Hmm, I am not completely sure what the website is trying to say (there is soooo much text and it's quite unreadable). But it feels like it says "it is hosted on US servers, so it's baaaaad".
The thing is, it seems to be end-to-end encrypted with MLS, which means that the servers cannot decrypt the conversations. Probably some metadata are leaking (which IP is in a call with which other IP), but that's a different threat model. Metadata is always a harder problem.
Now I don't know if Proton knows which users are together in a call, or if it's just leaking IPs. Maybe the article says it, but I didn't have time to decrypt it :-).
Most of the privacy claims (of all type of apps) are essentially garbage anyway because realistically, if a website or an app can be compelled to push an update to a specific user, then they can intercept anything they want.
It doesn't even have to be a specific binary, it can be "just turn on this A/B testing / debug flag for that user" or a piece of javascript
Privacy and security are not binary. Statements like “because it isn’t 100% secure or private, then it is not worth it” means one has essentially no clue. There is not such thing as 100% privacy or security, for starters.
It’s all layers of protection and/or trust and compromises.
>Most of the privacy claims (of all type of apps) are essentially garbage...
True. Everything has backdoored CPUs as its foundation. Consider, for starters: (Intel's 'Management' Engine); AMD's (PSP); Apple/Arm (black-box hardware).
You can layer as much theater as you like on top of the hardware-surveillance-layer in modern computers; it still won't grant you privacy.
Counter-surveillance is not a binary switch. We can win by forcing the government to use increasingly expensive backdoors and exploits (>$10k per capita per year, beyond which mass surveillance is impractical even with a $1T budget). Hardware backdoor capabilities are costlier to maintain and use than something at the app level. Encrypting content and leaving metadata exposed is still better than encrypting nothing because they'll have less info to work with which means more effort. The point of all this is not to make it impossible for the gov and corps to surveil a targeted individual (of course they'd be able to if they expend enough resources). The point is to ensure that they only have enough resources to do targeted operations rather than blanket mass surveillance. The former is fine for a democracy, but the latter destroys it.
They are very expensive. Cheapest Power9 system Raptor Systems has is $6,794.99 and it has only 4 cores and 8GB DDR4 RAM and 128GB SSD. Reminds me of Sun Sparc pricing.
How are they leading? If I parse this correctly, "actually" open would mean fully open data training and weights? Then, by this definition, I'm only aware of Olmo (AllenAI - Seattle), Apertus (Swiss) and to some degree (unclear what data was actually published) Nemotron (Nvda, US). What are some examples of chinese similar models? (I'm not aware of any).
It might not be slow forever, but it’s slow now. I’d love to see an open ISA that is fast. But I don’t understand why the industry decided to start over with RISC-V when the compilers and toolchains and chips already existed in power land.
Shrug. The first RVA23-compliant chips are coming soon.
spacemiT K3 imminent (likely shipping boards this month) and Tenstorrent Ascalon (via Atlantis SoC devboard) this summer. These won't be the fastest CPUs available, but they'll meet the "fast enough" criteria for many uses and users.
Multiple parties including Tenstorrent expect performance parity with the ARM and x86 offerings available at the same time by 2028. Note performance is mainly gated by access to latest fab nodes, which comes with costs that necessitate serious volume. They expect to be there by then.
>But I don’t understand why the industry decided to start over with RISC-V when the compilers and toolchains and chips already existed in power land.
The rationale was documented in the "Instruction Sets Should Be Free: The Case For RISC-V" paper[0].
Note OpenPOWER is mentioned but is not in the comparison. The reason for that is simple: RISC-V predates OpenPOWER. It was an obvious reaction to RISC-V, and they were too late, as RISC-V already had the industry's attention. Furthermore, Open is a lie; payment to IBM is required in practice.
>if a website or an app can be compelled to push an update to a specific user, then they can intercept anything they want
yes which is why i hoped they would implement a verification system like with a browser addon that compares the website client code used for encryption and alerts the user if it does not match the one served everyone else.
I don’t think that is a useful definition even if technically true. With that logic even Linux isn’t privacy because in theory they can push code that will only run for you.
I think the argument is that when you load a webpage, you download the code everytime you want to run it, from servers owned by the company building the service. So they can choose to serve you different software (e.g. with a backdoor), just this one time and just for you, and you won't know (not that it would be impossible, but it is generally impossible in practice).
When you download a program on Linux through the distro package manager, you download it once and run this, every time. You know very well when it gets updated. You can compare the hash of your program/package with the one distributed by the distro, and the distro is not the developer of the program (so there is another layer there). You can audit that code (if open source), and at the very least you can compare with others to see if they receive the same code. And again, the program is served by the distro, not by the developer. The backdoor situation would require asking the developer to implement a backdoor, and then asking the distro to server you a different executable, and then hoping that you never, ever check the hash of that program that you own offline. It's a lot harder.
In a way, for ProtonMail (in your browser) to be "end-to-end encrypted", you have to trust Proton. But that kind of defeats the purpose of end-to-end encryption.
Same applies to e.g. WhatsApp Web, which is an interesting example because there exists a browser extension allowing you to "validate" that you run the code Meta expects you to run. Though you still have to trust Meta: the extension only helps making sure that nobody other than Meta is abusing you. The WhatsApp mobile app doesn't have that problem, as it is distributed as an archive by a third party (Play Store).
> In a way, for ProtonMail (in your browser) to be "end-to-end encrypted", you have to trust Proton. But that kind of defeats the purpose of end-to-end encryption.
Yes, and every VPN in the world (that isn't self-hosted) relies on trust that they won't share your info, not even your fingerprint - which defeats the purpose of VPNs. It's very hard to have perfect security. OK, impossible.
Sure, it's always a tradeoff. There is no "perfect" security, but there is "better" and "worse" for the threat model.
My point here is that when you run a webapp from a browser, you have to trust the server. When you run a program that you download on your system, it's easier to check that it doesn't change and to make sure that others get the same one.
Exactly, as with all security you have to ask what the threat model you're defending against is and what you're willing to pay.
If it's "Google knows too much and I want an alternative" Proton is great, cheap, and convienent. If it' "my own government might kill me" then it might be time to think about self hosting.
> "Google knows too much and I want an alternative" Proton is great, cheap, and convienent.
I think that Proton does a good job with the suite (docs, sheets, calendar, password manager), and I believe they have a good VPN (for what we may expect from a VPN).
Interestingly, Proton started with ProtonMail, and I find it's the least convincing of their products:
1. As an individual, writing from your ProtonMail account to (probably) someone on GMail doesn't change anything.
2. As a company, writing from Proton to Proton is a good idea, but there is no need for end-to-end encryption: just choose a mail provider you trust, I guess?
