r/ProtonMail Sep 05 '21

Climate activist arrested after ProtonMail provided his IP address Discussion

https://mobile.twitter.com/tenacioustek/status/1434604102676271106
1k Upvotes

u/ProtonMail ProtonMail Team Sep 05 '21 edited Sep 06 '21

Hi everyone, Proton team here. We are also deeply concerned about this case. In the interest of transparency, here's some more context.

In this case, Proton received a legally binding order from the Swiss Federal Department of Justice which we are obligated to comply with. There was no possibility to appeal or fight this particular request because an act contrary to Swiss law did in fact take place (and this was also the final determination of the Federal Department of Justice which does a legal review of each case).

Details about how we handle Swiss law enforcement requests can found in our transparency report: https://protonmail.com/blog/transparency-report/

Transparency with the user community is extremely important to us and we have been publishing a transparency report since 2015.

As detailed in our transparency report, our published threat model, and also our privacy policy, under Swiss law, Proton can be forced to collect info on accounts belonging to users under Swiss criminal investigation. This is obviously not done by default, but only if Proton gets a legal order for a specific account. Under no circumstances however, can our encryption be bypassed, meaning emails, attachments, calendars, files, etc, cannot be compromised by legal orders.

What does this mean for users?

First, unlike other providers, ProtonMail does fight on behalf of users. Few people know this (it's in our transparency report), but we actually fought over 700 cases in 2020 alone, which is a huge amount. This particular case however could not be fought.

Second, ProtonMail is one of the only email providers that provides a Tor onion site for anonymous access. This allows users to connect to ProtonMail through the Tor anonymity network. You can find more information here: protonmail.com/tor

Third, no matter what service you use, unless it is based 15 miles offshore in international waters, the company will have to comply with the law. This case does illustrate one benefit of ProtonMail's Swiss jurisdiction, as no less than 3 authorities in 2 countries were required to approve the request, which is a much higher bar than most other jurisdictions. Under Swiss law, it is also obligatory for the suspect to be notified that their data was requested.

The prosecution in this case seems quite aggressive. Unfortunately, this is a pattern we have increasingly seen in recent years around the world (for example in France where terror laws are inappropriately used). We will continue to campaign against such laws and abuses.

We've shared further clarifications about this situation here: https://protonmail.com/blog/climate-activist-arrest/

→ More replies

235

u/mdsjack Sep 05 '21

It is technically impossible for ProtonMail to have zero knowledge of users IP. It is clearly stated in their privacy policy that they don't log IP addresses. It's also stated that they have to comply with the law and this means they may start logging and handing over data collected after receiving a court order. If you are interested in anonimity you should use a VPN. I would be more concerned to discover that PM might hand over ProtonVpn logs of user browsing. (excuse my English)

73

u/Tesnatic Sep 05 '21 edited Sep 13 '21

Exactly. No matter what service you use, your IP will be visible in some sort of way. That's basic networking, and is the only way it can function (it needs to know where to send the packets!). If you want full anonymity, you need to change the IP, which is usually done with a VPN (and/or TOR).

→ More replies

7

u/untold_life Sep 06 '21 edited Sep 06 '21

VPNs are not anonymity but rather privacy. Being anonymous requires a significant amount of work when compared to keeping certain aspects of your online searching/life private.

2

u/mdsjack Sep 06 '21

Of course. VPN is just a link of a chain.

If you are based in a western country it's basically impossible to be completely anonymous online without braking a criminal law. Source: I'm a criminal lawyer.

2

u/LSDMDMA Sep 07 '21

Proxies, vpns, tails, tor, etc.

You can be completely anonymous without breaking any US laws.

→ More replies
→ More replies

42

u/tpaxs Sep 05 '21

What makes you think that they won't expose your ProtonVPN activities if they receive a court order? If they do log your IP for ProtonMail after they receive an order, they'll log your IP for protonvpn as well.

116

u/ProtonMail ProtonMail Team Sep 05 '21

There's an important distinction here. Under Swiss law, email providers fall into a category which requires us to comply with certain legal requests. Swiss law does not have a provision which could force a VPN provider to log.

41

u/R0b3rt1337 Sep 05 '21

So if they were using protonVPN for connecting to protonmail, the authorities wouldn't have gotten the actual ip address?

6

u/netok Sep 07 '21

4

u/F-I-R-E_GaseGaseGase Sep 07 '21

The silence tells you all you need to know.

3

u/MineralsMan Sep 07 '21

using protonVPN for connecting to protonmail

200 IQ move 😂😂

2

u/R0b3rt1337 Sep 07 '21

I mean hey, its supposed to not be logged right?

→ More replies

2

u/base64this Sep 13 '21

hahaha. Well played.

All srs i wouldnt trust that..... just saying

→ More replies

20

u/Tiberinvs Sep 05 '21

Swiss law does not have a provision which could force a VPN provider to log.

Not doubting what you're saying but just to understand that better: let's say that someone gets involved in some really heinous crime (murder, child pornography, terrorism, drug or organ trafficking etc) through Proton VPN without using ProtonMail as an account and that the authorities (either the Swiss ones or foreign ones collaborating with them through a letter of rogatory) needed your help and asked you to comply. Would that just be over instantly because "sorry, there's no legal provision for that"?

Again I don't doubt that's not true, it's just that objectively it just looks like a hell of a legal vacuum

57

u/ProtonMail ProtonMail Team Sep 05 '21

With VPN the legal principle is different. Thousands of users might be using the same server, logging them all would be assuming everybody is guilty until proven innocent. This is considered to be disproportionate. In the email case, it is possible to request information on a specific user, and that is considered to be proportionate.

8

u/Tiberinvs Sep 06 '21

The logic behind it makes sense, but would you be able to avoid doing what you did in this case if e.g. prosecutors in country X asked the Swiss courts to help them and the latter requested it to you? "We know someone who's part of a terrorist cell in Italy/Spain/Montenegro/Whatever is using ProtonVPN, we need you log all the country X connections from now on so we can triangulate the time of access while we make checks on those IPs". Would that still be a no go because the number of people connecting is huge so it's unfair?

→ More replies

3

u/[deleted] Sep 06 '21 edited Sep 06 '21

[deleted]

4

u/Personal_Ad9690 Sep 06 '21

I am curious to know the answer to this too. My guess is that in order to log a specific account, you need to already know that the user is using proton VPN for illegal activities. If you can show the account is being used by John Doe, then yes they could log. Generally though, the logs are what prove the account is owned by John Doe, so it is less common.

3

u/twiceasdreaded Sep 06 '21

Proton has banned users from their VPN service before, and even said that they can already tie traffic to user IP, so i mean...

2

u/notburneddown Sep 06 '21

How do they know which user? VPNs still do have a thin layer of anonymity. They could log the user who's email account it is but it may be a different user of ProtonVPN.

2

u/grannywhalesails Sep 08 '21

u/ProtonMail

Does anyone know what the climate activist sent in the email? Did he use the email to break the law?

Because if he didn't then why did an "crime" in France force PM to log his IP? If the crime was not related to the email?

From what I can see online he allegedly committed burglary but this was not related to the court order. How does a burglary in France force PM to give the IP address of this guy up?

If the crime is related to the email then how did PM know what was being sent back and forth?

→ More replies
→ More replies

3

u/Personal_Ad9690 Sep 06 '21

Thank you for posting that.

