This is non-news, like all tech companies, they are bound by law to do this. It happens more than 6000 times per year for Proton. However, this user just had bad opsec. Proton emails are all encrypted and cannot be read unless law enforcement gets your password, which Proton does not have access to. Even if Proton hands over all data.
Proton’s mails are encrypted… between proton accounts. Send an email to a hotmail account and bye-bye encryption. Proton does rely on PGP so you can use that if the recipient supports it.
They mean encrypted at rest. As in, Proton cannot hand over a copy of all your emails to a law enforcement agency, they don’t have access.
This means law enforcement would have to capture an unencrypted email in transit, or obtains your emails from either recipient individually.
Mail stored in proton is encrypted
https://proton.me/support/password-protected-emails
A Password-protected Email is an email that requires a password to open it. It’s a way you can send a secure, end-to-end encrypted email to anyone who isn’t on Proton Mail.
Upon receiving the recovery email from Proton Mail, Spanish authorities further requested Apple to provide additional details linked to that email, leading to the identification of the individual.
I like how no ones talking about how Apple (the one its fanboys say is most privacy centric company) was the one that helped identity the individual.
Proton leaked the recovery email. Apple has never given any guarantee about their mail service, which isn’t the case of Proton
Don’t put any recovery info on Proton
Proton has never given any guarantee about hiding all account metadata from the Swiss government either.
They’re all like “privacy and freedom”, “take control of your data”…
They’re saying they’re the best for privacy literally on their website. You might argue that Apple does it too, which is fair, even though everyone knows it’s a lie
But yea anyways that’s a big flaw, they shouldn’t push customers to enable a feature that effectively deanonymizes them
They’re all like “privacy and freedom”, “take control of your data”…
That’s correct. And the fella used that freedom and control over his data to deanonymize himself. It isn’t proton’s job to be completely idiot-proof. They tell you what it is they do, and they do it. There are no false claims made.
I think you didn’t read my last paragraph
Don’t put any recovery info on Proton
About that. I’m still making the transition from gmail and currently most of my mail still goes to gmail first and gets forwarded to Proton through their easy switch process. Surely this is just as up for grabs as a recovery email, right?
FWIW I’m not likely to be investigated any time soon so I’m not worried either way.
That’s significantly worse privacy-wise, since Google gets a copy of everything.
A recovery email in this case was used to uncover the identity of the account-holder. Unless you’re using proton mail anonymously (if you’re replacing your personal gmail, then probably not) then you don’t need to consider the recover email as a weakness.
That’s significantly worse privacy-wise, since Google gets a copy of everything.
Obviously, but I still haven’t gone through all the things I’ve ever signed up to and changed my email to the proton one. When I sign up to new stuff I use Proton, this is a necessary step for transition… And one that is likely to stay in place for a very long time since I’m going to keep procrastinating it.
Unless you’re using proton mail anonymously then you don’t need to consider the recover email as a weakness.
Excellent point.
“Privacy” means two different things depending on the audience. For me privacy means that my information is not being used to advance some organizations commercial interest. For others it means that my information will never be shared with a government.
Don’t advertise to me
Or
Don’t narc on me
I guess I don’t really expect a company to resist pressure from government agencies on my behalf. Especially if I have been using their service to commit crimes in my country. If you are doing things your government would prefer you didn’t, hire a good lawyer and consult with them about what should be sent via email (spoiler, it’s nothing). The mafia doesn’t send emails, or put anything in writing, if you do crimes, you shouldn’t either.
I guess I don’t really expect a company to resist pressure from government agencies on my behalf.
Personally, I expect them to resist to the extent possible by law. The cops need to follow a lot of rules to make legally binding requests for data. I understand that if they do, there’s not much a company can do other than hand out the info, but if there’s a legal way to deny such a request, I expect the company to pursue it.
Pretty much. I’m not expecting a company to spend millions of dollars in court costs and lawyer fees on my behalf. But if it’s clear that the government is overreaching, the company should at least go “hey uhh judge, wtf?”
Companies selling data don’t tend to be picky who they sell to. Governments and police buy data all the time.
The best part is a government can buy data and and can change the rules on what is illegal.
So, if they decide tomorrow that your innocent behavior is a threat, you’re now a criminal.
Not to mention the fact that any new place your data is stored is a honeypot for criminals to try to hack. The more sensitive the data the better. Not every organization has the same protections and they will get your data stolen at some point.
Isn’t the old bit about organized crime how they always have a second set of books? After all they do want to be able to track their finances.
They provided the backup e-mail address
Upon receiving the recovery email from Proton Mail, Spanish authorities further requested Apple to provide additional details linked to that email, leading to the identification of the individual.
Just in case anyone thinks they decrypted mails and handed them over, nope. I hadn’t thought about that “settings” are not encrypted. Guess if you want to stay anonymous you shouldn’t add your private mail address in there as a backup.
Yeah. Even if they couldn’t hand over recovery emails, having a personal email as a backup to a “private and sensitive” email account is bad practice.