3. The ProtonMail end-to-end encryption in the web browser defeats the purpose of E2EE: you have to trust Proton anyway, because they serve the code every time your employees load the page.
Using what mechanism? Most Linux updates are not pushed but rather pulled at the user request. You can use Linux totally offline. This is fundamentally different than a webapp, where code is sent with every visit
Debian requires unattended-upgrades to be installed (it's not installed by default), Mint and Fedora has the option of enabling automatic updates (disabled by default), Arch has no mechanism for automatic updates.
Distros have mirrors and they don't know which one you use. The updaters don't send user IDs and downloading the package lists is separate from downloading the packages. So targeted backdoor distrubution is much harder than a company's web UI with user logins targeting a specific user.
Signal pushing updates every other day is pretty much a security anti-pattern though. It makes it almost as vulnerable as a web app to this kind of thing, but this isn't the typical Linux software experience by any stretch.
The checksums are verified automatically, based on a key bootstrapped by the original install (which could, though likely not done, be verified by other means). As happened with xz, you either get everyone or no-one.
Push or pull is just semantics. Can you honestly say that you never ever updated anything in a Linux distro without first reading the source code, checking all the checksums etc? Be honest.
Choose if you think Windows is just the kernel or the operating system.
The ones that control whatever source you are pulling the updates from. Very very few people are building everything from source and reading the source in full everytime.
Notice I am not saying this is likely. I am saying that it is theoretically possible anytime you accept code from the outside (doesn’t matter if it is pull or push)
You'll have to be more specific what kind of "privacy claims" you're talking about. Proton is definitely a lot more private than, say, Google. But, as always, you'll have to trust the party delivering the binaries you run. Also, any company operating legally, have to co-operate with court orders etc., but afaik they try to push back
You need mechanisms to avoid the possibility. The mechanisms to do such things exist by default, by both the software provider (e.g. Proton) and the software distributor (e.g. Apple for App Store, Google for Play Store, Cloudflare or AWS for web stuff), and various countries have laws that allow them to secretly compel implementing specific backdoors.
In order to block the distributor from going rogue, you need to be able to guarantee that the user device can only install/run code signed by the provider, who must never give those keys to the distributor. My impression is that Android is the only major platform that ever had this, but that Google ruined it a few years ago in the name of lighter bundles by insisting that they hold the keys. (I once had VLC from Google Play Store, but replaced it with a build from F-Droid under the same app ID; Google Play Store shows it has an update for it, but that it can’t install it.)
In order to block the provider or distributor sending specific users a different build, you need something more like Certificate Transparency logs: make it so that devices will only run packages that contains proof that they have been publicly shared. (This is necessary, but not sufficient.)
And if you’re using web tech, the mechanisms required to preclude such abuse do not at this time exist. If you’re shipping an app by some other channel, it can do a resource integrity check and mandate subresource integrity. But no one does things that way—half the reason for using web tech is specifically to bypass slow update channels and distribute new stuff immediately!
- A/B testing is agnostic of who the user is, it is randomized. If it was not, that would be a bad practice and would legitimately ruin the reputation of the company doing that,
- auto-updates is just the setting allowing the most recently published update to be installed. "Published" means it is for everyone. If that is to be understood in any other meaning, that would also be bad practice,
- and I don't see what you mean by server-side re-routing.
To be honest, maybe I just live with different platforms and apps than you I don't know. I use Android, and Linux on my Laptop, but I would also expect Windows to not discriminate by user when pushing updates.
There is NO such mechanism (discriminated updates by user), of my knowledge, in:
- Linux (apt, pacman, rpm...),
- Android
And I would add Windows and iOS/MacOS but I'm not at all an expert so I leave others to confirm that their "app stores" don't do such exotic prowesses.
You can artificially insert a malicious script in a package that would scan your system, deduce your identity, and install something based on that, but in this case that means that it is just a malware in the first place. And that would mean that the app to be installed contains a "mutable" component of data that is not defined by the contents of the package but rather written upon post-install actions, so that is also dubious to include that for formally in the "app from that package" definition. In any case, such behavior would get your package banned from any app store or Linux distribution.
Yes, the US government and US courts (including the secret court FISC) have tools to compel Google, Apple and other vendors to install malware on users devices. This is exactly the point.
Would you mind showing me some evidence that software update systems are able to push to you e.g. a different Android update based on your device ID or specific IP? (not just country geolocation) (PS: your link is about deploying malware through other routes, not by normal software updates)
Because all the other means I can think of are just basic malwarfare.
As you need to rely on a vendor/distributor to get updates, then of course they are able to push you malware, there is absolutely no going around this first ring of trust.
Conclusion : there is no point in accusing Proton of anything... there are just being software providers (FOSS by the way!!!).
Not sure if that counts as proper evidence, but I have seen some logs[0] albeit with encryption but from my understanding, they control the encryption keys or atleast certainly have the ability to change (if they get hacked themselves for example)
Would you like to see a proper evidence of the logging policy? I feel like I can try finding that again if you/HN community would be interested to see that.
Edit: also worth pointing out that keeping logs with time might be a form of meta-data, which depending on your threat-vector (journalism etc.) can be very sensitive info.
I'd like to see any kind of evidence that there's any substance of in these accusations of services not actually being private - not just theoretical theorycrafting about mechanisms.
And how does that compare to other services we have available and people actually use.
At some point, essentially everyone has to trust the product and more importantly, the company/the people in the company. Firstly its worth clarifying that there isn't really something akin to zero-trust in such cases. Thus the theoretical theorycrafting about mechanisms. Those show that you have to trust proton
Now, My issue with proton is that, they try to appear transparent but a lot of what they've done especially with proton meet seems to sometimes even be misleading. If they couldn't create EU/Swiss sovereign infrastructure for meet, then why are they using Cloud-act providers while within the same post talking about the implications of Cloud Act. There is some great irony in all of this and this is what is making me suspicious and how Proton seems to be misleading people rather than leading them towards more privacy.
At some point, it raises atleast some questions about trusting proton.
> And how does that compare to other services we have available and people actually use.
That depends on what service are you talking about from, Do you want a whole eco-system or are you happy with individual apps/companies focusing on one thing in a more unix-fashion of things.
Do you prefer non-profits or for-profit companies to handle such infrastructure?
How familiar you are with self-hosting and what is your threat vector?
Are you a corporate or a person yourself and what are your budget of things?
but just to give a pointer without asking these questions, Some good pointers are posteo.de, tutanota, infomaniak (has whole ecosystem) Within the calling system, I personally used to use fairmeeting.net, it used to have screen sharing option for free as well but looks like they might have paywalled it recently. You can find multiple jitsi community instances.
