4 ms·

Proton Pass utilizes end-to-end encryption, so not even Proton can decrypt user data, and there have been hundreds of court cases that have proven that Proton's

Proton Pass utilizes end-to-end encryption, so not even Proton can decrypt user data, and there have been hundreds of court cases that have proven that Proton's encryption cannot be bypassed by court orders. Proton like all law abiding companies must follow court orders. But unlike most companies, Proton actually fights in court and won a legal victory against the Swiss government after the case in question, overturning an earlier ruling that email providers can be classified as telecommunications providers. Details here: https://proton.me/blog/court-strengthens-email-privacy https://proton.me/blog/court-strengthens-email-privacy.

hammyhavoc 3y ago
Who said anything about encryption? The problem at hand is handing over IP addresses of a customer when they themselves are peddling a supposedly privacy-oriented service. The fact remains: it isn't fit-for-purpose, and these are non-solutions to real problems for anyone who isn't just LARPing a threat model. Replace "French climate activist" with "dissenter in an oppressive regime" and that person would be dead. Who cares if they later won in court? They still threw someone under the bus. Trusting a third-party business who is subject to the laws of where they operate means this will always be a problem, doesn't matter if they're an email provider or a VPN operator, the solutions aren't fit for purpose.
chrismorgan 3y ago
> Proton Pass utilizes end-to-end encryption, so not even Proton can decrypt user data … unless they decide they want to, in which case they can, because they serve the software, and can thereby easily exfiltrate the key. I have to keep on saying it: first-party end-to-end encryption is snake oil. https://hn.algolia.com/?query=chrismorgan+snake+oil&type=comment https://hn.algolia.com/?query=chrismorgan+snake+oil&type=com... It does resist casual or accidental leaking, and is even proof any form of disclosure if you have stopped using the service altogether, but is absolutely not robust against rogue employee, rogue company, legal compulsion, infiltrating attacker, &c. as long as you continue to use the service. If you want actually valuable end-to-end encryption, start by getting your software and network services from different providers. (And avoid the web’s distribution model like the plague, and probably mobile app distribution models too.)
Mindwipe 3y ago
> Proton Pass utilizes end-to-end encryption, so not even Proton can decrypt user data By default, who generates the keys? If you are compromised and your software starts to exfiltrate the keys to a third party, how long do you think it would be before anyone noticed?
stereoradonc 3y ago
The "Swiss version of neutrality" is an overblown concept and carefully constructed narrative.

hammyhavoc 3y ago

Who said anything about encryption? The problem at hand is handing over IP addresses of a customer when they themselves are peddling a supposedly privacy-oriented service. The fact remains: it isn't fit-for-purpose, and these are non-solutions to real problems for anyone who isn't just LARPing a threat model. Replace "French climate activist" with "dissenter in an oppressive regime" and that person would be dead. Who cares if they later won in court? They still threw someone under the bus. Trusting a third-party business who is subject to the laws of where they operate means this will always be a problem, doesn't matter if they're an email provider or a VPN operator, the solutions aren't fit for purpose.

chrismorgan 3y ago

> Proton Pass utilizes end-to-end encryption, so not even Proton can decrypt user data … unless they decide they want to, in which case they can, because they serve the software, and can thereby easily exfiltrate the key. I have to keep on saying it: first-party end-to-end encryption is snake oil. https://hn.algolia.com/?query=chrismorgan+snake+oil&type=comment https://hn.algolia.com/?query=chrismorgan+snake+oil&type=com... It does resist casual or accidental leaking, and is even proof any form of disclosure if you have stopped using the service altogether, but is absolutely not robust against rogue employee, rogue company, legal compulsion, infiltrating attacker, &c. as long as you continue to use the service. If you want actually valuable end-to-end encryption, start by getting your software and network services from different providers. (And avoid the web’s distribution model like the plague, and probably mobile app distribution models too.)

Mindwipe 3y ago

> Proton Pass utilizes end-to-end encryption, so not even Proton can decrypt user data By default, who generates the keys? If you are compromised and your software starts to exfiltrate the keys to a third party, how long do you think it would be before anyone noticed?

stereoradonc 3y ago

The "Swiss version of neutrality" is an overblown concept and carefully constructed narrative.