12 ms·

ProtonMail deletes 'we don't log your IP' from website after activist arrested

681 points by angrymouse 5y ago

rvz 5y ago
It has been admitted. So they DO log your IP address when you use their service. So their customers have been lied to and have their privacy at risk. They cannot be trusted. So how long have ProtonMail kept this massive lie from its users then?
- jacquesm 5y ago
  Since day #1 would be a safe guess. I don't think the honor system is a good way to deal with companies so when a company writes something like that and I have no way of verifying it then I don't believe them. Worked pretty good so far.
  - drstewart 5y ago
    Just to be clear, there's no reason to believe you aren't a Chinese bot trying to sow division among western countries with this comment. It's a pretty safe guess and we have no way of verifying otherwise, after all.
    - jacquesm 5y ago
      Actually, there is. I've met 10's of HN'ers in person, this account is many years old and in pretty good standing, on top of that I have regular contact with the mods and many others on here IRL. You probably should have picked a different account than mine to try this particular line with.
      - syops 5y ago
        You missed, entirely, the point made by the person you responded to.
        drra 5y ago
        He didn't. By stating that he has now way of verifying he most likely meant that he exhaust all the ways, within his ability, to verify it. While the other poster made no effort to verify if Jacques is not a bot (it's easy). There's a difference in actively verifying given statements and passively accepting all that is written or all doubts that a busy mind can produce.
        syops 5y ago
        I think you may have missed it a bit too. jacquesm wrote: ...I have no way of verifying it then I don't believe them. Worked pretty good so far. This can't possibly be true since one can't verify everything. If one truly lived this then they'd be in an endless quest of verifying things. For instance, verifying verifiers. We are about to enter into an age of hard to detect AI generated articles and research so this isn't philosophical silliness.
- numpad0 5y ago
  It’s not a lie; it said “By default, we do not…”. So under any non-default situations they always could. I guess.
  - aqsalose 5y ago
    From the article: >The firm's privacy policy, which was updated yesterday, now says: "If you are breaking Swiss law, ProtonMail can be legally compelled to log your IP address as part of a Swiss criminal investigation." That makes it sound like they normally do not / did not log the IP, but then got orders from the police the log these particular IPs.
  - craftinator 5y ago
    If that is the case, why did they remove this statement? It seems to me that if the statement remained true even though this guy got arrested, it would be true under the "by default" clause. By removing it, they indicate it was never true; or, I suppose, they discovered just how fun it is to get people arrested, and decided to change their policy on the fly! I was even considering switching to them...
    - Sebb767 5y ago
      They clearly changed it because of the amount of backlash they got and because so many people called that statement deceptive. Just because it's true doesn't mean it's smart to say it and them removing the statement is absolutely reasonable.
    - pera 5y ago
      > If that is the case, why did they remove this statement? As far as I understand according to several comments I read here in HN "99%" of the people don't understand what "by default" means, making the sentence misleading for most.
      - ipaddr 5y ago
        Most were falling for the trickey in wording and they are mad. Throwing in a word like default changes the entire meaning. Instead of we don't log anything* * we log only when requested They should say your ip can be logged. It's like saying in big headline. No meat burgers * * meat means carots
- warp 5y ago
  According to their statement: > under Swiss law, Proton can be forced to collect information on accounts belonging to users under Swiss criminal investigation. This is obviously not done by default, but only if Proton gets a legal order for a specific account. So I assume normally IP addresses aren't logged. But they can enable IP address logging for specific accounts when ordered to do so. There is very little practical difference in the protection that gives users, but seemingly the privacy policy was technically correct.
- Sayrus 5y ago
  It is probably worth reading the clarifications made by ProtonMail [1] and their Transparency Report [2]. As a company based in Switzerland, it was clear to they could be compelled to do so and they never hid that fact. IMO a breach of trust would be actually logging IPs by default and before a legal request is made. [1] https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/ [2] https://protonmail.com/blog/transparency-report/ https://protonmail.com/blog/transparency-report/
- vmception 5y ago
  pretty much every comment section about protonmail has been pointing this out for years their rabid sycophants were too busy creaming themselves over "Swiss laws" to pay attention, going as far to demand proof when observers were merely pointing out the fundamental flaw in the Protonmail concept and incongruent advertising well, now there is proof
- vmception 5y ago
  pretty much every comment section about protonmail has been pointing this out for years their users were too fanatical over "Swiss laws" to pay attention, going as far to demand proof when observers were merely pointing out the fundamental flaw in the Protonmail concept and incongruent advertising well, now there is proof
  - maxo133 5y ago
    Today, i read somewhere while watching protonmail case comments, that switzerland has quite extensive surivellance laws which include possiblity of logging whole country inbound and outbound traffic for period of 6 months.
notjes 5y ago
PM was a hoax from the start. Just talk to the Lavabit guy Ladar Levison or look up Crypto AG.
- pixxel 5y ago
  Surely the onus is on you to backup your statement calling PM a hoax.
  - JohnWhigham 5y ago
    They marketed themselves as a safe, secure platform away from prying eyes. As a platform for dissidents. Turns out it was bullshit (as many already expected).
avereveard 5y ago
Can't wait for the "sorry we got caught" statement
ajay-b 5y ago
This is just ridiculous.. If they receive a notice to log your IP address, they should notify you first. My trust in ProtonMail is gone.
- zpeti 5y ago
  I'm pretty sure in US law authorities can stop you from doing that, that's why these services have warrant canaries which are legally sound. Not sure what swiss law is like, but I can imagine they might not be allowed to notify the user?
- warp 5y ago
  According to their statement: > Under Swiss law, it is obligatory for a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. But the timeline is unclear to me. If they notified you via e-mail, and then immediately turned on IP logging. So... you'd go and check your e-mail, learn about the third-party request, but by then it's too late as your IP address has already been logged?
  - dewey 5y ago
    > but by then it's too late as your IP address has already been logged? If someone is so sensitive about leaking their IP address and they access some service with their real IP and relying on a service's promise to not log it they already are not very careful to begin with.
  - destitude 5y ago
    Techcrunch already went over this and the law allows you to delay notifying the person so it is in effect a worthless statement to make since all authorities would simply tell them not to notify the user.
  - ipaddr 5y ago
    They could notify the user after the username is entered to say the ip with this account is being logged are you sure you want to login?
- 5y ago
0xdeadb00f 5y ago
This is not surprising to me. I will still continue to use ProtonMail. I never signed up because of the "no IP logging" thing. In fact, if I had seen it before I just plain wouldn't have believed it, and still used ProtonMail. But hindsight is 20/20
- qwertox 5y ago
  I see it the same way. For me it always meant that the default mode is not to log. It's normal that they have to enable logging if a valid request to do so comes from the authorities. Same goes for any of the German mail providers like mailbox.org or posteo.de ("We do not save your IP address when you visit or use our website. [...] To protect your privacy and for security reasons, we also delete any potential IP address entries made by local email programs from the email headers. Emails sent using our webmail interface or using email programs therefore contain neither your local nor your public IP address."). If the authorities can prove that they have a legitimate reason to expect them to log the IP addresses, then they must do it. They are all normal companies which need to abide by the law if they want to conduct business.
- istingray 5y ago
  What's important for you about using Protonmail then?
  - eternalban 5y ago
    It’s not Google.
ddevault 5y ago
ProtonMail has been fraught with problems for a long time, and it's good that serious issues are being brought to light. Their marketing is very good and critics of them have struggled to communicate to users for a while. The most important thing a serious privacy-minded service provider can do is be forthright and honest with users about the limitations of their privacy guarantees, particularly with respect to what hinges on math and what hinges on trust. ProtonMail has failed in this respect. It has always been the case, for example, that they could log these IPs, or that any incoming plaintext emails can be recorded before being encrypted at rest - and the fact that they're encrypted at rest is another thing we have to take on faith. Their proprietary components have always been a problem, and we also trust that they won't silently add key exfiltration to their webmail UI on the demands of a court. They don't explain any of this, they just pose themselves as experts on privacy and let vulnerable users stumble into law enforcement's hands because they care about their money more than their security. Good privacy systems do not rely on trust or faith, they rely on math. Where some trust is required, in the case of a commercial service provider, it is their solemn duty to be honest with users and explain to them what promises they can and cannot make, and to make sure users understand which of these claims are backed up by math, which are backed up by law, and which are backed up with thoughts and prayers, so that these users can make informed decisions about how they use a service they're relying on for their personal liberty.
- EveYoung 5y ago
  In my opinion, email is the wrong medium for highly confidential communication. Especially, if someone's personal freedom or safety depends on it. Even if E2E works correctly, you still have to worry about meta data. Maybe Matrix over TOR would be a better alternative?
  - ddevault 5y ago
    I would not go so far as to day that email cannot be used privately, but I would say that it is very very difficult to use email privately. I agree that most people with highly confidential needs would be better served by another system, though I don't know what to recommend - Matrix over Tor seems viable, perhaps.
