3 ms·

Our encryption cannot be bypassed, and this case shows exactly that - even when we receive a data request we cannot legally contest, we are not able to share th

Our encryption cannot be bypassed, and this case shows exactly that - even when we receive a data request we cannot legally contest, we are not able to share the data encrypted on our servers in an unencrypted format. As any legally operating company, we have to comply with the local legislation, however, the Swiss legislation is one of the strictest in the world when it comes to privacy protection. We are also working on improving it further - we won a major court case in 2021: https://proton.me/blog/court-strengthens-email-privacy https://proton.me/blog/court-strengthens-email-privacy.

aborsy 3y ago
The government could say, we will send our engineer to push a bad JavaScript code or app update , or implement a backdooor, to a select set of users that we suspect, the encryption can be selectively bypassed or the user’s password be extracted. Also, the incoming non-PM emails can be logged unencrypted. That could be a gag order. Isn’t that true? Proton could improve the process. For example, it could provide the option of disabling the web access (using only client applications with signatures both of which publicly available. The user can then check that the code they run is same as everyone else’s).
- protonmail 3y ago
  This is not true. As a Swiss company, it is illegal for us to cooperate with any non-Swiss authorities. The methods you describe are not in the catalog of measures a Swiss court can take. Therefore, Proton could not be compelled to do so.
  - 3np 3y ago
    > As a Swiss company, it is illegal for us to cooperate with any non-Swiss authorities Taken as written, this is obviously false. If we need to add some unstated qualifiers and specific interpretation for that statement to remotely check out, consider the same for the rest, like: > Therefore, Proton could not be compelled to do so protonmail may or may not realize that people will read way more into these statements than they should.

aborsy 3y ago

The government could say, we will send our engineer to push a bad JavaScript code or app update , or implement a backdooor, to a select set of users that we suspect, the encryption can be selectively bypassed or the user’s password be extracted. Also, the incoming non-PM emails can be logged unencrypted. That could be a gag order. Isn’t that true? Proton could improve the process. For example, it could provide the option of disabling the web access (using only client applications with signatures both of which publicly available. The user can then check that the code they run is same as everyone else’s).

protonmail 3y ago
This is not true. As a Swiss company, it is illegal for us to cooperate with any non-Swiss authorities. The methods you describe are not in the catalog of measures a Swiss court can take. Therefore, Proton could not be compelled to do so.
- 3np 3y ago
  > As a Swiss company, it is illegal for us to cooperate with any non-Swiss authorities Taken as written, this is obviously false. If we need to add some unstated qualifiers and specific interpretation for that statement to remotely check out, consider the same for the rest, like: > Therefore, Proton could not be compelled to do so protonmail may or may not realize that people will read way more into these statements than they should.