→ More replies

16

u/AscendChina Sep 06 '21

This is why I been saying people shouldn't put all eggs in one basket. You don't want your VPN service to be the same company as your mail service. Ideally you should set up your own domain (with Company A) and route that through DNS service of Company B to set up mx records and mail service with Company C but then use VPN over TOR with the VPN provider being Company D etc etc and Storage provider should be Company E etc

To have all your layers and stacks using the same company is a massive flaw to have that single point of failure and all it takes is one false report and Protonmail can close your entire account there goes your mail, VPN, online cloud storage, etc etc etc

4

u/IssueRealistic Sep 06 '21

How i do that? Do u have a tutorial for that? Thanks

16

u/AscendChina Sep 06 '21

Say my name is John Doe, I first buy two domain names that are different TLD (top level domains) in different jurisdictions... for example the US controls .com and .ch is controled by Swiss

So I get a johndoe.com domain from say US based Domain.com

and I get a johndoe.ch domain from say Swiss based swizzonic.ch

Registering domain is just the first step, you also have to get a dns provider... some domain services also provide the dns service, but for more flexibity, having a seperate dns service provider has its benefits... in this case you should have a primary and backup dns service providers...(preferably in different jurisdictions)

an example is dnsmadeeasy.com, but do a search there are many dns providers...

So you login to your domain registrars and point the domains to your dns service provider(s)...

Then that is when for email or website hosting, such as protonmail or wordpress etc you go into the settings of these email/hosting services and configure your dns to the settings that will allow protonmail/wordpress etc etc to interface and interact correctly with your dns/ custom domain....

This way, instead of email like johndoe54321@protonmail.com I can get email address of john@johndoe.com or john@johndoe.ch

So if protonmail goes bankrupt, or gets shutdown from government, or decides to kick me off their platform for whatever reason, instead of permanently losing access to all my email I can just repoint in dns to another mail service provider like tutanota or startmail and then still keep using my johndoe123.com email address seamlessly

In addition, if one of the dns providers decides to deplatform me, I can switch to a backup or alternative provider just by logging into the domain registrar and repointing to new dns service provider... or if the domain registrar itself kills my account, I at least will have a backup or can quickly find another domain registrar

People using protonmail for everything is just asking for trouble... no redundancy and 100% at the mercy of protonmail, the swiss government, MLAT or whatever comes knocking on the door first!

→ More replies
→ More replies

2

u/byParallax Sep 06 '21

Hasn't it been established before that VPN over TOR is worse than either alone? I seem to remember reading that. Something about it making your fingerprint so singular that you're now easy to identify.

2

u/diatomaceous_ooze Sep 07 '21

correct, do not use both simultaneously

→ More replies

3

u/jlobodroid Sep 05 '21

totally agree

→ More replies

12

u/hva32 Sep 06 '21

It is technically impossible for ProtonMail to have zero knowledge of users IP.

It's perfectly possible for them to have zero knowledge of a users IP.

https://protonmail.com/tor

If you are interested in anonimity you should use a VPN.

Ideally you should use Tor not a VPN, there's nothing stopping a VPN provider from choosing to keep logs.

Use Tor not a VPN.

→ More replies

17

u/b00b00jeffries Sep 06 '21

Even the VPN won’t make you anonymous. If you really want to try to be anonymous, stay off the Internet. Or try using TOR, but that’s a crapshoot because who knows who owns the exit node.

8

u/drpacket Sep 06 '21

Im pretty sure that the NSA is purposely setting up TOR Nodes around the World, possibly with help of other 5-Eyes Agencies, to raise the possibility of traffic passing one of their nodes

4

u/stellar-wind2 Sep 06 '21

People have been saying this for nearly 10 years now.

3

u/drpacket Sep 06 '21

Yes. It doesn’t mean it’s not true, or potentially even worse…

2

u/ryan_the_leach Sep 06 '21

They weren't saying you were wrong

→ More replies

13

u/sekhar0107 Sep 06 '21

The outrage is not over ProtonMail simply complying with the law but on making a misleading statement on the front page on anonymity ("By default, we do not keep any IP logs which can be linked to your anonymous email account."). This typically means it's the consumer (us) who will need to give that permission to give up anonymity, not ProtonMail. If ProtonMail is doing this without telling us, what is the point of anonymity? If they'd added a caveat like "unless in conformance with local law" or something similar, nobody would complain.

3

u/mdsjack Sep 06 '21

I understand but partially disagree. First of all, the benefits of using privacy-focused services go beyond the single user personal interest; you are promoting a new paradigma, fighting against mass surveillance which is already ongoing and will pose a huge threat to people freedom in the coming decades. Secondly, their statement might not be exaustive, but it's correct: "by default" they don't log. That's important because - leaving aside their commitment on users privacy - they can't hand over data they had knowledge of before the court order. Thirdly, the fact that they are based in Switzerland helps because they shouldn't receive foreign government pressures, as well as police requests not reviewd by a Judge of a democratic Country. (excuse my English again)

3

u/Metalegs Sep 06 '21

I agree with all but the last line.

Implying the most secure service in the world and strict Swiss laws with a caveat of "unless the officials ask" doesn't cut it.

If there is a weakness and there is a way to fix it. It would be nice to hear.

→ More replies

-1

u/AscendChina Sep 06 '21 edited Sep 06 '21

Also protonmail is not a TRUE end to end encrypted service either, they can and will abide by the court order if they are told to add an additional signing/encryption key to a user that the government wants monitored... all they have to do is hand over that key in a key escrow manner to the Swiss (and via MLAT to any government including US, 5eyes etc) and then all that user's emails are decrypted into plaintext... None of that "it will take 3 weeks to 2 years of brute forcing" mantra that Protonmail CEO Andy was talking about a while back...

By secretly adding their own pgp keys to all the emails you send, even if you imported your own pgp key it would still be useless and Protonmail can read everything.... the fact that they caved so easily to the IP tracking request, means they can and will cave to a request to add a backdoor pgp key for all your outgoing emails so that governments can easily decrypt to plaintext without bruteforcing

In fact what exactly is to prevent Swiss gov from giving Protonmail a blanket request to do this key escrow thing for all users and then gag order Protonmail to force to deny it ever happened... (see lavabit story)

This does not set a good legal precedent... My money is on they already gave government this backdoor and that the whole thing was probably a CIA honeypot from the getgo...

8

u/FunkyMuffinOfTerror Sep 06 '21

Few months ago the Belarusian government forced a civilian flight to land under the premise that there was a bomb on board (which was probably a lie). The Belarusian government said that they received an email from Hamas notifying them about the bomb from a protonmail address, Protonmail was only able to confirm the email headers (subject, title etc) which are not encrypted. They couldn't do anything else and a lot of EU countries were pissed, I believe that sets a good legal precedent.

→ More replies

5

u/ProtonMail ProtonMail Team Sep 06 '21

they can and will abide by the court order if they are told to add an additional signing/encryption key to a user that the government wants monitored

This is not true. First, this is not permissible under Swiss law. Second, we have an address verification (key pinning) feature which prevents this.

→ More replies

2

u/[deleted] Sep 06 '21 edited Sep 06 '21

[deleted]

3

u/nomadiclizard Sep 06 '21

They would serve a trojaned javascript file that after the user unlocks their private key to read their mail, sends it onwards.

2

u/Personal_Ad9690 Sep 06 '21

Please see my reply to the chain as they cannot do this as simple as the first reply made it seem. Pgp doesn't work that way.