7demons 5y ago
I guess ProtonVPN also is not an exception to such "undeniable" requests. Bad day for company who bank on "no log" policy. Their marketing division will have a ton of work to fix reputation :)
- aero-glide2 5y ago
  No, ProtonVPN isn't subject to the same problem (according to the CEO).
  - krageon 5y ago
    That is of course not likely. If you get a police order you must comply, no matter what you have in your marketing.
  - qwertox 5y ago
    Care to share more information about this?
    - lrae 5y ago
      Probably refers to this: > Under current Swiss law, email and VPN are treated differently, and ProtonVPN cannot be compelled to log user data. https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/
      - sbuk 5y ago
        Until it is.
      - qwertox 5y ago
        I wonder if this only applies to their VPN servers in Switzerland.
    - cf_ 5y ago
      I assume what they mean is that - they might have to log connections to their service (like with ProtonMail), but they won't have to provide what data that user account has accessed through the service, same as they didn't provide the actual emails of the account in question, but "just" the connecting IP.
anothernewdude 5y ago
For such a stupid thing too. I'm surprised Switzerland provided a warrant for a climate activist.
- Sebb767 5y ago
  It seems the warrant went through Interpol; I'm not sure local authorities need to sign this off. EDIT: They actually clarify this in their statement[0], the crime must be valid under Swiss law. [0] https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/
- ArnoVW 5y ago
  From the blog posting I read yesterday, the individual was not arrested for his political convictions. He was not only a climate activist, but also a squatter. Apparently there were several police officers hurt during a legally mandated eviction of the building that he squatted. Saying "omg they arrested a climate activist" is like saying "omg, they arrested filesystem developer Hans Reiser!"
  - kiawe_fire 5y ago
    Your point is well taken that the headline is misleadingly conflating “who he was” with “what he did wrong”. But is the actual crime any better, though? If squatting and resisting arrest were the crimes, then I don’t see what justification there could be for wanting to probe into his emails. They already know the extent of what he did, and where he did it, by nature of the crimes themselves… no?
    - ArnoVW 5y ago
      Presumably the charge is not "resisting arrest", but "assault of an officer of the law". Several officers missed a couple of days work, one officer had to stop working for two weeks. I haven't more on the subject, but I can certainly imagine that they started an investigation only in the days afterwards, when doctors had established reports and cooler heads prevailed. Look at it from the perspective of the state / society. What's the alternative? Arrest everyone you find in the house, every time when you think you may press charges, and hold them indefinitely until you sort things out? The article stated that he refused to give ID / fingerprints at the time (which is his right, as he was not charged). Clearly he no longer has a house; you just kicked him out. What do you do? How do you find him? So they asked for an international warrant for his IP (not the contents) so that they could find him, which was approved by a disinterested third party. The warrant was executed, and now he will answer in a court of law, where he can argue his innocence while the onus is on the state to prove the contrary. Contrast that with the alternative approach "in the heat of things" (arresting everyone, retrebutive escalating violence) and I think it's pretty amazing that our society works this way, and how much effort is spent to safeguard both justice and individual liberties. Hell, in the US, 25% of homicide-by-police is happen as the result of traffic stops that turned sour.
Louno 5y ago
My trust in them had been broken as soon as they asked me to honour a bill when my vpn subscription ended, instead of notifying me to renew. Respectable companies don't use such asshole design/wording. They're a fraud.
dsign 5y ago
The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happen. What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of their customers. From there, all it takes is for somebody to change a law in Switzerland and end-to-end encryption of the messages themselves will only be "by default." I think there is a market for datacenters in open seas.
- segfaultbuserr 5y ago
  > I think there is a market for datacenters in open seas. Sealand's HavenCo tried it back in the 2000s. As it turned out, it didn't work well. https://en.wikipedia.org/wiki/HavenCo https://en.wikipedia.org/wiki/HavenCo See: Death of a data haven: cypherpunks, WikiLeaks, and the world’s smallest nation https://arstechnica.com/tech-policy/2012/03/sealand-and-havenco/ https://arstechnica.com/tech-policy/2012/03/sealand-and-have...
  - vmception 5y ago
    one company in the cloud sector failed 20 years ago, before people were even using the word cloud in this context
  - nvarsj 5y ago
    I find Sealand fascinating. Imagine founding an off-grid location as a data haven, and it got popular. What would happen? I can see covert operations from foreign governments happening for example, driven by copyright lobbyists. Would they then need to hire security forces or train their own armed forces? Would it eventually join global political organizations to influence and protect its position? It gets really interesting to think about. There's no doubt in my mind there would be huge demand for such a thing. People hate that the government can spy on anything you do. The chilling effect is exhausting.
    - 5y ago
ohgodplsno 5y ago
The homepage has always been misleading, since their TOS does mention that they can keep your IP address, for law-related purposes or spam prevention. Additionally, once they receive a request from Swiss police, they _have_ to comply and log those addresses. You can fight tooth and nail and pretend that your entire service is built to never see any IP, but in the end, you will still be made to log it. Welcome to reality.
- nickthemagicman 5y ago
  They can force you to implement functionality if it doesn't exist? Like logging?
  - ohgodplsno 5y ago
    Your service is connected to the internet, isn't it ? An IP is a fundamental component of it. It's impossible for you to say that you cannot have the IP. Even if it involves you going to your edge server and reading everything with Wireshark to find out the IP, you will still have to comply. EDIT: To add to this, this is why ProtonMail recommends using a TOR node to protect your address.
    - nickthemagicman 5y ago
      I know the technical aspects I was just curious what they were allowed to do legally. Are they legally allowed to force someone to implement nonexistent functionality?
raverbashing 5y ago
If people are unhappy about Protonmail I suggest they try find an email provider that is impervious to any judicial requests. Of any country. It is naive to imagine companies that have an address and take payments can ignore judicial decisions. Yes there's a point about fighting decisions, but as people say "we live in a society".
- dskloet 5y ago
  Some companies try harder to fight the decision than others and it makes a difference.
  - raverbashing 5y ago
    Protonmail fought 700 actions the past year as per the twitter thread. I think that's very above average. https://twitter.com/andyyen/status/1434665937203077120 https://twitter.com/andyyen/status/1434665937203077120
    - destitude 5y ago
      And yet they said they didn't even know it was a climate activist so how could they really fight if it isn't simply technicalities they are fighting on? Again, they fail to provide transparency in what reasons those requests were rejected and sounds like more marketing spin.
rawbot 5y ago
So they "don't log your IP", until the first time someone challenged that statement. Talk is cheap.
- ohgodplsno 5y ago
  ProtonMail has always said that they would comply with Swiss law. Your IP will not be logged unless you commit a crime in Switzerland and the swiss police hands in a request.
  - maxo133 5y ago
    So... if they receive valid swiss court order they can be forced to log user passwords on demand and their entire service is then useless? As when you have password you can decrypt entire mailbox content. They market their service to journalists and activists, which are often targetted by their own governments. Seems that they cannot protect any of them.
    - ohgodplsno 5y ago
      Be real for a second: if a government targets you, you have no way of escaping it. If you're targeted by a small country, with not much power, so your only real options are kidnapping you if you are ever in said country. So, moving away does keep you safe. Should be, say, a Chilean journalist reporting on wrong deeds in your own country, you can safely assume that ProtonMail is safe for you. (That is, unless the government knows who you are). But a first world country ? They have laws, they have international influence, they have technical means and the ability to intervene wherever you are. "Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https:// https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. In summary, https:// https:// and two dollars will get you a bus ticket to nowhere. Also, SANTA CLAUS ISN’T REAL. When it rains, it pours." - https://www.schneier.com/blog/archives/2015/08/mickens_on_secu.html https://www.schneier.com/blog/archives/2015/08/mickens_on_se... This applies to ProtonMail too. What do you think happened with Lavabit ? They were pretending full security too, and we all know what happened. Stop thinking this is a problem technology can fix.
plater 5y ago
Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy. Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference. Be also aware of the fact that many companies market themselves as Swiss, but all it means is they have a head office in Switzerland due to tax reasons. In one example, it's a cloud storage company, they say on their marketing page and their about page that they are based in Switzerland and under Swiss law, but if you look at the legal pages the company you sign up with are actually based in Bulgaria. Their servers are based in Texas, USA and Luxemburg, Europe and their development team in Bulgaria.
- kylehotchkiss 5y ago
  The company you’re mentioning in the end is Tresorit, right? If so, they still do get some kudos for running a pretty solid end to end encrypted storage service. Their whitepaper checked out to me and their heavy focus on business users instead of consumer seems to attract less of the advocate types of users that ended ProtonMail in this weeks situation to begin with
  - deleted 5y ago
    [deleted]
  - plater 5y ago
    No, I'm referring to pcloud. I'm not saying they are necessarily a bad service or anything, just that their marketing is false.
    - rPlayer6554 5y ago
      This is extra problematic because pcloud doesn't encrypt files by default. (It does have its "secure vault" but you can't sync it to your computer and costs a significant extra fee to use. You may as well use cryptomator)
timdaub 5y ago