I feel like the only way to answer this question is if people ask with more depth. The threat model differs for everybody, for some people (like journalists), even just this proton meet fiasco is enough for them to reconsider proton ecosystem as a whole and consider it too threatening, especially with recent incidents and their lives being on the line. You might say, well where might they go and I feel like they might go to disroot (non-profit activism oriented) or tutanota or even posteo.de depending on what they might prefer.
I once did some tinkering with Proton Docs and I was able to find that the comments within Proton Docs when I used it via curl definitely felt like it had something like logs (I feel like I should try doing this again to have more definitive answer)
Either way, the response was encrypted but they hold the encryption key atleast within proton-docs.
I also want to say that Proton allows the ability to change password through OTP, (Something which I sorta appreciate[0]) but that means that their infrastructure can then have the ability to change password and you can toggle that functionality by sending a request to proton to allow OTP and on which number, so proton themselves can do that too. Unless, I am getting it wrong, by default, Proton still has your encryption keys and even if you change them (which 99% including me might not do), even then I definitely feel like there can be some concern.
To be honest, There is nothing like zero trust, that's what I learnt, You are still trusting Proton Aka The swiss laws behind it so that you know that they won't get legally forced to give more data than usual (like US companies for example) but they will still comply with the swiss laws (recent proton incident)
Then, secondly, you have to trust Proton themselves, but with something like this incident where Proton Meet might be omitting somethings, it doesn't paste a clear picture of transparency or trust.
I don't really know why Proton might create something like Meet especially with its infrastructure relying on the CLOUD Act, and then, try to sell it within the idea of privacy. They both are contradictory.
Proton is, creating lots of products, On one hand I can appreciate that, but on the other, as part of community, I feel frustrated/sad because they don't have some core features like proper proton drive rsync support or even some API[1]'s surrounding it. I tried to do the experiment in first place because I wanted to create a commenting engine for static websites which could use proton-drive as its backend. They really could gain a lot from transparency with proper API support and letting the community do things with it, but that's not really the case :/
I am still using Proton but they definitely aren't a bastion recently. I might still recommend Proton, but I sort of hope that companies self host some open source applications themselves, whether self-hosting with hardware or in a proper EU cloud like Hetzner/OVH.
But Incidents like these are making me a little more hesitant to recommend Proton nowadays.
[0]: as someone who had lost one of my previous accounts after my Keepassxc database got deleted because of me accidentally wiping my archlinux with tinkering with it, Now I use Bitwarden with OTP on proton.
[1]: I was able to make something like an API myself by relying on something like puppeteer, even with puppeteer though, it was really hard to make something like that. I couldn't create a public endpoint of it because having puppeteer instances for a commenting engine would be very resource intensive.
The articles format is awful and designed to wast your time.
This article also just points out the use of Livekit but doesn't deliver what that means for your security. Maybe instead of writing a hit piece you could have dug deeper, talked to Proton?
I've seen alot of articles and posters here being negative on Proton, calling it "shady", regurgitating facts that are supposed to be gotchas but have tons of nuance if you dig and am beginning to think there is some coordinated effort to get people not to use it.
I recall hearing some controversy around Australian legislation and Proton cooperation with authorities. Though haven't dug into court records or anything yet.
Is there a balanced view someone has summarized somewhere?
Are there some references you'd recommend where I can begin to read up?
From every instance I've seen, Proton has only ever done what is legally required of them by a warrant. They do not get to say no when asked to turn over what they do have; which is going to be things they can't avoid storing - like email addresses or recurring payment information an account has.
But they don't store logs and all actual data is E2E / at-rest encrypted, so that data does not exist for them to give away. There's no master key or back doors.
The problem is the gap between marketing promises and realities. Proton markets itself as a safe Swiss product[0] for activists[1], but the reality is their accounts often expose more than a casual user may expect, like a secondary email address[2] (often required to sign up) or payment info[3]. The Swissness is even more suspect according to this article, if it's true that they rely so heavily on American infrastructure and don't responsibly disclose this even in their privacy policy.
This seems unreasonable. The entire point of Proton is that they themselves cannot access your data, that's how I've seen it advertised. The Swiss thing is more just that they can't be compelled to enable logging. (To be fair, though, maybe that's changed. it's been a while since I saw their home page and I don't exactly make a habit of disabling my adblock).
But I don't see how any reasonable person would not know that the email addresses and payment information that Proton must have access to would therefore be subject to disclosure to law enforcement. And for the vast majority of people, they aren't exactly on a tight watchlist where intelligence agencies are making thread boards to catch them committing for international crimes to make this matter.
Anyway, I especially don't understand the flack they get on this forum with people who do understand and should understand how hard it is to advertise technical features to normies.
Normal people aren't cyber criminals who needs to hide every spec of their trail from all governments. They just want to feel like no one is reading their messages or Internet history or passwords. Proton offers that, full stop.
A recovery email address is your data, and a company that prides itself on encryption could figure out a way to hash it too. Maybe I'm just below average here, but I expected that from them at a minimum. I was shocked to discover they didn't bother.
It's not unreasonable to think Proton should significantly tone down promises like "We support peaceful protest" while seriously downplaying what they will turn over[0], or promising "We are... committed to defending your freedom" on their homepage[1]. It's certainly reasonable to have a complete list of data processors in their own privacy policy.
If proton hashed your email how the fuck would they send you an email? Did you even think this through?
They're doing the best they can, but at the end of the day it's literally impossible for them to have absolutely zero data.
They need your credit card number stored somewhere so they can repeatedly bill you. That's just how billing works. They need a recovery email on file so they can email that address.
That doesn't mean that they're not committed to defending freedom.
I'll echo what other people have said: this feels like a psyop. If I were the CIA, I would be doing exactly what you're doing here: spewing unreasonable nonsense about proton in an effort to discredit it so that I can push people towards insecure services.
Nothing even comes close to proton when it comes to email security and privacy. That doesn't mean that we cant criticize proton - we can, and we should. But it has to be legitimate critique.
> If proton hashed your email how the fuck would they send you an email?
By asking you to provide it again if you click the "recover account" button, comparing what you enter against the hash, and then sending recovery into to the valid email you provided
Proton cannot destructively hash the email address for recovery because they need to use it. And if they can use it, they are legally mandated to give it to LEO in warrants that include that data as scope.
You can argue they should have a password the user holds to encrypt the recovery address, but that's going into the territory of hurting normal users. You use a recovery address when you don't have your password or recovery phrase. Requiring a password for the recovery email would just mean more customers locked out requiring human intervention (if it's even possible for that account) to get access back for the customer. And remember, many users also use the same account for their password manager.
