5 ms·

As I pointed out they also route all of their traffic through Cloudflare. They also have been caught red-handed logging the IP of an activist despite having pre

by janmo 2y ago

As I pointed out they also route all of their traffic through Cloudflare. They also have been caught red-handed logging the IP of an activist despite having previously advertised that they didn't keep any logs. Now they are using misleading terms such as "privacy by default" which according to them means that by default they won't log you but that they can be "forced" to log a user if a law enforcement agency asks them to do so... Sources: https://therecord.media/protonmail-forced-to-collect-an-activists-ip-address-in-police-investigation https://therecord.media/protonmail-forced-to-collect-an-acti... https://x.com/andyyen/status/1884907496705339544 https://x.com/andyyen/status/1884907496705339544

logifail 2y ago
> by default they won't log you but that they can be "forced" to log a user if a law enforcement agency asks them to do so Not wishing to be negative, but how (or more specifically for how long) can any provider refuse to cooperate with law enforcement/the legal system?
- janmo 2y ago
  The ones that don't end up shut down, in legal trouble or in jail. See Lavabit, Tor Mail, Telegram, EncroChat, Sky ECC and others.
  - nicce 2y ago
    > Telegram You know that Telegram is giving plenty much of information in these days? They even changed the privacy policy. https://techstartups.com/2024/09/06/telegram-silently-updates-its-privacy-policy-removes-privacy-guarantee-after-ceo-pavel-durov-arrest/ https://techstartups.com/2024/09/06/telegram-silently-update...
    - janmo 2y ago
      Seems like they didn't give enough. https://edition.cnn.com/2024/09/23/tech/telegram-ceo-durov-arrest-user-data-changes/index.html https://edition.cnn.com/2024/09/23/tech/telegram-ceo-durov-a...
    - yapyap 2y ago
      Yeah, after they got into trouble with the law
      - sharpshadow 2y ago
        In trouble.. France keeps the CEO hostage and blackmails him with decades of jail for numerous crimes committed over Telegram.
  - maeil 2y ago
    You forgot the mother of all: QWest.
- fulafel 2y ago
  Framing the question a bit differently could help: The aim should be to engineer the system so that you don't (and can't) have access to the information, so you minimize vulnerability to legal attacks. A strawman mod to protonmail could be to mandate the use of a VPN
  - logifail 2y ago
    > The aim should be to engineer the system so that you don't (and can't) have access to the information So when law enforcement and/or a three-letter agency rocks up with the legal paperwork (whether it be a National Security Letter or a local equivalent) and demands that "the system" be changed to start collecting the information they require, how should managers and engineers respond?
    - withinboredom 2y ago
      Generally, in my experience, people want to help "catch the criminal" -- note these are usually the worst of the worst at first. Then you start getting less and less information and starts becoming a process rather than an event/discussion. At least, that was my experience.
    - xethos 2y ago
