Be careful when companies market themselves as Swiss or that due to them being located in Switzerland means there is some extra layer of security or privacy.<p>Sure, it's a more stable country than many other countries in the world, but not much different from most EU countries for example. And privacy wise there is no difference.<p>Be also aware of the fact that many companies market themselves as Swiss, but all it means is they have a head office in Switzerland due to tax reasons. In one example, it's a cloud storage company, they say on their marketing page and their about page that they are based in Switzerland and under Swiss law, but if you look at the legal pages the company you sign up with are actually based in Bulgaria. Their servers are based in Texas, USA and Luxemburg, Europe and their development team in Bulgaria.
The ProtonMail guys always said that unless they were 20 miles from the littoral, in the sea side, they had to abide by national laws. So it was bound to happen.<p>What makes me sad is how flimsy their entire premise (not necessarily "promise") turned out to be: all it took was some minor rascal in France to hug the wrong tree (so to speak), and ProtonMail is in the open saying they can't even protect the IP address of their customers. From there, all it takes is for somebody to change a law in Switzerland and end-to-end encryption of the messages themselves will only be "by default."<p>I think there is a market for datacenters in open seas.
The expectation that Proton would be able to disobey the legal requests of their local authorities with impunity is unrealistic. Protonmail makes certain claims about privacy, particularly about encryption. They don't make any claims that they have the intention, or ability for that matter, to defy local authorities at their peril. Like Grugq said in one of his presentations (paraphrased): <i>"Don't expect your VPN company to do your jail time for you"</i>. I'm neither for nor against Protonmail. I don't think they've been dishonest. I think people have an unrealistic expectation of the service they offer. They offer additional <i>privacy</i>, not legal indemnity.
I see many comments here that seem to be uninformed. Please, make sure to ProtonMail's official statement first. It includes a lot of important background info: <a href="https://protonmail.com/blog/climate-activist-arrest/" rel="nofollow">https://protonmail.com/blog/climate-activist-arrest/</a><p>For example, this paragraph is important:<p>> <i>Unlike other providers, we do fight on behalf of our users. Few people know this (it’s in our transparency report), but we actually fought over 700 cases in 2020 alone. Whenever possible, we will fight requests, but it is not always possible.</i>
I don't see why it's AS big a scandal given what CEO stated and reading accounts from reputable news sources.<p>My quick take: France tells Switzerland who then compels PM to START tracking account holder(s) and prevented PM (by law from what I've read) from telling account holder. Per PM CEO this type of Swiss order could not be disputed with the way PM has disputed other claims.<p>To me, it's not logging of the IP; it's when did it start and from my reading they started after being compelled to do so over a period of time between compelled to and this coming to light.<p>To me, strong pushback (for those who feel passionate about it) should be directed to Switzerland for complying with France for what many think is not a high enough bar to compel all this tracking. Maybe they did scrutinize it and maybe they didn't.<p>Any meta-data saving isn't secure but sharing that after being compelled to track account holders isn't surprising.<p>There's a line in their agreement that says " If a request is made for encrypted message content that we do not possess the ability to decrypt, the fully encrypted message content may be turned over.".<p>Maybe I'm missing something in my logic.
I guess ProtonVPN also is not an exception to such "undeniable" requests. Bad day for company who bank on "no log" policy. Their marketing division will have a ton of work to fix reputation :)
> stated: "No personal information is required to create your secure email account. By default, we do not keep any IP logs which can be linked to your anonymous email account. Your privacy comes first."<p>And it still holds!!<p>What it didn't stat is that while _by default_ no such information is logged, but if they are legally compelled to they will log such the neseccary information for the email (account?) they are required to log them for.<p>Its honestly surprising for me that anyone though that a fully legally (in Swiss)operating service would protect their privacy beyond the point they are allowed to by Swiss law. But luckily for us Swiss law is pretty neat wrt. privacy, at least currently.
Why don’t they use surveillance in anti-corruption squads to make sure no back room deals are being made inside the government?<p>This tool is turned against the poor and marginalized and used to eliminate opposition but not for making the system work better as it was supposed to.<p>In a sense society is being hacked by those in power using surveillance.
I’m not that surprised that ProtonMail folded; as someone else said they’re not going to do jail for you. What’s concerning is the nature of this warrant and arrest. As far as I can tell all the articles haven’t mentioned any actual crimes; is France just straight up arresting climate activists now?
For secure communications it’s much better to use Signal than e-mail. (Preferably with disappearing messages.)<p>I understand that people desire the UX of an e-mail client such as Thunderbird, Mail.app, Gmail or whatever. Nothing wrong with wanting that. But there is currently no good way to send e-mail securely.
It‘s really tiresome how it‘s become the normal to market all kind of fantasy interpretations of your value proposition and banish all nuance to legalese documents. ProtonMail has enough to justify itself, it doesn‘t need all the over the top claims of Swissness or blunt statements about privacy that are only half truths. They could also do without their spintastic, content marketing blog.