And no, Proton is 100% welcome to publicly support free speech and protest while not destroying their company and going out of business with all their executives jailed for not complying with non-optional, legally required, minimally exposing warrants from law enforcement.
Proton can claim what they want, but when they promote themselves as supporters of peaceful protests while quietly handing over account details for people engaging in them, that is false advertising.
This isn't much comfort when the swiss government bends over and takes other states up the ass at the slightest issue, eg https://www.404media.co/proton-mail-helped-fbi-unmask-anonym.... Why on earth is the swiss state acting like stooge for the fbi? Tell them to go fuck themselves like a normal person.
PGP/GPG (can never remember the difference) is the only privacy solution worth a damn and proton is just a gmail alternative with a nice interface.
If they advertise that they will protect their users privacy, then I don't see how complying with government snooping is an excuse. Either provide what you say you will or don't say that you will provide it.
Proton has never said they will refuse a warrant for what your email address or recovery account are. They say that the contents of your emails, calendars, notes, passwords, etc are not accessible to them and therefore cannot be spied on even if a warrant is fulfilled.
The balanced view is Proton is a service that does not treat you as the product and does what I would describe as, the best it can, to provide privacy. They seem to avoid keeping data where they can but do cooperate with government when legally required to. The location they are in has more legal protections for privacy than most places.
If you are a normie wanting to not have your data sold and not have a company violating your privacy for non-legal reasons, they seem like a solid choice.
If you are worried about government level actors working against you or are the sort that gets put off at the idea of a service marketed as "privacy respecting" using any US based sub services, look elsewhere.
If you want references just start reading through comments on any topic here pertaining to proton.
I'm sorry I had to use a feature on my browser I rarely use which is summarize. I'm pretty sure your point is valid and concerning but the way that page was designed is just too painful to read.
Yeah this same site did an article on some minor ubuntu bootloader drama some weeks ago and when I recognized the design I just stopped reading. If you have something to say don’t go out of your way to make it hard to parse.
Especially questionable choice by Proton not to opt for the self-hosted option. LiveKit offers an enterprise tier that even lets you set up your own mesh, so you are not dependent on their hosted infra.
They're Swiss, so while technically in Europe, they are not in the EU. Maybe they're closer than the US, but they're still a foreign tech company in the EU.
Yeah, there's another thread showing a similar trend. In a strange way it's making Trump's incessant nonsensical big-upping of himself and the US as-a-whole make sense in a cultural context that I hadn't thought was as pervasive as maybe it is. It explains that polls still show 30% support.
Due to some comments the CEO made regarding a few Trump decisions there are a number of people that believe that the company supports the current US government and are looking for any link they can to prove it.
This is the worst form of Article I've ever seen. Did the author read this? Is there even really an author or did Chatgpt just write all of it and generate the page?
It may or may not be Proton Meet or Mail, but all I want is ZK E2EE (email at rest, text always similar to Signal) "Lavabit" with better tech architecture, without mandatory KYC de-anonymization, hosted in some US non-compliant location on real hardware they physically control, by a small, worker-owned co-op cadre of talented technical people who run a tight ship. Bonus points if they offer VPS and OpenVPN/wireguard exit nodes too.
I just love people who go on their soapbox to complain about a newer alternative when the status quo is worse
"nooo but proton mail complies to court orders!!111" wow shocking I know right? Do you think the other providers don't?
These are usually the same people who forget rubber-hose decrypting works
"But they use LiveKitCloud" yes - however we don't know half the story
Can Proton BYOK over their infra?
LiveKit's website TOS with a generic user - not ProtonMail. We don't know if there are any agreements there
> "all disputes are governed by the laws of the State of California"
Yes this is common with TOS.
> Their privacy policy explicitly acknowledges FTC jurisdiction and states the company will "access, preserve, and disclose your information"
This is the important part, not the other one above it
> showed active connections to 161.115.177.32 on port 443, a LiveKit-owned IP block (ARIN OrgId LIVEK) hosted on Oracle Cloud Infrastructure
Good test, but what/where was the originating IP? Was it using Brave's VPN (to the US) by any chance?
TBH I'm still more annoyed about the 90 day cookie - that was just rude
So again "why don't we have better privacy respecting options?" Maybe because if we try to do it some "privacy advicates" will throw a massive fit complaining about all its shorcomings (and still not pay for the service)
Proton does offer more privacy than mainstream providers, because they have less information to hand over when courts compel them.
Proton isn't perfect by any means, but the idea that there is no meaningful privacy difference between Proton and (for example) Gmail because both respond to court orders is flat-out false.
Your complaint is not at all what the article is about.
The article is showing that the proton claim that their new service is private from the US government data acquisition, including inability to access call metadata, is a lie (an intentional misrepresentation of the known truth by Proton).
Please remind me: Is there any legitimate business venture that can operate outside the laws of the country they are registered?
If there is, why don’t these people who write blog posts and comments about how “this is all a scam!!” “It’s a psyop! “They” control it all!” If it’s all black and white, if there no real difference between a company like Proton and Google or Microsoft, then why don’t they create a business that provides a service where there’s no way to any government know anything at all, ever? They’ll be printing money..
But perhaps the conspiracy realm and public broadcast of ideals is more attractive than a real business.
Yes, you shouldn’t trust 100% in a person let alone a group of people that form a company. Grow up.
What a shitty website. I got to about the third slowly-fading-in-picture-of-text block and realised that whether or not I wanted to read it, it's more effort than it's worth.
No, if a website is that obnoxious I just close the tab. It is not worth yet another mental drain on my limited attention span to read slop.
Just give me the boring single .htm page with your thoughts or a Wordpress site with minimal plugins. I'd hate to think the strain the author puts on people with accessible needs making this.
Many posts on this thread complain about how hard and unpleasant to read the article is. How is that not a valid complaint? And calling their "mindset" stupid... wow.
There's nothing bad about SFU, particularly the version you wrote, which forms the basis of Livekit. It would be my first choice for supporting larger groups in Briefing anyway. If the traffic is E2EE, it doesn't matter if an SFU is involved. The critical part is the signalling, in my opinion. This is where the initial communication is established. In the current version of my app, whose source code is yet to be published, this can happen via an untrusted server.
