4 ms·

There's a pretty egregious misunderstanding of how email works in both the article and the proposed ban. Protonmail can only end-to-end encrypt email when the

There's a pretty egregious misunderstanding of how email works in both the article and the proposed ban. Protonmail can only end-to-end encrypt email when the receiver is also using Protonmail. The email spec has no support for a universal encryption method, one of the reasons we'd be better off not using email at all today. They also don't explain how the inability to track the sender's IP is specific to Protonmail. Unless I missed a key feature, Protonmail doesn't do anything to hide or obscure the sender's IP.

alephnerd 3y ago
> inability to track the sender's IP is specific to Protonmail The issue is India doesn't have a judicial agreement with Switzerland over data sharing (which includes User IP Addresses) for criminal investigations [0] while the US does [1], and Protonmail only honors Swiss litigation [2] This should change with the new India-Switzerland FTA though. [0] - https://carnegieendowment.org/files/ParsheeraJha_DataAccess.pdf https://carnegieendowment.org/files/ParsheeraJha_DataAccess.... [1] - https://www.dataprivacyframework.gov/framework-article/1%E2%80%93NOTICE https://www.dataprivacyframework.gov/framework-article/1%E2%... [2] - https://proton.me/legal/law-enforcement https://proton.me/legal/law-enforcement
- _heimdall 3y ago
  India is target Protonmail rather than all companies in countries that India doesn't have an agreement with though, right? My point was just that singling out Protonmail doesn't make sense and misses the point on how email works.
  - alephnerd 3y ago
    Think of laws like Blacklists/Deny Lists. A platform is default allowed until it denies to comply with Law Enforcement Requests. When that happens, a platform can by denied/blacklisted. This is why Protonmail is blocked in India and not Gmail or Yahoo. If Proton AG decided to ignore US Law Enforcement requests, it would get shut down the same way. This exact thing happened to Lavabit in 2013.
    - _heimdall 3y ago
      I may be getting out over my skis here, hopefully someone will correct me if so. But I believe this is the main distinction with a Common Law system, where everything is default legal unless regulated by legislation. Effectively, laws are only blocklists under legal systems based on Common Law. I don't know for sure if India is Common Law, though given its history with the British Empire I would guess that it isn't.
      - alephnerd 3y ago
        India is Common Law as well. Former British Dependencies like India, Malaysia, Singapore, Canada, South Africa, New Zealand, Ireland, and Australia are ruled under Common Law with additional colonial authoritarian flourishes, as these dependencies could be overruled by Westminster until the mid-late 1900s. England, Wales, and North Ireland are themselves Common Law, and it's somewhat common for Indian lawyers to cross apply to join the English Inns of Court as well. That said, modern India is starting to transition towards an American style common law system over the British one, as America has way more of an impact in India today. Civil/Roman/Latin Law is a continental thing. You'll see influences of it in former Spanish, French, and Russian colonies.
behringer 3y ago
That is completely untrue. Email supports end to end encryption between any two servers. You set each server up with a list of supported protocols and denied protocols. If either side can't agree on the encryption algorithm, then the email does not go through. If both sides do agree, which is almost always the case if both sides are using industry standard encryption methods, then the email is end to end encrypted. On top of that, we have PGP encryption which allows the user to encrypt the email from everybody including the email provider. Only the recipient email address and possibly the subject line would be readable to the email providers. As for the IP, if protonmail removes the sender's origin IP then it's removed and that's it. Email is one of our best methods of international communication available today.
- _heimdall 3y ago
  There aren't many services that support e2e encryption though. I've been a Protonmail user for years and only remember being able to send encrypted emails to other PM users, maybe Fastmail also supports the same protocols? Regardless, if I'm not mistaken encryption protocols are layered on and not part of the official email spec. I'm not 100% on that so may it was added to the spec as an optional feature, but by no means is it common (especially with the market share Gmail owns).
  - behringer 3y ago
    PGP supports all email carriers. But there's also server side encryption that is end to end. If both the sender and recipient uses a trusted mail server that uses encryption then nobody between the two can see the email.
  - protonmail 3y ago
    Hi! PGP is open source, and therefore Proton Mail's encryption is interoperable with anyone who uses PGP to encrypt their emails: https://proton.me/blog/what-is-pgp-encryption https://proton.me/blog/what-is-pgp-encryption. Proton Mail also allows you to send password-protected emails to anyone: https://proton.me/support/open-password-protected-emails https://proton.me/support/open-password-protected-emails.

