6 ms·
Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on reques
by makeitdouble 2y ago
Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address.
In this case the email address was the lead, but I wonder what other info would be enough to get the phone provider to spill the beans. For instance would an IP address used at a specific time be uniquely identifying if it was VPNed by Apple at that moment ?
Or a Google Ad cookie that could get correlated to other devices showing similar behavior (the same way Google tracks households or related accounts) ?
- fbdab103 2y agoWhile an IP address is not an identity, it can still zero in on a location. I suspect governments and ISPs all keep historical logs of who was assigned what address.
- srockets 2y agoAn IP address in itself is not an identity, but it can be easily resolved to one. This is why IP address are considered PII, and are handled like such by any competent security organization.
- fiso64 2y ago>but it can be easily resolved to one Do you have any source to back that up? Last I heard a random person or company won't have a way to find out the real identity given just an IP in general.
- srockets 2y agoPer multiple opinions I got from people whose job was to advise me on the matter, a 2016 ECJ ruling[0] suggests that it doesn't matter if a provider can find a person from their IP address or any other detail, but that there exists a scenario where it is possible. I am not sure how the CCPA treats IP address, but unless you're at Google or Facebook, it doesn't matter. Few can afford to build separately for the EU and the rest of the world, and hence err on adapting the strictest interpretation. -- [0] https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:62014CJ0582 https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CEL...
- paledot 2y agoBut the threat actor in this case is a state, which does have that ability. (And data brokers of varying degrees of shadiness can and do provide this info to anyone for a price.)
- matheusmoreira 2y ago> I suspect governments and ISPs all keep historical logs of who was assigned what address. They do. It's often required by law.
- VelesDude 2y ago1 maybe 2KB of storage for the IP addresses of an individual for a year. Of course they are doing it even if accidentally.
- Sayrus 2y agoYou may need a bit more than that. Especially for shared IPs or when using CGNAT as you need which IP and Port-range was used and during what time-range.
- zzz999 2y ago[dead]
- refurb 2y agoIt can be used to identify a location, but not an individual. I assume it could be easily challenged in court (network was compromised, “i give out my WiFi to anyone who visits my home”) without other supporting evidence.
- BodyCulture 2y agoIt would be great to have the discussion open for people with actual knowledge and experience of the issues. To keep the discussion interesting, please do not assume or guess, thanks!
- Adrox 2y agoNot in Germany, where you are responsible for the Wifi access, see hundreds of copyrights fines each year... Anyway, it puts the persons living in that location on the radar of the police, and other evidence can be collected (For example by getting a warrant and taking all electronics out of the "location").
- immibis 2y agoApparently in Germany you can do public wifi now, but you have to register as a telecommunications provider, and comply with all law enforcement requests to wiretap your wifi.
- RachelF 2y agoWhy are ProtonMail keeping this IP and email information in their logs?
- datadeft 2y agoBecause of legal requirements?
- samjmck 2y agoThe identification came from the recovery email.
- AnonC 2y agoIn a previous case some years ago, a French activist’s IP address was provided by Proton on court order. Proton does store IP address and does provide it when legally demanded to.
- haakon 2y agoThey were legally compelled to add IP logging for that specific user. After this incidence, they went on to obtain a court ruling in Switzerland, where they operate, so that this specific attack cannot happen again. In their blog post about it [1], they instruct concerned users to access their account over Tor. Of course when Proton say they don't log, we just have to take their word for it. People who don't want that element of trust can use Tor. Personally I believe their story in this case. [1] https://proton.me/blog/climate-activist-arrest https://proton.me/blog/climate-activist-arrest
- BodyCulture 2y agoIs it possible now to sign up using TOR? It didn’t work a few years ago when I tried and never visited this website ever again.
- protonmail 2y ago
- lkdfjlkdfjlg 2y ago> Proton Mail is in the title because it's where they went first, but the actual identification (real name, phone number etc.) seems to come from Apple on request for info related to the address. Irrelevant to the point. Proton Mail provided authorities with user data.
- pc86 2y agoPlease quote from the linked article where it says that (it doesn't).
- EclipseMantis 2y agoAre you sure? > The core of the controversy stems from Proton Mail providing the Spanish police with the recovery email address associated with the Proton Mail account of an individual using the pseudonym ‘Xuxo Rondinaire.’
- obelus 2y agoThe recovery email is optional, the rest of the information was provided by Apple.
- lkdfjlkdfjlg 2y agoNo one is talking about the optionality of the information. We're saying that Proton Mail provided the authorities with user data, which it did.