4 ms·

Asserting "private email" is a modern litmus test for someone's technical understanding and capabilities, or lack thereof. Snake oil companies will always hide

Asserting "private email" is a modern litmus test for someone's technical understanding and capabilities, or lack thereof. Snake oil companies will always hide behind "it's encrypted" and "it's hosted in Switzerland" tropes that mean nothing to anyone who has done a modicum of research. Real privacy is not the result of some product, especially not when its so desperately and obviously shilled.

tediousdemise 4y ago
Couldn't have said it better myself! Privacy is first and foremost a discipline and a practice, just like security. It's a form of self-respect, in my eyes. Some would say it's even a natural human right. Commoditizing it is a recipe for disaster. Edit: Expansion of the self-respect tidbit. Lack of privacy enables others to have control over you. Feeling like you are not in control, or actually being controlled by someone (shame, blackmail, etc.) can be very damaging to your mental health. Respect yourself, strive for privacy. You deserve it as much as anyone else.
- randomhodler84 4y ago
  I don’t know. I don’t think all “commoditization” of privacy is a bad thing. WhatsApp commoditized it, Signal; SSL/TLS; Tor; Privacy Coins; these all vastly improved the privacy of comms on the planet. One needs to determine outcomes rather than declaring it app disasters. maybe democratizing privacy is a better way to phrase than commoditization — which implies some cost savings rather than the just consumer availability.
  - tediousdemise 4y ago
    Thanks for chiming in. I've been having some difficulty expressing my thoughts lately so sometimes I don't make the most sense. Yes, I definitely agree with you--democratization is a much better way to put it.
    - randomhodler84 4y ago
      Please write and express yourself! You made sense to me and I wanted to add the conversation. I’ve thrown around many crazy ideas and the best ones seem to stir conversation and evolve or die. Ideas are better discussed in a room with many dissenting opinions.
deleted 4y ago
[deleted]
ziddoap 4y ago
>Snake oil companies will always hide behind "it's encrypted" and "it's hosted in Switzerland" tropes that mean nothing to anyone who has done a modicum of research. Do you have evidence that Proton does not actually encrypt their emails? >Real privacy is not the result of some product, I do wholeheartedly agree with this, at least. Privacy is a scale and there are many, many pieces which tip the scale one way or the other.
- Tijdreiziger 4y ago
  > Do you have evidence that Proton does not actually encrypt their emails? It doesn't matter. Proton supplies the client software, so if they want (or are forced to by law enforcement), they can easily push an update that exfiltrates decrypted data back to their server.
  - ziddoap 4y ago
    It seems rather harsh to brand them as pure snake oil based on a hypothetical situation that applies to basically every single piece of software and hardware ever invented, but fair enough.
    - tediousdemise 4y ago
      I like to see it as an unsolved problem. Similar to when Diffie and Hellman revolutionized cryptography with the concept of public/private keys, I like to think that one day, a revolutionary proof will drop that demonstrates a true trustless privacy model where backdooring isn't even a remote possibility.
    - Tijdreiziger 4y ago
      I suppose you always have to trust someone. (I'm not the one who branded them as snake oil, BTW)
- 0daystock 4y ago
  What does "encrypting" an email mean to you? If a Gmail user contacts me on Protonmail and Protonmail "encrypts" the message to me after receipt - what problem have we solved?
almet 4y ago
Thanks for stating this. It's still good to have people working on tools to help us have better usable solutions though. Depending who is your enemy (threat model), I guess proton tools can help you protect your intimacy though.
jacooper 4y ago
Its the best you can get. Its fully end-to-end encrypted when stored, they don't scan anything, no ADs, no tracking, and they support laws and organization that improve individuals privacy. Why wouldn't I support them ? If i care about privacy I should support companies that care about it too, no? Proton is not perfect, the android mobile app currently doesn't have conversion view neither contact sync, and the desktop bridge doesn't implement Dav protocol, but its the best out there for people who want to protect their privacy. And if you care about privacy, you shouldn't be using anything made in Australia.
bashinator 4y ago
Are you suggesting that because the only way to have truly private email (in the U.S. at least), is to own the server hardware, the property it's colocated on, and the Internet connection. Because this is true, but not helpful.
- 0daystock 4y ago
  There isn't such a thing as "secure/private email" because its design was not conceived with such things even in mind. The "secure" solutions like Protonmail are something other than email, which is probably the way forward, but I wish it was done without twisting language giving others a false sense of security and understanding.
  - bashinator 4y ago
    I'm more thinking "legally private" than "technically private".
5350-uiop-1130 4y ago
How can I learn more about privacy online. It seems to me that the only private email would be no email.
- 0daystock 4y ago
  Threat modeling is the only logical way to reason about privacy and security. It is quite a tedious exercise of listing all the adversaries you're worried about, their capabilities, and data they want to compromise. Such a model will reveal gaps and additional controls you can implement to improve your state.

