5 ms·
Proton is a company not some charity and their services and what you do with them are hosted literally on someone else's computers that are outside of your cont
by drooopy 3y ago
Proton is a company not some charity and their services and what you do with them are hosted literally on someone else's computers that are outside of your control. They will comply with requests made by law encorcement if that's what they are forced to do, full stop.
- illiac786 3y agoProton Mail is a zero knowledge service and the whole point of zero knowledge is to protect yourself against court orders. Hence I think it's pretty clear for ZK customers that a company has to abide to the local law... The article is about what Proton knows, not what they will or will not do if the law knocks on their door.
- chinathrow 3y agoIf they allow you to give them knowledge about you, then they're not zero knowledge, at all.
- illiac786 3y agoIf they don't know your username they can't offer a service. Hence zero knowledge services cannot exist based on your line of argumentation. I feel you are being disingenuous though and you perfectly know what is commonly referred to as "zero knowledge", and specifically that the critical point is always "what does the zero knowledge applies to?". Proton sees your IP, your login, email headers, for example. They don't know your email body and can't hand it over.
- Tijdreiziger 3y agoThey necessarily know the e-mail body when the (unencrypted) e-mail first comes in.
- Ancapistani 3y agoThis applies only to emails sent from an external provider. Proton’s “secure email” functionality is limited to Proton addresses.
- Tijdreiziger 3y agoEven when you send a Proton-to-Proton e-mail, Proton’s e-mail client is encrypting that e-mail, so you still have to trust them.
- protonmail 3y agoNote that our cryptography is open-source and independently audited: https://openpgpjs.org/ https://openpgpjs.org/. The encryption keys are generated with your Proton account password, which we don't have access to, so we have no way to decrypt your content stored encrypted on our servers.
- deleted 3y ago[deleted]
- illiac786 3y agoYou are describing a problem without solution here. What is your preferred approach to this dilemma?
- Tijdreiziger 3y agoI’m just saying that you should be aware of it. Whether it’s a problem or not depends on your threat model, of course.
- protonmail 3y agoExactly, and even in the case when the emails are coming from a non-Proton service, the incoming emails are encrypted immediately after being checked for spam, phishing or malware: https://proton.me/support/proton-mail-encryption-explained https://proton.me/support/proton-mail-encryption-explained.
- deleted 3y ago[deleted]
- jeffbee 3y agoIf an entity exists for the purpose of subverting the exercise of legitimate government powers then the government in question should just bomb it flat. Tolerance would be dereliction of duty. Of course, Proton is not such an entity, but they are happy that you have fooled yourself into paying for this imaginary property.
- illiac786 3y agoHmmm, you're not a fan of civic disobedience and balance of powers it appears. I think abuse of power by government is common and wanting to get protection against it is a fair ask. And luckily this is not illegal in some countries. Finally, some government are not representing the people at all (dictatorship) and I am lucky I do not live in such a country, because then the existence of proton has a whole other level of merits.
- Ancapistani 3y agoI almost downvoted this, but decided to rebut instead. How far should this extend, in your opinion? Should the US be bombing cartels in Mexico? How about manufacturers of illicit goods like “Glock switches” in China? Tax avoidance firms in the US? The company registration division of the Turks and Caicos? How about the headquarters of domestic companies found to be in violation of federal regulations?
- layer8 3y agoThis may actually be a good point. Instead of storing your recovery address, they could only store a hash of it, and require an email to be sent from the recovery address to initiate the recovery process. Still not completely zero-knowledge, but an improvement.
- rendx 3y agoGiven the typical length and character set of email addresses, 'reversing' the hash can be considered trivial.
- layer8 3y agoPresumably you’d choose a long localpart for the recovery address. Proton could even require that.
- acdha 3y agoNot every mail system supports that and the longer & harder to guess it is the more likely it is that whatever disaster lead to needing the recovery process would also lose that information.
- layer8 3y agoThe rules on how long a local-part is allowed to be are very clear (https://datatracker.ietf.org/doc/html/rfc5321#section-4.5.3.1.1 https://datatracker.ietf.org/doc/html/rfc5321#section-4.5.3....), and once you’ve registered the address you would know that it works. You’d write it down and/or store it in your password manager like you would with any passphrase. I really don’t see the problem.
- acdha 3y agoIt’s not a question of whether it’s technically possible but practical to expect people to maintain a recovery address which is not otherwise used or guessable. If you can pull it off, sure, but from a security perspective I’d probably be looking for a way to avoid email at all for this mechanism since it just wasn’t designed around address privacy.
- takerjop 3y agoA google search will show Proton had cooperated before and given info leading to user arrest. THEY WILL 100% do it....sorry they did already. So it is greater than 100% from now onwards.
- illiac786 3y agogreater than 100% probability is audacious math. ALL companies must abide by the law. What did you expect? That they break the law? Not a very sustainable business model...
- hulitu 3y agoAny company will cooperate with law enforcement. There was a comment some days ago, in another thread, about a company, from US, which didn't want to cooperate. It didn't turn well for this company.