7 ms·

Proton Mail suspended journalist accounts at request of cybersecurity agency

371 points by lehi 1y ago

daft_pink 1y ago
You either die a hero, or you live long enough to see yourself become the villain.
- luqtas 1y ago
  not all heroes wear capes, much less releases personal AI assistant to navigate your own data while the MAIL CLIENT AND CALENDAR APP is on beta on Linux for YEARS
SilverElfin 1y ago
I thought Proton was a confidentiality / privacy oriented thing. How do they even know who owns the accounts?
- gruez 1y ago
  Second paragraph of the article: >But last month, Proton disabled email accounts belonging to journalists reporting on security breaches of various South Korean government computer systems following a complaint by an unspecified cybersecurity agency
- guywithahat 1y ago
  You can disable an account without knowing who owns it, although they do have credit card/payment information now, and I don't think new accounts get encryption services unless they pay. That said, if your inbox is encrypted, protonmail does so on the client side with a second password. They can maybe delete the account, but proton mail doesn't know what the encrypted data is. What happens to new emails sent to a disabled address is anyone's guess though. Honestly I think they're doing the best they can given the circumstances
  - Sunspark 1y ago
    You are trusting them. They control the client, how the keys are created/stored, etc. Javascript, etc. If they were to suddenly turn one day, they could. This is the weakness of cloud services.
    - HeatrayEnjoyer 1y ago
      Or just use an open source email client. I would expect their own apps to be open source, are they not?
      - j-bos 1y ago
        Indeed they are: https://github.com/ProtonMail https://github.com/ProtonMail If you, or someone else, like please audit the repos. Could be cool to see trusted forks of some of the clients.
      - balamatom 1y ago
        Using an email client requires a Proton Bridge thing that acts as a local IMAP/SMTP proxy: https://github.com/ProtonMail/proton-bridge https://github.com/ProtonMail/proton-bridge As if disabling the issue tracker and stonewalling pull requests wasn't bad enough, seeing how it is built out of multiple layers that communicate via gRPC was what made me instantly lose all trust in Proton. I don't know who's been doing their hiring but just from one look at that kludge it's evident they've lost the plot altogether. (There's a third-party alternative called Hydroxide, but it's experimental. Haven't been able to send emails through it from Thunderbird yet, though I've only looked into this for a few hours recently.)
    - j-bos 1y ago
      Trusting them is almost guaranteed, but it doesn't have to be, sort of. The clients are opensource so you literally clone, audit, and run the clients locally. Full disclosure, I use Proton and overall trust them so unless I see strong evidence of abuse or lies on their part I'm inclined to post contextualizing comments on stuff like this, b/c well I don't wanna host my own mail server, at least not in prod.
- mr90210 1y ago
  They all are until they get threatened. Soon or later we will default to analog means. It’s not looking good.
gruez 1y ago
Can proton even win here? The obvious solution would be "we don't take down unless there's a court order", but then you'd get exposé pieces saying how protonmail is a den for drug dealers/pedophiles/doxxers/cyber criminals.
- a0123 1y ago
  No. They currently do cooperate and they go get the odd bad press about this. So doing what they actually claim to do would change nothing. Their current stance is just a cop out.
- autoexec 1y ago
  > The obvious solution would be "we don't take down unless there's a court order", but then you'd get exposé pieces saying how protonmail is a den for drug dealers/pedophiles/doxxers/cyber criminals I think it'd be crazy to make a service worse because of worry over potential hit pieces that might whine about a perfectly reasonable policy. It isn't as if Proton Mail hasn't been accused of those things before anyway (along with accusations of being a honeypot and not private enough). It's better to have integrity and fight for your users than to cave just to avoid click bait articles by people with irrational views.
- vorpalhex 1y ago
  Yes. Most CERT requests are valid and good and should be obliged.. but there should be a manual check involved. Especially when an appeal is filed. Especially when the content is obviously security reporting. Both extremes are wrong - don't ignore CERTs and don't mindlessly oblige them. Find one of the many reasonable middlegrounds.
  - bigiain 1y ago
    > but there should be a manual check involved. I suspect there's a few email providers where the marketing and reputation management teams are hurriedly adding "check the user and the user's affiliated social media reach before suspending this account, and before responding to any support requests from the user." My new elevator pitch: We proactively research all of our customer's users and new signups to assign them a social media reach score. We then automate escalating external account action requests or user support calls for highly ranked users to senior staff and providing details and evidence of their social reach and industry affiliations. While we generate revenue from these customers, our primary revenue stream is the aggregated data we acquire while doing this, and selling access to that data to law enforcement, the insurance industry, and Nation State intelligence organisations across the globe.
BrandoElFollito 1y ago
The silence of proton can only be interpreted to their disadvantage. This is not very smart and will make everyone doubt on them. While I like the idea of a safe and uncompromising service, proton seems less so now.
- bigiain 1y ago
  Ladar Levison and Lavabit certainly earned themselves credibility there a dozen years or so back. Sadly https://lavabit.com/ https://lavabit.com/ currently just says "We are not accepting new users at this time. Mail services remain online, while we work on improving our website code. "
IncreasePosts 1y ago
So, is this a case where Random Cybersecurity/Tech Group mistakes responsible disclosure for hacking, and then reported it to Proton, which took their word for it and disabled the account?
fivefives55555 1y ago
I've been following this on X/Twitter and I think one of the most egregious things that's important to point out is that folks from Phrack reached out to Proton in private multiple times, and Proton ghosted them. Proton only engaged with them and then reinstated the accounts after Phrack went public and their X/Twitter post went viral. It also looks like one of the writers filed an appeal with Proton and Proton denied the appeal, so they manually investigated the incident and refused to reinstate the account and then only did after this got attention on X/Twitter. So make no mistake about it: Proton didn't just disable the accounts after whatever CERT complained, which would have been bad enough - they also didn't do anything about it until this started getting lots of eyes on social media.