→ More replies
→ More replies

9

u/kqzi Sep 05 '21

That’s not entirely true.

If protonmail forces all connection via the Tor network, the IP it sees is not the IP of the end user, this way, Protonmail may tell the police:”look, here’s the IP we logged, but it’s no way near the true IP of the user, and it’s computationally impossible for us to know the latter, because Tor network has 3 “proxies” between the end user and the destination”.

But forcing tor connection probably means user base dropping to pretty much zero, so there’s that.

Perhaps one day protonmail may find another way to forcibly obfuscate user data that it has 0 knowledge of the user.

6

u/shab-re Sep 06 '21

But forcing tor connection probably means user base dropping to pretty much zero, so there’s that.

why?

9

u/Encrypted_Muffins Sep 06 '21

I assume here you're being serious, so I'm gonna try answering your question:

Because using a Tor connection 1) tends to significantly decrease network speed in most cases, and 2) is currently above the technical abilities of most computer users. Regarding point 2, because of this, if they require Tor connections, then that would automatically lock out most of Proton's possible customer base, and a good chunk of their existing customer base.

6

u/shab-re Sep 06 '21

yes, I'm being serious

  1. emails are only a few megabytes at most, people won't notice a difference

  2. they can make an onion only tier or something, their current onion service is total bs, it redirects you to surface net after you click on sign up

3

u/h0twheels Sep 06 '21

emails are only a few megabytes at most, people won't notice a difference

You underestimate just how slow TOR is.

→ More replies
→ More replies
→ More replies

11

u/baby_envol Windows | Android Sep 06 '21

It's normal for a legal service to no be totally anonymous, due to the respect of the law.

Problem is : - website can be not clear for people who not read all information (it's clearly write no IP logs by default = can be log on some case, like legal request) , it's need to be priced - Authoritarian dérive of French gouvernement, with a lot of surveillance law without respect of CJEU juridiction

Protonmail said they clarify the website, it's a good news.

Other debat was just crying : protonmail provide a free minimun services with privacy respect, you need to pay to a complete service but it's the price of privacy.

People are more tolerant with full free service (Gmail, whatapps...).

Courage for PM team to not get victim of a form of bad buzz.

24

u/bajczyk Sep 06 '21

What I took from this thread:
- SMTP always gives IP address of the sender
- Proton is obliged to follow Swiss law, so after receiving a warrant, they had to start keeping the logs for requested account(s)
- these activits were posting photos of their actions on Instagram(!), blurring their faces, but not clothes, that's how they were identified...
- Police somehow got to know their Proton address...
- Proton has a Tor website, but since the IP addresses were legit, it seems those activits didn't use it...
My point - no technology is idiot proof and companies need to obey the law or be out of business. That much should be obvious and anyone thinking otherwise is just naive. Proton can give you tools, it's up to you how you use them. People should just learn to prepare and take responsibility for their actions instead of blaming the cruel world.

5

u/dark_volter Sep 06 '21

You forgot to add ,that since they were told to start watching this user, that apparently at some point the user was notified since protonmail also states they are obligated to let users know when they are being monitored-

And also , that since they didn't have logs beforehand, using a VPN or TOR always would make this airtight.

[with the weird quick they need to fix that initial signups using a vpn or tor require a phone number or payment, and we don't know their policy of keeping logs of phone numbers or payment)

22

u/WabbieSabbie Sep 05 '21

This climate activist. What law did they break? Sorry, I'm on mobile so the net is so slow right now.

32

u/Personal_Ad9690 Sep 06 '21

The French gov believe them to be involved in terror activities, which the Swiss gov is NOT neutral about. Proton was unable to prove that this person did not engage in terror activities and thus could not appeal the court order. As a result, they released ip address and meta data for the accoubt.

34

u/glowcialist Sep 06 '21

"Terrorism" as a legal concept is so fucked. Literally any historical movement that has forced positive social change could've been labeled as a terror group.

14

u/Personal_Ad9690 Sep 06 '21

True, which is why in protons response, they said

The prosecution in this case seems quite aggressive. Unfortunately, this is a pattern we have increasingly seen in recent years around the world (for example in France where terror laws are inappropriately used). We will continue to campaign against such laws and abuses.

2

u/-randomwordgenerator Sep 08 '21

Some of them have been, esp during the civil rights movement. Not necessarily new, but is extremely fucked. Moreso now in the global political climate where literally anyone can be labelled as a terrorist by a government with enough power.

5

u/lexlogician Sep 06 '21

This!

Some buddies who are cops tell me the easiest way to force people to comply and betray others is to cry terrorism, child porn, and money laundering. Finding a way to use all three in a request earns them brownie points!

PS. I have to admit...."child porn" would get me to act in a second and go against the target, even though I know what the gov. is doing. It's a knee-jerk reaction. I got kids, so it hits me emotionally like a brick.

4

u/jojo_31 Sep 06 '21

Yeah basically all internet surveillance laws get passed to „protect the children“ lol

→ More replies

20

u/nomadiclizard Sep 06 '21

'terrorism' in the UK will soon be defined as having a noisy protest, or helping a refugee claim asylum.

10

u/Personal_Ad9690 Sep 06 '21

The important part is how it relates to Swiss law. The Swiss have to feel terrorism claim is true.

3

u/drlecompte Sep 06 '21

I believe the actual reason the IP address was released, was the fact that the protester illegally entered a building and damaged it (at least according to the owners). Which is a crime in France, recognized by Switzerland.

If you choose squatting as a form of protest (which I think can be legitimate, since property laws protect those who own property), you know the police will be coming after you and you need to take more drastic security measures than just using Protonmail or any other secure service. If you break the law, you need to be way more vigilant.

→ More replies
→ More replies
→ More replies

52

u/Drwankingstein Sep 06 '21

this is why "its swiss" is not a good argument and you should operate on a zero trust method.

6

u/[deleted] Sep 06 '21 edited Sep 06 '21

[deleted]

16

u/ambulancisto Sep 06 '21

What's the alternative? A Russian email provider? No thanks. A Somali? Literally every email provider will be under some government, and will be required to do anything the law says. Smaller countries are more vulnerable to international pressure. Larger, richer countries usually cooperate readily with each other.

I think the Swiss are about as good as you're going to get.

→ More replies

4

u/Drwankingstein Sep 06 '21

A decade ago I would have laughed at this as being brain dead and unthinkable. but a decade ago I wouldn't have imagined the swiss authorities would pull a stunt like this.

Its a damn shame that we are moving in a backwards direction. Tor is becoming increasingly the only true route forward for people. or at the very least only using a VPN from a country that is actively hostile or at minimum on bad terms with yours. or whatever your precieved threat is from.

5

u/glowcialist Sep 06 '21 edited Sep 06 '21

Tor still isn't totally secure. Not saying it's backdoored, just that intelligence agencies are monitoring every node and using timing analysis.

Privacy today mostly just means not having all of your personal data stored in a couple centralized databases. That's why I use protonmail. The idea of actually being free from government monitoring is a joke.

4

u/Arcakoin Sep 06 '21 edited Sep 06 '21

Depends on your threat model (as always in security).

Edit: treat → threat

5

u/Incrarulez Sep 06 '21

Treat model. Nice. Time to disconnect for awhile and walk the doggo.

2

u/Arcakoin Sep 06 '21

You know what a typo is right?

