For all the Proton fans
-
For all the Proton fans
@skinnylatte they also did that to a climate fan. I've long said like Telegram is not so private as people think - use systems like cyberfear (and their related email system).
-
For all the Proton fans
@skinnylatte @protonprivacy ¿Explanation?
-
@skinnylatte This headline is incredibly biased. Did Proton help the FBI? Or did they hand over data to the Swiss government that the Swiss government ordered them to, and then the Swiss helped the FBI unmask an anonymous protester?
I keep seeing this post pop up in my feed with permutations of "WHY PROTON DO THIS!?" -- Because they were legally ordered to.
We're doing a disservice to ourselves for not recognizing the bounds of the privacy that Proton, or Tuta, or any other "private" email service provides, and looking at this moment as a failure by the provider - when really it's the failure of a user to recognize the technical & legal bounds of of their comms services to keep them anonymous.
The lesson here, i think, is about opsec, and knowing the bounds of the tools we're employing for whatever our goals are.
Would be good to know if they were legally compelled to turn over the (billing?) data …
-
@skinnylatte Whats the problem? Court order said give the info, they gave the info. They're not a pirate email provider operating in international waters in a submarine disguised as a whale.... they're a business who focuses on privacy.
sorta pearl clutching. tell me one business anywhare besides a swiss bank perhpas thats gonna NOT comply with the law
-
@skinnylatte Anyone who thinks Proton, Tuta or any other company is going to disobey a court order to protect a user is delusional. Proton states upfront that for absolute anonymity, use a free account (or pay with cash or whatever) and only connect using their onion site. They've never given up the content of emails (cause its encrypted in such a way that they can't access). They've never given any log info for VPN use (cause they have a strict no logs policy). Its as simple as that.
my account is free
-
@yc99.bsky.social Tuta isn’t even as good as Proton
-
If they can't structure their service in a way that avoids the collection and storage of personally identifiable customer data, then they have no business claiming they offer privacy. This is like charging a premium for the world’s most secure door lock when a burglar can easily enter your house by breaking a window.
@freediverx @taylor @boojum @skinnylatte
Privacy is not anonymity.
Encryption allows the details of a message only be read by sender and receiver. That’s privacy. Email otherwise is inherently insecure and not private. Your email address and the subject are plain text in transit.It’s not who you are, it’s what you say that is protected.
Keeping financial records may very well be part of Swiss law. I know they have to keep financials for 10 years.
-
@skinnylatte Anyone who thinks Proton, Tuta or any other company is going to disobey a court order to protect a user is delusional. Proton states upfront that for absolute anonymity, use a free account (or pay with cash or whatever) and only connect using their onion site. They've never given up the content of emails (cause its encrypted in such a way that they can't access). They've never given any log info for VPN use (cause they have a strict no logs policy). Its as simple as that.
@theangelofinsanity @skinnylatte Thank you for writing this (re legal standing of a business) for me :)). Yes, there is so much delusions everywhere.
-
Would be good to know if they were legally compelled to turn over the (billing?) data …
-
If they can't structure their service in a way that avoids the collection and storage of personally identifiable customer data, then they have no business claiming they offer privacy. This is like charging a premium for the world’s most secure door lock when a burglar can easily enter your house by breaking a window.
@freediverx @boojum @skinnylatte How do you charge somebody's credit card regularly on a subscription basis without storing any PII or working with a third party that stores PII?
This is like charging a premium for the world’s most secure door lock when a burglar can easily enter your house by breaking a window.
In which case it would be ridiculous to blame the door lock company when somebody breaks your window.
I think a more apt analogy is that it's like a hotel charging a premium for a high-privacy room, but still giving their card records to the FBI when they come with a warrant for those records, telling them what credit card paid for which room.
-
For all the Proton fans
@skinnylatte I never liked protonmail, they push you to use their centralized service, it is better to use Delta Chat for encrypted email and you can encrypt with any server or even host your own, no need to use a server in the hands of a specific company, also migrating from one server to another without losing your chats and contacts
-
If they can't structure their service in a way that avoids the collection and storage of personally identifiable customer data, then they have no business claiming they offer privacy. This is like charging a premium for the world’s most secure door lock when a burglar can easily enter your house by breaking a window.