- j-bos 1y ago
  > Phrack reached out to Proton in private multiple times, and Proton ghosted them. According to Proton's response in the linked reddit post: https://news.ycombinator.com/item?id=45227356 https://news.ycombinator.com/item?id=45227356 They say: "Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the size of Proton, especially since the message was sent to our legal team inbox on a Saturday, rather than through the proper customer support channels."
  - nsagent 1y ago
    To be honest, I've found Proton's public customer service representatives to be very duplicitous, so it's hard to take their word at face value. It's pretty ridiculous to see their response to legitimate concerns start with: "That doesn't sound right..." 80-90% of the time.
  - commmentator 1y ago
    You'll note that Proton's PR only mentions the second date - " last one on Sep 6 with a 48-hour deadline." Proton doesn't mention that the first email from Phrack which Proton ignored was weeks prior to that, which is what led to the second email in the first place. You'll also note that Proton doesn't mention that their Abuse Team refused to re-anable the account after the article author did the appeals process, as per Phrack's timeline at the top of their article.
bix6 1y ago
The Reddit response from Proton: https://www.reddit.com/r/ProtonMail/comments/1nd1nrc/comment/ndg68pz/ https://www.reddit.com/r/ProtonMail/comments/1nd1nrc/comment... I’d like more details about the initial CERT contact if anyone knows anything
ChrisArchitect 1y ago
A related submission a few days ago with similar Proton response on twitter: https://news.ycombinator.com/item?id=45201153 https://news.ycombinator.com/item?id=45201153
sitzkrieg 1y ago
proton always glowed but just straight up bending to unnamed agencies puts em rank and file with every single other provider
- lo_zamoyski 1y ago
  Is refusal realistic? It's nice in the abstract, but in practice, there are plenty of ways to coerce illegitimate compliance.
  - bigiain 1y ago
    No company is gonna seriously refuse when their jurisdiction's equivalent of the FBI or NSA turn up with a court authorised order. As James Mikkens said: "YOU'RE STILL GONNA BE MOSSAD’ED UPON" But it'd be nice to be able to expect your email provider to not cave in to a request from some other counties CERT organisation without pushing back for evidence and some sort of proper judicial authority behind the request.
    - crossroadsguy 1y ago
      This article, right? https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
      - bigiain 1y ago
        indeed
segmondy 1y ago
When people show you themselves, believe them. Proton is no longer to be trusted. Use at your own risk.
nsagent 1y ago
I've need a paying subscriber to Proton since 2018, but I recently canceled my subscription (which ends in November). I just got fed up with the constant bugginess and jankiness of their offerings. Any suggestions for mail hosting and VPN? I hear good things about Fastmail and mailbox.org (I see they very recently rebranded to just mailbox and revamped their offering). Also, I've been a heavy user of the SimpleLogin alias service. Any suggestions for easily porting all those accounts to a new provider? Manually changing each and every account to a new email seems painful.
- idle_zealot 1y ago
  I'm using Fastmail and Mullvad. Both seem to work pretty well and are reasonably priced. You could also host your own on VPSs if you're feeling adventurous.
- esseph 1y ago
  > constant bugginess and jankiness of their offerings This is something I had not heard (also have been a paying user for a very long time). I've never encountered a bug, to my knowledge. I did dislike that when they released photo storage they didn't have a proper search feature.
  - teekert 1y ago
    Same here, no bugs in Proton apps and I’m still a happy subscriber.
  - throwway120385 1y ago
    For me the jank is in their billing and the plans I can purchase. I can either have a Business Mail Essentials plan or a Business Password plan, but if i want both at the same time I have to buy a plan that's three times as expensive or drop my custom domain name.
    - esseph 1y ago
      I do dislike their billing options when it comes to feature / service selection.
antonymoose 1y ago
PSA: Proton deletes “unused” accounts after one year, and defines unused in some opaque sense where receiving but not sending emails is “unused” so I’m in a nasty position of my iCloud account being unrecoverable. Going to have to spend nontrivial time off boarding my account.
- nicce 1y ago
  Do they still use that old shady billing? You could get "credits" from coupon to upgrade your plan, and once it ends, it automatically subscribes and your account bill goes to negative. Unless you pay that, your account is locked. Happened to me some long time ago and haven't used Proton since.
- coppsilgold 1y ago
  > defines unused in some opaque sense where receiving but not sending emails is “unused” "You are considered active if you log in and use our services once a year. Simply logging in to any Proton service on our web, desktop, or mobile apps at least once a year is enough." <https://proton.me/support/inactive-accounts https://proton.me/support/inactive-accounts>
  - antonymoose 1y ago
    I had the mobile app and login. That wasn’t enough. Reading emails was not enough.
    - dotnet00 1y ago
      I almost never use my protonmail to send emails, just reading, mostly on phone too. Has been fine so far.
- NullPrefix 1y ago
  Is this for paid accounts too? If you prepay for 5 years and get lost at sea for 3 years, should you expect your proton to still work?
rvnx 1y ago
It is very naive to believe that email providers and VPNs do not have to respect the laws. If this would be the case they would not be approved by any payment providers at all. On top of that, add the possibility that hosting companies and upstream network peers would shut them down.
- Hizonner 1y ago
  And what specific law did you have in mind, exactly? You do know what law required Proton to act as it did at each step in the story, right? You wouldn't just come up with random non-sequiturs, right?
pagansRpedos 1y ago
It's because the journalists were covering the professor-student rape scandal at UIUC Champaign that was covered up by Champaign and other governing bodies.
- bigiain 1y ago
  Citation required? That's not what Phrak says here: https://phrack.org/issues/72/7_md https://phrack.org/issues/72/7_md Where they say "Proton was used only for email and only to communicate with South Korea"
0xbadc0de5 1y ago