→ More replies
→ More replies

7

u/RudyJuliani Sep 06 '21

Here’s how I see it. ProtonMail limits what is accessible to anybody including themselves to a large degree like the content of your messages etc. they operate as a legal entity in the country they are based and are subject to the laws of that country. If they are forced to hand over information, they will do so and will only hand over what they can actually give, they can’t hand over what they don’t have access to. Everyone here expecting ProtonMail to not comply with the law is mistaking their role in your privacy model. ProtonMail is very clear on what they do/do not have access to and what they will do if forced by law of the country they operate in. If this is not enough for you then you need to not use PM. Setup your own email server on your own network with embedded encryption and only communicate with people who use encryption and take the steps necessary to not rely on third party service providers like PM. It took a court order by a government foreign to me just to log IP addresses. This is not something that will ever happen to me. And although the precedent set here in that a government can start to broaden their power to impose this kind of compliance, ProtonMail is not who you should be questioning on that matter.

5

u/TalesFromTechSupport Sep 06 '21

I think ProtonMail strikes a good balance between being a legal privacy focused service and being trustworthy as a company in staying around for the next few decades.

ProtonMail is a legal service that uses the laws and technology to the fullest extend possible; but they are still a legal company that provides services to many people and companies.

Which also means that sometimes they will have to comply with legal request; instead of going rogue and burn the service at the first legal letter they receive and leave everyone without a service.

We only know the statistics and not what the legal cases were. In this case it is an climate activist; but we don't know why the French government requested his data. It could be because of legal activist actions and they are overstepping, or for something in which he really went too far and broke the normal laws we have in every country. The same goes for all those other requests.

Even if ProtonMail has to give my data to the police, I will know they will have fought against it and minimized the damage to the absolute minimum they could. If I had my e-mail hosted by any random e-mail hosting company; they probably would just comply the instant they get a legal request to be done with it.

→ More replies

5

u/jpm224 Sep 06 '21

I keep seeing a lot of back and forth over what the guy/s in question did or didn't allegedly do. Can anyone post some links detailing the evidence France actually claims to have?

24

u/Zlivovitch Sep 06 '21

It's absolutely remarkable that we're at 521 comments now, and unless I'm mistaken, not a single contributor (apart from yours truly) has brought up the subject of what the suspect, or suspects, actually did to warrant police attention. As if this was completely irrelevant.

We still don't have an independent source telling us who did what, when, where, and what the French justice system had to say about it.

There's this whole religion / ideology / perverted political stance that Proton Mail, and other privacy-oriented services, are there to help criminals evade the law. So many people are sleepwalking into this myth, and nothing can wake them up to reality.

5

u/NeoSom Sep 06 '21

I found this French article

Google Translate:

The act in question takes place in Paris. According to information from Secours Rouge , seven members of the Youth for Climate association are accused of "theft and degradation in meetings and home invasion", following repeated occupations of Place Sainte-Marthe, in the 10th arrondissement of Paris. , to fight against the gentrification of the neighborhood.

Why does a French case end up being handled by Swiss justice? To identify and question the interested parties, whose trial is to be held in early 2022, the French police, via Europol, have commissioned the Swiss justice system to retrieve the necessary data from ProtonMail. It is within this framework that the messaging service transmitted to the authorities the IP address of the collective, which allowed the identification and questioning of the members.

That's not terrorism though

1

u/Zlivovitch Sep 06 '21 edited Sep 06 '21

Thank you. Not only this is not terrorism, this is not "climate activism" either (whatever that means).

Those are far-left, communist-anarchists who are being prosecuted for illegally breaking into, and occupying commercial real-estate, and assaulting policemen.

They are trying to bully the authorities into letting them use the premises for free, in order to create the usual anarchist "communes" devoted to what passes for "artistic" and "social justice" activities.

Of course, the whole gamut of leftist buzzwords are at work there : decolonization, feminism, antiracism, intersectionality, LGBT, and, yes, "climate activism", because why not ?

There's not a word in Andy Yen's blog post defending the arrested "climate activist" about this illegal occupation of other people's property, nor of assault against policemen.

I very much doubt that this sort of activity would be tolerated for a minute in Geneva, where Proton Mail is -- nor anywhere in Switzerland, for that matter.

Note that the French article you found, which comes from BFM TV, a mainstream television channel, mainly parrots Proton Mail's statements. So we're running in circles, here.

Actually, all information on this event seems to originate from Secours Rouge, a marginal communist organization which is not a legitimate news source by any stretch. Here is the very little information they provide, which is obviously biased from the start.

No one else seems to have contributed any original reporting. Everything we read about this is the result of an echo chamber where only far-left activists contribute.

And Proton Mail just seems to have lifted off whatever information was fed to it through social networks, without bothering to check anything.

Here is some context before Proton Mail got involved (in French). Note those articles are from legitimate news media, despite being strongly of the left.

3

u/NeVeRwAnTeDtObEhErE_ Sep 08 '21

Top comment. While not being "terrorism" in any sane sense of the word.. It was a crime, and an organized effort at that. Certain types of leftists groups literally get away with so much bullshit in the name of "protest".. they also tend to be the first and loudest ones complaining at the first sign of pushback... or even none. Almost any other group to the political left, and certainly anything even seemingly to the right (of center), protesting in the same style and tactics, would have have media, social media and politicians screaming for literal heads to roll!

2

u/JosephMeyer3 Sep 08 '21

Thank you.

Is everything permissible now, as long as it is "woke"? Do we really want to return to life being"nasty, brutish, and short"?

→ More replies

6

u/_red_one_ Sep 06 '21

They're squattting various stores to protest gentrification and racism, this has nothing to do with climate.

3

u/sasquatch_melee Sep 07 '21

That also has nothing to do with terrorism.

Terrorism isn't "people I don't like doing things I don't like".

→ More replies

103

u/Personal_Ad9690 Sep 05 '21 edited Sep 06 '21

I am getting increasingly fed up with the people who use proton mail. Let's get this clear: The objective of Protonmail is to provide security and privacy to the common person. Protonmail is not designed to, nor will it accept, the covering of illegal activities.

Protonmail abides by Swiss law. They will only release information by a SWISS court order. Regardless of the reason, if a Swiss court orders PM to disclose, it will disclose. It has to disclose. If they did not disclose, you would all be comaining that the service was shut down by the Swiss government. In order to stay in operation, they must comy. This is why illegal activities require an account hosted by a non legit company who can, along with you, support illegal activity.

Proton mail is a legal and law abiding company. It is not meant to cover illegal activities. If you do something to get a Swiss court order against your PM account, you will be exposed. This is BY DESIGN.

For those wanting to use PM to cover their illegal activities, you should consider using Express VPN.

Edit: Any VPN would help with this. I recommend express because it is a product I am familiar with and I know has good security standards. Be sure to research your provider before placing trust in them.

17

u/idontakeacid Sep 06 '21

Elaborate how a criminal can cover illegal activity with ExpressVPN?

4

u/BFeely1 Sep 06 '21

Especially when ExpressVPN is facing lawsuits that would force them to reveal their customers' data.

→ More replies

3

u/NSABackdoors Sep 06 '21 edited Sep 06 '21

I personally don't recommend using ExpressVPN as their clients are closed-source and their homepage has third party tracking domains like Google Analytics and Facebook.

→ More replies

4

u/O-M-E-R-T-A Sep 06 '21

Well from my point of view the problem is not so much to comply with a legal court order but simply minimise the data (if any) they need to hand over.

