7 ms·
Hmm, I wish the author had reviewed Proton. I think it's kind of seen as a meme here? But I heavily rely on it and generally the Proton ecosystem is getting bet
by triyambakam 2y ago
Hmm, I wish the author had reviewed Proton. I think it's kind of seen as a meme here? But I heavily rely on it and generally the Proton ecosystem is getting better and better from a UX perspective
- canadiantim 2y agoI think Proton is more viewed as a honeypot
- ziddoap 2y agoI have not seen this take before, do you have any pointers to someone making this claim?
- thephyber 2y agoFrom my reading, the “ProtonMail is a honey trap” meme seems to be a popular rumor. Seems like there might be some smoke, but I haven’t seen any fire. Interesting breakdown[1] of one of the claims that E2E encryption on ProtonMail is broken. I’m assuming that Proton storage is a product from the same team as ProtonMail. [1] https://lemmygrad.ml/post/4177 https://lemmygrad.ml/post/4177
- kaanyalova 2y agoThe link on that post is down. The domain seems to be bought out. Did you not even check the post before posting it?
- rettichschnidi 2y agoFounders with US affiliation/physicist creating crypto products [1], faulty claims how the relevant Swiss law (BÜPF) applies to them [2], doing crypto in JavaScript on the client side, etc. To me, this smells like Crypto AG [3][4]. [1] https://proton.me/about/team https://proton.me/about/team [2] https://steigerlegal.ch/2019/07/27/protonmail-transparenzbericht-buepf/#buepf-anwendbarkeit https://steigerlegal.ch/2019/07/27/protonmail-transparenzber... [3] https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG [4] https://en.wikipedia.org/wiki/Operation_Rubicon https://en.wikipedia.org/wiki/Operation_Rubicon
- andrewinardeer 2y agoIs the suggestion that founders who have US affiliation are automatically in bed with three letter agencies?
- justinclift 2y agoIf they're physically located in the US, they have no way to stop (legal) coercion by the TLAs yeah?
- willis936 2y agoHow is this different than 90% of other VPN providers out there? The claim shouldn't be "Proton is a honeypot" but that "US VPNs are a honeypot".
- bartbutler 2y agoWe aren't physically located in the US.
- justinclift 2y agoWho's the "we" in this context? :)
- devman0 2y agoHow else would you do client side crypto for a website if not with JavaScript, isn't that kind of the point of how Proton does E2EE?
- stavros 2y agoCrypto for websites is completely broken (because the server can serve you whatever it wants), so doing crypto for websites at all is suspicious.
- iknowstuff 2y ago
- yieldcrv 2y agoIn account creation, requiring a phone number for “spam prevention” on Tor There was some deanonymizing like that, phone or credit card
- ranger_danger 2y agoKYC for a business is the smart legal move IMO whether it's technically required or not. Yes Proton is required to cooperate with law enforcement and government requests. Mullvad has been raided and Tutanota servers have been seized before too. Nobody is going to jail for you.
- gertop 2y agoKnowing as little as legally possible about your customer is the actually smart move if your entire selling point is privacy. Mail providers aren't bound to specific KYC regulation, proton could simply collect... Nothing. But they still do, why? The only legitimate reason they've given is to prevent spam. Fair enough, spammers using them will impact all users. But then why not impose a captcha when sending emails until you provide/validate your phone number? Possibly laziness, possibly complacency, possibly because it's a honeypot. When it comes to mullvad I'm not sure what you're trying to say? That Proton collecting personally identifiable information will prevent a raid/downtime? Feels like wishful thinking. Or are you suggesting that mullvad gave personal info to the police? Because they didn't. They couldn't. BECAUSE THEY DON'T FORCE YOU TO PROVIDE ANY.
- ranger_danger 2y ago> Knowing as little as legally possible about your customer is the actually smart move if your entire selling point is privacy. Yes I agree, but Proton also provides paid services and it is often the law that you must retain certain records in cases of audits, fraud etc., so there is some necessary KYC in that sense, but perhaps you're right in that they could keep less information, possibly at the cost of increased spam and decreased reputation though, so I understand the struggle. > But then why not impose a captcha when sending emails I suppose you could, but perhaps they weighed that possibility against it turning people off to using the service entirely? Not sure. > When it comes to mullvad I'm not sure what you're trying to say I was not trying to imply any of those things, just pointing out that companies still have to answer to law enforcement sometimes, that they are not immune from the laws of their country... because I have seen that some people who are staunch privacy enthusiasts seem to think companies have the luxury or practical ability (without detriment to their business) to simply not know their customer at all, and I don't think that is often the case. There is also a balance between simplicity and privacy. If you want anonymous payments that's fine, but crypto isn't as easy to use as a credit card. But if you handle credit cards, you must keep some data by law usually. Things like that. And some people might just want to sell your info to advertisers or data brokers, there's always that.
- triyambakam 2y agoSo what's the alternative?
- opengears 2y agoSelfhosting
- triyambakam 2y agoHmm, yeah that's true
- dartos 2y agoIf that 3+ TB attack CF just mitigated starts aiming at the entire ipv4 range (probably more spread out and cyclical), self hosting could die :( At least anything on UDP
- MarcusE1W 2y agoActually I don't think self-hosting is a viable solution for many people. Most server hosts are not security experts. IT security is really hard due to the many possible attack vectors you have to be knowledgeable about. In this article they assume that an attacker has compromised a server and I don't see how a layman can keep a server safe if experts want to compromise it in the long term if you just follow the reccomend maintenance. One day you will slip up. You might get a security related update late, did not hear about the last breach and are not aware how that relates to you, all sorts of scenarios. The only way to make it much more difficult to be compromised is if you don't connect your self-hosted cloud solution to the internet. But then it's not a really a cloud solution anymore. And that's before you have to consider that not everyone has the knowledge, time, interest to self host.
- create-username 2y agoThe alternative is to store Cryptomator vaults on any cloud. I’m looking forward for reading that proton drive allows cyberduck compatibility to manage Cryptomator vaults
- traceroute66 2y ago> I think Proton is more viewed as a honeypot Honestly, this FUD goes round more often than the seasons. As with most FUD, I'm still waiting for someone to prove it. And no, I don't buy the "smells like crypto AG" FUD, because you could use that sort of FUD for any of the US-cloud providers .... For example, when AWS says "trust us" in relation to their KMS or HSM services, can you, really ... eh eh eh .... how do you know KMS or HSM isn't just a software proxy that pretends to be what it is ? :) The fact is that if you are going to use someone else's servers to do something for you. Whether that someone is Proton or AWS or anyone else. You are, by definition, forced to abstract away your trust boundaries.
- 3np 2y agoWhich would make it all the more interesting to look at.
- willis936 2y agoI want to consider Proton, but they cap out their maximum storage very low with no option to increase. They're not really competing in this space because no one needs backup of only a few GB of data. https://proton.me/support/increase-storage-space/ https://proton.me/support/increase-storage-space/