Last time I checked, hacking was still a crime in most jurisdictions - even if the target is considered a geopolitical adversary. This sort of activity is also against the Proton ToS. Once KrCERT and Proton were alerted to this activity, they would have been legally obligated to act. That's not to say I feel any sympathy to the target - who by all counts has done a fair bit of damage. But this sort of hacktivism / vigilantism simply isn't helpful. There's a high likelihood that one or more nation states / law enforcement agencies may have had active operations directed against this threat actor derailed by such activity. tl;dr - If you're going to conduct such activities, practice proper OPSEC. And don't let your desire for attention / recognition take priority over staying on the right side of the law.
dotnet00 1y ago
Hmm going to wait and see how this plays out, maybe it's time to look at alternatives, assuming that my custom domain email isn't somehow locked to them.
drnick1 1y ago
And this is why I host my own email server, even if I am not a journalist investigating governments or anything of the sort. It's a matter of control over my computing.
- abnercoimbre 1y ago
  Common folklore is that this is extremely onerous to self-host (and have it work successfully.) How did you go about it?
  - drnick1 1y ago
    The common folklore is just FUD. The main issue is deliverability to the likes of Google, Microsoft, Yahoo, etc. You need a clean fixed IP in non-residential block and a sufficiently aged domain or your mail will be flagged as spam or rejected. Alternatively, you can use a relay service for outbound email. Besides the deliverability issue, hosting email is fairly trivial from a technical standpoint; on Linux, the standard utilities are Postfix, Dovecot and OpenDKIM. The server is for my own use, so I don't even bother with spam and AV filters. Even if you can't send email at all (unlikely if you use an outbound relay), there are very significant privacy benefits to having your own server. I send very few emails relative to the number I receive. You couldn't pay me enough to go back to one of big commercial providers.
    - bigiain 1y ago
      > You need a clean fixed IP in non-residential block Feels like that's carrying a lot of load there? Where do you get those? I doubt any inexpensive VPS provider has any clean IP addresses? AWS charge you $5/month for an elastic IP address, and I bet you'd need to cycle through their pool of those looking for one that hasn't been blacklisted recently? There's another thing to consider here too. I was selfhosting my own mail, but back in 2013/14 I investigated all my mail, and even though I'd avoided Google/Microsoft,Yahoo et al. - over 80% of my personal email was on their servers because that's where my correspondents were. I pretty much gave up maintaining my own (slightly over complicated) stuff and gave in and chose to accept the "Do no evil" company at face value. 4 or 5 years later that company no longer existed, even though they continue with the same name today.
chatmasta 1y ago
Proton dropped from the top spot on my list of “user-first email platforms” when they announced they’ll be deleting accounts that haven’t logged into their service in some arbitrary amount of time. If I can’t rely on my email / messaging / phone / communications provider to keep an open line for as long as I need it – whether that’s one year or two years or twenty years, then I’m not going to use it. And if they require payment in exchange for providing that service, then it better accept privacy-preserving payment, but even then, I’m probably not going to use it. Proton had a great thing going where their VPN service and business service funded the cost of maintaining free accounts. The fact that they chose to destroy years of trust by announcing a deletion policy, indicated to me that they no longer care about their users more than they care about running a business. I’m not even asking for something unreasonable. It’d be one thing if they didn’t want to maintain free accounts with no activity but hundreds of gigabytes of storage. But they haven’t stratified the limit by storage usage. If you’ve got a free account consuming a few megabytes of storage, maybe an email you setup for the government service you interact with every few years… well you better make sure you remember to do the arbitrary chore of logging into that account every year, or Proton will just delete it, no questions asked. Maybe they’ll send you some reminders if you gave them a “recovery” email, but that defeats the point of signing up to a privacy-preserving email service and calls into question the premise that they even are one. (In related news, I need to text myself on Google Voice every few months or they’re gonna delete the number I use for 2FA on critical services… and this is an account that has $4 of credit loaded into it from ten years ago…)
- nullhole 1y ago
  > deleting accounts that haven’t logged into their service in some arbitrary amount of time One year, to be exact: https://proton.me/support/inactive-accounts https://proton.me/support/inactive-accounts
  - crossroadsguy 1y ago
    It's not exact or strict. They may or may not delete.
- neobrain 1y ago
johnklos 1y ago
The true value of a company can be measured by our ability to communicate with them. If we can't communicate except after public outrage, then what does that say about the company? Here's a genuine question: is Proton Mail the least shitty of companies that provide email services? I self-host email and will continue until I die. But for others who need a company to do this for them, is Proton Mail the least shitty of options? Does this change the evaluation? I'm genuinely curious about the opinion of others here.
- dbpcut 1y ago
  [dead]
- jegp 1y ago
  What's your stack? After reading this, self hosting suddenly appeals to me.
  - seszett 1y ago
    OpenSMTPd + Dovecot is extremely easy to setup and maintain. For my parents, I registered a domain on OVH and they use the free email accounts they come with. So that's an independent, ready to migrate, email account for about 8 euros per year.
  - BLKNSLVR 1y ago
    Not who you asked, but I self-host some non-critical mail domains using Mailu[0], which is a set of docker containers. It's been fairly low maintenance. Ease of setup depends on your technical knowledge, but if I can do it, and you're on HN asking the question, you'll probably manage. [0]: https://mailu.io/ https://mailu.io/
  - thr0w4w4y1337 1y ago
    So, now you have to worry about your VPS/Internet provider deplatforming you. Or about your domain name being seized. And spam filtration, backups, redundancy... I'm not saying email self hosting should not be done, I just say a bit of planning should be done. DNS seems like the most annoying part, it is SPoF by design. The problem can be mitigated, but seems like cannot be solved. For example, owning multiple domain names in multiple jurisdictions. And round-robin them. You cannot eliminate SPoF for any one specific service you want to login using email. But you won't lose access to everything at once. Edit: P.s. At the same time, owning your domain for mail seems to be one of the most impactful things to do to reduce digital serfdom. Banned at *mail? Just switch those MX records and go on.