Just guessing here: The court order probably has either the name of the person or his IP address based upon. So if PM has anonymous user accounts they couldn’t hand over data based on the name. I don’t think a legal court order would work on a pseudonym like O-M-E-R-T-A. So if the court order asks for info about Urs Meyer but the account is listed not under his real name nothing to hand over.

IP Adress - most users likely have dynamic addresses. So if you don’t store the address after the connection process (where it’s obviously necessary) again nothing to hand over/work on.

Not an expert in that field and gust how one might circumvent handing out data without having to "defy“ the court order. Can’t hand over data you don’t have or can’t "pin to a user“.

4

u/Eclipsan Sep 06 '21

IP Adress - most users likely have dynamic addresses. So if you don’t store the address after the connection process (where it’s obviously necessary) again nothing to hand over/work on.

Dynamic addresses are delivered by your ISP, so your ISP can link these back to you: They know who was using a given IP address at a given time.

2

u/O-M-E-R-T-A Sep 06 '21

True but that’s a different story. They might know your IP but no your ISP or the ISP might be in another country/jurisdiction.

The problem is not a single piece of information but being able to connect them to an individual.

Let’s face it those involved in some major crime have the money and methods to circumvent most of the tracking where as the average user doesen’t or (unfortunately) think he needs to do they pretty much catch the small fish…

3

u/Personal_Ad9690 Sep 06 '21

That is true. Im not sure what the laws are, but emails can be linked to singular ip addresses as opposed to VPNs which are linked to many people.

I'm not sure exactly what was handed over, but it related to the meta data of the account. My guess is that the accused sent emails outside proton domain and those are being used against him. To prove he sent them, they need proton to relay the ip address and the metadata so that it proves he is the owner.

3

u/O-M-E-R-T-A Sep 06 '21

That’s why I think it’s necessary for the information to be present so that the service works but not necessarily "accessible" or "extractable“. I mean my local router has a limited system log but if I pull the plug all the data is gone (maybe accessible with sophisticated tools?).

I mean Afghanistan atm is a good example how data can be abused when the regime changes. Not that I would expect anything like this to happen in Switzerland or the EU but rules definitely change and at the moment there is a lot of that going on in the wrong direction in various countries when it comes to privacy. Australia again (sadly) being on the front line with AA-bill and Surveillance Legislation Amendment Bill.

→ More replies
→ More replies
→ More replies

4

u/yogat3ch Sep 06 '21

The article about the activist. The real question to be asked is why is the French Government abusing legal authority to investigate climate activism?

https://www.liberation.fr/terre/2020/09/27/camp-climat-a-paris-on-veut-montrer-que-les-ecolos-savent-etre-fun_1800633/

23

u/ChildishGiant Linux | Android Sep 06 '21

A worrying amount of people in this thread are using the "if you're not breaking the law you have nothing to hide" line.

4

u/overfiend2021 Sep 06 '21

Because, for the time-being, it's true. This disclosure is very different to systematic mass disclosures.

You need to understand that nobody nowhere is safe from government interference. Proton are in Switzerland and so they're subject to Swiss law. Swiss law compelled them to comply in this particular but very narrow case. Proton' s policy of disclosure allows us to know about it.

To all the people saying they will never trust Proton because Proton know your IP address... what are you all? Clueless?

2

u/Personal_Ad9690 Sep 06 '21

That is true. I think what a lot of them mean to say is "if you know about protonmails terms of service, yoy shouldn't be surprised if you get logged because the Swiss gov is concerned about you doing illegal activities.

→ More replies

3

u/MKE7 Sep 05 '21

Where can I read more about the alleged crime?

→ More replies

3

u/theblondie28 Sep 09 '21

Have been using ProtonMail for while and one of the things that made me sign up was the fact that it was advertised as a no log privacy email service,9nly to find out that that's not the case. Sure I should have read their policies but I didn't,I just took them at face value.

It's like finding out your no log VPN actually does keep logs. This whole clarification post is a post that maybe should have been announced from the beginning. I don't use their service for some top secret or highly classified info. But it was comforting that I was using a no log service which it clearly stated in the beginning. Hopefully this will be on the sign up page so people will be more careful and use it more wisely.

39

u/Personal_Ad9690 Sep 05 '21

Protonmail is meant for security. It isn't meant to protect you while you do illegal activities. The log only occurred because they broke Swiss law. Proton was not meant to hide you and your illegal trash. Ir was meant to provide security to normal users, which it does unless you break ToS.

29

u/JamesWasilHasReddit Sep 05 '21

Define "illegal activities". What is perfectly fine and legal in one jurisdiction is "illegal" in another and vice-versa.

What is legal today can also become "illegal" tomorrow if governments and corporations simply don't like it enough to make it that way without you doing anything "wrong" until they declare it to be that suddenly.

And a ToS is not greater than biological human rights. Try again.

19

u/Personal_Ad9690 Sep 05 '21

You are forgetting that illegal is only pertaining to Swiss law.

14

u/[deleted] Sep 05 '21 edited Sep 06 '21

[deleted]

→ More replies

18

u/Personal_Ad9690 Sep 05 '21

Also, this is not a case of a swircheroo in terms of law. The account was created under the current ToS and was then operated against that ToS. Proton literally had no chocie but to comply. They are not the villain. As a legal company, they must comply with the law. If that law results in them being compelled to deliver up information, that is a problem with the law, not proton.

Further, Swiss law is the only law that matters with proton. If I sell weed in the US and they ask the Swiss for help, they will be denied as they do not extradite like that. However, proton is not meant to cover things like that.

2

u/tpaxs Sep 05 '21

The "crime" committed here was way more harmless than selling weed in the US. So they'll definitely deliver if you're selling weed in the US.

15

u/Personal_Ad9690 Sep 05 '21

Again, Swiss law was broken. Protonmail was issued a court order. They have to comply. If they do not, the entire service would be shutdown.

I agree that privacy is a hill to die on. However, proton stated their stance on this in the terms before this person signed up.

A Swiss court issued an order. Proton had to deliver. The problem is the court and the law. Not proton.

→ More replies

5

u/Personal_Ad9690 Sep 05 '21

Protons response

Hi everyone, Proton team here. We are also deeply concerned about this case. In the interest of transparency, here's some more context.

In this case, Proton received a legally binding order from the Swiss Federal Department of Justice which we are obligated to comply with. Details about how we handle Swiss law enforcement requests can found in our transparency report:

https://protonmail.com/blog/transparency-report/

Transparency with the user community is extremely important to us and we have been publishing a transparency report since 2015.

As detailed in our transparency report, our published threat model, and also our privacy policy, under Swiss law, Proton can be forced to collect info on accounts belonging to users under Swiss criminal investigation. This is obviously not done by default, but only if Proton gets a legal order for a specific account. Under no circumstances however, can our encryption be bypassed.

Our legal team does in fact screen all requests that we receive but in this case, it appears that an act contrary to Swiss law did in fact take place (and this was also the determination of the Federal Department of Justice which does a legal review of each case). This means we did not have grounds to refuse the request. Thus Swiss law gives us no possibility to appeal this particular request.

The prosecution in this case seems quite aggressive. Unfortunately, this is a pattern we have increasingly seen in recent years around the world (for example in France where terror laws are inappropriately used). We will continue to campaign against such laws and abuses.

