5 ms·

I'm always confused by the conspiratorial takes that think there's some service out there _not_ bound by the legal system where it resides. Obviously Proton ob

by 0x3f 6mo ago

I'm always confused by the conspiratorial takes that think there's some service out there _not_ bound by the legal system where it resides. Obviously Proton obeys the law and gives up data when it has to. Where are the services that don't do that? Somalia?

streetfighter64 6mo ago
I mean, is it really a conspiracy theory to want or believe that there are services (based in Europe) that don't hand over any and all user data to the USA government when asked? It's probably wrong to believe it to be the case, but just because it's wrong doesn't make it "conspiratorial". It's quite hypocritical of Proton to claim that they protect against government surveillance when they do things like this though [0]. Their legal team has probably ensured they don't claim anything strictly false, but the implication and the reality are wildly different. [0] https://freedom.press/digisec/blog/proton-mail-is-not-for-anonymity/ https://freedom.press/digisec/blog/proton-mail-is-not-for-an...
- pogue 6mo ago
  Proton's marketing definitely makes it sound like they are fully anonymous and wouldn't even have anything to hand over to law enforcement. Look at the wording they use to describe the product. Proton has always-on end-to-end encryption and zero‑access encryption, meaning even we do not have access to your data. [...] Based in Europe, Proton ensures your data is protected by some of the world’s strongest privacy laws. Because Proton isn’t a US‑based company, we can’t be compelled by laws such as the US CLOUD Act to hand over your data to the US government or terminate your services. [1] [1] https://proton.me/business/blog/proton-workspace https://proton.me/business/blog/proton-workspace Obviously as we have seen, they 100% can and will hand over your data to the US government. Yes, it's in the privacy policy/ToS & they're compiling with local laws. But that's clearly not how that reads. [In 2021, the Switzerland-based vendor provided local police with the IP address and device details of a netizen the cops were trying to identify. That individual – a French climate activist who was already known to police – was later arrested. Shortly after that kerfuffle, Proton removed the claim that it didn't track user IP addresses from its website. Proton has also previously been accused of offering real-time surveillance of users to authorities.] [2] [2] https://www.theregister.com/2024/05/13/infosec_in_brief/ https://www.theregister.com/2024/05/13/infosec_in_brief/ See also: ProtonMail filters this into its junk folder: New claim it goes out of its way to help cops spy https://www.theregister.com/2019/05/29/protonmail_dismisses_spying/ https://www.theregister.com/2019/05/29/protonmail_dismisses_... A search on your favorite search engine of 'instances where proton has turned over user info to the government' will provide further reading.
woutervdb 6mo ago
I think the key difference is the amount of data the service can offer when it is asked to do so by some legal entity. Signal famously claims to barely have any useful data to turn over when ordered to do so [1]. If some provider states they are pricacy-focused and protect your data from governments, but can still offer loads of your private data when ordered to, that damages their privacy claim. EDIT: "some provider like Proton" -> "some provider", never wanted to imply Proton specifically did or does this. [1] https://signal.org/blog/looking-back-as-the-world-moves-forward/ https://signal.org/blog/looking-back-as-the-world-moves-forw...
- Yiin 6mo ago
  can you expand on the "loads" part? ip and payment option?
  - woutervdb 6mo ago
    Keyword is "like": a service like Proton. No idea if and what data they have offered to their government. I was merely trying to offer an explanation to the parent commenter, who was wondering how people can critique pricacy-focused services offering data when required by law.
    - Yiin 6mo ago
      Fair enough, I agree. In Proton case, I'm biased because I used to work there ~2019-2022 and the company was basically printing money from subscriptions alone (covid likely helped with that), while fighting (pretty successfully) every request to avoid providing even that limited metadata, because alternative of ruining your core strength - privacy - meant the death of the business. I don't know if anything changed, but I'd bet the goals remain largely the same - providing good-enough privacy any commercial company can realistically give you. Unencrypted user data in this business is poison, and they're well aware fwiw.
      - Scarblac 6mo ago
        But don't they have both the encrypted data and the decryption keys? I don't remember giving them my keys to use, and I can look at my stuff from multiple devices so the keys aren't stored on my device. So they must have the ability to look at all that encrypted data anyway?
g6506jjjss 6mo ago
[dead]