      In a perfect world? The same way Apple did in ~2015. Argue that code is equivalent to speech, compelling them to write code to change the way the system works is compelling speech, and making that demand is unconstitutional. Apple gets lots of shit for a multitude of reasons, but their stance of "We built it to be securely encrypted from everyone but the owner; if you want to change that then fuck you, make me" is something everyone involved with should be proud of Realistically, we can't all be one of the richest companies in the modern era. Not every corporation has both morals, and pockets deep enough to pick a fight with not just a government, but the government of the country they're headquartered in. Frankly, shutting down like Lavabit is one of the better realistic scenarios if you're making promises of guaranteed privacy
      - taurknaut 2y ago
- cma 2y ago
  Asking them to is different than a warrant, they are free to refuse without one.
- mvieira38 2y ago
  Yup. Unless you're providing a truly zero-access encrypted service such as chat (e.g. Signal), there truly is no way of avoiding it while staying afloat as a private company. It seems people don't understand that email, which is Proton's bread and butter, CAN'T be fully anonymous and private in relation to the provider unless the provider severely limits functionality by only allowing PGP.
- Terretta 2y ago
  > how (or more specifically for how long) can any provider refuse to cooperate with law enforcement/the legal system That's a good question. https://en.wikipedia.org/wiki/Apple–FBI_encryption_dispute https://en.wikipedia.org/wiki/Apple–FBI_encryption_dispute As a result of this, Apple released a series of tools such as iCloud Advanced Security where they don't even have the keys (but causes user support issues, users can now "lose everything" with no recourse, which is why this isn't on by default; most users' "threat model" is more risk from deleting themselves accidentally than of nation state disclosure), along with the new feature that a phone not being actively used turns itself, off, and a few more things. // See also: https://www.wired.com/story/the-time-tim-cook-stood-his-ground-against-fbi/ https://www.wired.com/story/the-time-tim-cook-stood-his-grou... or https://archive.is/fvAqN https://archive.is/fvAqN
  - akimbostrawman 2y ago
    There exist different laws for different services. There VPN for example is exempt from the court order that got the IP while using there mail service. https://protonvpn.com/blog/threat-model/ https://protonvpn.com/blog/threat-model/
deleted 2y ago
[deleted]
ThePowerOfFuet 2y ago
https://xcancel.com/andyyen/status/1884907496705339544 https://xcancel.com/andyyen/status/1884907496705339544
LWIRVoltage 2y ago
Not sure why you didn't mention the law ruled heavily in favor of protonmail as a result of that massive fight between Protonmail and the authorities after that happened( they had to comply, while fighting back) - so as a result, they now have legal law BACKING for privacy even more and cannot be compelled like that again- when they got that court order that wanted them to retain logs, they , challenged it immediately- and the rulingcame down - and they won. They can no longer be compelled to cooperate in cases of crimes in other countries that match crimes in Swiss laws, as happened here- and this happened because they fought back -it just took time for the ruling to come down. https://www.msn.com/en-us/money/other/protonmail-wins-privacy-ruling-on-email-security/ar-AAPW6YU https://www.msn.com/en-us/money/other/protonmail-wins-privac... https://protonmail.com/blog/court-strengthens-email-privacy/ https://protonmail.com/blog/court-strengthens-email-privacy/ So they are in a good position on that aspect -most countries aren't as solid legally.
akimbostrawman 2y ago
Service has to follow the law more breaking news at 11....they even before this have always advocated to use a VPN or Tor if your threat model is law enforcement.