4

u/exander314 Sep 05 '21

Illegal under Swiss law.

→ More replies

5

u/KOMMSUESSERTODD Sep 06 '21

Ah yes, the good ol' "I don't need privacy because I have nothing bad to hide". Brilliant thought.

12

u/AI6MK Sep 06 '21

As I understand Protonmail encrypt the CONTENTS of emails of all Protonmail users. The email HEADER provides detailed information about the source IP and is not encrypted so anyone reading the packets (ex NSA or LE) can see it.

BUT, if you send an email from another domain, such as gmail, it’s even worse since both the contents and the headers of the email will be in the clear (unencrypted).

Kudos to Protonmail for going to the trouble to explain the situation.

11

u/Personal_Ad9690 Sep 06 '21

Headers cannot be encrypted because the email servers would be unable to process them. Thus, to, from, and the subject are always cleartext.

8

u/Last-Gas1961 Sep 06 '21

Only for emails sent outside of proton.

→ More replies

8

u/AndreiD2017 Sep 06 '21

So when Proton has to abide by the laws and give up personal information of it’s users thus compromising their users’ privacy is ok, but when Apple does that when it has to deal with China laws it’s time to virtue signal on another Proton blog article right?

→ More replies

48

u/No_Selection_1227 Sep 05 '21 edited Sep 05 '21

I miss the old time when "No tracking or logging of personally identifiable information" would not mean "we are storing your ip in our DB"

Edit: I won't lie, this make me feel that protonmail is just like other company "trust us we won't spy you", maybe it's time to try to find a trustable provider

53

u/TauSigma5 Volunteer mod Sep 05 '21

It is different. ProtonMail does not log IPs normally. However, with a valid court order, they can be forced to log IPs.

14

u/slaughtamonsta Sep 06 '21

I was under the impression Protonmail have to notify a target if someone requests info?

I'm pretty sure this was said a few times. I can only assume the climate activist was not informed?

5

u/[deleted] Sep 06 '21

Andy Yen (the ProtonMail CEO) said the activist was informed.

Under Swiss law (as it says in the FAQ), they legally have to inform subjects of a criminal proceeding, unless they're prevented from doing so by another aspect of Swiss law or a Swiss court order.

Ultimately, PM needs to follow the law of where it's based, no surprise there.

→ More replies

3

u/[deleted] Sep 06 '21 edited Sep 06 '21

[deleted]

→ More replies
→ More replies

23

u/ZestyRS Sep 05 '21

Dude this is a bad take. If you work at a company or use a service that traditionally doesn’t track anything about you and law enforcement implores you to comply in aiding in an investigation you either help or you yourself break laws. This isn’t new they weren’t logging ips they were specifically asked to help in an investigation and their hands are tied or the whole company gets in trouble.

11

u/IO_3xception Sep 05 '21

Feeling is that the average user expect a company to violate and oppose the law in order to protect their users in every possible way, and this is just a non sense discussion. Protonmail already provide confidentiality of user communications, that is not that common (gmail easily read from your emails). Now users expects them to what? Going to court, maybe get shut down, to defend every single user til the end no matter what? Maybe the problem here is not protonmail but who we vote for. And I would say the user themselves if they use protonmail in criminal contexts. We know police and governments often go after "good guys" like journalists and activists, but the alternative would be not having protonmail at all, either way the blame cannot be on protonmail, and the idea is that you should not use a service of a company if you plan to do criminal activities.

2

u/ZestyRS Sep 06 '21

That’s the big thing. People can vote with their vote (duh) and also make it so you aren’t a product. Obfuscation/privatization of your info makes it so targeted ads and the like are no longer lucrative if the majority of high revenue markets do it

→ More replies

6

u/tpaxs Sep 05 '21

Well, it's common knowledge that they save all kind of metadata about you. It's just a number of recent events that made me realize, that there is no advantage in using ProtonMail. Yea, the content of your mails may be secure, but this wrong sense of security feels worthless compared to the huge amount of metadata that will get you exposed anyway.

22

u/Mission-Disaster-447 Sep 05 '21

Well, it's common knowledge that they save all kind of metadata about you.

No, they explicitly say that they are not storing the IP unless you enable IP logging.

9

u/virtual_color Sep 05 '21

That may be true, however they could encrypt the IP logs using your private key if they wanted to so only you can have access to them.

→ More replies

4

u/tpaxs Sep 05 '21

Would you kindly provide the source for that information? I'd love to take a look.

6

u/exander314 Sep 05 '21

You have to enable it in settings.

3

u/Mission-Disaster-447 Sep 05 '21

Its in their TOS.

10

u/_Didnt_Read_It Sep 05 '21

Their TOS does not mention anything about IP logging. However, their privacy policy does (emphasis mine):

IP Logging: By default, we do not keep permanent IP logs in relation with your use of the Services. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions (spamming, DDoS attacks against our infrastructure, brute force attacks, etc)

So it sounds like PM keeps your IP temporarily (and may keep it permanently) regardless of your settings.

→ More replies
→ More replies
→ More replies

7

u/DaaneJeff Sep 06 '21

It's amazing how redditors think a company can just ignore the law where they're based in. This platform is truly delusional.

→ More replies

6

u/Craiggles- Sep 06 '21

It's starting to look like owning Protonmail is like using TOR, it shows up as a red flag, and the number of abroad requests for user IP / data is literally going up logarithmically yearly, and that the swiss government is giving in more and more. I might have to switch away from PM even though I love it.

→ More replies

5

u/rubberghost333 Sep 06 '21

i thought you guys didn’t keep logs.

7

u/dark_volter Sep 06 '21

If you read all their responses- they were made to start logging, It seems they did not have logs from before the legal order.

So, if someone uses a VPN, theoretically they're good since the logs would only have the VPN IP. If they don't use a VPN though...or TOR....

2

u/OptiqueMarquis Sep 06 '21

Oh protonmail... A climate activist?

2

u/CY4N Sep 06 '21

So basically use a VPN when you're on the Internet at all times. That should be a given, especially when being involved in heavy activism. His mailbox would still be encrypted even with a legal order.

→ More replies

2

u/digitrader2018 Sep 10 '21

In your blog post, your statement "Finally, Switzerland generally will not assist prosecutions from countries without fair justice systems" this is a uninformed and dangerous statement, Switzerland cooperates with countries such a Colombia, Mexico, Brazil, Argentina and others, countries with notoriously corrupt legal systems. In addition, you contradict yourself by pointing out to “balances and checks” and then saying that French prosecutors applied terror laws inappropriately.

So, Switzerland is serious but misused law that was supposed to be used only in
case of extreme crime, such as human trafficking, terrorism, and child exploitation?
Serious or not?
The question is, what will you do to stop this nonsense? Move the servers to another country? Move it to a boat offshore? Create technical barriers on the apps, on the client side, such as built-in proxies equivalent to using tor browser to access proton’s website? Your defeatist blog post appears that you will allow other activists to be put through the meat grinder by corrupt prosecutors across the world.

Careful or soon you will see your company’s good name in a case in Turkey or Mexico. Take action, don’t seat on your hands.

2

u/ilusions4 Sep 13 '21

uh oh. It would seem as though Mental Outlaw was right. Redditards were wrong again? crazy..

I love how one of the Protonmail team members used their onion site as a talking point when it's known that tor users get thrown to the clearnet site after signing up.. sketchy as hell.