tediousdemise 4y ago

Couldn't have said it better myself! Privacy is first and foremost a discipline and a practice, just like security. It's a form of self-respect, in my eyes. Some would say it's even a natural human right. Commoditizing it is a recipe for disaster. Edit: Expansion of the self-respect tidbit. Lack of privacy enables others to have control over you. Feeling like you are not in control, or actually being controlled by someone (shame, blackmail, etc.) can be very damaging to your mental health. Respect yourself, strive for privacy. You deserve it as much as anyone else.

randomhodler84 4y ago
I don’t know. I don’t think all “commoditization” of privacy is a bad thing. WhatsApp commoditized it, Signal; SSL/TLS; Tor; Privacy Coins; these all vastly improved the privacy of comms on the planet. One needs to determine outcomes rather than declaring it app disasters. maybe democratizing privacy is a better way to phrase than commoditization — which implies some cost savings rather than the just consumer availability.
- tediousdemise 4y ago
  Thanks for chiming in. I've been having some difficulty expressing my thoughts lately so sometimes I don't make the most sense. Yes, I definitely agree with you--democratization is a much better way to put it.
  - randomhodler84 4y ago
    Please write and express yourself! You made sense to me and I wanted to add the conversation. I’ve thrown around many crazy ideas and the best ones seem to stir conversation and evolve or die. Ideas are better discussed in a room with many dissenting opinions.

deleted 4y ago

[deleted]

ziddoap 4y ago

>Snake oil companies will always hide behind "it's encrypted" and "it's hosted in Switzerland" tropes that mean nothing to anyone who has done a modicum of research. Do you have evidence that Proton does not actually encrypt their emails? >Real privacy is not the result of some product, I do wholeheartedly agree with this, at least. Privacy is a scale and there are many, many pieces which tip the scale one way or the other.

Tijdreiziger 4y ago
> Do you have evidence that Proton does not actually encrypt their emails? It doesn't matter. Proton supplies the client software, so if they want (or are forced to by law enforcement), they can easily push an update that exfiltrates decrypted data back to their server.
- ziddoap 4y ago
  It seems rather harsh to brand them as pure snake oil based on a hypothetical situation that applies to basically every single piece of software and hardware ever invented, but fair enough.
  - tediousdemise 4y ago
    I like to see it as an unsolved problem. Similar to when Diffie and Hellman revolutionized cryptography with the concept of public/private keys, I like to think that one day, a revolutionary proof will drop that demonstrates a true trustless privacy model where backdooring isn't even a remote possibility.
  - Tijdreiziger 4y ago
    I suppose you always have to trust someone. (I'm not the one who branded them as snake oil, BTW)
0daystock 4y ago
What does "encrypting" an email mean to you? If a Gmail user contacts me on Protonmail and Protonmail "encrypts" the message to me after receipt - what problem have we solved?

almet 4y ago

Thanks for stating this. It's still good to have people working on tools to help us have better usable solutions though. Depending who is your enemy (threat model), I guess proton tools can help you protect your intimacy though.

jacooper 4y ago

Its the best you can get. Its fully end-to-end encrypted when stored, they don't scan anything, no ADs, no tracking, and they support laws and organization that improve individuals privacy. Why wouldn't I support them ? If i care about privacy I should support companies that care about it too, no? Proton is not perfect, the android mobile app currently doesn't have conversion view neither contact sync, and the desktop bridge doesn't implement Dav protocol, but its the best out there for people who want to protect their privacy. And if you care about privacy, you shouldn't be using anything made in Australia.

bashinator 4y ago

Are you suggesting that because the only way to have truly private email (in the U.S. at least), is to own the server hardware, the property it's colocated on, and the Internet connection. Because this is true, but not helpful.

0daystock 4y ago
There isn't such a thing as "secure/private email" because its design was not conceived with such things even in mind. The "secure" solutions like Protonmail are something other than email, which is probably the way forward, but I wish it was done without twisting language giving others a false sense of security and understanding.
- bashinator 4y ago
  I'm more thinking "legally private" than "technically private".

5350-uiop-1130 4y ago

How can I learn more about privacy online. It seems to me that the only private email would be no email.

0daystock 4y ago
Threat modeling is the only logical way to reason about privacy and security. It is quite a tedious exercise of listing all the adversaries you're worried about, their capabilities, and data they want to compromise. Such a model will reveal gaps and additional controls you can implement to improve your state.