For all the Proton fans

[r3dr3clus3@infosec.exchange]

@lucas @skinnylatte YES!

[k3ym0@infosec.exchange]

@serebit @skinnylatte unless you’re planning on self hosting there is literally no other email service you could jump to that hasn’t done the same thing.

[wonkothesane@mstdn.social]

@freediverx @boojum @skinnylatte the issue here seems more to do with the credit card from what I’m reading

[64bithero@mstdn.games]

@skinnylatte when officials come after you and your a business your going to comply. From what I heard it wasn’t email data or their inbox it was credit card information.

Most people are with services like proton to ensure their data isn’t for sale to just anyone.

But hey if you love Google knowing everything about you or Ads Galore on Yahoo , you do you !

[wonkothesane@mstdn.social]

@skinnylatte @babe Let’s all go back to Google!

[csolisr@hub.azkware.net]

That reminds me, how's Tuta doing?

[serebit@floss.social]

@k3ym0 @skinnylatte I mean yeah, but I'll put it this way: Proton sells its service on how unbelievably private it is and how they'd never give away your identity. When they turn around and do it, it stings far more than another company who never made those promises doing the same. Kinda like Target and DEI: it was a complete 180 from the way they'd sold their brand.

[mangotable@famichiki.jp]

@skinnylatte I got that the implication in the article quote from Proton is if the user had used crypto and not CC then maybe no issue.

[r3dr3clus3@infosec.exchange]

@skinnylatte This headline is incredibly biased. Did Proton help the FBI? Or did they hand over data to the Swiss government that the Swiss government ordered them to, and then the Swiss helped the FBI unmask an anonymous protester?

I keep seeing this post pop up in my feed with permutations of "WHY PROTON DO THIS!?" -- Because they were legally ordered to.

We're doing a disservice to ourselves for not recognizing the bounds of the privacy that Proton, or Tuta, or any other "private" email service provides, and looking at this moment as a failure by the provider - when really it's the failure of a user to recognize the technical & legal bounds of of their comms services to keep them anonymous.

The lesson here, i think, is about opsec, and knowing the bounds of the tools we're employing for whatever our goals are.

[randamumaki@mstdn.social]

@skinnylatte FFS remember to link to your sources.
This would be the 404 Media article in question: https://www.404media.co/proton-mail-helped-fbi-unmask-anonymous-stop-cop-city-protestor/

[wakinuniversejo@rivals.space]

@serebit
What's your alternative ?
Asking for a friend...
@skinnylatte

[skua@mastodon.social]

@skinnylatte

I've not seen such responses for a long time.

For your next posts you could criticise Microsoft, Musk & Linus Torvalds.

We could make a new "popularity index" this way.

[jeffcodes@infosec.exchange]

@lucas @skinnylatte
Additionally, privacy and encryption != free from consequences of illegal activity.

Proton is also zero-knowledge with email and drive, meaning contents is encrypted behind anyone’s purview without the password.

Swiss law requires a retention period of 10 years for financial data. I would have to imagine some of this information might fall under that umbrella.

[serebit@floss.social]

@WakinUniverseJo @skinnylatte I switched to https://forwardemail.net. It doesn't currently have a web UI, so I use Thunderbird with it.

[pyrogenesis@mefi.social]

@r3dr3clus3 @skinnylatte If you don't have the data, you can be ordered to give it up by whomever, and you can't. Proton mail claims privacy, but it in fact saves enough data to identify a single individual.

The headline is not biased. Proton claims things they actually can't uphold. This is not the fault of the customer. Stop blaming the victim.

[taylor@social.axfive.net]

@skinnylatte

We want to first clarify that Proton did not provide any information to the FBI, the information was obtained from the Swiss justice department via MLAT. Proton only provides the limited information that we have when issued with a legally binding order from Swiss authorities, which can only happen after all Swiss legal checks are passed. This is an important distinction because Proton operates exclusively under Swiss law

I don't use Proton products at all (not for any idealist reasons), but I don't really think this can be much of a condemnation of the company. I don't know what else you can expect them to do in this case.

edit: That said, the real takeaway is that if you want to remain anonymous to a service that can be compelled to hand over data about you (read: more or less any service you might want to use), you should not pay with a credit card linked to your actual name, you should not access it from your home IP address, and you should not use it in any way that links it to your real self.

Proton is security focused, but even they are bound by the laws of the country they operate in.  Use TOR, use E2EE, pay with cryptocurrency, maintain hermetic separation between your anonymous and public selves, etc.

[rickscully@heads.social]

@skinnylatte @serebit their embrace of crypto is what made me leave.

[taylor@social.axfive.net]

@freediverx @boojum @skinnylatte That they will protect your privacy to the limit that they legally can, perhaps? A privacy-focused email provider that doesn't abide by the laws of the country they operate in stops existing pretty quickly.

[oneloop@mastodon.xyz]

@skinnylatte I know someone who will have a field day with this story @Tutanota

[wakinuniversejo@rivals.space]

@serebit @skinnylatte thanks a bunch