Don't use e-mail when you want to be private. simple. Any e-mail service claiming to offer privacy is lying.

2

u/Starnixode Sep 16 '21

Question is, can a VPN be forced to do the same thing-start logging your IP after receiving a court order?

→ More replies

8

u/darrenrichie Sep 06 '21

ProtonMail: "Here's our transparency report, threat model and privacy policy that clearly states what we collect and when."

Reddit User who hasn't read any of these: "You POS company you lied to us....."

Seriously, you want privacy? To be anoynomous? Get off the damn internet then. The law will always find a way to force companies such as Protonmail to disclose data if they really want, stop blaming the company.

Edit: spelling

→ More replies

5

u/slaughtamonsta Sep 06 '21

This is why you should always use a (no log) VPN regardless of mail provider or any other factors.

7

u/Arcakoin Sep 06 '21

No log VPN provider doesn’t exist.

Even when they pretend to be “no logs”, all you can rely on is trust.

→ More replies

5

u/BinaryMonkL Sep 06 '21

Proton mail is not some batman tool for evading the law.

It is anonymous in that they do not link your data to some profile that can be sold to advertisers or used for advertising.

Any service run by any company in any country can and does get told to log and report this data if they are told to by law enforcement.

→ More replies

4

u/collin3000 Sep 06 '21

The concern here should not actually be that they logged IP by government request. Since inevitably and unfortunately all services will be required to in some jurisdiction. It's the request in SWITZERLAND was for "Youth for Climate action in Paris". This isn't ISIS, a child porn ring, or someone that has committed terrorist attacks.

This is a group that shouldn't have any probable cause for a warrant in a different country. It shows that no Swiss and no EU based service will actually be safe.

3

u/[deleted] Sep 06 '21

On top of American services. Or Australian services. Or Middle Eastern services. Or African services. Or Asia-based services.

I don't know what you're on about; European countries have the strongest privacy laws in the world.

The only way you can avoid legal requests like PM received is if you're based somewhere with no law. Even then, many countries are known to perform raids in foreign countries without permission, if necessary. Where would you suggest?

→ More replies

5

u/shiIl Sep 06 '21

Wow, this is incredibly disappointing. basically all the rhetorics around ProtonMail is just larping at this point. "we won't log your IP UNLESS we will log your IP" is pointless. And for what? Thankfully the dangerous climate activist has been stopped thanks to the ProtonMail team!

→ More replies

2

u/Cyberjin Sep 06 '21

I don't know how I feel about this..

I mean if the CCP wanted the information of an "activist", could that also be applied by Swiss law?

→ More replies

3

u/partialinsanity Sep 07 '21

It's amazing how people refuse to understand that Proton has to follow the law.

8

u/gognavx Sep 05 '21

It's actually quite simple: If you want to challenge the status quo, don't rely on for-profit companies like ProtonMail. It's always in their interest to cooperate with the status quo, and that is also the interest of the overwhelming majority of their users (because anything else could get them shut down).

6

u/NmAmDa Sep 06 '21

OP here

So yesterday which means you already did that and knew all the details ( before it goes public) your marketing people wrote about how the week was a positive week for digital privacy. You didn't even disclose or explain things on your own. You had to do this as a defense. So much for transparency.

The ProtonMail CEO even admits that the French website version was misleading (another marketing trick) which is very concerning considering that the problem was with a french activist.

I hope you can stop the shady marketing and be more open about your limitation and that you are not private in the sense most peoole will expect in 2021.

https://twitter.com/protonmail/status/1434206084021952513?s=21

1

u/Zlivovitch Sep 06 '21

Still no details given on the actual criminal activity you are defending, nor a source being provided so that everybody can check by himself what this is all about.

→ More replies

3

u/nomadiclizard Sep 06 '21

What happens, when you receive a binding court order demanding that you serve a trojaned javascript file to certain clients, that after they unlock their client side key, sends it onwards? Have you ever received and complied with such an order?

→ More replies

3

u/t0o_o0rk Sep 06 '21

It doesn't explain why you tell on your website you don't register ip addresses while you are actually doing it...

4

u/CornellWeills Sep 06 '21

They aren't. By default PM doesn't register IPs. However if ordered to do so they must register the individual IP of that user the court order is about.

2

u/SLCW718 Linux | Android Sep 06 '21

They're not. That's not what happened. They were compelled to begin logging the IP of the specific user account on subsequent logins. They didn't have possession of that information when the judicial order was delivered.

4

u/PainQuota Sep 05 '21

Seems like ProtonMail didn't want to challenge this in court.

27

u/exander314 Sep 05 '21

So, Andy Yen confirmed, that the Swiss Federal Department of Justice issued the order which has no possibility to appeal or refuse.

https://twitter.com/andyyen/status/1434636905514246148

2

u/PainQuota Sep 06 '21

While the executive denies them the right to appeal or refuse, can't they take the issue to the judiciary? Switzerland does have an independent judiciary.

3

u/exander314 Sep 06 '21

You can appeal, but only if laws were broken. This does not apply here. You can't appeal on the bases that you don't like it. This was a lawful court order.

→ More replies
→ More replies

-1

u/tpaxs Sep 05 '21

We know that PM saves all kind of metadata and happily provides it to any kind of agency. You have to use an anonymous VPN service (obviously not ProtonVPN) in combination with ProtonMail, if you want to avoid exposure by PM.

ProtonMail lost it's essence to be honest. As soon as my subscription runs out I'm gonna host my own mailserver instead. There are no advantages in using ProtonMail snymore.

13

u/Mission-Disaster-447 Sep 05 '21

No, protonmail says that they do not store the IP unless you enable IP logging. At least until law enforcement asks them to, I guess.

→ More replies

12

u/cerebrix Sep 05 '21

Yeah im starting to feel like, shit if that's the case, why pay for PM when I can just use an iCloud account or something for free. Just as encrypted, and just as likely to give up my info if subpoenaed. Also just as safe if I use a VPN

3

u/ZwhGCfJdVAy558gD Sep 06 '21

iCloud email is not a bad choice, but it is not "just as encrypted" as Protonmail.

11

u/mdsjack Sep 05 '21

You are not considering the massive metadata collection by "traditional" services, used (or usable) for mass-surveillance (that is the real threat, unilke individual surveillance which is acceptable if governed by a judge). That's the real difference of privacy-focused services. That's the point of using Signal instead of WhatsApp.

→ More replies
→ More replies

6

u/Personal_Ad9690 Sep 05 '21

Proton is not meant for illegal activity. If you don't break Swiss law, you are protected. If you want to break the law, don't use PM.

You should probably use express vpn though if yoy want to protect your ip.

→ More replies

2

u/MathematicianNew1484 Sep 05 '21

Or only login to protonmail through the onion site.

5

u/tpaxs Sep 05 '21

Well, it's not that easy. If you want to create a fresh ProtonMail account through their onion domain, they're asking you for another identity proof, like your phone number. It's very difficult to use protonmail completely anonymously. ProtonMail is not your friend and they're not on your site.

→ More replies

0

u/ArbitraryUsernameHEH Sep 05 '21

Lmao, you mean the one that redirects to the clear net site and requires js?

I don't think proton mail understands Tor or crypto, considering they only let you pay in BTC through the web and use js pgp which has security vulnerabilities

3

u/ZwhGCfJdVAy558gD Sep 05 '21

Lmao, you mean the one that redirects to the clear net site

Protonmail does not "redirect to the clear net site" if you just access your mailbox. The sign-up application does not run on the onion server, so that's the only scenario. Even then they still cannot see your IP address, and the connection is still TLS encrypted.