drnick1 1y ago
As far as I can remember, you don't even get IMAP access on the Proton free tier. For me, that's a non-starter. The privacy claims are also mostly marketing, as it is basically impossible to verify what Proton actually does when approached by a three-letter agency. I wouldn't use email anyway if I had something to hide, the email protocol wasn't designed with secrecy of communications in mind. For that, Signal seems far better, or perhaps a self-hosted, encrypted Matrix room.
KingOfCoders 1y ago
From the Proton/X discussion in the Intercept article "Big Tech CEOs are tripping over themselves to kiss the ring precisely because Trump represents an unprecedented challenge to their monopolistic dominance.” They don't know how this is going, from what I see Trump threatens something not to change something, but to get something. If there is any anti-trust drive it's there to shake the tree, not to break up big tech. Trump loves big US corporations, like those in the 50s and 60s, those pre-Bell-breakup.
Ey7NFZ3P0nzAe 1y ago
I'm worried and surprised to see the many comments here that, contrary to what I'm used to reading here, nobody seems to have dug deeper, looked critically at the evidence. Quite a lot of just ad hominem and insinuations. This looks like brigading to me. Which is the only way for govs to fight against protonmail: spreading doubt. Hence I am reinforced to continue being a strong supporter of Proton.
demarq 1y ago
Proton does not do anything it says in the tin. Just a warning
shauntest12321 1y ago
Forward Email fan for the fact they are 100% open source. Easy access to the developers. All others closed source in most regards.
0-_-0 1y ago
Proton's response copied from a Reddit thread: Hi everyone, No, Proton did not knowingly block journalists’ email accounts. Our support for journalists and those working in the public interest has been demonstrated time and again through actions, not just words. In this case, we were alerted by a CERT that certain accounts were being misused by hackers in violation of Proton’s Terms of Service. This led to a cluster of accounts being disabled. Because of our zero-access architecture, we cannot see the content of accounts and therefore cannot always know when anti-abuse measures may inadvertently affect legitimate activism. Our team has reviewed these cases individually to determine if any can be restored. We have now reinstated 2 accounts, but there are other accounts we cannot reinstate due to clear ToS violations. Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the size of Proton, especially since the message was sent to our legal team inbox on a Saturday, rather than through the proper customer support channels. The situation has unfortunately been blown out of proportion without giving us a fair chance to respond to the initial outreach. Thank you for your understanding, The Proton Team
- BoredPositron 1y ago
  This makes the situation even worse for me. CERTs lack any legal authority to compel action or enforce compliance. Without a thorough and fast post mortem analysis, this incident is deeply concerning for anyone who relies on Proton as their primary email provider. I guess getting trigger happy just comes as soon as you get a bigger user base but that's exactly when you get caught slipping. Like they did with the false positives it honestly reads like: "We have good relationships and trust this CERT so we carpet bombed all accounts they send us without even looking at them." I wonder what would have happened to accounts or users without the reach on socials.
  - 93po 1y ago
    they didnt do it because CERT said they legally had to - they did it presumably because they pay CERT to catch abuse and misuse and take action based on their findings
deleted 1y ago
[deleted]
Imustaskforhelp 1y ago
Side note regarding proton that it seems that people are mentioning the fact that ip is being tracked with user creation in proton mail? So if someone downloads proton vpn and uses it that way, then I always considered it to be the best vpn (even better than mullvad) but I guess I was wrong... I would still use protonvpn but I will try to migrate towards quite frankly more services from now on.. Email should just be a way to discuss what should be your matrix account or xmpp or even signal... Another thing that I want to point out is that I had once went into network permissions etc. in proton docs and tried to write a comment and write stuff etc. and I am not sure about the writing stuff but although these do feel "encrypted" but I saw a thing in the api response when I did curl or something which showed logs so I assumed proton keeps logs.. Another problem I feel is that since proton is only encrypted via your password which you enter into the system and it seems that you can change the password if you have something like phone verification. Fundamentally something like this can only work if they have the keys, so they are having the keys to your encrypted account. I am sure that there are ways of adding your own private key too but how many people using proton are doing that? Fundamentally, this is how the stack will work or has to work imo. You are trusting them because of lack of conflicts. They have built their name on privacy and so everyone will leave if it they are less private but the thing is, is that they might be using some open source tech that might have an update that couldn't be audited or somehow get hacked themselves and since proton might have some juicy targets like journalists. People's lives may be on the cutting edge. I heard this somewhere that I wish to share, you want technologically private solutions not because you don't trust someone but rather that it should remove the need of trusting in the first place. Proton hasn't / can't reach it imo. I don't mean any hate towards proton but that was my understanding. I still use it and in fact Please let me know if I caught something wrong or what I am saying is correct. My purpose is not to spread misinformation but rather inform my opinions/correct them if I am wrong.. (I may be wrong, I usually am [my most loved line from the book how to win friends and influence people]) I feel as if we need to get things like pi etc. or whatever and atleast to me hosting something like matrix seems okay-ish I am not sure. Email just doesn't feel as if a good protocol for privacy.
yieldcrv 1y ago
Proton mail is a exercise in gullibility
WarOnPrivacy 1y ago
https://archive.ph/ITtIB https://archive.ph/ITtIB