I don’t know much about the case beyond some very lazy peripheral searching, but it strikes me that Proton’s compliance isn’t an issue, but the requests themselves are totally unjustifiable and based on malicious prosecutions to nab some separatists on ridiculous terrorism charges for their nonviolent action and protests.
This individual is suspected of being a member of the Mossos d’Esquadra (Catalonia’s police force) and of using their internal knowledge to assist the Democratic Tsunami movement.
The requests were made under the guise of anti-terrorism laws, despite the primary activities of the Democratic Tsunami involving protests and roadblocks, which raises questions about the proportionality and justification of such measures.
The same thing which happened in the past. Antiterrorism laws used for -if I remember correctly - and environmental activist.
Probably the request to Proton arrived from a Swiss judge, who received a request from Spanish judge, and he evaluated the request and decided that it has merit.
Doesn’t look like Proton did anything wrong, they can’t fight these requests and he was caught by identifying information he linked to his account.
They could disclose the fact that they might need to give that info to authorities and warn users of that.
They never mention it here for example https://proton.me/blog/protonmail-threat-model
They do mention it on that page:
However, if presented with a valid order from a Swiss court involving a case of criminal activity that is against Swiss law, Proton Mail can be compelled to share account metadata (but not message contents or attachments) with law enforcement.
The only ever claim to encrypt message contents and attachments. And explicitly call out account meta data here as something they can hand over if requested by law enforcement. They also mention they are not good vs targeted and governmental level attacks:
There are, however, some risks for users facing a strong adversary, such as a government focusing all its resources on a very specific target.
And explicitly mention they might be compelled to log and give up information like ip adresses:
if you are breaking Swiss law, a law-abiding company such as Proton Mail can be legally compelled to log your IP address.
https://proton.me/legal/law-enforcement
Here the mention clearly the data mentioned in the privacy policy which in turns clearly states that you MAY provide a recovery account which will be associated with your account. I also think that anybody that should be concerned for this should understand that law enforcement can get ALL the data the company has on you.
It’s basic common sense. I understand that some people simply don’t have any.
As much as some of us may dislike it when a company does these kinds of things. You can’t really blame them for following the laws of the country that they are headquartered in.
You can blame them for operating there to begin with in cases like Apple in China, but you could hardly blame them for following the laws of the US where they are headquartered for example.
If the law of the land where the headquarters is requires them to give up the data they do have to partner nations then they don’t really have much choice in the long run if they want to continue to exist.
Plus there isn’t many jurisdictions with stronger privacy law than the swiss. It is unlike they made a bad choice for choosing a headquarters.
I guess they can operate on the public sea or the arctic, but I imagine the commute will be terrible.
“Nobody’s going to jail for you” is pretty much the way to think about any cloud privacy service. They may not keep logs unless they’re required to, but in the end, they will comply to stay in business.
If you use ANYTHING other than face to face meetings when discussing something illegal, you get what you deserve.
Although I like the idea of a drug smuggler typing “as per my previous email…”
Proton a few years ago disclosed the IP address of the user of a certain mailbox upon request by LEA. That was enough to get the person found and arrested (I don’t remember what the case was about). They HAVE to comply with these requests,
but they DON’T need to log/retain those infoETA: and I was wrong, thanks @Cheradenine@sh.itjust.works to set me straight. But I think the point still stands. I don’t want to be ALWAYS be tied to a VPN, there are some scenarios where I can’t use a VPN.That was the moment I decided to selfhost my email server.
In that particular case they did need to log the ip because they were compelled to do so by a Swiss court.
That was an opsec failure on the user, if they used a VPN or Tor they would not have been caught.
A VPN would’ve only shifted the “blame” unless it was a decent one like IVPN.
Tor would’ve been much better, especially considering Proton has an
.onionaddress.Yes, by VPN I meant something decent. Not whatever spyware is top on the Play Store for circumventing geoblocks.
They were already using Proton Mail, they just were probably thinking that was enough. It would have been if the French had not been able to convince a Swiss court that their request was valid.
So couldn’t a court compel the VPN to log all IPs and then use some FISA level shit to prevent the VPN from alerting users?
There’s been a handful of VPN cases taken to court where they have proved, at that moment in time, that they had no logs to hand over. But why not take it that last step and compel the change then?
That’s a good question. I know good vpns like mullvad do not and can not log ips/traffic without changes to their backend, I wonder if they could claim “it’s impossible” or something (clearly bogus, but the argument could be “with our current infrastructure, I.e. We can’t afford to redo our systems to comply”)
US Gov: Here’s a blank cheque, make it happen.
But really, the best I can come up with given this is clearly not impossible, is it would destroy the business, but I still think FISA could somehow bypass that given how broad and secret it is.
Posteo doesn’t have to retain IPs and doesn’t, it also doesn’t retain payment info (though if you transfer by wire there’s still a window where a payment can be traced AFAIU).
They will also absolutely forward any and all traffic for a particular account to law enforcement when given a court order. What’s it with criminals thinking that they can outsource opsec to legitimate businesses. Defending against a state-level actor actively hunting you down, watching closely and pouncing on any and every mistake, is a vastly different beast than making sure google doesn’t know about the butt plug you just bought.