Well, at least they own their mistakes and change accordingly. All email is shit. Nothing is encrypted and many company's simply try to sell you on better productivity (hey.com). Already having my email be encrypted so that the host can't read it is a step forward, in my opinion.
pluc 5y ago
The line is thin between privacy and anonymizing criminal activity.
- happybirds07 5y ago
  Well yes, which is why we should always beware of outlawing things "because criminals". Criminals won't stop using VPNs or other tech because they're not legal, and as you say, most things have legitimate uses too.
  - pluc 5y ago
    I agree, but that's also why I don't think 100% anonymity is something we should strive for. I'm fine with anonymity until the provider is obligated to comply by law... but that's mostly because I'm in Canada and I have a relative trust in laws. Wouldn't feel safe with anonymity guaranteed by US law at all.
shafyy 5y ago
I see many comments here that seem to be uninformed. Please, make sure to ProtonMail's official statement first. It includes a lot of important background info: https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/ For example, this paragraph is important: > Unlike other providers, we do fight on behalf of our users. Few people know this (it’s in our transparency report), but we actually fought over 700 cases in 2020 alone. Whenever possible, we will fight requests, but it is not always possible.
- occamrazor 5y ago
  They also say that they had no idea about the identity of the activist and the charges against them. That means that the information was not provided in the warrant/police request, and thus that they can’t or don’t want to look into the merits of any requests. My hypothesis is that the 700 cases they mention are requests from _foreign_ authorities, to whom they answer that they need the request to come through Swiss authorities. More like a template email than a “fight”
  - Sebb767 5y ago
    > My hypothesis is that the 700 cases they mention are requests from _foreign_ authorities, to whom they answer that they need the request to come through Swiss authorities. They can also fight against Swiss authorities, unless they come with a court+gag order. Anyway, I believe them that the do their best to protect their customers, but it's simply not an option to break the law. And they never promised to do so; in fact, they quite clearly state that they don't.
- luckylion 5y ago
  This comment should be at the top, half the comments here either haven't read the article or just don't have a technical understanding of how the internet and servers work.
deleted 5y ago
[deleted]
livinginfear 5y ago
The expectation that Proton would be able to disobey the legal requests of their local authorities with impunity is unrealistic. Protonmail makes certain claims about privacy, particularly about encryption. They don't make any claims that they have the intention, or ability for that matter, to defy local authorities at their peril. Like Grugq said in one of his presentations (paraphrased): "Don't expect your VPN company to do your jail time for you". I'm neither for nor against Protonmail. I don't think they've been dishonest. I think people have an unrealistic expectation of the service they offer. They offer additional privacy, not legal indemnity.
- edly 5y ago
  This is exactly what baffled me about people saying "I'm cancelling my PM subscription" as if they didn't make this abundantly clear. In their transparency report, they state very clearly that they "may also be obligated to monitor the IP addresses" being used to access accounts engaged in criminal activity. Privacy activists, for some reason, don't take the time to read transparency reports.
  - destitude 5y ago
    What about the perception they gave that state if you were being monitored you would be notified? The part not made clear was that they could delay notifying you for months.
    - Sebb767 5y ago
      They did make it clear and did so before this outcry: > Swiss law requires a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. However, in certain situations, notification can be delayed. This includes the following cases [...] From https://web.archive.org/web/20210724054806/https://protonmail.com/law-enforcement https://web.archive.org/web/20210724054806/https://protonmai... (under "ProtonMail User Notification Policy", emphasis is mine).
      - 5y ago
thrownaway561 5y ago
question... why did they have this information readily available for them? couldn't they not retain logs and delete this sort of information right away? is there some legal aspect that makes them have to retain it for a certain amount of time or something?
- 0-_-0 5y ago
  They didn't. They were compelled to start logging the IP of a specific customer.
jcq3 5y ago
I think as an EU citizen you have more privacy on yandex.ru than PM. Russian authorities are unlikely to collaborate with French one for instance
- yaris 5y ago
  If you can make sure you and your relatives and your friends never cross Russian (or for that matter Russia-friendly state) border and/or you never write anything remotely resembling criticism of Russian regime - then maybe yes.
hasmanean 5y ago
Why don’t they use surveillance in anti-corruption squads to make sure no back room deals are being made inside the government? This tool is turned against the poor and marginalized and used to eliminate opposition but not for making the system work better as it was supposed to. In a sense society is being hacked by those in power using surveillance.
antocv 5y ago
Honeypot always was a honeypot
- SV_BubbleTime 5y ago
  You mean an EU funded email service that said “by default” we don’t log complied with EU requests and started logging!? Better rabble on HN for a few hundred comments, this is outrageous.
maxo133 5y ago
If they really cared about anonymity ProtonMail would ship their mobile app with bundled TOR. Especially the mobile version, since plenty of non-tech savy people use mobile only.
- istingray 5y ago
  Yes 100% this. Their mobile apps need to have a switch for "All connections through Tor", and that switch should be enabled by default. Tor too slow? Speed up the ecosystem by setting up your own Tor nodes, Proton.
bubblethink 5y ago
The obvious questions being a) Why do they sell vpn ?, and b) Why is the web-email client not routed over vpn if it has any value whatsoever? If they route all email over vpn, do they have to disclose the enduser's ip ? If so, how do they avoid that with standalone vpn ?
cpach 5y ago
For secure communications it’s much better to use Signal than e-mail. (Preferably with disappearing messages.) I understand that people desire the UX of an e-mail client such as Thunderbird, Mail.app, Gmail or whatever. Nothing wrong with wanting that. But there is currently no good way to send e-mail securely.
- ducktective 5y ago
  What about Matrix?
  - cpach 5y ago
    Good question. IMO it depends on the threat model. If I was a political activist I would not rely on Matrix. Some previous threads worth reading: https://news.ycombinator.com/item?id=23108750 https://news.ycombinator.com/item?id=23108750 https://news.ycombinator.com/item?id=24123997 https://news.ycombinator.com/item?id=24123997
ashtonkem 5y ago
I’m not that surprised that ProtonMail folded; as someone else said they’re not going to do jail for you. What’s concerning is the nature of this warrant and arrest. As far as I can tell all the articles haven’t mentioned any actual crimes; is France just straight up arresting climate activists now?
eplanit 5y ago
I can't imagine running an internet based service and not logging IP addresses. How else do you debug issues or isolate malicious users, etc. Does anyone think it's realistic (or even responsible) to not log basic info? I don't use PM, but it seems their product is end to end email encryption, not complete web anonymity. Maybe those wanting to add anonymity should access it via tor (if PM allows it).
Verdex 5y ago
My day to day life is pretty boring, but occasionally I'll imagine what I would need to do if I ever had to get out a secret message out where it was important that it couldn't be traced back to me. It always ends up being something like, "Well, I could buy a bunch of raspberry PIs with cash and then go to a coffee shop that I never go to and upload the message to a gmail account that I'll only ever use once. Throw the PI away afterwards in a random trash can in town and make sure to wear gloves every time I touch it. Finally use some sort of encryption scheme or something so I can identify myself for repeated correspondences because each time will be with a different one shot email account." It turns out that this isn't some fanciful paranoia, but is in fact the bare minimum of what I should be doing if something like that ever came up.
- snet0 5y ago
  Coffee shops have CCTV, no?
- laurent123456 5y ago
  Tor from a coffee shop should be sufficient shouldn't it? If the browser cannot be finger printed and the IP is not yours, it shouldn't be possible to identify you.
- ArnoVW 5y ago
  You're making it too complicated. Find an open wifi somewhere.
  - eternalban 5y ago
    CCTV Cameras are everywhere. To get to point B, you will leave a nice trail. It should not be that difficult to assemble the necessary identifying data. And when the biosecurity state comes online in its robust form, your movements will be fully traced.
nicolas_t 5y ago
I think a distinction must be made between a service that will protect your privacy historically and a service that will continuously protect your privacy. If I sign up with protonmail today using a vpn like mullwad, since I'm probably not currently be targeted, I can reasonably be sure that it will be difficult to track things back to me. However, once I'm targeted and there's a warrant against me, any activity I have on such services is going to be logged going forward. So, using the service once to receive some data or do something anonymously is reasonably secure... This is very different from services like gmail which will have kept any logs in the past about me and that will always be able to track me without any further logging. It's imperfect but I think that given the current environment and the current laws, this might be the best we can have.
m-p-3 5y ago
Seems like another good reason to not trust anyone's words and protect yourself using good OPSEC.
CalChris 5y ago
Wasn't this a form of fraud? I don't know what the Swiss law is but in the United States, fraud is both a civil tort and criminal wrong. The elements of a fraud are: 1) the making of a statement 2) the falsity of the statement 3) an intent to deceive 4) reasonable reliance on the statement by the injured party 5) injury sustained as the result of the reliance ProtonMail knowingly told this activist 'we don't log your IP' in order to attract their business. ProtonMail did log the IP address. The activist believed this and got arrested.
- yaris 5y ago
  2. was missing when the activist started using PM. 3. also missing (unless there is strong evidence of presence). So no, no fraud. PM has to follow Swiss law and they have stated this long before the incident pretty clearly.
  - CalChris 5y ago
    They've been saying this since at least 2015. https://web.archive.org/web/20151117172602/https://ProtonMail.com/ https://web.archive.org/web/20151117172602/https://ProtonMai... When did the activist start using ProtoMail? Also, if they say roughly, we will not follow Swiss law for you and they follow Swiss law, that is still lying.