by janmo 2y ago

logifail 2y ago

> by default they won't log you but that they can be "forced" to log a user if a law enforcement agency asks them to do so Not wishing to be negative, but how (or more specifically for how long) can any provider refuse to cooperate with law enforcement/the legal system?

janmo 2y ago
The ones that don't end up shut down, in legal trouble or in jail. See Lavabit, Tor Mail, Telegram, EncroChat, Sky ECC and others.
- nicce 2y ago
  > Telegram You know that Telegram is giving plenty much of information in these days? They even changed the privacy policy. https://techstartups.com/2024/09/06/telegram-silently-updates-its-privacy-policy-removes-privacy-guarantee-after-ceo-pavel-durov-arrest/ https://techstartups.com/2024/09/06/telegram-silently-update...
  - janmo 2y ago
    Seems like they didn't give enough. https://edition.cnn.com/2024/09/23/tech/telegram-ceo-durov-arrest-user-data-changes/index.html https://edition.cnn.com/2024/09/23/tech/telegram-ceo-durov-a...
  - yapyap 2y ago
    Yeah, after they got into trouble with the law
    - sharpshadow 2y ago
      In trouble.. France keeps the CEO hostage and blackmails him with decades of jail for numerous crimes committed over Telegram.
- maeil 2y ago
  You forgot the mother of all: QWest.
fulafel 2y ago
Framing the question a bit differently could help: The aim should be to engineer the system so that you don't (and can't) have access to the information, so you minimize vulnerability to legal attacks. A strawman mod to protonmail could be to mandate the use of a VPN
- logifail 2y ago
  > The aim should be to engineer the system so that you don't (and can't) have access to the information So when law enforcement and/or a three-letter agency rocks up with the legal paperwork (whether it be a National Security Letter or a local equivalent) and demands that "the system" be changed to start collecting the information they require, how should managers and engineers respond?
  - withinboredom 2y ago
    Generally, in my experience, people want to help "catch the criminal" -- note these are usually the worst of the worst at first. Then you start getting less and less information and starts becoming a process rather than an event/discussion. At least, that was my experience.
  - xethos 2y ago
    In a perfect world? The same way Apple did in ~2015. Argue that code is equivalent to speech, compelling them to write code to change the way the system works is compelling speech, and making that demand is unconstitutional. Apple gets lots of shit for a multitude of reasons, but their stance of "We built it to be securely encrypted from everyone but the owner; if you want to change that then fuck you, make me" is something everyone involved with should be proud of Realistically, we can't all be one of the richest companies in the modern era. Not every corporation has both morals, and pockets deep enough to pick a fight with not just a government, but the government of the country they're headquartered in. Frankly, shutting down like Lavabit is one of the better realistic scenarios if you're making promises of guaranteed privacy
    - taurknaut 2y ago
cma 2y ago
Asking them to is different than a warrant, they are free to refuse without one.
mvieira38 2y ago
Yup. Unless you're providing a truly zero-access encrypted service such as chat (e.g. Signal), there truly is no way of avoiding it while staying afloat as a private company. It seems people don't understand that email, which is Proton's bread and butter, CAN'T be fully anonymous and private in relation to the provider unless the provider severely limits functionality by only allowing PGP.
Terretta 2y ago
> how (or more specifically for how long) can any provider refuse to cooperate with law enforcement/the legal system That's a good question. https://en.wikipedia.org/wiki/Apple–FBI_encryption_dispute https://en.wikipedia.org/wiki/Apple–FBI_encryption_dispute As a result of this, Apple released a series of tools such as iCloud Advanced Security where they don't even have the keys (but causes user support issues, users can now "lose everything" with no recourse, which is why this isn't on by default; most users' "threat model" is more risk from deleting themselves accidentally than of nation state disclosure), along with the new feature that a phone not being actively used turns itself, off, and a few more things. // See also: https://www.wired.com/story/the-time-tim-cook-stood-his-ground-against-fbi/ https://www.wired.com/story/the-time-tim-cook-stood-his-grou... or https://archive.is/fvAqN https://archive.is/fvAqN
- akimbostrawman 2y ago
  There exist different laws for different services. There VPN for example is exempt from the court order that got the IP while using there mail service. https://protonvpn.com/blog/threat-model/ https://protonvpn.com/blog/threat-model/

deleted 2y ago

[deleted]

ThePowerOfFuet 2y ago

https://xcancel.com/andyyen/status/1884907496705339544 https://xcancel.com/andyyen/status/1884907496705339544

LWIRVoltage 2y ago

Not sure why you didn't mention the law ruled heavily in favor of protonmail as a result of that massive fight between Protonmail and the authorities after that happened( they had to comply, while fighting back) - so as a result, they now have legal law BACKING for privacy even more and cannot be compelled like that again- when they got that court order that wanted them to retain logs, they , challenged it immediately- and the rulingcame down - and they won. They can no longer be compelled to cooperate in cases of crimes in other countries that match crimes in Swiss laws, as happened here- and this happened because they fought back -it just took time for the ruling to come down. https://www.msn.com/en-us/money/other/protonmail-wins-privacy-ruling-on-email-security/ar-AAPW6YU https://www.msn.com/en-us/money/other/protonmail-wins-privac... https://protonmail.com/blog/court-strengthens-email-privacy/ https://protonmail.com/blog/court-strengthens-email-privacy/ So they are in a good position on that aspect -most countries aren't as solid legally.

akimbostrawman 2y ago

Service has to follow the law more breaking news at 11....they even before this have always advocated to use a VPN or Tor if your threat model is law enforcement.