Proton is the most shady company out there, especially with the fact that they try to make you put all your eggs into their basket. I stopped using their email (when they used to be an only email company) when they dropped the .ch domain. Same goes with botched security products like grapheneOS and the likes, when the hardware is backdoored, the modem is tracking you more than your psycho ex, yet you are given these illusion of security to buy.. you are not, in fact, you are gonna get more obvious for fingerprinting than using an average iPhone like most people and blend in. Honeypot, hornets nest, whatever the terminology but the concept being used and is still used to lure people in and make the job easier to ID them than going after them in the wild.
nope, you can make new emails with .ch as well, just not on the free tier. I am looking at my settings now. .ch is definitely an option when creating new emails. I believe pm.me is also only for paid plans.
yo, livekit acts as independent controller for call detail records under their own dpa. that means proton's privacy constraints don't even apply to that data. livekit can hand call records to us law enforcement without notifying proton
> Proton’s launch blog post for their new video conferencing product contains this paragraph: “laws like the US CLOUD Act can compel US-owned video conferencing platforms to hand over any data they store, even if the servers reside outside of the United States. This creates serious compliance challenges for organizations bound by GDPR, CCPA, or similar data protection laws. That’s why we’ve created Proton Meet.”
Actually, it creates an incompatibility, period.
How much I dislike all this weasling around, trying to find a gap, where none exists, hoping, that the law won't be followed to the letter, lack of interest in following the law to its logical conclusion, all in the name of wanting to conduct business in an easier way, even if not adhering to the law. I wish all those companies trying that would be gone. Let us have solutions that are inside the EU, many of us don't want the US big tech crap any longer. I wish that governments and people in charge of public institutions and their tech decisions realized this. Instead they weasle around and try the "But we are using Microsoft in the EU!" as if that is worth a dime.
Try convincing me, that a company like MS in EU won't oblige, when the command from MS in the US comes to send over some data. Good luck!
Proton has too many services. I wonder how many more they will introduce until Proton Drive will finally receive a Linux Desktop client? The worst thing about "we have everything" services, that they will actively try to shove you each and every service repeatedly on each occasion. As "do not put all your eggs in single basket" type of user I absolutely have this marketing nonsense.
What the hell kind of horrible website did I just click on. That may perhaps be the single worst format of any web page I have EVER visited in my entire life. Wow.
Pretty funny because a few weeks ago some dude felt compelled to virtue signal about how he was moving off American-controlled services like Gmail, as some ostensible protest against Trump and the Iran War. I pointed out that Proton Mail, one of the services he moved to, is ultimately controlled by the US Gov, and my comment got flagged lol.
Proton being at the behest of Uncle Sam has been old news for a while.
"Controlled" is a bit hyperbolic, but there's a collaboration agreement between the USA government and the Swiss government, so Proton has to comply with requests from for example the FBI. Quoting a comment by Proton staff on Reddit
> First, let's correct the headline: Proton did not provide information to the FBI. What happened is that the FBI submitted a Mutual Legal Assistance Treaty (MLAT) request, which was processed by the Swiss Federal Department of Justice and Police. Proton operates exclusively under Swiss law, and we only respond to legally binding orders from Swiss authorities, after all Swiss legal checks have been passed. This is an important distinction.
> [...]
> The only information Proton could provide was a payment identifier because the user chose to pay with a credit card. This is information the user themselves provided to us through their choice of payment method. Proton also accepts cryptocurrency and cash payments, which would not have been linkable to an identity.
So basically, don't trust Proton with information unless you want the FBI to know it.
Sorry, perhaps the takeaway is clearer when you see the full quote [0]. I omitted it for space, here's the relevant part
> Third, let's talk about what was actually disclosed. No emails were handed over. No message content. No metadata about who the user communicated with. The only information Proton could provide [...]
Yes, paying by crypto prevents Proton from disclosing your identity that way. Is there anything preventing Proton from disclosing the email content or metadata? Do they claim they won't disclose that? Clearly they do allow themselves to disclose metadata [1]
> For example, in ransomware cases, we can preserve information about which victims contacted the suspect, so that victims can be notified.
So, "just don't pay with a credit card" comes with the additional caveat of "don't email somebody you don't want the FBI to know you emailed". Whether you also need to "don't write anything you don't want the FBI to know", I haven't investigated further, but you could perhaps look that up yourself. I will just assume that to be the case based on what I've seen.
There are limits of what you can encrypt, in all of the cases of proton being critiqued for its compliance with law I haven't seen any instance of them being able to disclose email content, where metadata is "who we're sending email to", which is, I assume, not encryptable if you want an usable service. That being said, the quote does make your pov clearer, thank you for that.
Yeah, if you trust that they will never push a backdoor to your client on the request of Swiss law enforcement. It's a web app "fgs".
They also admit to scanning all mail to and from non-Proton accounts "for spam". So what's stopping them from one day adding a small if statement that just writes that data to disk, for specific "interesting" users?
Regarding metadata, I sure hope you have nothing to hide in the below emphasized:
> Account Activity: Due to limitations of the SMTP protocol, we have access to the following email metadata: *sender and recipient email addresses, the IP address incoming messages originated from, attachment name, message subject, and message sent and received times*. We do NOT have access to encrypted message content, but unencrypted messages sent from external providers to your Account, or from Proton Mail to external unencrypted email services, are scanned for spam and viruses to pursue the legitimate interest of protecting the integrity of our Services and users. Such inbound messages are scanned for spam in memory, and then encrypted and written to disk. We do not possess the technical ability to scan the content of the messages after they have been encrypted. We also have access to the following records of Account activity: number of messages sent, amount of storage space used, total number of messages, last login time. User data is never used for advertising purposes.
Please quote where in that document the answer to my question is:
> Is there anything preventing Proton from disclosing the email content or metadata?
Also please link me to the source code of Proton's server-side code, so I can audit their scanning of all incoming and outgoing mail, to verify it's not logging them. What you linked above is just the clients.
After Proton has repeatedly turned over users of their email account to law enforcement, always with many excuses, their claims about no ability for any government to see what's going on on their network ran very hollow.
I know Brave has offered their talk video conferencing service for awhile, but I don't know if any serious network analysis has been performed on it.
https://talk.brave.com/
I am fundamentally against spyware that constantly monitors you and reports anything. Because of the constant and pre crime nature of it.
On the other hand i am actually not fundamentally against turning over data when independent judges sign a warrant.
This is arguably a very tight rope to walk but i think thats the most realistic comporomise between my right to privacy and the right of others to get justice when something is done onto them.
Perhaps you may not remember the US government's tendency to invade privacy for suspicious reasons (that is, at the very least extra-legal and sometimes downright unconstitutional).
You mentioned a warrant. I do not believe that has been a required threshold.
I am not American so my lense may be a different one.
What I am coming from is basically an extension of the German Laws that Govern the Mail Secret (Briefgeheimnis) which actually is constitutionally enshrined in the German constitution.
