7 ms·
Proton AG of ProtonMail can provide FBI with your account recovery email
- deleted 3y ago[deleted]
- andersa 3y agoOf course they can, why is this news? If you intend to use it anonymously why would you set a recovery email to something that identifies you?
- dgellow 3y agoIt’s “news” because someone wanted to share it.
- codetrotter 3y agoEven the guy that ran Silk Road messed up and provided his email address with his real name online while posting about Silk Road before almost anyone had heard about Silk Road. This would later come back to bite him. > In that post, altoid asked for some programming help and gave his email address: rossulbricht@gmail.com. Doing a Google search for Ross Ulbricht, Mr. Alford found a young man from Texas who, just like Dread Pirate Roberts, admired the free-market economist Ludwig von Mises and the libertarian politician Ron Paul — the first of many striking parallels Mr. Alford discovered that weekend. https://www.nytimes.com/2015/12/27/business/dealbook/the-unsung-tax-agent-who-put-a-face-on-the-silk-road.html?_r=0 https://www.nytimes.com/2015/12/27/business/dealbook/the-uns... I don’t doubt for a second that a non-zero number of people similarly create a ProtonMail address for something shady and then provide a Gmail address using their real name as recovery address.
- blactuary 3y agoAlso, most recent tweet from that account blaming a Boeing jet hardware failure on diversity initiatives https://twitter.com/monetaryreset/status/1766156285249012151 https://twitter.com/monetaryreset/status/1766156285249012151
- throw089672 3y agoI'm currently a paying Proton customer. I'm dreaming of the day when I can cancel my subscription, to be honest. I've been a customer for a few years now. Long enough to watch the company steadily scope creep in ways I don't agree with. I wasn't 100% against the VPN idea. But then came Drive. And calendar. And ... Thing is, their core Mail product kinda sucks. End to end encryption is great, but have you ever actually tried to search for emails in Proton Mail? It's embarrassingly bad. I've lost count of the number of times I know exactly what I'm looking for in my mail archives, but no matter what search incantations I try, I can't find it. Their bridge clients are stupid. The way threaded replies are handled are stupid. Their web UI is frustratingly laggy in Firefox. I didn't particularly like their iOS app, and now that I'm on Android, I don't particularly like their Android app, either. For me, the next step is to self host my email. Yes yes, I know: "but self hosting your email is notoriously hard and bla bla bla!". Yes, no doubt. But email is important, and I've been burned by GMail, appalled by Fastmail spying for the Aussie govt (god, what a shitshow that was/is), and suffered constant disappointment as a Proton customer. Self hosting feels like the only option left.
- staunton 3y agoSelf hosting by itself is easy. The hard part is not getting all your sent emails marked as spam. It's not really a technical problem.
- deleted 3y ago[deleted]
- ChrisMarshallNY 3y agoI won't self-host, but even hosted mail can easily be spam-canned. I have found success, using SPF and DKIM signing. I had to do that, to get emails from my current app, through Apple's anonymizer.
- vel0city 3y agoThe thing I often see forgotten is ensuring your reverse DNS is set right.
- r721 3y agoSource article: https://www.forbes.com/sites/thomasbrewster/2023/08/08/protonmail-fbi-search-led-to-a-suspect-threatening-a-2020-election-official/ https://www.forbes.com/sites/thomasbrewster/2023/08/08/proto... (Aug 2023)
- protonmail 3y agoThe article doesn't link the original court filing or discuss what actually happened, and from the title alone, is rather misleading. The actual warrant can be found here and has the important missing details: https://drive.proton.me/urls/57QC5F26BW#nseYl6ICaQHm https://drive.proton.me/urls/57QC5F26BW#nseYl6ICaQHm The only data we could provide (in response to a binding Swiss legal order), was the user's recovery email address, which the user added himself, and is optional to begin with. Unfortunately, said user also used that recovery address to create a Twitter account, and Twitter turned over his phone number and IP address. Coincidentally, this case again proves that Proton Mail's encryption cannot be bypassed by law enforcement.
- henriquez 3y agoNo shit, Sherlock.
- nrthRockHopper 3y agoAnd they REALLY pester you to set one. They are not looking out for the user that's for sure.
- dewey 3y ago99% of users would be angry if they can’t restore their account because they forgot they credentials. A very small amount who needs the “privacy” knows that they shouldn’t set a non anonymous recovery email.