371 points by lehi 1y ago

daft_pink 1y ago

You either die a hero, or you live long enough to see yourself become the villain.

luqtas 1y ago
not all heroes wear capes, much less releases personal AI assistant to navigate your own data while the MAIL CLIENT AND CALENDAR APP is on beta on Linux for YEARS

SilverElfin 1y ago

I thought Proton was a confidentiality / privacy oriented thing. How do they even know who owns the accounts?

gruez 1y ago
Second paragraph of the article: >But last month, Proton disabled email accounts belonging to journalists reporting on security breaches of various South Korean government computer systems following a complaint by an unspecified cybersecurity agency
guywithahat 1y ago
You can disable an account without knowing who owns it, although they do have credit card/payment information now, and I don't think new accounts get encryption services unless they pay. That said, if your inbox is encrypted, protonmail does so on the client side with a second password. They can maybe delete the account, but proton mail doesn't know what the encrypted data is. What happens to new emails sent to a disabled address is anyone's guess though. Honestly I think they're doing the best they can given the circumstances
- Sunspark 1y ago
  You are trusting them. They control the client, how the keys are created/stored, etc. Javascript, etc. If they were to suddenly turn one day, they could. This is the weakness of cloud services.
  - HeatrayEnjoyer 1y ago
    Or just use an open source email client. I would expect their own apps to be open source, are they not?
    - j-bos 1y ago
      Indeed they are: https://github.com/ProtonMail https://github.com/ProtonMail If you, or someone else, like please audit the repos. Could be cool to see trusted forks of some of the clients.
    - balamatom 1y ago
      Using an email client requires a Proton Bridge thing that acts as a local IMAP/SMTP proxy: https://github.com/ProtonMail/proton-bridge https://github.com/ProtonMail/proton-bridge As if disabling the issue tracker and stonewalling pull requests wasn't bad enough, seeing how it is built out of multiple layers that communicate via gRPC was what made me instantly lose all trust in Proton. I don't know who's been doing their hiring but just from one look at that kludge it's evident they've lost the plot altogether. (There's a third-party alternative called Hydroxide, but it's experimental. Haven't been able to send emails through it from Thunderbird yet, though I've only looked into this for a few hours recently.)
  - j-bos 1y ago
    Trusting them is almost guaranteed, but it doesn't have to be, sort of. The clients are opensource so you literally clone, audit, and run the clients locally. Full disclosure, I use Proton and overall trust them so unless I see strong evidence of abuse or lies on their part I'm inclined to post contextualizing comments on stuff like this, b/c well I don't wanna host my own mail server, at least not in prod.
mr90210 1y ago
They all are until they get threatened. Soon or later we will default to analog means. It’s not looking good.

gruez 1y ago

Can proton even win here? The obvious solution would be "we don't take down unless there's a court order", but then you'd get exposé pieces saying how protonmail is a den for drug dealers/pedophiles/doxxers/cyber criminals.

a0123 1y ago
No. They currently do cooperate and they go get the odd bad press about this. So doing what they actually claim to do would change nothing. Their current stance is just a cop out.
autoexec 1y ago
> The obvious solution would be "we don't take down unless there's a court order", but then you'd get exposé pieces saying how protonmail is a den for drug dealers/pedophiles/doxxers/cyber criminals I think it'd be crazy to make a service worse because of worry over potential hit pieces that might whine about a perfectly reasonable policy. It isn't as if Proton Mail hasn't been accused of those things before anyway (along with accusations of being a honeypot and not private enough). It's better to have integrity and fight for your users than to cave just to avoid click bait articles by people with irrational views.
vorpalhex 1y ago
Yes. Most CERT requests are valid and good and should be obliged.. but there should be a manual check involved. Especially when an appeal is filed. Especially when the content is obviously security reporting. Both extremes are wrong - don't ignore CERTs and don't mindlessly oblige them. Find one of the many reasonable middlegrounds.
- bigiain 1y ago
  > but there should be a manual check involved. I suspect there's a few email providers where the marketing and reputation management teams are hurriedly adding "check the user and the user's affiliated social media reach before suspending this account, and before responding to any support requests from the user." My new elevator pitch: We proactively research all of our customer's users and new signups to assign them a social media reach score. We then automate escalating external account action requests or user support calls for highly ranked users to senior staff and providing details and evidence of their social reach and industry affiliations. While we generate revenue from these customers, our primary revenue stream is the aggregated data we acquire while doing this, and selling access to that data to law enforcement, the insurance industry, and Nation State intelligence organisations across the globe.

BrandoElFollito 1y ago

The silence of proton can only be interpreted to their disadvantage. This is not very smart and will make everyone doubt on them. While I like the idea of a safe and uncompromising service, proton seems less so now.

bigiain 1y ago
Ladar Levison and Lavabit certainly earned themselves credibility there a dozen years or so back. Sadly https://lavabit.com/ https://lavabit.com/ currently just says "We are not accepting new users at this time. Mail services remain online, while we work on improving our website code. "

IncreasePosts 1y ago

So, is this a case where Random Cybersecurity/Tech Group mistakes responsible disclosure for hacking, and then reported it to Proton, which took their word for it and disabled the account?

fivefives55555 1y ago

I've been following this on X/Twitter and I think one of the most egregious things that's important to point out is that folks from Phrack reached out to Proton in private multiple times, and Proton ghosted them. Proton only engaged with them and then reinstated the accounts after Phrack went public and their X/Twitter post went viral. It also looks like one of the writers filed an appeal with Proton and Proton denied the appeal, so they manually investigated the incident and refused to reinstate the account and then only did after this got attention on X/Twitter. So make no mistake about it: Proton didn't just disable the accounts after whatever CERT complained, which would have been bad enough - they also didn't do anything about it until this started getting lots of eyes on social media.