- SV_BubbleTime 5y ago
  “We don’t log your ip by default” This is all very silly. They said right up front they can. Their TOS said they can. It’s also very silly to assume PM would disobey EU requests. They were created with EU funding.
  - istingray 5y ago
    Maybe for you that's clear. But I use Protonmail to advocate for journalists, whistleblowers, and teachers, many of which are not security experts and not familiar with the twisted language used by Protonmail's marketing team. If their marketing team can't come up with something better, just take text from the privacy policy verbatim.
jeffbee 5y ago
Privacy weenies are the most easily defrauded people I've ever come across.
lanevorockz 5y ago
So they lied ... not surprising companies promise things just to betray their customers in a second. I still remember when Facebook won the social media war by promising to never allow advertisement.
bawana 5y ago
How do you say 'honeytrap' in Swiss?
dathinab 5y ago
> stated: "No personal information is required to create your secure email account. By default, we do not keep any IP logs which can be linked to your anonymous email account. Your privacy comes first." And it still holds!! What it didn't stat is that while _by default_ no such information is logged, but if they are legally compelled to they will log such the neseccary information for the email (account?) they are required to log them for. Its honestly surprising for me that anyone though that a fully legally (in Swiss)operating service would protect their privacy beyond the point they are allowed to by Swiss law. But luckily for us Swiss law is pretty neat wrt. privacy, at least currently.
- istingray 5y ago
  ProtonMail requires a phone number for account creation through Tor. "no personal information"...does it still say that? Let me know where, will email them.
  - yaris 5y ago
    In Sweden you can get a prepaid phone number completely for free: Comviq literally gives away SIMs and to pre-pay you can still use cash. So from this point of view PM is not lying, not one bit.
    - istingray 5y ago
      It's a lie. Including in their home country of Switzerland. To buy a Swiss SIM card, you’ll need to provide proof of identity (such as a passport).
      - yaris 5y ago
        Either you are confusing Switzerland and Sweden (which were two quite different countries last time I checked) or I'd be very much interested in data on why you see my words about Comviq giving away SIM cards as lie. As you probably know, there are no roaming charges in EU, so if you have a swedish SIM card - you can use it (to receive SMS at least, sometimes answer calls) in any EU country. If you put some cash on it - you can even make calls. Still without providing a single bit of your PI (assuming you bought/stole a burner phone). EDIT: clarification regarding SIM usage.
janmo 5y ago
I am no lawyer, but there are over 180 countries in the world, and there is not one that will let you open a company that don't have to log user IP addresses? I call this complete BS. Protonmail has just become one of those providers that is only about making money and is probably getting money kickbacks from law enforcement under the form of legal processing fees or even something else, who knows..., really sad...
1cvmask 5y ago
For those who love Swiss "privacy" and security they should read about the CIA front-company from Switzerland for secure encrypted communications: https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG And remember Mark Twain: “History Doesn't Repeat Itself, but It Often Rhymes”
qwerty456127 5y ago
ProtonMail has an official TOR page, there hardly is a reason for those performing activities illegal under relevant jurisdictions (I support the notion of illegal non necessarily being evil - in many countries many good things like fighting corruption, loving a same-sex partner or responsibly using psychoactive substances for genuine medical reasons can be illegal) to use it the way exposing their actual IP address. I also don't understand why does ProtonMail record the device type - I doubt there is a law requiring this.
- NotEvil 5y ago
  Can be telemetry
  - qwerty456127 5y ago
    Telemetry is evil. No company respecting their users should use telemetry.
    - NotEvil 5y ago
      No, it's very useful tool. If disclosed correctly I have no problem with it
- istingray 5y ago
  Agreed, that's why I've asked Protonmail to promote their Tor page. Before yesterday the only mention was in their footer under "Onion site" and in a single blog post from 2017. They need to do better at promoting and supporting users through Tor. Heck, add it to their transparency report "40% of users connected through Tor, our goal is 90%"
rarba786 5y ago
I don't see why it's AS big a scandal given what CEO stated and reading accounts from reputable news sources. My quick take: France tells Switzerland who then compels PM to START tracking account holder(s) and prevented PM (by law from what I've read) from telling account holder. Per PM CEO this type of Swiss order could not be disputed with the way PM has disputed other claims. To me, it's not logging of the IP; it's when did it start and from my reading they started after being compelled to do so over a period of time between compelled to and this coming to light. To me, strong pushback (for those who feel passionate about it) should be directed to Switzerland for complying with France for what many think is not a high enough bar to compel all this tracking. Maybe they did scrutinize it and maybe they didn't. Any meta-data saving isn't secure but sharing that after being compelled to track account holders isn't surprising. There's a line in their agreement that says " If a request is made for encrypted message content that we do not possess the ability to decrypt, the fully encrypted message content may be turned over.". Maybe I'm missing something in my logic.
a3n 5y ago
Oh, boy.
mark_l_watson 5y ago
ProtonMail is my main e-mail, so I am positively biased in their favor. I think their advertising copy about not logging IP addresses was poorly done, but their service is private enough for me. It probably doesn’t much matter or make much difference, but I feel OK with using their service, and tweaking my account settings for Google and Apple to the minimum amount of data retention. I feel that people who let corporations easily have all of their data put themselves at a disadvantage when it comes to any interaction between yourself and any large company (insurance, retail, etc.). Governments will always have our private information so the real purpose of privacy is economic value. Imagine playing poker with your friends and you had to have your cards face up on the table and they could keep their cards hidden from you. In this example, your friends are corporations. EDIT: Carissa Véliz, author of Privacy is Power, was interviewed recently on the ProtonMail blog, and I think the interview does a good job of summarizing her excellent book: https://protonmail.com/blog/carissa-veliz-data-privacy/ https://protonmail.com/blog/carissa-veliz-data-privacy/
- istingray 5y ago
  What's important for you about using Protonmail? Would any non-Google non-Apple email account suffice?
  - mark_l_watson 5y ago
    Nothing special about ProtonMail, except it seemed like an "easy choice" after reading the Surviving Surveillance Capitalism book a couple of years ago. Everyone just needs to make their own decisions on privacy. I feel fairly comfortable with my practices. For me, it is the economic motivation of wanting to reduce the advantage companies I deal with have over me that convinced me to take extra precautions.
    - istingray 5y ago
      Ah got it. I support Protonmail because I believe in easy to use privacy tools for others like journalists, whistleblowers, and teachers. That's why I want Protonmail to be a leader in this space with clear marketing and communications.
dang 5y ago
Recent and related: Clarifications regarding arrest of climate activist - https://news.ycombinator.com/item?id=28433601 https://news.ycombinator.com/item?id=28433601 - Sept 2021 (273 comments) ProtonMail logged IP address of French activist after order by Swiss authorities - https://news.ycombinator.com/item?id=28433131 https://news.ycombinator.com/item?id=28433131 - Sept 2021 (155 comments) Climate activist arrested after ProtonMail provided his IP address - https://news.ycombinator.com/item?id=28427259 https://news.ycombinator.com/item?id=28427259 - Sept 2021 (565 comments)
jd3 5y ago
it seems like ProtonMail should collaborate with Lavabit to see if it's feasible to implement darkmail (DMTP/DMAP protocols) in production http://darkmail.info/ http://darkmail.info/ https://protonmail.com/blog/protonmail-beta-v1-13-release-notes/#comment-7320 https://protonmail.com/blog/protonmail-beta-v1-13-release-no... https://www.youtube.com/watch?v=TWzvXaxR6us https://www.youtube.com/watch?v=TWzvXaxR6us
atok1 5y ago
I'm glad that they are at least removing that fallacy and people can't quote it any longer.
traspler 5y ago
It‘s really tiresome how it‘s become the normal to market all kind of fantasy interpretations of your value proposition and banish all nuance to legalese documents. ProtonMail has enough to justify itself, it doesn‘t need all the over the top claims of Swissness or blunt statements about privacy that are only half truths. They could also do without their spintastic, content marketing blog.
FirstLvR 5y ago
i know there are some Protonmail guys reading this thread... people choose your service exactly for this very same reason, good luck trying to regain people trust
istingray 5y ago
Similar to Apple, Protonmail seems poised to redefine privacy as "privacy from advertisers" rather than "privacy from us too". I for one am now only using Protonmail through Tor. Recommend Brave users enable "Automatically redirect .onion sites". If a site has an onion service, it will automatically redirect in case you forget.
deleted 5y ago
[deleted]
eth0up 5y ago
Anyone have feedback on this https://ctemplar.com/ https://ctemplar.com/ ? I get a sense to move along, but it still seems interesting. It is, or was, based in Iceland.
Grimm665 5y ago
Maybe I missed it in all the kerfuffle, but what was the crime that was allegedly committed by the French climate activist that required ProtonVPN to comply with this request for IP information?
Ikatza 5y ago
Thanks for clarifying, Proton Mail. And also, good bye. I'll be canceling my accounts today.
throwawayswede 5y ago
What a douchebag company honestly. Their marketing is absolutely evil. Changing the headline does not cut it, they need to fire people responsible for that outright lie. After a dude gets arrested, they’re like: oh, we were talking about advertisers! Who did you think? What a trash team. Proton mail ==
nrvn 5y ago
It is not the first time this company finds itself in the center of an international scandal. It has proven multiple times that privacy and security are not something they really care about. I wonder what else should happen for everyone to completely lose trust in this scam.
neycoda 5y ago
Listen, don't do crime through email.
Ginden 5y ago
Use TOR and onion services.