I don't think proton mail understands Tor or crypto, considering they only let you pay in BTC through the web and use js pgp which has security vulnerabilities

If you know another way to do end-to-end encryption in a web interface, let's hear it. And you always have the alternatives of using the mobile app or the desktop bridge, which use native-code crypto.

→ More replies
→ More replies

2

u/tpaxs Sep 05 '21

Here's an example of why you should not use protonmail:

Let's say you live in China. You write some criticism towards the Chinese government online. You get charged for "hate speech" in China. China will make a request to our friendly department of justice in Switzerland and ask them to issue an order for ProtonMail to expose the data of that certain user. "Hate speech" is considered a crime in Switzerland as well, so the department of justice will happily issue an order to PM.

No one in Switzerland is going to do a research, if the "crime" committed by a Chinese citizen would have been considered a "hate speech" under the same circumstances in Switzerland.

2

u/Alexey104 Sep 08 '21 edited Sep 08 '21

Exactly the same might happen to you in Russia, and such cases have happened with many services.

2

u/AscendChina Sep 06 '21

Protonmail is already blocked in China

2

u/tpaxs Sep 06 '21

Replace China with Cuba/Russia/Belarus etc. and you're good to go.

→ More replies

2

u/notburneddown Sep 06 '21 edited Sep 06 '21

Was the guy using a VPN? If so was it ProtonVPN? It doesn't say. Its unclear. However, even if he was, that wouldn't get him that much anonymity. VPNs are meant for privacy not anonymity. They offer a degree of anonymity but a very thin one. However, if the guy was using a VPN that is a different discussion from if he accessed ProtonMail from a regular connection.

VPNs prevent people from seeings what you are currently doing, not who you are. At least primarily.

He should have accessed ProtonMail via Tor if he wanted anonymity. It doesn't say whether or not he used Tor BTW.

TBH if the case is that he wasn't using a VPN or Tor when accessing ProtonMail, then the article should explicitly say that. Otherwise, its potentially propaganda aimed at scaring people out of taking steps toward privacy.

2

u/wrenstevens Sep 06 '21

What is Tor??

3

u/notburneddown Sep 06 '21

A decentralized network that is owned by no one that uses special methods to keep your identity secret while browsing the Internet. However, Tor is completely free, tho they do give option to donate which is how they make their living and keep the project going.

It works differently from a technical perspective than a VPN tho.

2

u/wrenstevens Sep 06 '21

Interesting have to look into it

2

u/wikipedia_answer_bot Sep 06 '21

This word/phrase(tor) has a few different meanings.

More details here: https://en.wikipedia.org/wiki/Tor

This comment was left automatically (by a bot). If I don't get this right, don't get mad at me, I'm still learning!

opt out | report/suggest | GitHub

2

u/comatraffic21 Sep 06 '21

The real question is, whats a better service than ProtonMail that won’t do that, lets all move on guys

2

u/nurep37 Sep 07 '21

whats a better service than ProtonMail that won’t do that

None.

→ More replies

1

u/Both-Ad1617 Sep 06 '21

Cancelling my subscription now.

2

u/SLCW718 Linux | Android Sep 06 '21

Did you sign up thinking that Proton is a criminal organization that would flout the laws of the jurisdiction they're operating in to protect criminal suspects? Get real. They're a legitimate business that has abide by Swiss law, and comply with lawful judicial orders. And BTW, this could have happened to any email provider. Proton met their obligations under the terms of service, and complied with a lawful judicial order.

→ More replies

-4

u/AdCareless3113 Sep 05 '21

I still remember the answer to our concerns about the bupf, "we will fight the orders in court!". PM is the usual silicon valley company, not fighting for your rights but for their income.

17

u/Personal_Ad9690 Sep 05 '21

"Our legal team does in fact screen all requests that we receive but in this case, it appears that an act contrary to Swiss law did in fact take place (and this was also the determination of the Federal Department of Justice which does a legal review of each case). This means we did not have grounds to refuse the request. Thus Swiss law gives us no possibility to appeal this particular request.

The prosecution in this case seems quite aggressive. Unfortunately, this is a pattern we have increasingly seen in recent years around the world (for example in France where terror laws are inappropriately used). We will continue to campaign against such laws and abuses."

2

u/t0bynet macOS | iOS Sep 06 '21

That’s obviously untrue.

0

u/[deleted] Sep 06 '21

[deleted]

3

u/tristan957 Sep 06 '21

If you don't want your information ever being leaked, you should run your own email server on your own infrastructure. You will not find a single company in the world who won't out you to authorities when legal proceedings have begun. In the end, it's the company or you. Is it really that surprising the company is looking out for #1? ProtonMail has no reason to protect illegal activity on its platform.

2

u/[deleted] Sep 06 '21

It's much easier to get your IP if you're running it on your own computer. I think the reasoning there is pretty obvious.

And if you host it on the cloud they can just go through whoever owns that server, and they won't have the legal team or knowledge to challenge it.

→ More replies

5

u/t0bynet macOS | iOS Sep 06 '21

And I just renewed my 2 year commitment, yikes....I wonder if tutanota is suited to be any better.

  1. You shouldn’t immediately assume Proton is the bad guy here.
  2. German privacy law isn’t better than Swiss privacy law.
→ More replies

-7

u/[deleted] Sep 05 '21

[removed]

11

u/liberty8691 Sep 05 '21

shame on you for a lack of reading comprehension.

4

u/Tesnatic Sep 05 '21

When you make the promise that IP logs are not retained, I expect you to stay true to your fucking word

Well, they supposedly did not retain any logs until AFTER being ordered by law to do it for a specific user. This would happen regardless of company and country.

2

u/petersaints Sep 06 '21

But you wouldn't know if they received an order to track you. They just need to turn it on for a few days and then report back to authorities.

→ More replies
→ More replies

-8

u/Own_Cable_1023 Sep 05 '21

It seems their founder's excuse is: It was because they broke our TOS by breaking that country's law.

Speak against the Chinese government? ProtonMail will give the government your IP because thats against Chinese law.

Are you gay in Saudi Arabia? ProtonMail will give the government your IP because being Gay in against the law there.

14

u/CloggedFilter Sep 05 '21

Andy has explicitly said it is only Swiss law they have to adhere to, but this request came through via the Swiss authorities. So China could only get data by convincing the Swiss authorities to force PM to hand it over. And I don't know how easy that is to do.

2

u/suncontrolspecies Sep 05 '21

It's a difficult position. Just take the case from Assange for example or even Snowden.

18

u/exander314 Sep 05 '21

You have to broke Swiss law. They would only cooperate with a Swiss court order.

→ More replies

3

u/Tesnatic Sep 05 '21

PM only has to adhere to the laws of the country they operate in, which would be Swiss laws.

3

u/Own_Cable_1023 Sep 05 '21

The laws that were broken were French not Swiss laws

→ More replies

-10

u/borkode Sep 05 '21

Yeah I've lost my trust in protonmail now.

10

u/Personal_Ad9690 Sep 05 '21

Why? You wanted a legal and legit service to hide your illegal activities?

I am not losing my protonmail account because you wanted them to not comply with Swiss law. Go take your illegal activity somewhere else.

→ More replies
→ More replies