j-bos 1y ago
> Phrack reached out to Proton in private multiple times, and Proton ghosted them. According to Proton's response in the linked reddit post: https://news.ycombinator.com/item?id=45227356 https://news.ycombinator.com/item?id=45227356 They say: "Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the size of Proton, especially since the message was sent to our legal team inbox on a Saturday, rather than through the proper customer support channels."
- nsagent 1y ago
  To be honest, I've found Proton's public customer service representatives to be very duplicitous, so it's hard to take their word at face value. It's pretty ridiculous to see their response to legitimate concerns start with: "That doesn't sound right..." 80-90% of the time.
- commmentator 1y ago
  You'll note that Proton's PR only mentions the second date - " last one on Sep 6 with a 48-hour deadline." Proton doesn't mention that the first email from Phrack which Proton ignored was weeks prior to that, which is what led to the second email in the first place. You'll also note that Proton doesn't mention that their Abuse Team refused to re-anable the account after the article author did the appeals process, as per Phrack's timeline at the top of their article.

bix6 1y ago

The Reddit response from Proton: https://www.reddit.com/r/ProtonMail/comments/1nd1nrc/comment/ndg68pz/ https://www.reddit.com/r/ProtonMail/comments/1nd1nrc/comment... I’d like more details about the initial CERT contact if anyone knows anything

ChrisArchitect 1y ago

A related submission a few days ago with similar Proton response on twitter: https://news.ycombinator.com/item?id=45201153 https://news.ycombinator.com/item?id=45201153

sitzkrieg 1y ago

proton always glowed but just straight up bending to unnamed agencies puts em rank and file with every single other provider

lo_zamoyski 1y ago
Is refusal realistic? It's nice in the abstract, but in practice, there are plenty of ways to coerce illegitimate compliance.
- bigiain 1y ago
  No company is gonna seriously refuse when their jurisdiction's equivalent of the FBI or NSA turn up with a court authorised order. As James Mikkens said: "YOU'RE STILL GONNA BE MOSSAD’ED UPON" But it'd be nice to be able to expect your email provider to not cave in to a request from some other counties CERT organisation without pushing back for evidence and some sort of proper judicial authority behind the request.
  - crossroadsguy 1y ago
    This article, right? https://www.usenix.org/system/files/1401_08-12_mickens.pdf https://www.usenix.org/system/files/1401_08-12_mickens.pdf
    - bigiain 1y ago
      indeed

segmondy 1y ago

When people show you themselves, believe them. Proton is no longer to be trusted. Use at your own risk.

nsagent 1y ago

I've need a paying subscriber to Proton since 2018, but I recently canceled my subscription (which ends in November). I just got fed up with the constant bugginess and jankiness of their offerings. Any suggestions for mail hosting and VPN? I hear good things about Fastmail and mailbox.org (I see they very recently rebranded to just mailbox and revamped their offering). Also, I've been a heavy user of the SimpleLogin alias service. Any suggestions for easily porting all those accounts to a new provider? Manually changing each and every account to a new email seems painful.

idle_zealot 1y ago
I'm using Fastmail and Mullvad. Both seem to work pretty well and are reasonably priced. You could also host your own on VPSs if you're feeling adventurous.
esseph 1y ago
> constant bugginess and jankiness of their offerings This is something I had not heard (also have been a paying user for a very long time). I've never encountered a bug, to my knowledge. I did dislike that when they released photo storage they didn't have a proper search feature.
- teekert 1y ago
  Same here, no bugs in Proton apps and I’m still a happy subscriber.
- throwway120385 1y ago
  For me the jank is in their billing and the plans I can purchase. I can either have a Business Mail Essentials plan or a Business Password plan, but if i want both at the same time I have to buy a plan that's three times as expensive or drop my custom domain name.
  - esseph 1y ago
    I do dislike their billing options when it comes to feature / service selection.

antonymoose 1y ago

PSA: Proton deletes “unused” accounts after one year, and defines unused in some opaque sense where receiving but not sending emails is “unused” so I’m in a nasty position of my iCloud account being unrecoverable. Going to have to spend nontrivial time off boarding my account.

nicce 1y ago
Do they still use that old shady billing? You could get "credits" from coupon to upgrade your plan, and once it ends, it automatically subscribes and your account bill goes to negative. Unless you pay that, your account is locked. Happened to me some long time ago and haven't used Proton since.
coppsilgold 1y ago
> defines unused in some opaque sense where receiving but not sending emails is “unused” "You are considered active if you log in and use our services once a year. Simply logging in to any Proton service on our web, desktop, or mobile apps at least once a year is enough." <https://proton.me/support/inactive-accounts https://proton.me/support/inactive-accounts>
- antonymoose 1y ago
  I had the mobile app and login. That wasn’t enough. Reading emails was not enough.
  - dotnet00 1y ago
    I almost never use my protonmail to send emails, just reading, mostly on phone too. Has been fine so far.
NullPrefix 1y ago
Is this for paid accounts too? If you prepay for 5 years and get lost at sea for 3 years, should you expect your proton to still work?

rvnx 1y ago

It is very naive to believe that email providers and VPNs do not have to respect the laws. If this would be the case they would not be approved by any payment providers at all. On top of that, add the possibility that hosting companies and upstream network peers would shut them down.