681 points by angrymouse 5y ago

rvz 5y ago

It has been admitted. So they DO log your IP address when you use their service. So their customers have been lied to and have their privacy at risk. They cannot be trusted. So how long have ProtonMail kept this massive lie from its users then?

jacquesm 5y ago
Since day #1 would be a safe guess. I don't think the honor system is a good way to deal with companies so when a company writes something like that and I have no way of verifying it then I don't believe them. Worked pretty good so far.
- drstewart 5y ago
  Just to be clear, there's no reason to believe you aren't a Chinese bot trying to sow division among western countries with this comment. It's a pretty safe guess and we have no way of verifying otherwise, after all.
  - jacquesm 5y ago
    Actually, there is. I've met 10's of HN'ers in person, this account is many years old and in pretty good standing, on top of that I have regular contact with the mods and many others on here IRL. You probably should have picked a different account than mine to try this particular line with.
    - syops 5y ago
      You missed, entirely, the point made by the person you responded to.
      - drra 5y ago
        He didn't. By stating that he has now way of verifying he most likely meant that he exhaust all the ways, within his ability, to verify it. While the other poster made no effort to verify if Jacques is not a bot (it's easy). There's a difference in actively verifying given statements and passively accepting all that is written or all doubts that a busy mind can produce.
        syops 5y ago
        I think you may have missed it a bit too. jacquesm wrote: ...I have no way of verifying it then I don't believe them. Worked pretty good so far. This can't possibly be true since one can't verify everything. If one truly lived this then they'd be in an endless quest of verifying things. For instance, verifying verifiers. We are about to enter into an age of hard to detect AI generated articles and research so this isn't philosophical silliness.
numpad0 5y ago
It’s not a lie; it said “By default, we do not…”. So under any non-default situations they always could. I guess.
- aqsalose 5y ago
  From the article: >The firm's privacy policy, which was updated yesterday, now says: "If you are breaking Swiss law, ProtonMail can be legally compelled to log your IP address as part of a Swiss criminal investigation." That makes it sound like they normally do not / did not log the IP, but then got orders from the police the log these particular IPs.
- craftinator 5y ago
  If that is the case, why did they remove this statement? It seems to me that if the statement remained true even though this guy got arrested, it would be true under the "by default" clause. By removing it, they indicate it was never true; or, I suppose, they discovered just how fun it is to get people arrested, and decided to change their policy on the fly! I was even considering switching to them...
  - Sebb767 5y ago
    They clearly changed it because of the amount of backlash they got and because so many people called that statement deceptive. Just because it's true doesn't mean it's smart to say it and them removing the statement is absolutely reasonable.
  - pera 5y ago
    > If that is the case, why did they remove this statement? As far as I understand according to several comments I read here in HN "99%" of the people don't understand what "by default" means, making the sentence misleading for most.
    - ipaddr 5y ago
      Most were falling for the trickey in wording and they are mad. Throwing in a word like default changes the entire meaning. Instead of we don't log anything* * we log only when requested They should say your ip can be logged. It's like saying in big headline. No meat burgers * * meat means carots
warp 5y ago
According to their statement: > under Swiss law, Proton can be forced to collect information on accounts belonging to users under Swiss criminal investigation. This is obviously not done by default, but only if Proton gets a legal order for a specific account. So I assume normally IP addresses aren't logged. But they can enable IP address logging for specific accounts when ordered to do so. There is very little practical difference in the protection that gives users, but seemingly the privacy policy was technically correct.
Sayrus 5y ago
It is probably worth reading the clarifications made by ProtonMail [1] and their Transparency Report [2]. As a company based in Switzerland, it was clear to they could be compelled to do so and they never hid that fact. IMO a breach of trust would be actually logging IPs by default and before a legal request is made. [1] https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/ [2] https://protonmail.com/blog/transparency-report/ https://protonmail.com/blog/transparency-report/
vmception 5y ago
pretty much every comment section about protonmail has been pointing this out for years their rabid sycophants were too busy creaming themselves over "Swiss laws" to pay attention, going as far to demand proof when observers were merely pointing out the fundamental flaw in the Protonmail concept and incongruent advertising well, now there is proof
vmception 5y ago
pretty much every comment section about protonmail has been pointing this out for years their users were too fanatical over "Swiss laws" to pay attention, going as far to demand proof when observers were merely pointing out the fundamental flaw in the Protonmail concept and incongruent advertising well, now there is proof
- maxo133 5y ago
  Today, i read somewhere while watching protonmail case comments, that switzerland has quite extensive surivellance laws which include possiblity of logging whole country inbound and outbound traffic for period of 6 months.

notjes 5y ago

PM was a hoax from the start. Just talk to the Lavabit guy Ladar Levison or look up Crypto AG.

pixxel 5y ago
Surely the onus is on you to backup your statement calling PM a hoax.
- JohnWhigham 5y ago
  They marketed themselves as a safe, secure platform away from prying eyes. As a platform for dissidents. Turns out it was bullshit (as many already expected).

avereveard 5y ago

Can't wait for the "sorry we got caught" statement

ajay-b 5y ago

This is just ridiculous.. If they receive a notice to log your IP address, they should notify you first. My trust in ProtonMail is gone.

zpeti 5y ago
I'm pretty sure in US law authorities can stop you from doing that, that's why these services have warrant canaries which are legally sound. Not sure what swiss law is like, but I can imagine they might not be allowed to notify the user?
warp 5y ago
According to their statement: > Under Swiss law, it is obligatory for a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. But the timeline is unclear to me. If they notified you via e-mail, and then immediately turned on IP logging. So... you'd go and check your e-mail, learn about the third-party request, but by then it's too late as your IP address has already been logged?
- dewey 5y ago
  > but by then it's too late as your IP address has already been logged? If someone is so sensitive about leaking their IP address and they access some service with their real IP and relying on a service's promise to not log it they already are not very careful to begin with.
- destitude 5y ago
  Techcrunch already went over this and the law allows you to delay notifying the person so it is in effect a worthless statement to make since all authorities would simply tell them not to notify the user.
- ipaddr 5y ago
  They could notify the user after the username is entered to say the ip with this account is being logged are you sure you want to login?
5y ago

0xdeadb00f 5y ago

This is not surprising to me. I will still continue to use ProtonMail. I never signed up because of the "no IP logging" thing. In fact, if I had seen it before I just plain wouldn't have believed it, and still used ProtonMail. But hindsight is 20/20

qwertox 5y ago
I see it the same way. For me it always meant that the default mode is not to log. It's normal that they have to enable logging if a valid request to do so comes from the authorities. Same goes for any of the German mail providers like mailbox.org or posteo.de ("We do not save your IP address when you visit or use our website. [...] To protect your privacy and for security reasons, we also delete any potential IP address entries made by local email programs from the email headers. Emails sent using our webmail interface or using email programs therefore contain neither your local nor your public IP address."). If the authorities can prove that they have a legitimate reason to expect them to log the IP addresses, then they must do it. They are all normal companies which need to abide by the law if they want to conduct business.
istingray 5y ago
What's important for you about using Protonmail then?
- eternalban 5y ago
  It’s not Google.

ddevault 5y ago

ProtonMail has been fraught with problems for a long time, and it's good that serious issues are being brought to light. Their marketing is very good and critics of them have struggled to communicate to users for a while. The most important thing a serious privacy-minded service provider can do is be forthright and honest with users about the limitations of their privacy guarantees, particularly with respect to what hinges on math and what hinges on trust. ProtonMail has failed in this respect. It has always been the case, for example, that they could log these IPs, or that any incoming plaintext emails can be recorded before being encrypted at rest - and the fact that they're encrypted at rest is another thing we have to take on faith. Their proprietary components have always been a problem, and we also trust that they won't silently add key exfiltration to their webmail UI on the demands of a court. They don't explain any of this, they just pose themselves as experts on privacy and let vulnerable users stumble into law enforcement's hands because they care about their money more than their security. Good privacy systems do not rely on trust or faith, they rely on math. Where some trust is required, in the case of a commercial service provider, it is their solemn duty to be honest with users and explain to them what promises they can and cannot make, and to make sure users understand which of these claims are backed up by math, which are backed up by law, and which are backed up with thoughts and prayers, so that these users can make informed decisions about how they use a service they're relying on for their personal liberty.

EveYoung 5y ago
In my opinion, email is the wrong medium for highly confidential communication. Especially, if someone's personal freedom or safety depends on it. Even if E2E works correctly, you still have to worry about meta data. Maybe Matrix over TOR would be a better alternative?
- ddevault 5y ago
  I would not go so far as to day that email cannot be used privately, but I would say that it is very very difficult to use email privately. I agree that most people with highly confidential needs would be better served by another system, though I don't know what to recommend - Matrix over Tor seems viable, perhaps.

7demons 5y ago

I guess ProtonVPN also is not an exception to such "undeniable" requests. Bad day for company who bank on "no log" policy. Their marketing division will have a ton of work to fix reputation :)

aero-glide2 5y ago
No, ProtonVPN isn't subject to the same problem (according to the CEO).
- krageon 5y ago
  That is of course not likely. If you get a police order you must comply, no matter what you have in your marketing.
- qwertox 5y ago
  Care to share more information about this?
  - lrae 5y ago
    Probably refers to this: > Under current Swiss law, email and VPN are treated differently, and ProtonVPN cannot be compelled to log user data. https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/
    - sbuk 5y ago
      Until it is.
    - qwertox 5y ago
      I wonder if this only applies to their VPN servers in Switzerland.
  - cf_ 5y ago
    I assume what they mean is that - they might have to log connections to their service (like with ProtonMail), but they won't have to provide what data that user account has accessed through the service, same as they didn't provide the actual emails of the account in question, but "just" the connecting IP.

anothernewdude 5y ago

For such a stupid thing too. I'm surprised Switzerland provided a warrant for a climate activist.