This is not surprising to me. I will still continue to use ProtonMail. I never signed up because of the "no IP logging" thing. In fact, if I had seen it before I just plain wouldn't have believed it, and still used ProtonMail. But hindsight is 20/20
Recent and related:<p><i>Clarifications regarding arrest of climate activist</i> - <a href="https://news.ycombinator.com/item?id=28433601" rel="nofollow">https://news.ycombinator.com/item?id=28433601</a> - Sept 2021 (273 comments)<p><i>ProtonMail logged IP address of French activist after order by Swiss authorities</i> - <a href="https://news.ycombinator.com/item?id=28433131" rel="nofollow">https://news.ycombinator.com/item?id=28433131</a> - Sept 2021 (155 comments)<p><i>Climate activist arrested after ProtonMail provided his IP address</i> - <a href="https://news.ycombinator.com/item?id=28427259" rel="nofollow">https://news.ycombinator.com/item?id=28427259</a> - Sept 2021 (565 comments)
Maybe I missed it in all the kerfuffle, but what was the crime that was allegedly committed by the French climate activist that required ProtonVPN to comply with this request for IP information?
ProtonMail has been fraught with problems for a long time, and it's good that serious issues are being brought to light. Their marketing is very good and critics of them have struggled to communicate to users for a while.<p>The most important thing a serious privacy-minded service provider can do is be <i>forthright</i> and <i>honest</i> with users about the limitations of their privacy guarantees, particularly with respect to what hinges on math and what hinges on trust. ProtonMail has failed in this respect. It has always been the case, for example, that they could log these IPs, or that any incoming plaintext emails can be recorded before being encrypted at rest - and the fact that they're encrypted at rest is another thing we have to take on faith. Their proprietary components have always been a problem, and we also trust that they won't silently add key exfiltration to their webmail UI on the demands of a court. They don't explain any of this, they just pose themselves as experts on privacy and let vulnerable users stumble into law enforcement's hands because they care about their money more than their security.<p>Good privacy systems do not rely on trust or faith, they rely on math. Where some trust is required, in the case of a commercial service provider, it is their solemn duty to be honest with users and explain to them what promises they can and cannot make, and to make sure users understand which of these claims are backed up by math, which are backed up by law, and which are backed up with thoughts and prayers, so that these users can make informed decisions about how they use a service they're relying on for <i>their personal liberty</i>.
My day to day life is pretty boring, but occasionally I'll imagine what I would need to do if I ever had to get out a secret message out where it was important that it couldn't be traced back to me.<p>It always ends up being something like, "Well, I could buy a bunch of raspberry PIs with cash and then go to a coffee shop that I never go to and upload the message to a gmail account that I'll only ever use once. Throw the PI away afterwards in a random trash can in town and make sure to wear gloves every time I touch it. Finally use some sort of encryption scheme or something so I can identify myself for repeated correspondences because each time will be with a different one shot email account."<p>It turns out that this isn't some fanciful paranoia, but is in fact the bare minimum of what I should be doing if something like that ever came up.
I think a distinction must be made between a service that will protect your privacy historically and a service that will continuously protect your privacy.<p>If I sign up with protonmail today using a vpn like mullwad, since I'm probably not currently be targeted, I can reasonably be sure that it will be difficult to track things back to me.<p>However, once I'm targeted and there's a warrant against me, any activity I have on such services is going to be logged going forward.<p>So, using the service once to receive some data or do something anonymously is reasonably secure... This is very different from services like gmail which will have kept any logs in the past about me and that will always be able to track me without any further logging.<p>It's imperfect but I think that given the current environment and the current laws, this might be the best we can have.
Wasn't this a form of fraud? I don't know what the Swiss law is but in the United States, fraud is both a civil tort and criminal wrong. The elements of a fraud are:<p><pre><code> 1) the making of a statement
2) the falsity of the statement
3) an intent to deceive
4) reasonable reliance on the statement by the injured party
5) injury sustained as the result of the reliance
</code></pre>
ProtonMail knowingly told this activist 'we don't log your IP' in order to attract their business. ProtonMail did log the IP address. The activist believed this and got arrested.
Anyone have feedback on this <a href="https://ctemplar.com/" rel="nofollow">https://ctemplar.com/</a> ?<p>I get a sense to move along, but it still seems interesting. It is, or was, based in Iceland.
it seems like ProtonMail should collaborate with Lavabit to see if it's feasible to implement darkmail (DMTP/DMAP protocols) in production<p><a href="http://darkmail.info/" rel="nofollow">http://darkmail.info/</a><p><a href="https://protonmail.com/blog/protonmail-beta-v1-13-release-notes/#comment-7320" rel="nofollow">https://protonmail.com/blog/protonmail-beta-v1-13-release-no...</a><p><a href="https://www.youtube.com/watch?v=TWzvXaxR6us" rel="nofollow">https://www.youtube.com/watch?v=TWzvXaxR6us</a>
ProtonMail has an official TOR page, there hardly is a reason for those performing activities illegal under relevant jurisdictions (I support the notion of illegal non necessarily being evil - in many countries many good things like fighting corruption, loving a same-sex partner or responsibly using psychoactive substances for genuine medical reasons can be illegal) to use it the way exposing their actual IP address.<p>I also don't understand why does ProtonMail record the device type - I doubt there is a law requiring this.
