9 ms·
Tuta (formerly Tutanota) denies claim it has intelligence ties
- treypitt 3y agoIt seems obvious Five Eyes will not tolerate or legitimize any email provider that doesn't allow them access to subpoenas, at the very least - this rules out most of the privacy features touted by protonmail & tutanota (no logs, E2E encryption, etc). Perhaps what makes the ruse convincing in Tutanota's case is the crappy interface and clear dearth of basic features: search basically doesn't work; it's impossible to select all messages or use shift to select pages of messages. Their excuse is that customers might accidentally delete emails, but it might make more sense that they want to retain as much data as possible: https://www.reddit.com/r/tutanota/comments/nc9jxx/suggestion_select_all_to_select_mail/ https://www.reddit.com/r/tutanota/comments/nc9jxx/suggestion...
- nicce 3y ago> Perhaps what makes the ruse convincing in Tutanota's case is the crappy interface and clear dearth of basic features: search basically doesn't work; it's impossible to select all messages or use shift to select pages of messages. Their excuse is that customers might accidentally delete emails, but it might make more sense that they want to retain as much data as possible: https://www.reddit.com/r/tutanota/comments/nc9jxx/suggestion https://www.reddit.com/r/tutanota/comments/nc9jxx/suggestion... Implementing search for E2EE mailbox is difficult problem (Protonmail is not doing the same). For search to be efficient, you would need to download the whole mailbox for your device. If you want to support as many users as possible, you can't. But maybe they could make it optional. And they are very small team, offering mail for very low price (free for most), which has resulted on using Electron for producing the applications for as many platforms as possible. And it is a mess. What comes to that Reddit post, it is two years old and they have supported mass selection for a long while for now.
- Ayesh 3y agoMy naive thought is that they could have an E2EE search index for each mailbox? I wouldn't even mind if the index storage counts against the quota.
- nicce 3y agoIndex processing should happen on the client's device (server never sees the content). That defeats the purpose since you need full mailbox on your device for that. At least in the beginning. Maybe over longer period it would be possible to integrate and maintain the index so, that you can guarantee the correctness without full mailbox.
- blueflow 3y agoTuta is not in Five Eyes jurisdiction, it is in Germany.
- Dah00n 3y agoNo but it is in 14 eyes.
- anjel 3y agoBoth proton and tuta cripple search so that deleting mail detritus is tedious so that you'll use up your free storage quota and have to subscribe.
- deleted 3y ago[deleted]
- DSingularity 3y agoWhat evidence is there that they do have such ties?
- agilob 3y agoSome dude said so publicly.
- boomboomsubban 3y agoThe testimony of the director of the RCMP Operations Research group.
- yborg 3y agoWho is on trial for allegedly trying to sell internal Canadian government investigative documents to the CEO of Phantom Secure, the 'secure' communications app popular with the underworld until it got rumbled and who needs some explanation for why he wanted to communicate via a privacy-focused open email service.
- loufe 3y agoWe can all speculate. An alternative would be "he's got nothing left to lose and wants to expose more secrets". I think the Western intelligence agencies have lots of documented cases of creating companies for purposes like this. https://www.theguardian.com/us-news/2020/feb/11/crypto-ag-cia-bnd-germany-intelligence-report https://www.theguardian.com/us-news/2020/feb/11/crypto-ag-ci...
- boomboomsubban 3y agoI know very little about the case, but how would disparaging Tutanota help his case in this scenario? And why would anyone in the intelligence field need to justify using a privacy focused service?
- flotzam 3y ago"I did not use the privacy focused email service for my conversations with criminals because I wanted to sell classified material without being surveilled. I used the privacy focused email service to make it easier to catch these criminals, because it's very very surveilled! A reliable source once told me this. No you can't meet her, she lives in Canada^W undisclosed location. Not guilty, your honor."
- hackideiomat 3y ago> "This would completely contradict our mission as a privacy protection organization." no shit, but the claim is that you aren't...
- anti-clockwise 3y ago[flagged]
- hackideiomat 3y agoworst privacy take ever
- grammers 3y agoSimilar allegations were removed from r/privacy as fake news: https://www.reddit.com/r/privacy/comments/17st6yu/tutanota_is_a_honeypot_according_to_a_cbc_article/ https://www.reddit.com/r/privacy/comments/17st6yu/tutanota_i...
- canadiantim 3y agoreddit isn't exactly known for the free sharing of information anymore tho
- deleted 3y ago[deleted]
- rez9x 3y agoWhile I tend to assume the vast majority of privacy is either imagined or a façade, I also have a deep enough distrust of authority that when I see such a claim made by a government, or government official, I'm inclined to believe it's a ploy to discredit someone that won't cooperate with them.
- injeolmi_love 3y agoThe campaign against Wikileaks and Assange comes to mind in particular.
- shrimp_emoji 3y agoHe was a hacker who leaked information about a single political party, justifying that with "Trump's already bad enough on his own, so no need to sling mud his way". Then said party, and the country's intelligence agencies, got mad. How is that surprising? Of course they're going to discredit and prosecute him; it's the healthy response to a foreign actor trying to target and influence politics to their agenda.
- injeolmi_love 3y agoIts dangerous to think that committing crimes and violating rights is ok as long as the other side loses. A healthy response would have been internal reforms to the party and the abolishment of secret police. Punishing free speech just increases political cynicism in the general public, which can just as easily be taken advantage of by the other side.
