this post was submitted on 02 Oct 2023
126 points (95.0% liked)
Privacy
30004 readers
1413 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 4 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Got a source for that? Proton isn't able to access to any user emails. I believe Swiss law also makes it illegal for them to provide user information without a (Swiss) court order.
The only case I've heard of that was similar was when the Swiss court ordered them to provide all the info they had on a user. This was the last IP address they logged on from and a recovery email the user had entered. The recovery email is an optional thing the user had set up on their account. They also used this same email address to sign up for a Twitter account. They were able to get enough data from Twitter to identify the person.
Courts can require you to provide your password in some circumstances. Where your email is stored is irrelevant.
In that case Proton wouldn't be providing the data, the user would be. Proton can't provide what they don't have.
This wasn't the case, at all. Proton simply handed the entire mailbox decrypted.
That seems unlikely since your data is encrypted with a password they don't have.
I'm simply reporting on what I've been told and saw. Form what I read seem to be using asymmetric encryption and generating a private key itself protected with your password when you sign up. There's no guarantee they don't have an unprotected copy of that as well.
Vast majority of Proton users signed up because Proton promises your data is safe at rest. Even from them. In fact, they specifically advertise this protects them from subpoenas because they cannot provide decrypted copy of user's data.
Of course, the only emails that are encrypted with proton are proton->proton. Mail between proton and anyone else, like say gmail, isn't encrypted unless you pgp it separately.
Guess the question is if your private key is actually only yours or do they have some copy they can use somewhere.
Not fully correct. Mails between Proton users are E2E encrypted where Proton cannot see them, and rest of the emails are encrypted at rest once Proton receives them. Based on the audits and open source code, Proton is not keeping a copy of those emails when it receives them, and once they are encrypted, nobody but you will have access to it
You were being mislead with false information. Share appropriate sources to back up whatever you are saying. Proton has regular audits for security and encryption for all their products, which makes whatever you've been told pretty much false information
What's more likely? a) I'm being mislead by someone that actually got into legal trouble that involved them and isn't profiting in any way from it or b) You / everyone else that simply is eating their marketing and PR is being mislead in some way.
Truth is, none of us can prove their claims and auditors are true.
Yes I do, and I tried encouraged my source to make the entire thing public but no luck there. In this case the person was already identified it wasn't much of an issue, the issue is that Proton simply provided everything to an US court without even a flinch. Apparently they can access user emails and they do without much fuzz.
That's called hearsay.
That doesn't hold up against the publicly available source code for their applications, white papers on their security and encryption, and multiple independent security reviews. And again, they are legally required to ignore US court orders. Only a Swiss court order can compel them to provide user information.
Yes, I know about all of that.
show the source mothe*****r