6 ms·

Regardless of whether they’re secure or private they have to comply with data request. They’re not outside of the law Edit: of course if they kept minimal logs

Regardless of whether they’re secure or private they have to comply with data request. They’re not outside of the law Edit: of course if they kept minimal logs & user information would help when law enforcement came knocking. Can’t give what you don’t have

parker_mountain 3y ago
Unfortunately, their model isn't resistant to these requests as it should be. You either build your model to be resistant to a data request (user controlled keys that never leave the device), or you don't even come to the table.
- candiodari 3y ago
  This is fundamentally incompatible with software updates. The keys must not just never leave the device, both the key distribution and what the software does with decrypted data must be locked as well. Which means it must be impossible for the software to update, as the government could use force to compel a company to hack it's own users. This means that the cloud model, where code is downloaded through a web browser, is right out. Regardless of where the keys are.
  - runnerup 3y ago
    > as the government could use force to compel a company to hack it's own users. Currently, in the USA, the most generally accepted view among legal scholars is that this is not legal for the government to do -- mainly because of a view that it's a particular form of compelled speech / forced labor which is unconstitutional for the government to compel. It is, however, an avenue that the law enforcement community does occasionally investigate as a possible route to get what they want. There's no clear court ruling as no cases have gone that far.
- erinnh 3y ago
  Thats currently the case, isnt it? All the encryption/decryption happens locally (inside your browser/client). Thats why, if you want to full text search in proton you have to download your complete history into your browser.
- protonmail 3y ago
  This is already the case with Proton Mail. Your encryption key is stored encrypted so that we have no access to it. It is decrypted when you enter your password, which we have no access to. The article above confirms that, in fact, and all of these cases are proof that our encryption cannot be bypassed by legal means. All the data stored encrypted on our servers (email content, calendars, attachments, etc.) is inaccessible to us: https://proton.me/blog/zero-access-encryption https://proton.me/blog/zero-access-encryption. All we can provide is the unencrypted metadata which we need to have access to in order for the services to work properly.
runnerup 3y ago
Mullvad and CounterMail allegedly do a good job of this (retaining no user data). However, USA authorities occasionally look into what it would take, in a legal sense, to force companies to write and distribute edited code to gain more access to customer data that the company immediately lacks[0]. For now it’s probably a bridge too far for law enforcement agencies, but one can never be sure about the future. 0: https://archive.is/jd7LT https://archive.is/jd7LT
kaba0 3y ago
That's what I don't understand about these click-bait titles -- some people live in some lawless alternative reality, what do they expect? That a company will hire some warriors resisting a lawful order by the state they operate under? I'm all for privacy, and indeed, stored data should be kept to a minimal. But if a lawful order against a criminal is complied with, I definitely won't cry murder.
- xinayder 3y ago
  > But if a lawful order against a criminal is complied with, I definitely won't cry murder. The problem is that Proton markets themselves as "secure, encrypted email" when in reality they have access to all your stuff and say they don't. What I would expect from a service that kept their word: police knocks at their door, they say "sorry we cannot give you data we don't have, we don't keep records here". They would probably battle against the authorities in court, but that should be the modus operandi if you care about your users privacy in the first place. Proton doesn't do that. They say they are under strong Swiss laws but any subpoena or warrant they get, they just comply with it instead of battling it. cock.li is a provider handled by a single person only and he received several gag orders and never complied to one of them, and he lives in the US. At least the guy is honest and tells people that if you're worried about privacy, you should know that he can read your emails whenever he wants to. The problem here is that Proton sold itself as a privacy-first service that would protect you from the authorities, but it turns out it's just as normal as a service than Gmail or Outlook.
  - protonmail 3y ago
    Note that this is a false statement. The cases such as this show that our encryption provides privacy by default: we are not able to provide any of the content stored encrypted on our servers to third-parties, even when presented with a data request we cannot legally contest. All we can provide is the limited data which we need to have anyway for the services to function. You can learn more in our Privacy Policy (https://proton.me/legal/privacy https://proton.me/legal/privacy), Threat model (https://proton.me/blog/protonmail-threat-model https://proton.me/blog/protonmail-threat-model, available publicly since the beginning), and in this support article: https://proton.me/support/proton-mail-encryption-explained https://proton.me/support/proton-mail-encryption-explained. You can also see in the Transparency report that we contest all of the legal requests we have any legal ground to contest. We are also working on improving the Swiss privacy legislation (which is already one of the strictest in the world) further - we won a major court case in 2021: https://proton.me/blog/court-strengthens-email-privacy https://proton.me/blog/court-strengthens-email-privacy.
IAmNotAFix 3y ago
Have you ever heard about the term "lawyer"?
j16sdiz 3y ago
Their website advertise they are Swiss company and "your data is protected by strict Swiss privacy laws and Swiss neutrality". With that statement, I don't expect they have to compliant with FBI or US laws.. If that's Swiss court, it's fair game... but no way for FBI.
- protonmail 3y ago
  The FBI can request assistance from a Swiss court and the Swiss government may assist in some cases, and that's what happened here. That being said, even in such cases, emails cannot be decrypted, which was proven again in this case.