by 0x3f 6mo ago

streetfighter64 6mo ago

I mean, is it really a conspiracy theory to want or believe that there are services (based in Europe) that don't hand over any and all user data to the USA government when asked? It's probably wrong to believe it to be the case, but just because it's wrong doesn't make it "conspiratorial". It's quite hypocritical of Proton to claim that they protect against government surveillance when they do things like this though [0]. Their legal team has probably ensured they don't claim anything strictly false, but the implication and the reality are wildly different. [0] https://freedom.press/digisec/blog/proton-mail-is-not-for-anonymity/ https://freedom.press/digisec/blog/proton-mail-is-not-for-an...

pogue 6mo ago
Proton's marketing definitely makes it sound like they are fully anonymous and wouldn't even have anything to hand over to law enforcement. Look at the wording they use to describe the product. Proton has always-on end-to-end encryption and zero‑access encryption, meaning even we do not have access to your data. [...] Based in Europe, Proton ensures your data is protected by some of the world’s strongest privacy laws. Because Proton isn’t a US‑based company, we can’t be compelled by laws such as the US CLOUD Act to hand over your data to the US government or terminate your services. [1] [1] https://proton.me/business/blog/proton-workspace https://proton.me/business/blog/proton-workspace Obviously as we have seen, they 100% can and will hand over your data to the US government. Yes, it's in the privacy policy/ToS & they're compiling with local laws. But that's clearly not how that reads. [In 2021, the Switzerland-based vendor provided local police with the IP address and device details of a netizen the cops were trying to identify. That individual – a French climate activist who was already known to police – was later arrested. Shortly after that kerfuffle, Proton removed the claim that it didn't track user IP addresses from its website. Proton has also previously been accused of offering real-time surveillance of users to authorities.] [2] [2] https://www.theregister.com/2024/05/13/infosec_in_brief/ https://www.theregister.com/2024/05/13/infosec_in_brief/ See also: ProtonMail filters this into its junk folder: New claim it goes out of its way to help cops spy https://www.theregister.com/2019/05/29/protonmail_dismisses_spying/ https://www.theregister.com/2019/05/29/protonmail_dismisses_... A search on your favorite search engine of 'instances where proton has turned over user info to the government' will provide further reading.

woutervdb 6mo ago

I think the key difference is the amount of data the service can offer when it is asked to do so by some legal entity. Signal famously claims to barely have any useful data to turn over when ordered to do so [1]. If some provider states they are pricacy-focused and protect your data from governments, but can still offer loads of your private data when ordered to, that damages their privacy claim. EDIT: "some provider like Proton" -> "some provider", never wanted to imply Proton specifically did or does this. [1] https://signal.org/blog/looking-back-as-the-world-moves-forward/ https://signal.org/blog/looking-back-as-the-world-moves-forw...

Yiin 6mo ago
can you expand on the "loads" part? ip and payment option?
- woutervdb 6mo ago
  Keyword is "like": a service like Proton. No idea if and what data they have offered to their government. I was merely trying to offer an explanation to the parent commenter, who was wondering how people can critique pricacy-focused services offering data when required by law.
  - Yiin 6mo ago
    Fair enough, I agree. In Proton case, I'm biased because I used to work there ~2019-2022 and the company was basically printing money from subscriptions alone (covid likely helped with that), while fighting (pretty successfully) every request to avoid providing even that limited metadata, because alternative of ruining your core strength - privacy - meant the death of the business. I don't know if anything changed, but I'd bet the goals remain largely the same - providing good-enough privacy any commercial company can realistically give you. Unencrypted user data in this business is poison, and they're well aware fwiw.
    - Scarblac 6mo ago
      But don't they have both the encrypted data and the decryption keys? I don't remember giving them my keys to use, and I can look at my stuff from multiple devices so the keys aren't stored on my device. So they must have the ability to look at all that encrypted data anyway?

g6506jjjss 6mo ago

[dead]