If they really cared about anonymity ProtonMail would ship their mobile app with bundled TOR. Especially the mobile version, since plenty of non-tech savy people use mobile only.
I am no lawyer, but there are over 180 countries in the world, and there is not one that will let you open a company that don't have to log user IP addresses?
I call this complete BS.
Protonmail has just become one of those providers that is only about making money and is probably getting money kickbacks from law enforcement under the form of legal processing fees or even something else, who knows..., really sad...
The homepage has always been misleading, since their TOS does mention that they can keep your IP address, for law-related purposes or spam prevention. Additionally, once they receive a request from Swiss police, they _have_ to comply and log those addresses. You can fight tooth and nail and pretend that your entire service is built to never see any IP, but in the end, you will still be made to log it.<p>Welcome to reality.
Similar to Apple, Protonmail seems poised to redefine privacy as "privacy from advertisers" rather than "privacy from us too".<p>I for one am now only using Protonmail through Tor. Recommend Brave users enable "Automatically redirect .onion sites". If a site has an onion service, it will automatically redirect in case you forget.
ProtonMail is my main e-mail, so I am positively biased in their favor.<p>I think their advertising copy about not logging IP addresses was poorly done, but their service is private enough for me. It probably doesn’t much matter or make much difference, but I feel OK with using their service, and tweaking my account settings for Google and Apple to the minimum amount of data retention.<p>I feel that people who let corporations easily have all of their data put themselves at a disadvantage when it comes to any interaction between yourself and any large company (insurance, retail, etc.). Governments will always have our private information so the real purpose of privacy is economic value.<p>Imagine playing poker with your friends and you had to have your cards face up on the table and they could keep their cards hidden from you. In this example, your friends are corporations.<p>EDIT: Carissa Véliz, author of Privacy is Power, was interviewed recently on the ProtonMail blog, and I think the interview does a good job of summarizing her excellent book: <a href="https://protonmail.com/blog/carissa-veliz-data-privacy/" rel="nofollow">https://protonmail.com/blog/carissa-veliz-data-privacy/</a>
The obvious questions being a) Why do they sell vpn ?, and b) Why is the web-email client not routed over vpn if it has any value whatsoever?<p>If they route all email over vpn, do they have to disclose the enduser's ip ? If so, how do they avoid that with standalone vpn ?
It is not the first time this company finds itself in the center of an international scandal.<p>It has proven multiple times that privacy and security are not something they really care about.<p>I wonder what else should happen for everyone to completely lose trust in this scam.
My trust in them had been broken as soon as they asked me to honour a bill when my vpn subscription ended, instead of notifying me to renew. Respectable companies don't use such asshole design/wording. They're a fraud.
So they lied ... not surprising companies promise things just to betray their customers in a second. I still remember when Facebook won the social media war by promising to never allow advertisement.
question... why did they have this information readily available for them? couldn't they not retain logs and delete this sort of information right away? is there some legal aspect that makes them have to retain it for a certain amount of time or something?
i know there are some Protonmail guys reading this thread... people choose your service exactly for this very same reason, good luck trying to regain people trust
Well, at least they own their mistakes and change accordingly.<p>All email is shit. Nothing is encrypted and many company's simply try to sell you on better productivity (hey.com). Already having my email be encrypted so that the host can't read it is a step forward, in my opinion.
For those who love Swiss "privacy" and security they should read about the CIA front-company from Switzerland for secure encrypted communications:<p><a href="https://en.wikipedia.org/wiki/Crypto_AG" rel="nofollow">https://en.wikipedia.org/wiki/Crypto_AG</a><p>And remember Mark Twain:
“History Doesn't Repeat Itself, but It Often Rhymes”
What a douchebag company honestly. Their marketing is absolutely evil. Changing the headline does not cut it, they need to fire people responsible for that outright lie.<p>After a dude gets arrested, they’re like: oh, we were talking about advertisers! Who did you think?<p>What a trash team.<p>Proton mail ==
I can't imagine running an internet based service and <i>not</i> logging IP addresses. How else do you debug issues or isolate malicious users, etc. Does anyone think it's realistic (or even responsible) to not log basic info?<p>I don't use PM, but it seems their product is end to end email encryption, not complete web anonymity. Maybe those wanting to add anonymity should access it via tor (if PM allows it).
It has been admitted. So they DO log your IP address when you use their service. So their customers have been lied to and have their privacy at risk. They cannot be trusted.<p>So how long have ProtonMail kept this massive lie from its users then?
If people are unhappy about Protonmail I suggest they try find an email provider that is impervious to any judicial requests. Of any country.<p>It is naive to imagine companies that have an address and take payments can ignore judicial decisions.<p>Yes there's a point about fighting decisions, but as people say "we live in a society".