parker_mountain 3y ago

Unfortunately, their model isn't resistant to these requests as it should be. You either build your model to be resistant to a data request (user controlled keys that never leave the device), or you don't even come to the table.

candiodari 3y ago
This is fundamentally incompatible with software updates. The keys must not just never leave the device, both the key distribution and what the software does with decrypted data must be locked as well. Which means it must be impossible for the software to update, as the government could use force to compel a company to hack it's own users. This means that the cloud model, where code is downloaded through a web browser, is right out. Regardless of where the keys are.
- runnerup 3y ago
  > as the government could use force to compel a company to hack it's own users. Currently, in the USA, the most generally accepted view among legal scholars is that this is not legal for the government to do -- mainly because of a view that it's a particular form of compelled speech / forced labor which is unconstitutional for the government to compel. It is, however, an avenue that the law enforcement community does occasionally investigate as a possible route to get what they want. There's no clear court ruling as no cases have gone that far.
erinnh 3y ago
Thats currently the case, isnt it? All the encryption/decryption happens locally (inside your browser/client). Thats why, if you want to full text search in proton you have to download your complete history into your browser.
protonmail 3y ago
This is already the case with Proton Mail. Your encryption key is stored encrypted so that we have no access to it. It is decrypted when you enter your password, which we have no access to. The article above confirms that, in fact, and all of these cases are proof that our encryption cannot be bypassed by legal means. All the data stored encrypted on our servers (email content, calendars, attachments, etc.) is inaccessible to us: https://proton.me/blog/zero-access-encryption https://proton.me/blog/zero-access-encryption. All we can provide is the unencrypted metadata which we need to have access to in order for the services to work properly.

runnerup 3y ago

Mullvad and CounterMail allegedly do a good job of this (retaining no user data). However, USA authorities occasionally look into what it would take, in a legal sense, to force companies to write and distribute edited code to gain more access to customer data that the company immediately lacks[0]. For now it’s probably a bridge too far for law enforcement agencies, but one can never be sure about the future. 0: https://archive.is/jd7LT https://archive.is/jd7LT

kaba0 3y ago

That's what I don't understand about these click-bait titles -- some people live in some lawless alternative reality, what do they expect? That a company will hire some warriors resisting a lawful order by the state they operate under? I'm all for privacy, and indeed, stored data should be kept to a minimal. But if a lawful order against a criminal is complied with, I definitely won't cry murder.

xinayder 3y ago
> But if a lawful order against a criminal is complied with, I definitely won't cry murder. The problem is that Proton markets themselves as "secure, encrypted email" when in reality they have access to all your stuff and say they don't. What I would expect from a service that kept their word: police knocks at their door, they say "sorry we cannot give you data we don't have, we don't keep records here". They would probably battle against the authorities in court, but that should be the modus operandi if you care about your users privacy in the first place. Proton doesn't do that. They say they are under strong Swiss laws but any subpoena or warrant they get, they just comply with it instead of battling it. cock.li is a provider handled by a single person only and he received several gag orders and never complied to one of them, and he lives in the US. At least the guy is honest and tells people that if you're worried about privacy, you should know that he can read your emails whenever he wants to. The problem here is that Proton sold itself as a privacy-first service that would protect you from the authorities, but it turns out it's just as normal as a service than Gmail or Outlook.
- protonmail 3y ago
  Note that this is a false statement. The cases such as this show that our encryption provides privacy by default: we are not able to provide any of the content stored encrypted on our servers to third-parties, even when presented with a data request we cannot legally contest. All we can provide is the limited data which we need to have anyway for the services to function. You can learn more in our Privacy Policy (https://proton.me/legal/privacy https://proton.me/legal/privacy), Threat model (https://proton.me/blog/protonmail-threat-model https://proton.me/blog/protonmail-threat-model, available publicly since the beginning), and in this support article: https://proton.me/support/proton-mail-encryption-explained https://proton.me/support/proton-mail-encryption-explained. You can also see in the Transparency report that we contest all of the legal requests we have any legal ground to contest. We are also working on improving the Swiss privacy legislation (which is already one of the strictest in the world) further - we won a major court case in 2021: https://proton.me/blog/court-strengthens-email-privacy https://proton.me/blog/court-strengthens-email-privacy.

IAmNotAFix 3y ago

Have you ever heard about the term "lawyer"?

j16sdiz 3y ago

Their website advertise they are Swiss company and "your data is protected by strict Swiss privacy laws and Swiss neutrality". With that statement, I don't expect they have to compliant with FBI or US laws.. If that's Swiss court, it's fair game... but no way for FBI.

protonmail 3y ago
The FBI can request assistance from a Swiss court and the Swiss government may assist in some cases, and that's what happened here. That being said, even in such cases, emails cannot be decrypted, which was proven again in this case.