But has notable exceptions that can be made uppon federal law. The burden for these is supposed to be pretty high.
I think this should not happen willy nilly. And if thats the case in the US I am obviously against it.
It is a complex multi layered subject because it has to weigh the rights of multiple people against each other.
I think this comment deserves some nuance. Every company has to comply to local laws. Unless you want to run something illegal, at which point it's not a very reliable alternative for all your mail and more.
Proton in some cases was forced to turn over whatever they knew of a few accounts, according to Swiss law. They try to obfuscate as much as possible, so they can't turn over complete e-mail conversations. But some info is in there, and they have to turn that over. But (correct me if I'm wrong) they have to only comply to Swiss law, when there's a court order.
I like to point out often the yellow vests protesters being ratted out by Proton as good example of how misleading their marketing is.
French police contacted Swiss police to get the id of the accounts, Swiss told proton to hand over the data.
Problem is - under French law, their police would not be able to get that data from local providers.
Proton - HK owner, dev team in Bulgaria and marketing with mythical claims of "Swiss company privacy".
For a company that is selling essencially trust, they sure are shady as f...
I'm always confused by the conspiratorial takes that think there's some service out there _not_ bound by the legal system where it resides. Obviously Proton obeys the law and gives up data when it has to. Where are the services that don't do that? Somalia?
I think the key difference is the amount of data the service can offer when it is asked to do so by some legal entity. Signal famously claims to barely have any useful data to turn over when ordered to do so [1]. If some provider states they are pricacy-focused and protect your data from governments, but can still offer loads of your private data when ordered to, that damages their privacy claim.
EDIT: "some provider like Proton" -> "some provider", never wanted to imply Proton specifically did or does this.
> If some provider like Proton states they are pricacy-focused and protect your data from governments, but can still offer loads of your private data when ordered to, that damages their privacy claim.
"Loads" of private data? When has this allegedly happened or how would it technically even be possible?
Well, Proton themselves say they will provide information about who has contacted a randsomware attacker to law enforcement. https://proton.me/legal/law-enforcement
So that probably has happened. Whether they've even provided other private data I don't know, but
> how would it technically even be possible
Well, it's not possible if you trust their claims about E2EE, but that is just a claim. How's that any different from a non-encrypted email provider saying they won't provide your emails to others? It all comes down to trust in the end.
They don't claim email is E2EE. Of course they need to know email metadata to route messages. That's unavoidable if you are using email. It's not encapsulated like that.
Edit: A reply to your misunderstanding and accusation below:
What do you mean? By "provide your emails to others" I obviously mean the email *contents*, not the email *address*. (Which I also clarified with "the storage of your emails on their servers"). You know, the very thing that is almost the whole selling point of Proton: that they keep the contents of your emails encrypted so "only you" can access them.
> Proton Mail protects the contents of all your messages with zero-access encryption, meaning no one can read them except you and your recipients. Messages you send to other Proton Mail accounts are always end-to-end encrypted, as are emails sent to non-Proton Mail accounts when you use Password-protected Emails.
Also, what in the SMTP protocol requires Proton to *store* that metadata? Could they not simply delete it after using it (or, crazy idea, encrypt it in the same way the message contents are encrypted in storage), so they would be unable to respond to law enforcement requests the next week, say? They did also previously claim that they didn't log user's IP addresses. Why would they claim something like that, if it's "obvious to anyone who knows" that it's a false claim? Marketing aimed towards their not so technically savvy userbase?
Let me also remind you that I was replying to a question about "how would it technically even be possible" to "offer loads of your private data when ordered". My reply was, it's easily possible for them to offer your metadata, and you still need to trust their claims about heir implementation of E2EE to believe they won't offer your message contents.
You're very quick to accuse people of spreading misinformation. Let me hit back with an accusation of my own, which is that Proton's PR team have a habit of regularly trying to discredit any critique as "misinformation". Perhaps you've just read too many of their rebuttals?
> Account Activity: Due to limitations of the SMTP protocol, we have access to the following email metadata: sender and recipient email addresses, the IP address incoming messages originated from, attachment name, message subject, and message sent and received times.
This would be obvious to anyone knows how email works. It would be very silly for them to claim otherwise.
Keyword is "like": a service like Proton. No idea if and what data they have offered to their government. I was merely trying to offer an explanation to the parent commenter, who was wondering how people can critique pricacy-focused services offering data when required by law.
You seem to be hiding behind this "like" while writing into comments about Proton - making accusations and theories that imply it's Proton that actually does that.
Fair enough, I agree. In Proton case, I'm biased because I used to work there ~2019-2022 and the company was basically printing money from subscriptions alone (covid likely helped with that), while fighting (pretty successfully) every request to avoid providing even that limited metadata, because alternative of ruining your core strength - privacy - meant the death of the business. I don't know if anything changed, but I'd bet the goals remain largely the same - providing good-enough privacy any commercial company can realistically give you. Unencrypted user data in this business is poison, and they're well aware fwiw.
But don't they have both the encrypted data and the decryption keys? I don't remember giving them my keys to use, and I can look at my stuff from multiple devices so the keys aren't stored on my device.
So they must have the ability to look at all that encrypted data anyway?
I mean, is it really a conspiracy theory to want or believe that there are services (based in Europe) that don't hand over any and all user data to the USA government when asked? It's probably wrong to believe it to be the case, but just because it's wrong doesn't make it "conspiratorial".
It's quite hypocritical of Proton to claim that they protect against government surveillance when they do things like this though [0]. Their legal team has probably ensured they don't claim anything strictly false, but the implication and the reality are wildly different.
Proton's marketing definitely makes it sound like they are fully anonymous and wouldn't even have anything to hand over to law enforcement. Look at the wording they use to describe the product.
Proton has always-on end-to-end encryption and zero‑access encryption, meaning even we do not have access to your data.
[...]
Based in Europe, Proton ensures your data is protected by some of the world’s strongest privacy laws. Because Proton isn’t a US‑based company, we can’t be compelled by laws such as the US CLOUD Act to hand over your data to the US government or terminate your services. [1]
Obviously as we have seen, they 100% can and will hand over your data to the US government. Yes, it's in the privacy policy/ToS & they're compiling with local laws. But that's clearly not how that reads.
[In 2021, the Switzerland-based vendor provided local police with the IP address and device details of a netizen the cops were trying to identify. That individual – a French climate activist who was already known to police – was later arrested.
Shortly after that kerfuffle, Proton removed the claim that it didn't track user IP addresses from its website. Proton has also previously been accused of offering real-time surveillance of users to authorities.] [2]
What a truly unreadable website. As another commenter said I see a few of these get churned out with the same annoying dark patterns.