@freediverx @taylor @boojum @skinnylatte
> If they can't structure their service in a way that avoids the collection and storage of personally identifiable customer data, then they have no business claiming they offer privacy
Well they have, they give you the option of mailing them cash to pay for your service, that the person in question chose to use their credit card just shows bad judgment of their threat model and bad OPSEC.
> This is like charging a premium for the world’s most secure door lock when a burglar can easily enter your house by breaking a window.
Exactly, you hit the nail on the head, the person had bad opsec, like using Tor and Tails to go ahead and sign into your Gmail address before doing something the state disapproves of. Tech really isn't the issue in this case
-
For all the Proton fans
@skinnylatte This is very misleading. Proton never claimed you would be anonymous. They do not collect user data, the maximum they can have (if I'm not mistaken) is your IP, backup email and credit card, if you paid with one. The rest is end-to-end encrypted.
In this case, the account was a premium one that was paid with a credit card. You have ways of getting the subscription more privately, and this was a case of bad OpSec.
Please don't spread FUD.
-
For all the Proton fans
@skinnylatte There is no anonymity on the nets. Even for very versed in nuances of surveilance hackers. 25 years ago we could use mixmasters and other aonymization techniques. And all privacy seeking users could have been deanonymized by a simple cepstral analysis of text produced. Some cypherpunks who knew tried to counter this using with their wanna-be-anon persona unusual capitalization, peculiar typos, and were sprinkling their posts with mannerisms and other distractive goodies perl allowed. It was not much helpful, ok, it usually could give a day or two of leg, because sample posts needed to be manually marked for topical analysis, but it was not possible to hide from determined adversary. No LLMs, just a few tools built for linguists.
Today so many netfarers want 'absolute anonymity' yet demand from us techies that it all must support stickers and must run on Android/iOS device that is costantly beaming not only their whreabouts, but also their food, flowers, body parts. And this fancy new furniture.
-
@r3dr3clus3 @skinnylatte If you don't have the data, you can be ordered to give it up by whomever, and you can't. Proton mail claims privacy, but it in fact saves enough data to identify a single individual.
The headline is not biased. Proton claims things they actually can't uphold. This is not the fault of the customer. Stop blaming the victim.
@Pyrogenesis @r3dr3clus3 @skinnylatte Maybe don’t use a traceable credit card if you’re that worried about privacy.
-
For all the Proton fans
@skinnylatte I live in Canada and I use https://typewire.com . It is quite new and has a few glitches though.
-
For all the Proton fans
@skinnylatte@hachyderm.io gpg密钥在服务提供商手里本身就是一个笑话
-
@boojum @skinnylatte
What's the point of paying for a privacy-focused email provider that doesn't provide privacy?@freediverx @boojum @skinnylatte I’d want my money back. There should be a class action because everyone has been actually paying for nothing.
-
@skry @r3dr3clus3 @skinnylatte
If it was a (Swiss equivalent) legal warrant then that's fine.
But I don't see what the "Cop shot" and "explosive devices" have anything to do with this. Either the warrant (or equivalent) is valid or it isn't - the cop thing shouldn't have any direct bearing on what Proton does or doesn't do.
Bottom line, though was that it was a valid warrant and they had no choice.
-
@r3dr3clus3 @skinnylatte If you don't have the data, you can be ordered to give it up by whomever, and you can't. Proton mail claims privacy, but it in fact saves enough data to identify a single individual.
The headline is not biased. Proton claims things they actually can't uphold. This is not the fault of the customer. Stop blaming the victim.
If you pay by credit card they, by definition, have the data and can be compelled to give it up. Just like any company will be. The headline is sensational FUD.
I don't use Proton, but the misinformation flying around about this now will lead people to very simplistic "Proton bad! No use Proton!" instead of "I want to be anonymous, so I need to rethink my opsec in ways that avoid obviously traceable things like credit cards."
This is the problem. People need to learn the difference between security, privacy, anonymity and secrecy and where those things overlap and how to balance them against living as a hermit in a cave somewhere. Simplistic "Proton(etc.) bad! No use Proton(etc.)" hijack what needs to be a calm, fact-based discussion.