alephnerd 3y ago

> inability to track the sender's IP is specific to Protonmail The issue is India doesn't have a judicial agreement with Switzerland over data sharing (which includes User IP Addresses) for criminal investigations [0] while the US does [1], and Protonmail only honors Swiss litigation [2] This should change with the new India-Switzerland FTA though. [0] - https://carnegieendowment.org/files/ParsheeraJha_DataAccess.pdf https://carnegieendowment.org/files/ParsheeraJha_DataAccess.... [1] - https://www.dataprivacyframework.gov/framework-article/1%E2%80%93NOTICE https://www.dataprivacyframework.gov/framework-article/1%E2%... [2] - https://proton.me/legal/law-enforcement https://proton.me/legal/law-enforcement

_heimdall 3y ago
India is target Protonmail rather than all companies in countries that India doesn't have an agreement with though, right? My point was just that singling out Protonmail doesn't make sense and misses the point on how email works.
- alephnerd 3y ago
  Think of laws like Blacklists/Deny Lists. A platform is default allowed until it denies to comply with Law Enforcement Requests. When that happens, a platform can by denied/blacklisted. This is why Protonmail is blocked in India and not Gmail or Yahoo. If Proton AG decided to ignore US Law Enforcement requests, it would get shut down the same way. This exact thing happened to Lavabit in 2013.
  - _heimdall 3y ago
    I may be getting out over my skis here, hopefully someone will correct me if so. But I believe this is the main distinction with a Common Law system, where everything is default legal unless regulated by legislation. Effectively, laws are only blocklists under legal systems based on Common Law. I don't know for sure if India is Common Law, though given its history with the British Empire I would guess that it isn't.
    - alephnerd 3y ago
      India is Common Law as well. Former British Dependencies like India, Malaysia, Singapore, Canada, South Africa, New Zealand, Ireland, and Australia are ruled under Common Law with additional colonial authoritarian flourishes, as these dependencies could be overruled by Westminster until the mid-late 1900s. England, Wales, and North Ireland are themselves Common Law, and it's somewhat common for Indian lawyers to cross apply to join the English Inns of Court as well. That said, modern India is starting to transition towards an American style common law system over the British one, as America has way more of an impact in India today. Civil/Roman/Latin Law is a continental thing. You'll see influences of it in former Spanish, French, and Russian colonies.

behringer 3y ago

That is completely untrue. Email supports end to end encryption between any two servers. You set each server up with a list of supported protocols and denied protocols. If either side can't agree on the encryption algorithm, then the email does not go through. If both sides do agree, which is almost always the case if both sides are using industry standard encryption methods, then the email is end to end encrypted. On top of that, we have PGP encryption which allows the user to encrypt the email from everybody including the email provider. Only the recipient email address and possibly the subject line would be readable to the email providers. As for the IP, if protonmail removes the sender's origin IP then it's removed and that's it. Email is one of our best methods of international communication available today.

_heimdall 3y ago
There aren't many services that support e2e encryption though. I've been a Protonmail user for years and only remember being able to send encrypted emails to other PM users, maybe Fastmail also supports the same protocols? Regardless, if I'm not mistaken encryption protocols are layered on and not part of the official email spec. I'm not 100% on that so may it was added to the spec as an optional feature, but by no means is it common (especially with the market share Gmail owns).
- behringer 3y ago
  PGP supports all email carriers. But there's also server side encryption that is end to end. If both the sender and recipient uses a trusted mail server that uses encryption then nobody between the two can see the email.
- protonmail 3y ago
  Hi! PGP is open source, and therefore Proton Mail's encryption is interoperable with anyone who uses PGP to encrypt their emails: https://proton.me/blog/what-is-pgp-encryption https://proton.me/blog/what-is-pgp-encryption. Proton Mail also allows you to send password-protected emails to anyone: https://proton.me/support/open-password-protected-emails https://proton.me/support/open-password-protected-emails.