- ivan_gammel 3y agoProviding recovery methods is certainly care about the users. Proton isn’t the weakest point in the privacy defenses: user stupidity is. If you make FBI or DHS your enemy, you’d better think about your attack surface and don’t assume there exists something or someone who will secure your communications for you.
- hallway_monitor 3y agoThis comment feels like it's coming from communist Russia. You'd better not make the KGB your enemy. Be careful not to do anything they would take an interest in, even if it's not illegal. Is that the USA we're living in? Sure feels like it sometimes.
- layer8 3y agoThe user you are replying to doesn’t live in the USA. And for non-US citizens, not doing anything a US three-letter agency might take an interest in is certainly a consideration, because US law doesn’t protect them. (I’m not sure how much better the situation is for US citizens in actual practice.)
- ivan_gammel 3y agoIf I would try to do something against American interests, US law would be the last thing I would care about. I have more faith in German or Swiss law regarding privacy and if that’s not enough, keeping data in Russian or Chinese jurisdiction in that specific case would make more sense.
- drooopy 3y agoProton is a company not some charity and their services and what you do with them are hosted literally on someone else's computers that are outside of your control. They will comply with requests made by law encorcement if that's what they are forced to do, full stop.
- illiac786 3y agoProton Mail is a zero knowledge service and the whole point of zero knowledge is to protect yourself against court orders. Hence I think it's pretty clear for ZK customers that a company has to abide to the local law... The article is about what Proton knows, not what they will or will not do if the law knocks on their door.
- chinathrow 3y agoIf they allow you to give them knowledge about you, then they're not zero knowledge, at all.
- illiac786 3y agoIf they don't know your username they can't offer a service. Hence zero knowledge services cannot exist based on your line of argumentation. I feel you are being disingenuous though and you perfectly know what is commonly referred to as "zero knowledge", and specifically that the critical point is always "what does the zero knowledge applies to?". Proton sees your IP, your login, email headers, for example. They don't know your email body and can't hand it over.
- Tijdreiziger 3y agoThey necessarily know the e-mail body when the (unencrypted) e-mail first comes in.
- Ancapistani 3y agoThis applies only to emails sent from an external provider. Proton’s “secure email” functionality is limited to Proton addresses.
- nwhnwh 3y agoProton Saga
- janmo 3y agoA few years ago they already shared the IP Address of a user with law enforcement https://www.pcmag.com/news/protonmail-explains-why-it-shared-a-users-ip-address-with-police https://www.pcmag.com/news/protonmail-explains-why-it-shared...
- webstrand 3y agoThis feels like a post promoting FUD.
- arvindkumarc 3y agoThere was a bomb threat email sent by one of the proton mail users to South Indian state’s TN, some weeks ago. There was a big turmoil in 4-5 different schools in the city. Until the time they realised it to be a fake threat it was a nightmare. Some of my relatives were directly affected. What’s the privacy crap we talk here?
- tjpnz 3y agoThe authorities still have a choice in how they respond to it.
- arvindkumarc 3y agoThe problem is still not supported by proton and team.
- synicalx 3y agoProton very clearly states they will happily comply with law enforcement requests, IF it comes from the country they operate in.
- arvindkumarc 3y ago“If it comes from the country that they operate in. “ How’s that for privacy?
- tjpnz 3y agoWhat about privacy? Your whole argument seems to be that nobody deserves it.
- protonmail 3y agoNote that, at Proton, we are resolutely against the use of Proton services for purposes that are contrary to Swiss law (Proton is a Swiss company). The issue you're mentioning has been raised to the attention of the Swiss federal authorities, who have been in contact with the relevant Indian authorities. You can learn more about the case here: https://proton.me/blog/india-block-proton-mail https://proton.me/blog/india-block-proton-mail
- irusensei 3y agoCome on guys. If you are sending stuff that cannot be seen for some reason (potentially illegal on your (potentially) authoritarian (and this includes the US) country) do not use e-mail. It’s a protocol from decades ago when the web was gentle and naive. For SMTP to work lots of stuff must be readable by the MTAs handling the message. It is also highly centralized nowadays because it essentially works on a whitelist of what the big providers allow. Just give up.