Hmm, I am not completely sure what the website is trying to say (there is soooo much text and it's quite unreadable). But it feels like it says "it is hosted on US servers, so it's baaaaad".
The thing is, it seems to be end-to-end encrypted with MLS, which means that the servers cannot decrypt the conversations. Probably some metadata are leaking (which IP is in a call with which other IP), but that's a different threat model. Metadata is always a harder problem.
Now I don't know if Proton knows which users are together in a call, or if it's just leaking IPs. Maybe the article says it, but I didn't have time to decrypt it :-).
Most of the privacy claims (of all type of apps) are essentially garbage anyway because realistically, if a website or an app can be compelled to push an update to a specific user, then they can intercept anything they want.
It doesn't even have to be a specific binary, it can be "just turn on this A/B testing / debug flag for that user" or a piece of javascript
Privacy and security are not binary. Statements like “because it isn’t 100% secure or private, then it is not worth it” means one has essentially no clue. There is not such thing as 100% privacy or security, for starters.
It’s all layers of protection and/or trust and compromises.
>Most of the privacy claims (of all type of apps) are essentially garbage...
True. Everything has backdoored CPUs as its foundation. Consider, for starters: (Intel's 'Management' Engine); AMD's (PSP); Apple/Arm (black-box hardware).
You can layer as much theater as you like on top of the hardware-surveillance-layer in modern computers; it still won't grant you privacy.
Counter-surveillance is not a binary switch. We can win by forcing the government to use increasingly expensive backdoors and exploits (>$10k per capita per year, beyond which mass surveillance is impractical even with a $1T budget). Hardware backdoor capabilities are costlier to maintain and use than something at the app level. Encrypting content and leaving metadata exposed is still better than encrypting nothing because they'll have less info to work with which means more effort. The point of all this is not to make it impossible for the gov and corps to surveil a targeted individual (of course they'd be able to if they expend enough resources). The point is to ensure that they only have enough resources to do targeted operations rather than blanket mass surveillance. The former is fine for a democracy, but the latter destroys it.
Power is open. But nobody wants to build power devices for some reason.
They are very expensive. Cheapest Power9 system Raptor Systems has is $6,794.99 and it has only 4 cores and 8GB DDR4 RAM and 128GB SSD. Reminds me of Sun Sparc pricing.
https://www.raptorcs.com/content/BK1SD1/intro.html
Yeah, that’s because nobody is building them so they have to use IBM server chips.
Why is the motherboard so expensive?
Same problem, low volume
Power?
https://en.wikipedia.org/wiki/Power_ISA
RISC-V is also open. That “some reason” is likely to be power/performance levels being quite far from ARM & Intel for consumer devices.
China is building out RISC-V, just like they are leading actually-open AI.
https://www.scmp.com/tech/big-tech/article/3347684/alibaba-d...
Weirdly, the authoritarian state is the one saving us from our own digital authoritarians.
> they are leading actually-open AI.
How are they leading? If I parse this correctly, "actually" open would mean fully open data training and weights? Then, by this definition, I'm only aware of Olmo (AllenAI - Seattle), Apertus (Swiss) and to some degree (unclear what data was actually published) Nemotron (Nvda, US). What are some examples of chinese similar models? (I'm not aware of any).
RISC-V is slow though
RISC-V is an ISA.
There's nothing inherently slow about it, anymore than there is anything inherently slow about x86 or ARM.
High performance microarchitecture implementations are definitely possible. Some of them are available for licensing.
At least one of them (Tenstorrent Ascalon) has been tapped out into a chip and will show up in development boards later this year.
If you can’t buy a fast one, then it’s slow.
It might not be slow forever, but it’s slow now. I’d love to see an open ISA that is fast. But I don’t understand why the industry decided to start over with RISC-V when the compilers and toolchains and chips already existed in power land.
>If you can’t buy a fast one, then it’s slow.
Shrug. The first RVA23-compliant chips are coming soon.
spacemiT K3 imminent (likely shipping boards this month) and Tenstorrent Ascalon (via Atlantis SoC devboard) this summer. These won't be the fastest CPUs available, but they'll meet the "fast enough" criteria for many uses and users.
Multiple parties including Tenstorrent expect performance parity with the ARM and x86 offerings available at the same time by 2028. Note performance is mainly gated by access to latest fab nodes, which comes with costs that necessitate serious volume. They expect to be there by then.
>But I don’t understand why the industry decided to start over with RISC-V when the compilers and toolchains and chips already existed in power land.
The rationale was documented in the "Instruction Sets Should Be Free: The Case For RISC-V" paper[0].
Note OpenPOWER is mentioned but is not in the comparison. The reason for that is simple: RISC-V predates OpenPOWER. It was an obvious reaction to RISC-V, and they were too late, as RISC-V already had the industry's attention. Furthermore, Open is a lie; payment to IBM is required in practice.
0. https://www2.eecs.berkeley.edu/Pubs/TechRpts/2014/EECS-2014-...
That’s no guarantee that a Power implementation isn’t compromised.
This is security nihilism, https://news.ycombinator.com/item?id=27897975
> Most of the privacy claims (of all type of apps) are essentially garbage anyway
I think that’s a sweeping generalisation.
And sweepingly true.
How so? Reproducible builds are a thing.
So are networks
So? If the app is using reproducible builds and is also audited not to contain any backdoors, what do networks have to do with it?
>if a website or an app can be compelled to push an update to a specific user, then they can intercept anything they want
yes which is why i hoped they would implement a verification system like with a browser addon that compares the website client code used for encryption and alerts the user if it does not match the one served everyone else.
ctemplar mail used to have this many years ago
https://web.archive.org/web/20200201012958/https://ctemplar....
I don’t think that is a useful definition even if technically true. With that logic even Linux isn’t privacy because in theory they can push code that will only run for you.
I think the argument is that when you load a webpage, you download the code everytime you want to run it, from servers owned by the company building the service. So they can choose to serve you different software (e.g. with a backdoor), just this one time and just for you, and you won't know (not that it would be impossible, but it is generally impossible in practice).
When you download a program on Linux through the distro package manager, you download it once and run this, every time. You know very well when it gets updated. You can compare the hash of your program/package with the one distributed by the distro, and the distro is not the developer of the program (so there is another layer there). You can audit that code (if open source), and at the very least you can compare with others to see if they receive the same code. And again, the program is served by the distro, not by the developer. The backdoor situation would require asking the developer to implement a backdoor, and then asking the distro to server you a different executable, and then hoping that you never, ever check the hash of that program that you own offline. It's a lot harder.
