's almost never what actually happens, though. They sell access to you and use your data internally to target ads. A law enforcement request does literally release your data.
- cowtools 4y ago
  It doesn't matter to me whether or not they only use the advertising data internally. Google is such a large monopoly at this point that I am basically forced to deal with them on a daily basis through the businesses and institutions I work with. It's not even the surveillance that I am concerned with at this point. I just am trying to disentangle all these services that I use that demand to become linked in difficult ways. Like let's say you have a gmail account linked to a youtube account, and you upload a video or like something that sets off google's automated spam heuristic. Boom, your google account is deleted and you can no longer access your email or sign into your accounts that require email verification. All this extra surveillance is just going to increase the odds of my account getting falsely flagged as a bot or something. Let's say you lose your phone. You have to use your phone to login to some institution's service, so you get a new phone and try to reset the 2FA with your email. However you need access to your phone as a 2FA to access your email. (this exact scenario happened to a family member the other day, just goes to show you should NEVER link your accounts with a cell number).
  - yupper32 4y ago
    > It doesn't matter to me whether or not they only use the advertising data internally. Okay, but it does matter when you say something significant that isn't true. Do you understand that?
charcircuit 4y ago
>At least they are not selling my data to advertisers No they don't. >We do not scan or read your Gmail messages to show you ads https://support.google.com/mail/answer/10434152 https://support.google.com/mail/answer/10434152

post_break 4y ago

Exactly, which leads me to the spiral of what's the point? If there is nothing truly encrypted, then what do they really offer?

ziddoap 4y ago
You're conflating different things. It doesn't help that people who seem to have a bone to pick with companies obeying the laws of the country they operate in continuously leave out the nuance and detail of the event. The court order that Proton complied with released the IP address of the suspect, not the encrypted contents of the emails in the suspects inbox.
tristan957 4y ago
The content of your email is encrypted.

yabones 4y ago

The value of proton is not that they'll break the law for you -- they absolutely will not. They are bound by the laws of the land, and when compelled will hand over all the data they are required. The value IS that they simply don't have that much data. All your emails are encrypted at rest with a key they can't read. All your data is stored in such a way that they can't decrypt it on demand. Think about it. When Microsoft gets served a FISMA warrant, everything they have is stored in plaintext, so they have to hand it all over. With Proton, all they have is your IP, the date you created your account, the last login date, potentially the subject lines of any messages in their mail queue, and that's about it. Nobody is going to risk their business to help people hide from law enforcement, and anybody that says they will is probably lying to you.

tristan957 4y ago
They also know who you send and receive emails to, but your point still stands.
distracted_boy 4y ago
They can't perhaps decrypt emails sent between proton users, but that is not the case if you are communicating with someone using a different email service.

ziddoap 4y ago

If asked via lawful court order, yes. Can you provide me the name of any company who does not comply court orders of the country it operates in and continues to operate freely? Edit: I thought this was a more than fair question, evidently people do not think so.

metadat 4y ago
> Can you provide me the name of any company who does not comply court orders of the country it operates in and continues to operate freely? AT&T, Google, Apple, Comcast, Verizon, ... Oh, did you mean companies who refuse to comply specifically to legal inquiries about their users or customers? No company will (or even should) stick their neck out for you personally. With sufficient resources and clout, they will risk it for themselves because $$$ and power.
- ziddoap 4y ago
  >AT&T, Google, Apple, Comcast, Verizon, ... Really? I understand that they fight court orders when they feel they need to, which Proton at least claims to do as well (have not verified that, though), but they get away with just... ignoring them? Or not complying after losing an appeal? I stand corrected if that is the case. >With sufficient resources and clout Does Proton have the clout to do so? I don't believe they do, which makes me wonder why it's such an unpopular opinion to believe exactly what you said ("No company will (or even should) stick their neck out for you personally.") when it comes to Proton.
  - metadat 4y ago
    tl;dr: The climate is heading towards the best option being to need as little privacy as possible. Corporations and their employees have learned clever techniques to get away with "complying" without really complying in instances where they're sufficiently motivated. It's not always politically feasible, but is in many cases. A quick (and ironic) Google search for "google lawsuit federal compliance" turns up many instances: https://www.dol.gov/newsroom/releases/ofccp/ofccp20170104 https://www.dol.gov/newsroom/releases/ofccp/ofccp20170104 https://www.justice.gov/opa/pr/justice-department-sues-monopolist-google-violating-antitrust-laws https://www.justice.gov/opa/pr/justice-department-sues-monop... These violations are all calculated risks on their part. Internally, they intentionally keep certain communications off of email to ensure it will never be discoverable through a legal process. It's not like Big-G is the only one, do you think this is ubiquitously commonplace across the megacorps in virtually every industry in the United States? Here's what happens when they come for your / our data: https://www.nytimes.com/2006/01/20/technology/google-resists-us-subpoena-of-search-data.html https://www.nytimes.com/2006/01/20/technology/google-resists... > even as three of its competitors agreed to provide information > Rather than seeking data on individuals, it says it is trying to establish a profile of Internet use that will help it defend the Child Online Protection Act, a 1998 law that would impose tough criminal penalties on individuals whose Web sites carried material deemed harmful to minors.