3 ms·

Any tl/dr available?

hammyhavoc 4y ago
The general gist is that any legal, above board company providing privacy-oriented services is subject to the laws of where they operate, ergo, if privacy and security is something that matters to you, don't trust a third-party because they will want to stay in business. They received a court order, they cooperated with the police, for better or worse (I have zero opinion on it; frankly don't care), and handed over a customer's IP, which led to the arrest of the activist. The problems that Proton is trying to solve, e.g., email, are better taken care of by other tools depending on a user's threat model. Likewise, if someone actually needs privacy and security because their life is on the line in an oppressive regime, utilizing a service like Proton's is a shit idea.
- protonmail 4y ago
  That's why we published a threat model that goes over what Proton Mail can and cannot protect against: https://proton.me/blog/protonmail-threat-model https://proton.me/blog/protonmail-threat-model.
  - hammyhavoc 4y ago
    It's hard to take it seriously when you invoke an XKCD comic in threat model documentation. It isn't cute. Anybody receiving sensitive information via email is doing email wrong. Email in and of itself is not fit for purpose as anything but a means of notification that something needs their attention on x, hence banks tell you to login to read a sensitive notification, hence the government tell you to login to the web portal to read a message.
    - red-iron-pine 4y ago
      They have a link, mostly near the bottom of the report, as a way of (politely) saying that their service won't protect you from "rubber hose cryptanalysis". It's a cheeky way of saying "this won't stop people from torturing shit out of you", and the rest of the article looks fine. It's hard to take a poster seriously when they dismiss the entire model based on a hyperlink who fails to address the points in the model. I'll agree with your point about email though: it's a tool for correspondence, not for secure transfer of sensitive info.

The general gist is that any legal, above board company providing privacy-oriented services is subject to the laws of where they operate, ergo, if privacy and security is something that matters to you, don't trust a third-party because they will want to stay in business. They received a court order, they cooperated with the police, for better or worse (I have zero opinion on it; frankly don't care), and handed over a customer's IP, which led to the arrest of the activist. The problems that Proton is trying to solve, e.g., email, are better taken care of by other tools depending on a user's threat model. Likewise, if someone actually needs privacy and security because their life is on the line in an oppressive regime, utilizing a service like Proton's is a shit idea.

protonmail 4y ago
That's why we published a threat model that goes over what Proton Mail can and cannot protect against: https://proton.me/blog/protonmail-threat-model https://proton.me/blog/protonmail-threat-model.
- hammyhavoc 4y ago
  It's hard to take it seriously when you invoke an XKCD comic in threat model documentation. It isn't cute. Anybody receiving sensitive information via email is doing email wrong. Email in and of itself is not fit for purpose as anything but a means of notification that something needs their attention on x, hence banks tell you to login to read a sensitive notification, hence the government tell you to login to the web portal to read a message.
  - red-iron-pine 4y ago
    They have a link, mostly near the bottom of the report, as a way of (politely) saying that their service won't protect you from "rubber hose cryptanalysis". It's a cheeky way of saying "this won't stop people from torturing shit out of you", and the rest of the article looks fine. It's hard to take a poster seriously when they dismiss the entire model based on a hyperlink who fails to address the points in the model. I'll agree with your point about email though: it's a tool for correspondence, not for secure transfer of sensitive info.