- cross-posted to:
- technology@lemmy.ml
- cross-posted to:
- technology@lemmy.ml
You must log in or # to comment.
This is non-news, like all tech companies, they are bound by law to do this. It happens more than 6000 times per year for Proton. However, this user just had bad opsec. Proton emails are all encrypted and cannot be read unless law enforcement gets your password, which Proton does not have access to. Even if Proton hands over all data.
deleted by creator
Upon receiving the recovery email from Proton Mail, Spanish authorities further requested Apple to provide additional details linked to that email, leading to the identification of the individual.
The user specifically requested that Proton retain this PII for account recovery.
Speaking of which, how do they implement recovery emails? Do they save your private keys only if account recovery is enabled?
They are bound by Swiss Law, so they have to comply with lawful orders. They are very up front about this even within their marketing that pertains to protection from other government authorities. They are also very good at explaining exactly what is protected and what inherently isn’t. A recovery email isn’t. In order for a recovery email to work by its very nature, Proton has to have a record of it. But at the same time they don’t require you to set one. Proton hasn’t done anything that they’ve promised not to. There comes a point where you need to put a little effort into understanding the product you’re using.
deleted by creator
As much as some of us may dislike it when a company does these kinds of things. You can’t really blame them for following the laws of the country that they are headquartered in.
You can blame them for operating there to begin with in cases like Apple in China, but you could hardly blame them for following the laws of the US where they are headquartered for example.
If the law of the land where the headquarters is requires them to give up the data they do have to partner nations then they don’t really have much choice in the long run if they want to continue to exist.
Plus there isn’t many jurisdictions with stronger privacy law than the swiss. It is unlike they made a bad choice for choosing a headquarters.
I guess they can operate on the public sea or the arctic, but I imagine the commute will be terrible.
Upon receiving the recovery email from Proton Mail, Spanish authorities further requested Apple to provide additional details linked to that email, leading to the identification of the individual.
I like how no ones talking about how Apple (the one its fanboys say is most privacy centric company) was the one that helped identity the individual.
Proton leaked the recovery email. Apple has never given any guarantee about their mail service, which isn’t the case of Proton
Don’t put any recovery info on Proton
Proton has never given any guarantee about hiding all account metadata from the Swiss government either.
“Privacy” means two different things depending on the audience. For me privacy means that my information is not being used to advance some organizations commercial interest. For others it means that my information will never be shared with a government.
Don’t advertise to me
Or
Don’t narc on me
I guess I don’t really expect a company to resist pressure from government agencies on my behalf. Especially if I have been using their service to commit crimes in my country. If you are doing things your government would prefer you didn’t, hire a good lawyer and consult with them about what should be sent via email (spoiler, it’s nothing). The mafia doesn’t send emails, or put anything in writing, if you do crimes, you shouldn’t either.
I don’t know much about the case beyond some very lazy peripheral searching, but it strikes me that Proton’s compliance isn’t an issue, but the requests themselves are totally unjustifiable and based on malicious prosecutions to nab some separatists on ridiculous terrorism charges for their nonviolent action and protests.
This individual is suspected of being a member of the Mossos d’Esquadra (Catalonia’s police force) and of using their internal knowledge to assist the Democratic Tsunami movement.
The requests were made under the guise of anti-terrorism laws, despite the primary activities of the Democratic Tsunami involving protests and roadblocks, which raises questions about the proportionality and justification of such measures.
They provided the backup e-mail address
Upon receiving the recovery email from Proton Mail, Spanish authorities further requested Apple to provide additional details linked to that email, leading to the identification of the individual.
Just in case anyone thinks they decrypted mails and handed them over, nope. I hadn’t thought about that “settings” are not encrypted. Guess if you want to stay anonymous you shouldn’t add your private mail address in there as a backup.
Yeah. Even if they couldn’t hand over recovery emails, having a personal email as a backup to a “private and sensitive” email account is bad practice.
But what do you do if that field is needed? A throwaway address won’t work as it’s easy to recreate. Buy your own domain and run a server?
I put the Simplelogin email alias as my backup mail. Which forwards mail to my proton, so I guess it isn’t really a backup. Even more so if you realize I need to sign into simplelogin with my protonmail account and protonmail owns Simplelogin.
Ah yes the email ouroboros
Doesn’t look like Proton did anything wrong, they can’t fight these requests and he was caught by identifying information he linked to his account.
They could disclose the fact that they might need to give that info to authorities and warn users of that.
They never mention it here for example https://proton.me/blog/protonmail-threat-model
This is why you sign and encrypt the contents of email. If the recipient doesn’t have the public key, they can’t read the content.
Allowing a service provider to “handle your keys” is tantamount to letting the fox watch the henhouse.
Proton doesn’t provide IMAP/SMTP access for free accounts, so you won’t be able to encrypt emails locally.
This ultimately is the tech version of “trust me bro”. This means you are as secure on Proton as you are on GMail, depending upon how you use the service.
If the recipient doesn’t have the public key, they can’t read the content.
Sir, if your recipients don’t have a public key, you cannot even encrypt the message… That is how asymmetric-key crypto works.
This comment is completely off the mark. The information that they disclosed is the recovery email -the same exact thing which happened previously- not any content of any email.
Also, proton does encryption with PGP, but you can’t encrypt if the other side doesn’t use PGP (which is the case for 99.98% of humans on the planet). If they do, proton supports this including with arbitrary clients using their bridge.
What I am find curious about this is if a recovery email would have any weight in court. I can add whatever recovery email I want to an account. It doesn’t have to be mine.
I still find it fascinating that you can go to jail because there’s an IP address in a log file somewhere or because of a screenshot of a messenger communication.
Any more so than, say, fingerprints, DNA, or accounting records?
Or, for that matter, surveillance video recordings stored on a server somewhere. It’s all just ones and zeros, but some combinations of ones and zeros are quite informative.
As technology progresses it is a fact of life that AI will get better at forgery. Perhaps these items will be less permissible in the future.
Forgery is easy. Putting the forged document into the chain of custody is, and has always been, the hard part.
If we’re talking about financial records, it’s been trivially easy to create fake bank statements, or fraudulently place an old date on a newly created document, or even forge wet signatures, since before computers were invented. But getting that forged document into the filing cabinet of a bank or an accounting firm is the hard part.
I can make fake IP logs, sure. I can generate fake videos, I guess (under current tech, that takes a ton of effort and skill to be believable). But getting those logs onto Proton’s servers, without Proton knowing? I don’t know about that.
If you use ANYTHING other than face to face meetings when discussing something illegal, you get what you deserve.
Although I like the idea of a drug smuggler typing “as per my previous email…”
Or use WhatsApp like most of criminals