Hizonner 1y ago
And what specific law did you have in mind, exactly? You do know what law required Proton to act as it did at each step in the story, right? You wouldn't just come up with random non-sequiturs, right?

pagansRpedos 1y ago

It's because the journalists were covering the professor-student rape scandal at UIUC Champaign that was covered up by Champaign and other governing bodies.

bigiain 1y ago
Citation required? That's not what Phrak says here: https://phrack.org/issues/72/7_md https://phrack.org/issues/72/7_md Where they say "Proton was used only for email and only to communicate with South Korea"

0xbadc0de5 1y ago

Last time I checked, hacking was still a crime in most jurisdictions - even if the target is considered a geopolitical adversary. This sort of activity is also against the Proton ToS. Once KrCERT and Proton were alerted to this activity, they would have been legally obligated to act. That's not to say I feel any sympathy to the target - who by all counts has done a fair bit of damage. But this sort of hacktivism / vigilantism simply isn't helpful. There's a high likelihood that one or more nation states / law enforcement agencies may have had active operations directed against this threat actor derailed by such activity. tl;dr - If you're going to conduct such activities, practice proper OPSEC. And don't let your desire for attention / recognition take priority over staying on the right side of the law.

dotnet00 1y ago

Hmm going to wait and see how this plays out, maybe it's time to look at alternatives, assuming that my custom domain email isn't somehow locked to them.

drnick1 1y ago

And this is why I host my own email server, even if I am not a journalist investigating governments or anything of the sort. It's a matter of control over my computing.

abnercoimbre 1y ago
Common folklore is that this is extremely onerous to self-host (and have it work successfully.) How did you go about it?
- drnick1 1y ago
  The common folklore is just FUD. The main issue is deliverability to the likes of Google, Microsoft, Yahoo, etc. You need a clean fixed IP in non-residential block and a sufficiently aged domain or your mail will be flagged as spam or rejected. Alternatively, you can use a relay service for outbound email. Besides the deliverability issue, hosting email is fairly trivial from a technical standpoint; on Linux, the standard utilities are Postfix, Dovecot and OpenDKIM. The server is for my own use, so I don't even bother with spam and AV filters. Even if you can't send email at all (unlikely if you use an outbound relay), there are very significant privacy benefits to having your own server. I send very few emails relative to the number I receive. You couldn't pay me enough to go back to one of big commercial providers.
  - bigiain 1y ago
    > You need a clean fixed IP in non-residential block Feels like that's carrying a lot of load there? Where do you get those? I doubt any inexpensive VPS provider has any clean IP addresses? AWS charge you $5/month for an elastic IP address, and I bet you'd need to cycle through their pool of those looking for one that hasn't been blacklisted recently? There's another thing to consider here too. I was selfhosting my own mail, but back in 2013/14 I investigated all my mail, and even though I'd avoided Google/Microsoft,Yahoo et al. - over 80% of my personal email was on their servers because that's where my correspondents were. I pretty much gave up maintaining my own (slightly over complicated) stuff and gave in and chose to accept the "Do no evil" company at face value. 4 or 5 years later that company no longer existed, even though they continue with the same name today.

chatmasta 1y ago

Proton dropped from the top spot on my list of “user-first email platforms” when they announced they’ll be deleting accounts that haven’t logged into their service in some arbitrary amount of time. If I can’t rely on my email / messaging / phone / communications provider to keep an open line for as long as I need it – whether that’s one year or two years or twenty years, then I’m not going to use it. And if they require payment in exchange for providing that service, then it better accept privacy-preserving payment, but even then, I’m probably not going to use it. Proton had a great thing going where their VPN service and business service funded the cost of maintaining free accounts. The fact that they chose to destroy years of trust by announcing a deletion policy, indicated to me that they no longer care about their users more than they care about running a business. I’m not even asking for something unreasonable. It’d be one thing if they didn’t want to maintain free accounts with no activity but hundreds of gigabytes of storage. But they haven’t stratified the limit by storage usage. If you’ve got a free account consuming a few megabytes of storage, maybe an email you setup for the government service you interact with every few years… well you better make sure you remember to do the arbitrary chore of logging into that account every year, or Proton will just delete it, no questions asked. Maybe they’ll send you some reminders if you gave them a “recovery” email, but that defeats the point of signing up to a privacy-preserving email service and calls into question the premise that they even are one. (In related news, I need to text myself on Google Voice every few months or they’re gonna delete the number I use for 2FA on critical services… and this is an account that has $4 of credit loaded into it from ten years ago…)

nullhole 1y ago
> deleting accounts that haven’t logged into their service in some arbitrary amount of time One year, to be exact: https://proton.me/support/inactive-accounts https://proton.me/support/inactive-accounts
- crossroadsguy 1y ago
  It's not exact or strict. They may or may not delete.
neobrain 1y ago

johnklos 1y ago

The true value of a company can be measured by our ability to communicate with them. If we can't communicate except after public outrage, then what does that say about the company? Here's a genuine question: is Proton Mail the least shitty of companies that provide email services? I self-host email and will continue until I die. But for others who need a company to do this for them, is Proton Mail the least shitty of options? Does this change the evaluation? I'm genuinely curious about the opinion of others here.

dbpcut 1y ago
[dead]
jegp 1y ago
What's your stack? After reading this, self hosting suddenly appeals to me.
- seszett 1y ago
  OpenSMTPd + Dovecot is extremely easy to setup and maintain. For my parents, I registered a domain on OVH and they use the free email accounts they come with. So that's an independent, ready to migrate, email account for about 8 euros per year.
- BLKNSLVR 1y ago
  Not who you asked, but I self-host some non-critical mail domains using Mailu[0], which is a set of docker containers. It's been fairly low maintenance. Ease of setup depends on your technical knowledge, but if I can do it, and you're on HN asking the question, you'll probably manage. [0]: https://mailu.io/ https://mailu.io/
- thr0w4w4y1337 1y ago
  So, now you have to worry about your VPS/Internet provider deplatforming you. Or about your domain name being seized. And spam filtration, backups, redundancy... I'm not saying email self hosting should not be done, I just say a bit of planning should be done. DNS seems like the most annoying part, it is SPoF by design. The problem can be mitigated, but seems like cannot be solved. For example, owning multiple domain names in multiple jurisdictions. And round-robin them. You cannot eliminate SPoF for any one specific service you want to login using email. But you won't lose access to everything at once. Edit: P.s. At the same time, owning your domain for mail seems to be one of the most impactful things to do to reduce digital serfdom. Banned at *mail? Just switch those MX records and go on.

drnick1 1y ago

As far as I can remember, you don't even get IMAP access on the Proton free tier. For me, that's a non-starter. The privacy claims are also mostly marketing, as it is basically impossible to verify what Proton actually does when approached by a three-letter agency. I wouldn't use email anyway if I had something to hide, the email protocol wasn't designed with secrecy of communications in mind. For that, Signal seems far better, or perhaps a self-hosted, encrypted Matrix room.