- deleted 3y ago[deleted]
- jeffbee 3y ago[flagged]
- Karsteski 3y ago> Belief in the privacy offered by these types of services amounts to a mental illness. Do you seriously think this line made sense?
- jeffbee 3y agoYes. The irrational belief that big, sophisticated organizations are scary but tiny, opaque organizations with weird names and no verifiable capabilities whatsoever are safe is a form of low-level derangement.
- JohnMakin 3y agoThat isn't what mental illness is, but thanks for playing.
- jeffbee 3y agoAre we now having a philosophical debate? It is a delusion to believe that you can "get privacy" by switching to Tutanota, and the harm of acting on such delusions is that your precious data will be delivered directly rather than indirectly to the BND. Perhaps you are thinking that it can't be a mental disorder because there are so many people who think this, therefore it is more like a religion, i.e. an obviously irrational behavior that is tolerated because of an in-group.
- JohnMakin 3y agoMental illness is a testable set of clearly-defined symptoms that are diagnosed by a mental health professional. You are contributing to the stigma around mental illness when you toss that word around to describe something like a stupid/delusional belief. They aren't remotely the same.
- PrimeMcFly 3y agoIt's such a bad service, I don't know why anyone uses it. ProtonMail is superior in every way. Tuta has all kind of weird restrictions, like not being able to search back more than a month.
- Karsteski 3y agoYou can definitely search back more than a month. However the search is genuinely atrocious. I've been using tutanota for a few years now but every time I need to search my emails I think about switching to something else. It is just not acceptable for the service to need to slowly iterate through emails, downloading them one by one the first time you decide to go back that far, just to find something important.
- shrimp_emoji 3y agoCan confirm. Search is brutal. But I just set it to auto-delete old emails anyway now, so problem "solved". ;D
- PrimeMcFly 3y agoI have a tuta account, I tried to search for something recently and it only let me search from October 12th or something. I'm not sure you can search back more than a month on the free plan.
- norenh 3y agoOne reason is that tuta does not require you to have any other connection to create and account. Protonmail require a second mail, phone or possibly some kind of payment if I recall correctly (for verification?) that could be linked from your account in theory. Without having a good anonymous starting point, protonmail does not let you get that starting point, at least the last time I tired (maybe a year ago).
- PrimeMcFly 3y agoProtonMail never used to require another email to verify, and only asked for a phone if I was on an IP that had made more than one account already.
- hnarn 3y agoI'm not a fan of Tuta, mainly because of their disingenuous advertising where they keep calling themselves "open source" when they in fact only open source their clients but keep anything server-side under wraps -- but for this reason this also makes me skeptical; if their clients are indeed open source (which I assume is true, I haven't verified), and all encryption happens client-side before being sent to the server (also an assumption), how would it even be possible for this to be true? In my understanding, anything that Tuta potentially did to compromise e-mails would necessarily have to shine through in their open source client code -- unless they willingly serve binaries that are not actually built from that code, which of course would be a scandal. So even if I don't like them, I'm going to need something more concrete than someone simply saying they have "intelligence ties" to be willing to believe that they are somehow duping their users.
- linhns 3y agoPrivacy-wise, all your emails are stored in Germany, and govt can just flip the switch at any time and just confiscate the servers.
- byyll 3y agoAnd privacy-wise, the data can be encrypted.
- hnarn 3y agoSo what? The assumption is that the data is encrypted at rest. If your threat model is "physical seizure by a nation state" then obviously you shouldn't be storing your encrypted data at a SaaS provider in a location out of your control anyway, but I don't see why it would be a reasonable assumption by default that Tuta willingly uses weak (or no) encryption.
- byyll 3y ago> I don't see why it would be a reasonable assumption by default that Tuta willingly uses weak (or no) encryption. Quite the opposite even, according to them at least. They are one of the first pioneering post-quantum encryption in email.
- popcalc 3y agoSame with Proton. Basically the spiritual successor to Crypto AG.
- deleted 3y ago[deleted]
- protonmail 3y agoWe understand your concerns, however there is no comparison between Crypto AG and us. Our encryption occurs client-side, our cryptographic code is open source ( https://proton.me/community/open-source https://proton.me/community/open-source ), and our tech can and has been independently verified. More about this here: https://proton.me/blog/is-protonmail-trustworthy https://proton.me/blog/is-protonmail-trustworthy.
- popcalc 3y agoEmails arrive at your datacenter in the clear and that is simply a flaw of SMTP; you're not going to change that. Blabbing on about your client-side JS as if it stops you from reading your users' mail just makes you look disingenuous.
- poutinepapi 3y agoStick a fork in them, they're done. At least with that name they are. Easiest thing would be to disolve, and start a brand new company with the same people. Don't get me wrong, whether they have or don't have intelligence ties is irrelevant. No one serious uses them, they're a general public supplier, and the general public is about as brave as a gringo cop, i.e.: not much. So they're about to lose a chunk of customers and Tutanota's leadership isn't exactly quality so who knows what they'll do.
- shrimp_emoji 3y ago> No one serious uses them Hey... :c
- poutinepapi 3y agoSorry mate! Didn't want to be mean XD, but funny you commented this, because I posted about it on LinkedIn and got like 5 private messages asking:"Should I really switch?" XD, so you're at least not alone and in the company of some pretty fine people :P
- ThePowerOfFuet 3y agoCould it be that their backend is compromised, instead of being willing participants?