Agree with you, that’s why I buy my butt plugs (and similar toys) with my gmail account! 😁
“If law enforcement is going to look at my data, I’ll give them something to look at” lmao
That was the moment I decided to selfhost my email server.
So now the hosting you use will share the same(or likely much more) data if some government requests it.
They can get my encrypted drive. My domain name is registered to me so that’s clear it’s my email. But no content.
What I am find curious about this is if a recovery email would have any weight in court. I can add whatever recovery email I want to an account. It doesn’t have to be mine.
If your recovery email address is not yet verified, click the Verify now link and then the Send verification email button. You’ll be sent a link to confirm that the email address belongs to you.
https://proton.me/support/set-account-recovery-methods#how-to-add-or-change-a-recovery-email-address
Ah, makes sense.
I still find it fascinating that you can go to jail because there’s an IP address in a log file somewhere or because of a screenshot of a messenger communication.
Any more so than, say, fingerprints, DNA, or accounting records?
Definitely. I can just write a log file myself, change the creation date in the filesystem if I have to. There are websites that generate images of DM conversations on a myriad of platforms online. Manipulation of these artifacts is beyond trivial
Or, for that matter, surveillance video recordings stored on a server somewhere. It’s all just ones and zeros, but some combinations of ones and zeros are quite informative.
As technology progresses it is a fact of life that AI will get better at forgery. Perhaps these items will be less permissible in the future.
Forgery is easy. Putting the forged document into the chain of custody is, and has always been, the hard part.
If we’re talking about financial records, it’s been trivially easy to create fake bank statements, or fraudulently place an old date on a newly created document, or even forge wet signatures, since before computers were invented. But getting that forged document into the filing cabinet of a bank or an accounting firm is the hard part.
I can make fake IP logs, sure. I can generate fake videos, I guess (under current tech, that takes a ton of effort and skill to be believable). But getting those logs onto Proton’s servers, without Proton knowing? I don’t know about that.
deleted by creator
Because they want to frame someone else.
Yes its a good thing the result is what it is, but you watch, theyll try to use it as justification. And as a small(ish) fyi, try running a tracert on whatever site youre looking at. Unless you are directly connected to that site, there are likely multiple hops -domains- that your connection passes through to get from your machine to the target. Each one of those has the potential to read what youre doing and reporting on it.
Well not exactly. They might be reading the metadata of your lower level packages.
Unless you’re not using encryption, then wth are you even doing?
You forget the nsa, interpol. I remember back in the 90s there was a blurb about hackers sniffing packets and using that data to hack those systems. Gotta remember back then everyone had more open ports than shanghai
I mean yeah, maybe? Are you one of the people that believes aes or ecc has a backdoor? I think we’d know by now, and I’m certain they don’t have the compute to break aes256.
Keep believing that. Just because all those ports are closed to you and me is no guaratee that theyre not being keyed for them
Yeah sure. There is no perfect security, but your paranoia is not only impractical but conspiratory.
Im not paranoid about anything. I merely read what gets published and sift out the trash
This is why you sign and encrypt the contents of email. If the recipient doesn’t have the public key, they can’t read the content.
Allowing a service provider to “handle your keys” is tantamount to letting the fox watch the henhouse.
Proton doesn’t provide IMAP/SMTP access for free accounts, so you won’t be able to encrypt emails locally.
This ultimately is the tech version of “trust me bro”. This means you are as secure on Proton as you are on GMail, depending upon how you use the service.
This comment is completely off the mark. The information that they disclosed is the recovery email -the same exact thing which happened previously- not any content of any email.
Also, proton does encryption with PGP, but you can’t encrypt if the other side doesn’t use PGP (which is the case for 99.98% of humans on the planet). If they do, proton supports this including with arbitrary clients using their bridge.
If the recipient doesn’t have the public key, they can’t read the content.
Sir, if your recipients don’t have a public key, you cannot even encrypt the message… That is how asymmetric-key crypto works.
Proton doesn’t provide IMAP/SMTP access for free accounts, so you won’t be able to encrypt emails locally
Umm, you absolutely can. Use gpg, encrypt the txt, copy the encrypted text into the email. EZPZ.
…yes, that’s what I said. But sign them locally. Do not put your private key on Protons service. Sign and distribute pub keys locally.
Probably should have clarified.
Also, paid IMAP/SMTP makes Proton a freemium service. Thought I should just underline that.
Just encrypt with pgp and send encrypted text
That’s how a good portion of the Dark web works, and I find it amazing
FYI email contents were not decrypted or turned over to police, as far as I know Proton’s E2EE is still as good as whatever system you’re using. Proton doesn’t have the keys to decrypt your emails, it never did. What they have access to is metadata that is necessary to function when your private key is unavailable - e.g. your public encryption key used to encrypt incoming emails from non-Proton sources, or in this case, a recovery email address (I don’t know what the recovery process entails and whether it can restore encrypted emails).
proton is untrustable