- overstay8930 3y agoThis is why Apple didn't bother to implement E2EE for iCloud Mail, Calendar, and Contacts for Advanced Data Protection. It was just never meant for privacy, and any implementation would just have backdoors everywhere.
- sph 3y agoMake two Protonmail accounts, and use the other as recovery email address. Let the spooks figure that one out.
- jeffbee 3y agoPeople who think this is interesting news always turn out to have Twitter accounts completely full of batshit content. We live in a society. The state exists and has powers legitimized by the consent of the governed. Grow up and get over it.
- deleted 3y ago[deleted]
- overstay8930 3y agoPeople are surprised by this because Proton does the best it can to hide what information they actually have that isn't E2EE. Especially if you want to use it as a regular email service as a form of "privacy" (just read https://proton.me/mail/security https://proton.me/mail/security if you want to see how misleading they're trying to be. "Strong encryption at all times" *except when there isn't). They need a page like this to explain what exactly is E2EE and what isn't: https://support.apple.com/en-us/102651 https://support.apple.com/en-us/102651
- lolinder 3y agoSorry, but what exactly is misleading on that page? Over and over again it says that the content of your email is encrypted. It's very specific about that, and it's hard to see how someone would misinterpret that to include the account recovery email address. Is that claim itself not accurate?
- overstay8930 3y ago"We cannot read or give anyone else access to your emails." is completely false, Proton can read emails sent or received from non-proton infrastructure. They have to. I mean just look at the end-to-end encryption block, it's such an obvious dark pattern to make people believe they're getting end to end encryption, but when you actually read it they don't claim it at all, but how is someone who doesn't understand technobabble supposed to know that? They're just trying to pretend it's the same thing. If Proton was an American company they would have been fined into the ground for this stunt. Google wasn't even safe from the Incognito mode lawsuit.
- lolinder 3y agoHere's that block for reference: > With Proton Mail, emails are encrypted at all times, so we can never access your messages. The content of your emails is encrypted on your device before being sent to our servers, meaning only you and your intended recipient can decrypt it. > You can also use our Password-protected Emails feature to quickly send end-to-end encrypted emails to any email address, not just Proton Mail accounts. That first sentence, if left alone, could be interpreted to include incoming email from non-Proton Mail accounts. But as soon as you keep reading it clears that right up: * It clearly says that the security comes from encrypting outbound email on your device. * It clearly says that there is a way to encrypt outgoing email even to non-Proton Mail accounts. This isn't technobabble either, it's using terminology that is as accessible to laypeople as possible while still being precise in its language.
- peter_d_sherman 3y agoTransparency report pages for a few selected online email / social media platforms: Apple (iCloud, Mail, etc.): https://www.apple.com/legal/transparency/ https://www.apple.com/legal/transparency/ Facebook / Meta (Instagram, etc.): https://transparency.fb.com/reports/ https://transparency.fb.com/reports/ Google (Gmail, Google Voice, Search, etc.): https://transparencyreport.google.com/user-data/overview https://transparencyreport.google.com/user-data/overview Microsoft (Skype, Outlook 360, LinkedIn, etc.): https://www.microsoft.com/en-au/digitalsafety/transparency-reports https://www.microsoft.com/en-au/digitalsafety/transparency-r... Proton: https://proton.me/legal/transparency https://proton.me/legal/transparency TikTok: https://www.tiktok.com/transparency/en/reports/ https://www.tiktok.com/transparency/en/reports/ Twitter / X: https://transparency.x.com/en.html https://transparency.x.com/en.html
- synicalx 3y agoA simple-ish workaround here if you want to use email recovery; 1. Use a custom domain for your emails with Proton 2. Set an address @ that domain as the recovery address 3. If you need to recover, simply update your MX records to point elsewhere, and begin the recovery process from another provider temporarily.
- protonmail 3y agoRegarding the case in question, you can find the actual warrant here, to understand what exactly happened: https://drive.proton.me/urls/57QC5F26BW#nseYl6ICaQHm https://drive.proton.me/urls/57QC5F26BW#nseYl6ICaQHm The only data we could provide (in response to a binding Swiss legal order), was the user's recovery email address, which the user added himself, and is optional to begin with. Unfortunately, the said user also used that same recovery address to create a Twitter account, and Twitter turned over his phone number and IP address. Coincidentally, this case again proves that Proton Mail's encryption cannot be bypassed by law enforcement.