Sebb767 5y ago
It seems the warrant went through Interpol; I'm not sure local authorities need to sign this off. EDIT: They actually clarify this in their statement[0], the crime must be valid under Swiss law. [0] https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/
ArnoVW 5y ago
From the blog posting I read yesterday, the individual was not arrested for his political convictions. He was not only a climate activist, but also a squatter. Apparently there were several police officers hurt during a legally mandated eviction of the building that he squatted. Saying "omg they arrested a climate activist" is like saying "omg, they arrested filesystem developer Hans Reiser!"
- kiawe_fire 5y ago
  Your point is well taken that the headline is misleadingly conflating “who he was” with “what he did wrong”. But is the actual crime any better, though? If squatting and resisting arrest were the crimes, then I don’t see what justification there could be for wanting to probe into his emails. They already know the extent of what he did, and where he did it, by nature of the crimes themselves… no?
  - ArnoVW 5y ago
    Presumably the charge is not "resisting arrest", but "assault of an officer of the law". Several officers missed a couple of days work, one officer had to stop working for two weeks. I haven't more on the subject, but I can certainly imagine that they started an investigation only in the days afterwards, when doctors had established reports and cooler heads prevailed. Look at it from the perspective of the state / society. What's the alternative? Arrest everyone you find in the house, every time when you think you may press charges, and hold them indefinitely until you sort things out? The article stated that he refused to give ID / fingerprints at the time (which is his right, as he was not charged). Clearly he no longer has a house; you just kicked him out. What do you do? How do you find him? So they asked for an international warrant for his IP (not the contents) so that they could find him, which was approved by a disinterested third party. The warrant was executed, and now he will answer in a court of law, where he can argue his innocence while the onus is on the state to prove the contrary. Contrast that with the alternative approach "in the heat of things" (arresting everyone, retrebutive escalating violence) and I think it's pretty amazing that our society works this way, and how much effort is spent to safeguard both justice and individual liberties. Hell, in the US, 25% of homicide-by-police is happen as the result of traffic stops that turned sour.

Louno 5y ago

My trust in them had been broken as soon as they asked me to honour a bill when my vpn subscription ended, instead of notifying me to renew. Respectable companies don't use such asshole design/wording. They're a fraud.

dsign 5y ago

The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happen. What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of their customers. From there, all it takes is for somebody to change a law in Switzerland and end-to-end encryption of the messages themselves will only be "by default." I think there is a market for datacenters in open seas.

segfaultbuserr 5y ago
> I think there is a market for datacenters in open seas. Sealand's HavenCo tried it back in the 2000s. As it turned out, it didn't work well. https://en.wikipedia.org/wiki/HavenCo https://en.wikipedia.org/wiki/HavenCo See: Death of a data haven: cypherpunks, WikiLeaks, and the world’s smallest nation https://arstechnica.com/tech-policy/2012/03/sealand-and-havenco/ https://arstechnica.com/tech-policy/2012/03/sealand-and-have...
- vmception 5y ago
  one company in the cloud sector failed 20 years ago, before people were even using the word cloud in this context
- nvarsj 5y ago
  I find Sealand fascinating. Imagine founding an off-grid location as a data haven, and it got popular. What would happen? I can see covert operations from foreign governments happening for example, driven by copyright lobbyists. Would they then need to hire security forces or train their own armed forces? Would it eventually join global political organizations to influence and protect its position? It gets really interesting to think about. There's no doubt in my mind there would be huge demand for such a thing. People hate that the government can spy on anything you do. The chilling effect is exhausting.
  - 5y ago

ohgodplsno 5y ago

The homepage has always been misleading, since their TOS does mention that they can keep your IP address, for law-related purposes or spam prevention. Additionally, once they receive a request from Swiss police, they _have_ to comply and log those addresses. You can fight tooth and nail and pretend that your entire service is built to never see any IP, but in the end, you will still be made to log it. Welcome to reality.

nickthemagicman 5y ago
They can force you to implement functionality if it doesn't exist? Like logging?
- ohgodplsno 5y ago
  Your service is connected to the internet, isn't it ? An IP is a fundamental component of it. It's impossible for you to say that you cannot have the IP. Even if it involves you going to your edge server and reading everything with Wireshark to find out the IP, you will still have to comply. EDIT: To add to this, this is why ProtonMail recommends using a TOR node to protect your address.
  - nickthemagicman 5y ago
    I know the technical aspects I was just curious what they were allowed to do legally. Are they legally allowed to force someone to implement nonexistent functionality?

raverbashing 5y ago

If people are unhappy about Protonmail I suggest they try find an email provider that is impervious to any judicial requests. Of any country. It is naive to imagine companies that have an address and take payments can ignore judicial decisions. Yes there's a point about fighting decisions, but as people say "we live in a society".

dskloet 5y ago
Some companies try harder to fight the decision than others and it makes a difference.
- raverbashing 5y ago
  Protonmail fought 700 actions the past year as per the twitter thread. I think that's very above average. https://twitter.com/andyyen/status/1434665937203077120 https://twitter.com/andyyen/status/1434665937203077120
  - destitude 5y ago
    And yet they said they didn't even know it was a climate activist so how could they really fight if it isn't simply technicalities they are fighting on? Again, they fail to provide transparency in what reasons those requests were rejected and sounds like more marketing spin.

rawbot 5y ago

So they "don't log your IP", until the first time someone challenged that statement. Talk is cheap.

ohgodplsno 5y ago
ProtonMail has always said that they would comply with Swiss law. Your IP will not be logged unless you commit a crime in Switzerland and the swiss police hands in a request.
- maxo133 5y ago
  So... if they receive valid swiss court order they can be forced to log user passwords on demand and their entire service is then useless? As when you have password you can decrypt entire mailbox content. They market their service to journalists and activists, which are often targetted by their own governments. Seems that they cannot protect any of them.
  - ohgodplsno 5y ago
    Be real for a second: if a government targets you, you have no way of escaping it. If you're targeted by a small country, with not much power, so your only real options are kidnapping you if you are ever in said country. So, moving away does keep you safe. Should be, say, a Chilean journalist reporting on wrong deeds in your own country, you can safely assume that ProtonMail is safe for you. (That is, unless the government knows who you are). But a first world country ? They have laws, they have international influence, they have technical means and the ability to intervene wherever you are. "Basically, you’re either dealing with Mossad or not-Mossad. If your adversary is not-Mossad, then you’ll probably be fine if you pick a good password and don’t respond to emails from ChEaPestPAiNPi11s@virus-basket.biz.ru. If your adversary is the Mossad, YOU’RE GONNA DIE AND THERE’S NOTHING THAT YOU CAN DO ABOUT IT. The Mossad is not intimidated by the fact that you employ https:// https://. If the Mossad wants your data, they’re going to use a drone to replace your cellphone with a piece of uranium that’s shaped like a cellphone, and when you die of tumors filled with tumors, they’re going to hold a press conference and say “It wasn’t us” as they wear t-shirts that say “IT WAS DEFINITELY US,” and then they’re going to buy all of your stuff at your estate sale so that they can directly look at the photos of your vacation instead of reading your insipid emails about them. In summary, https:// https:// and two dollars will get you a bus ticket to nowhere. Also, SANTA CLAUS ISN’T REAL. When it rains, it pours." - https://www.schneier.com/blog/archives/2015/08/mickens_on_secu.html https://www.schneier.com/blog/archives/2015/08/mickens_on_se... This applies to ProtonMail too. What do you think happened with Lavabit ? They were pretending full security too, and we all know what happened. Stop thinking this is a problem technology can fix.

plater 5y ago

Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy. Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference. Be also aware of the fact that many companies market themselves as Swiss, but all it means is they have a head office in Switzerland due to tax reasons. In one example, it's a cloud storage company, they say on their marketing page and their about page that they are based in Switzerland and under Swiss law, but if you look at the legal pages the company you sign up with are actually based in Bulgaria. Their servers are based in Texas, USA and Luxemburg, Europe and their development team in Bulgaria.

kylehotchkiss 5y ago
The company you’re mentioning in the end is Tresorit, right? If so, they still do get some kudos for running a pretty solid end to end encrypted storage service. Their whitepaper checked out to me and their heavy focus on business users instead of consumer seems to attract less of the advocate types of users that ended ProtonMail in this weeks situation to begin with
- deleted 5y ago
  [deleted]
- plater 5y ago
  No, I'm referring to pcloud. I'm not saying they are necessarily a bad service or anything, just that their marketing is false.
  - rPlayer6554 5y ago
    This is extra problematic because pcloud doesn't encrypt files by default. (It does have its "secure vault" but you can't sync it to your computer and costs a significant extra fee to use. You may as well use cryptomator)

timdaub 5y ago

Well, at least they own their mistakes and change accordingly. All email is shit. Nothing is encrypted and many company's simply try to sell you on better productivity (hey.com). Already having my email be encrypted so that the host can't read it is a step forward, in my opinion.

pluc 5y ago

The line is thin between privacy and anonymizing criminal activity.