KingOfCoders 1y ago

From the Proton/X discussion in the Intercept article "Big Tech CEOs are tripping over themselves to kiss the ring precisely because Trump represents an unprecedented challenge to their monopolistic dominance.” They don't know how this is going, from what I see Trump threatens something not to change something, but to get something. If there is any anti-trust drive it's there to shake the tree, not to break up big tech. Trump loves big US corporations, like those in the 50s and 60s, those pre-Bell-breakup.

Ey7NFZ3P0nzAe 1y ago

I'm worried and surprised to see the many comments here that, contrary to what I'm used to reading here, nobody seems to have dug deeper, looked critically at the evidence. Quite a lot of just ad hominem and insinuations. This looks like brigading to me. Which is the only way for govs to fight against protonmail: spreading doubt. Hence I am reinforced to continue being a strong supporter of Proton.

demarq 1y ago

Proton does not do anything it says in the tin. Just a warning

shauntest12321 1y ago

Forward Email fan for the fact they are 100% open source. Easy access to the developers. All others closed source in most regards.

0-_-0 1y ago

Proton's response copied from a Reddit thread: Hi everyone, No, Proton did not knowingly block journalists’ email accounts. Our support for journalists and those working in the public interest has been demonstrated time and again through actions, not just words. In this case, we were alerted by a CERT that certain accounts were being misused by hackers in violation of Proton’s Terms of Service. This led to a cluster of accounts being disabled. Because of our zero-access architecture, we cannot see the content of accounts and therefore cannot always know when anti-abuse measures may inadvertently affect legitimate activism. Our team has reviewed these cases individually to determine if any can be restored. We have now reinstated 2 accounts, but there are other accounts we cannot reinstate due to clear ToS violations. Regarding Phrack’s claim on contacting our legal team 8 times: this is not true. We have only received two emails to our legal team inbox, last one on Sep 6 with a 48-hour deadline. This is unrealistic for a company the size of Proton, especially since the message was sent to our legal team inbox on a Saturday, rather than through the proper customer support channels. The situation has unfortunately been blown out of proportion without giving us a fair chance to respond to the initial outreach. Thank you for your understanding, The Proton Team

BoredPositron 1y ago
This makes the situation even worse for me. CERTs lack any legal authority to compel action or enforce compliance. Without a thorough and fast post mortem analysis, this incident is deeply concerning for anyone who relies on Proton as their primary email provider. I guess getting trigger happy just comes as soon as you get a bigger user base but that's exactly when you get caught slipping. Like they did with the false positives it honestly reads like: "We have good relationships and trust this CERT so we carpet bombed all accounts they send us without even looking at them." I wonder what would have happened to accounts or users without the reach on socials.
- 93po 1y ago
  they didnt do it because CERT said they legally had to - they did it presumably because they pay CERT to catch abuse and misuse and take action based on their findings

deleted 1y ago

[deleted]

Imustaskforhelp 1y ago

Side note regarding proton that it seems that people are mentioning the fact that ip is being tracked with user creation in proton mail? So if someone downloads proton vpn and uses it that way, then I always considered it to be the best vpn (even better than mullvad) but I guess I was wrong... I would still use protonvpn but I will try to migrate towards quite frankly more services from now on.. Email should just be a way to discuss what should be your matrix account or xmpp or even signal... Another thing that I want to point out is that I had once went into network permissions etc. in proton docs and tried to write a comment and write stuff etc. and I am not sure about the writing stuff but although these do feel "encrypted" but I saw a thing in the api response when I did curl or something which showed logs so I assumed proton keeps logs.. Another problem I feel is that since proton is only encrypted via your password which you enter into the system and it seems that you can change the password if you have something like phone verification. Fundamentally something like this can only work if they have the keys, so they are having the keys to your encrypted account. I am sure that there are ways of adding your own private key too but how many people using proton are doing that? Fundamentally, this is how the stack will work or has to work imo. You are trusting them because of lack of conflicts. They have built their name on privacy and so everyone will leave if it they are less private but the thing is, is that they might be using some open source tech that might have an update that couldn't be audited or somehow get hacked themselves and since proton might have some juicy targets like journalists. People's lives may be on the cutting edge. I heard this somewhere that I wish to share, you want technologically private solutions not because you don't trust someone but rather that it should remove the need of trusting in the first place. Proton hasn't / can't reach it imo. I don't mean any hate towards proton but that was my understanding. I still use it and in fact Please let me know if I caught something wrong or what I am saying is correct. My purpose is not to spread misinformation but rather inform my opinions/correct them if I am wrong.. (I may be wrong, I usually am [my most loved line from the book how to win friends and influence people]) I feel as if we need to get things like pi etc. or whatever and atleast to me hosting something like matrix seems okay-ish I am not sure. Email just doesn't feel as if a good protocol for privacy.

yieldcrv 1y ago

Proton mail is a exercise in gullibility

WarOnPrivacy 1y ago

https://archive.ph/ITtIB https://archive.ph/ITtIB