happybirds07 5y ago
Well yes, which is why we should always beware of outlawing things "because criminals". Criminals won't stop using VPNs or other tech because they're not legal, and as you say, most things have legitimate uses too.
- pluc 5y ago
  I agree, but that's also why I don't think 100% anonymity is something we should strive for. I'm fine with anonymity until the provider is obligated to comply by law... but that's mostly because I'm in Canada and I have a relative trust in laws. Wouldn't feel safe with anonymity guaranteed by US law at all.

shafyy 5y ago

I see many comments here that seem to be uninformed. Please, make sure to ProtonMail's official statement first. It includes a lot of important background info: https://protonmail.com/blog/climate-activist-arrest/ https://protonmail.com/blog/climate-activist-arrest/ For example, this paragraph is important: > Unlike other providers, we do fight on behalf of our users. Few people know this (it’s in our transparency report), but we actually fought over 700 cases in 2020 alone. Whenever possible, we will fight requests, but it is not always possible.

occamrazor 5y ago
They also say that they had no idea about the identity of the activist and the charges against them. That means that the information was not provided in the warrant/police request, and thus that they can’t or don’t want to look into the merits of any requests. My hypothesis is that the 700 cases they mention are requests from _foreign_ authorities, to whom they answer that they need the request to come through Swiss authorities. More like a template email than a “fight”
- Sebb767 5y ago
  > My hypothesis is that the 700 cases they mention are requests from _foreign_ authorities, to whom they answer that they need the request to come through Swiss authorities. They can also fight against Swiss authorities, unless they come with a court+gag order. Anyway, I believe them that the do their best to protect their customers, but it's simply not an option to break the law. And they never promised to do so; in fact, they quite clearly state that they don't.
luckylion 5y ago
This comment should be at the top, half the comments here either haven't read the article or just don't have a technical understanding of how the internet and servers work.

deleted 5y ago

[deleted]

livinginfear 5y ago

The expectation that Proton would be able to disobey the legal requests of their local authorities with impunity is unrealistic. Protonmail makes certain claims about privacy, particularly about encryption. They don't make any claims that they have the intention, or ability for that matter, to defy local authorities at their peril. Like Grugq said in one of his presentations (paraphrased): "Don't expect your VPN company to do your jail time for you". I'm neither for nor against Protonmail. I don't think they've been dishonest. I think people have an unrealistic expectation of the service they offer. They offer additional privacy, not legal indemnity.

edly 5y ago
This is exactly what baffled me about people saying "I'm cancelling my PM subscription" as if they didn't make this abundantly clear. In their transparency report, they state very clearly that they "may also be obligated to monitor the IP addresses" being used to access accounts engaged in criminal activity. Privacy activists, for some reason, don't take the time to read transparency reports.
- destitude 5y ago
  What about the perception they gave that state if you were being monitored you would be notified? The part not made clear was that they could delay notifying you for months.
  - Sebb767 5y ago
    They did make it clear and did so before this outcry: > Swiss law requires a user to be notified if a third party makes a request for their private data and such data is to be used in a criminal proceeding. However, in certain situations, notification can be delayed. This includes the following cases [...] From https://web.archive.org/web/20210724054806/https://protonmail.com/law-enforcement https://web.archive.org/web/20210724054806/https://protonmai... (under "ProtonMail User Notification Policy", emphasis is mine).
    - 5y ago

thrownaway561 5y ago

question... why did they have this information readily available for them? couldn't they not retain logs and delete this sort of information right away? is there some legal aspect that makes them have to retain it for a certain amount of time or something?

0-_-0 5y ago
They didn't. They were compelled to start logging the IP of a specific customer.

jcq3 5y ago

I think as an EU citizen you have more privacy on yandex.ru than PM. Russian authorities are unlikely to collaborate with French one for instance

yaris 5y ago
If you can make sure you and your relatives and your friends never cross Russian (or for that matter Russia-friendly state) border and/or you never write anything remotely resembling criticism of Russian regime - then maybe yes.

hasmanean 5y ago

Why don’t they use surveillance in anti-corruption squads to make sure no back room deals are being made inside the government? This tool is turned against the poor and marginalized and used to eliminate opposition but not for making the system work better as it was supposed to. In a sense society is being hacked by those in power using surveillance.

antocv 5y ago

Honeypot always was a honeypot

SV_BubbleTime 5y ago
You mean an EU funded email service that said “by default” we don’t log complied with EU requests and started logging!? Better rabble on HN for a few hundred comments, this is outrageous.

maxo133 5y ago

If they really cared about anonymity ProtonMail would ship their mobile app with bundled TOR. Especially the mobile version, since plenty of non-tech savy people use mobile only.

istingray 5y ago
Yes 100% this. Their mobile apps need to have a switch for "All connections through Tor", and that switch should be enabled by default. Tor too slow? Speed up the ecosystem by setting up your own Tor nodes, Proton.

bubblethink 5y ago

The obvious questions being a) Why do they sell vpn ?, and b) Why is the web-email client not routed over vpn if it has any value whatsoever? If they route all email over vpn, do they have to disclose the enduser's ip ? If so, how do they avoid that with standalone vpn ?

cpach 5y ago

For secure communications it’s much better to use Signal than e-mail. (Preferably with disappearing messages.) I understand that people desire the UX of an e-mail client such as Thunderbird, Mail.app, Gmail or whatever. Nothing wrong with wanting that. But there is currently no good way to send e-mail securely.

ducktective 5y ago
What about Matrix?
- cpach 5y ago
  Good question. IMO it depends on the threat model. If I was a political activist I would not rely on Matrix. Some previous threads worth reading: https://news.ycombinator.com/item?id=23108750 https://news.ycombinator.com/item?id=23108750 https://news.ycombinator.com/item?id=24123997 https://news.ycombinator.com/item?id=24123997

ashtonkem 5y ago

I’m not that surprised that ProtonMail folded; as someone else said they’re not going to do jail for you. What’s concerning is the nature of this warrant and arrest. As far as I can tell all the articles haven’t mentioned any actual crimes; is France just straight up arresting climate activists now?

eplanit 5y ago

I can't imagine running an internet based service and not logging IP addresses. How else do you debug issues or isolate malicious users, etc. Does anyone think it's realistic (or even responsible) to not log basic info? I don't use PM, but it seems their product is end to end email encryption, not complete web anonymity. Maybe those wanting to add anonymity should access it via tor (if PM allows it).

Verdex 5y ago

My day to day life is pretty boring, but occasionally I'll imagine what I would need to do if I ever had to get out a secret message out where it was important that it couldn't be traced back to me. It always ends up being something like, "Well, I could buy a bunch of raspberry PIs with cash and then go to a coffee shop that I never go to and upload the message to a gmail account that I'll only ever use once. Throw the PI away afterwards in a random trash can in town and make sure to wear gloves every time I touch it. Finally use some sort of encryption scheme or something so I can identify myself for repeated correspondences because each time will be with a different one shot email account." It turns out that this isn't some fanciful paranoia, but is in fact the bare minimum of what I should be doing if something like that ever came up.

snet0 5y ago
Coffee shops have CCTV, no?
laurent123456 5y ago
Tor from a coffee shop should be sufficient shouldn't it? If the browser cannot be finger printed and the IP is not yours, it shouldn't be possible to identify you.
ArnoVW 5y ago
You're making it too complicated. Find an open wifi somewhere.
- eternalban 5y ago
  CCTV Cameras are everywhere. To get to point B, you will leave a nice trail. It should not be that difficult to assemble the necessary identifying data. And when the biosecurity state comes online in its robust form, your movements will be fully traced.

nicolas_t 5y ago

I think a distinction must be made between a service that will protect your privacy historically and a service that will continuously protect your privacy. If I sign up with protonmail today using a vpn like mullwad, since I'm probably not currently be targeted, I can reasonably be sure that it will be difficult to track things back to me. However, once I'm targeted and there's a warrant against me, any activity I have on such services is going to be logged going forward. So, using the service once to receive some data or do something anonymously is reasonably secure... This is very different from services like gmail which will have kept any logs in the past about me and that will always be able to track me without any further logging. It's imperfect but I think that given the current environment and the current laws, this might be the best we can have.

m-p-3 5y ago

Seems like another good reason to not trust anyone's words and protect yourself using good OPSEC.

CalChris 5y ago

Wasn't this a form of fraud? I don't know what the Swiss law is but in the United States, fraud is both a civil tort and criminal wrong. The elements of a fraud are: 1) the making of a statement 2) the falsity of the statement 3) an intent to deceive 4) reasonable reliance on the statement by the injured party 5) injury sustained as the result of the reliance ProtonMail knowingly told this activist 'we don't log your IP' in order to attract their business. ProtonMail did log the IP address. The activist believed this and got arrested.

yaris 5y ago
2. was missing when the activist started using PM. 3. also missing (unless there is strong evidence of presence). So no, no fraud. PM has to follow Swiss law and they have stated this long before the incident pretty clearly.
- CalChris 5y ago
  They've been saying this since at least 2015. https://web.archive.org/web/20151117172602/https://ProtonMail.com/ https://web.archive.org/web/20151117172602/https://ProtonMai... When did the activist start using ProtoMail? Also, if they say roughly, we will not follow Swiss law for you and they follow Swiss law, that is still lying.
SV_BubbleTime 5y ago
“We don’t log your ip by default” This is all very silly. They said right up front they can. Their TOS said they can. It’s also very silly to assume PM would disobey EU requests. They were created with EU funding.
- istingray 5y ago
  Maybe for you that's clear. But I use Protonmail to advocate for journalists, whistleblowers, and teachers, many of which are not security experts and not familiar with the twisted language used by Protonmail's marketing team. If their marketing team can't come up with something better, just take text from the privacy policy verbatim.

jeffbee 5y ago

Privacy weenies are the most easily defrauded people I've ever come across.

lanevorockz 5y ago

So they lied ... not surprising companies promise things just to betray their customers in a second. I still remember when Facebook won the social media war by promising to never allow advertisement.

bawana 5y ago

How do you say 'honeytrap' in Swiss?

dathinab 5y ago

> stated: "No personal information is required to create your secure email account. By default, we do not keep any IP logs which can be linked to your anonymous email account. Your privacy comes first." And it still holds!! What it didn't stat is that while _by default_ no such information is logged, but if they are legally compelled to they will log such the neseccary information for the email (account?) they are required to log them for. Its honestly surprising for me that anyone though that a fully legally (in Swiss)operating service would protect their privacy beyond the point they are allowed to by Swiss law. But luckily for us Swiss law is pretty neat wrt. privacy, at least currently.

istingray 5y ago
ProtonMail requires a phone number for account creation through Tor. "no personal information"...does it still say that? Let me know where, will email them.
- yaris 5y ago
  In Sweden you can get a prepaid phone number completely for free: Comviq literally gives away SIMs and to pre-pay you can still use cash. So from this point of view PM is not lying, not one bit.
  - istingray 5y ago
    It's a lie. Including in their home country of Switzerland. To buy a Swiss SIM card, you’ll need to provide proof of identity (such as a passport).
    - yaris 5y ago
      Either you are confusing Switzerland and Sweden (which were two quite different countries last time I checked) or I'd be very much interested in data on why you see my words about Comviq giving away SIM cards as lie. As you probably know, there are no roaming charges in EU, so if you have a swedish SIM card - you can use it (to receive SMS at least, sometimes answer calls) in any EU country. If you put some cash on it - you can even make calls. Still without providing a single bit of your PI (assuming you bought/stole a burner phone). EDIT: clarification regarding SIM usage.

janmo 5y ago

I am no lawyer, but there are over 180 countries in the world, and there is not one that will let you open a company that don't have to log user IP addresses? I call this complete BS. Protonmail has just become one of those providers that is only about making money and is probably getting money kickbacks from law enforcement under the form of legal processing fees or even something else, who knows..., really sad...

1cvmask 5y ago

For those who love Swiss "privacy" and security they should read about the CIA front-company from Switzerland for secure encrypted communications: https://en.wikipedia.org/wiki/Crypto_AG https://en.wikipedia.org/wiki/Crypto_AG And remember Mark Twain: “History Doesn't Repeat Itself, but It Often Rhymes”

qwerty456127 5y ago

ProtonMail has an official TOR page, there hardly is a reason for those performing activities illegal under relevant jurisdictions (I support the notion of illegal non necessarily being evil - in many countries many good things like fighting corruption, loving a same-sex partner or responsibly using psychoactive substances for genuine medical reasons can be illegal) to use it the way exposing their actual IP address. I also don't understand why does ProtonMail record the device type - I doubt there is a law requiring this.

NotEvil 5y ago
Can be telemetry
- qwerty456127 5y ago
  Telemetry is evil. No company respecting their users should use telemetry.
  - NotEvil 5y ago
    No, it's very useful tool. If disclosed correctly I have no problem with it
istingray 5y ago
Agreed, that's why I've asked Protonmail to promote their Tor page. Before yesterday the only mention was in their footer under "Onion site" and in a single blog post from 2017. They need to do better at promoting and supporting users through Tor. Heck, add it to their transparency report "40% of users connected through Tor, our goal is 90%"

rarba786 5y ago

I don't see why it's AS big a scandal given what CEO stated and reading accounts from reputable news sources. My quick take: France tells Switzerland who then compels PM to START tracking account holder(s) and prevented PM (by law from what I've read) from telling account holder. Per PM CEO this type of Swiss order could not be disputed with the way PM has disputed other claims. To me, it's not logging of the IP; it's when did it start and from my reading they started after being compelled to do so over a period of time between compelled to and this coming to light. To me, strong pushback (for those who feel passionate about it) should be directed to Switzerland for complying with France for what many think is not a high enough bar to compel all this tracking. Maybe they did scrutinize it and maybe they didn't. Any meta-data saving isn't secure but sharing that after being compelled to track account holders isn't surprising. There's a line in their agreement that says " If a request is made for encrypted message content that we do not possess the ability to decrypt, the fully encrypted message content may be turned over.". Maybe I'm missing something in my logic.

a3n 5y ago

Oh, boy.

mark_l_watson 5y ago

ProtonMail is my main e-mail, so I am positively biased in their favor. I think their advertising copy about not logging IP addresses was poorly done, but their service is private enough for me. It probably doesn’t much matter or make much difference, but I feel OK with using their service, and tweaking my account settings for Google and Apple to the minimum amount of data retention. I feel that people who let corporations easily have all of their data put themselves at a disadvantage when it comes to any interaction between yourself and any large company (insurance, retail, etc.). Governments will always have our private information so the real purpose of privacy is economic value. Imagine playing poker with your friends and you had to have your cards face up on the table and they could keep their cards hidden from you. In this example, your friends are corporations. EDIT: Carissa Véliz, author of Privacy is Power, was interviewed recently on the ProtonMail blog, and I think the interview does a good job of summarizing her excellent book: https://protonmail.com/blog/carissa-veliz-data-privacy/ https://protonmail.com/blog/carissa-veliz-data-privacy/

istingray 5y ago
What's important for you about using Protonmail? Would any non-Google non-Apple email account suffice?
- mark_l_watson 5y ago
  Nothing special about ProtonMail, except it seemed like an "easy choice" after reading the Surviving Surveillance Capitalism book a couple of years ago. Everyone just needs to make their own decisions on privacy. I feel fairly comfortable with my practices. For me, it is the economic motivation of wanting to reduce the advantage companies I deal with have over me that convinced me to take extra precautions.
  - istingray 5y ago
    Ah got it. I support Protonmail because I believe in easy to use privacy tools for others like journalists, whistleblowers, and teachers. That's why I want Protonmail to be a leader in this space with clear marketing and communications.

dang 5y ago

Recent and related: Clarifications regarding arrest of climate activist - https://news.ycombinator.com/item?id=28433601 https://news.ycombinator.com/item?id=28433601 - Sept 2021 (273 comments) ProtonMail logged IP address of French activist after order by Swiss authorities - https://news.ycombinator.com/item?id=28433131 https://news.ycombinator.com/item?id=28433131 - Sept 2021 (155 comments) Climate activist arrested after ProtonMail provided his IP address - https://news.ycombinator.com/item?id=28427259 https://news.ycombinator.com/item?id=28427259 - Sept 2021 (565 comments)

jd3 5y ago

it seems like ProtonMail should collaborate with Lavabit to see if it's feasible to implement darkmail (DMTP/DMAP protocols) in production http://darkmail.info/ http://darkmail.info/ https://protonmail.com/blog/protonmail-beta-v1-13-release-notes/#comment-7320 https://protonmail.com/blog/protonmail-beta-v1-13-release-no... https://www.youtube.com/watch?v=TWzvXaxR6us https://www.youtube.com/watch?v=TWzvXaxR6us

atok1 5y ago

I'm glad that they are at least removing that fallacy and people can't quote it any longer.

traspler 5y ago

It‘s really tiresome how it‘s become the normal to market all kind of fantasy interpretations of your value proposition and banish all nuance to legalese documents. ProtonMail has enough to justify itself, it doesn‘t need all the over the top claims of Swissness or blunt statements about privacy that are only half truths. They could also do without their spintastic, content marketing blog.

FirstLvR 5y ago

i know there are some Protonmail guys reading this thread... people choose your service exactly for this very same reason, good luck trying to regain people trust

istingray 5y ago

Similar to Apple, Protonmail seems poised to redefine privacy as "privacy from advertisers" rather than "privacy from us too". I for one am now only using Protonmail through Tor. Recommend Brave users enable "Automatically redirect .onion sites". If a site has an onion service, it will automatically redirect in case you forget.

deleted 5y ago

[deleted]

eth0up 5y ago

Anyone have feedback on this https://ctemplar.com/ https://ctemplar.com/ ? I get a sense to move along, but it still seems interesting. It is, or was, based in Iceland.

Grimm665 5y ago

Maybe I missed it in all the kerfuffle, but what was the crime that was allegedly committed by the French climate activist that required ProtonVPN to comply with this request for IP information?

Ikatza 5y ago

Thanks for clarifying, Proton Mail. And also, good bye. I'll be canceling my accounts today.

throwawayswede 5y ago

What a douchebag company honestly. Their marketing is absolutely evil. Changing the headline does not cut it, they need to fire people responsible for that outright lie. After a dude gets arrested, they’re like: oh, we were talking about advertisers! Who did you think? What a trash team. Proton mail ==

nrvn 5y ago

It is not the first time this company finds itself in the center of an international scandal. It has proven multiple times that privacy and security are not something they really care about. I wonder what else should happen for everyone to completely lose trust in this scam.

neycoda 5y ago

Listen, don't do crime through email.

Ginden 5y ago

Use TOR and onion services.