In a way, for ProtonMail (in your browser) to be "end-to-end encrypted", you have to trust Proton. But that kind of defeats the purpose of end-to-end encryption.
Same applies to e.g. WhatsApp Web, which is an interesting example because there exists a browser extension allowing you to "validate" that you run the code Meta expects you to run. Though you still have to trust Meta: the extension only helps making sure that nobody other than Meta is abusing you. The WhatsApp mobile app doesn't have that problem, as it is distributed as an archive by a third party (Play Store).
> In a way, for ProtonMail (in your browser) to be "end-to-end encrypted", you have to trust Proton. But that kind of defeats the purpose of end-to-end encryption.
Yes, and every VPN in the world (that isn't self-hosted) relies on trust that they won't share your info, not even your fingerprint - which defeats the purpose of VPNs. It's very hard to have perfect security. OK, impossible.
Sure, it's always a tradeoff. There is no "perfect" security, but there is "better" and "worse" for the threat model.
My point here is that when you run a webapp from a browser, you have to trust the server. When you run a program that you download on your system, it's easier to check that it doesn't change and to make sure that others get the same one.
Exactly, as with all security you have to ask what the threat model you're defending against is and what you're willing to pay.
If it's "Google knows too much and I want an alternative" Proton is great, cheap, and convienent. If it' "my own government might kill me" then it might be time to think about self hosting.
> "Google knows too much and I want an alternative" Proton is great, cheap, and convienent.
I think that Proton does a good job with the suite (docs, sheets, calendar, password manager), and I believe they have a good VPN (for what we may expect from a VPN).
Interestingly, Proton started with ProtonMail, and I find it's the least convincing of their products:
1. As an individual, writing from your ProtonMail account to (probably) someone on GMail doesn't change anything.
2. As a company, writing from Proton to Proton is a good idea, but there is no need for end-to-end encryption: just choose a mail provider you trust, I guess?
3. The ProtonMail end-to-end encryption in the web browser defeats the purpose of E2EE: you have to trust Proton anyway, because they serve the code every time your employees load the page.
Using what mechanism? Most Linux updates are not pushed but rather pulled at the user request. You can use Linux totally offline. This is fundamentally different than a webapp, where code is sent with every visit
The automatic updates most distros have enabled by default. Signal desktop outright stops working if you don't constantly pull updates from them.
Debian requires unattended-upgrades to be installed (it's not installed by default), Mint and Fedora has the option of enabling automatic updates (disabled by default), Arch has no mechanism for automatic updates.
Which ones are these "most distros"?
Distros have mirrors and they don't know which one you use. The updaters don't send user IDs and downloading the package lists is separate from downloading the packages. So targeted backdoor distrubution is much harder than a company's web UI with user logins targeting a specific user.
Signal pushing updates every other day is pretty much a security anti-pattern though. It makes it almost as vulnerable as a web app to this kind of thing, but this isn't the typical Linux software experience by any stretch.
A typical user experience is Ubuntu/Fedora with Auto Updates from repos enabled.
Can you honestly say that you never ever updated anything in a Linux distro without first reading all the code, comparing all the checksums etc?
The checksums are verified automatically, based on a key bootstrapped by the original install (which could, though likely not done, be verified by other means). As happened with xz, you either get everyone or no-one.
How will they push it?
Push or pull is just semantics. Can you honestly say that you never ever updated anything in a Linux distro without first reading the source code, checking all the checksums etc? Be honest.
Linux as in the kernel? Who is "they"? Torvalds?
Choose if you think Windows is just the kernel or the operating system.
The ones that control whatever source you are pulling the updates from. Very very few people are building everything from source and reading the source in full everytime.
Notice I am not saying this is likely. I am saying that it is theoretically possible anytime you accept code from the outside (doesn’t matter if it is pull or push)
You'll have to be more specific what kind of "privacy claims" you're talking about. Proton is definitely a lot more private than, say, Google. But, as always, you'll have to trust the party delivering the binaries you run. Also, any company operating legally, have to co-operate with court orders etc., but afaik they try to push back
Is there any evidence that the mechanism to do that is in place?
I think that would be widely decried especially on HN if that is one day implemented.
You need mechanisms to avoid the possibility. The mechanisms to do such things exist by default, by both the software provider (e.g. Proton) and the software distributor (e.g. Apple for App Store, Google for Play Store, Cloudflare or AWS for web stuff), and various countries have laws that allow them to secretly compel implementing specific backdoors.
In order to block the distributor from going rogue, you need to be able to guarantee that the user device can only install/run code signed by the provider, who must never give those keys to the distributor. My impression is that Android is the only major platform that ever had this, but that Google ruined it a few years ago in the name of lighter bundles by insisting that they hold the keys. (I once had VLC from Google Play Store, but replaced it with a build from F-Droid under the same app ID; Google Play Store shows it has an update for it, but that it can’t install it.)
In order to block the provider or distributor sending specific users a different build, you need something more like Certificate Transparency logs: make it so that devices will only run packages that contains proof that they have been publicly shared. (This is necessary, but not sufficient.)
And if you’re using web tech, the mechanisms required to preclude such abuse do not at this time exist. If you’re shipping an app by some other channel, it can do a resource integrity check and mandate subresource integrity. But no one does things that way—half the reason for using web tech is specifically to bypass slow update channels and distribute new stuff immediately!
Yes? A/B testing flags, auto-updates, server-side re-routing, etc are just some mechanisms from the top of my head that can do that.
The ways to avoid it is by having locked and cryptographically verified software and connections.
One by one:
- A/B testing is agnostic of who the user is, it is randomized. If it was not, that would be a bad practice and would legitimately ruin the reputation of the company doing that,
- auto-updates is just the setting allowing the most recently published update to be installed. "Published" means it is for everyone. If that is to be understood in any other meaning, that would also be bad practice,
- and I don't see what you mean by server-side re-routing.
To be honest, maybe I just live with different platforms and apps than you I don't know. I use Android, and Linux on my Laptop, but I would also expect Windows to not discriminate by user when pushing updates.
That's not evidence, that's conjecture again. Is there evidence that this kind of client push is actually used to extract data in these projects?
That's evidence for the mechanism, as asked
The evidence that it's being actively used in the US is in the secret proceedings of a secret court. I kid you not, look up FISA warrant
There is NO such mechanism (discriminated updates by user), of my knowledge, in:
- Linux (apt, pacman, rpm...),
- Android
And I would add Windows and iOS/MacOS but I'm not at all an expert so I leave others to confirm that their "app stores" don't do such exotic prowesses.
You can artificially insert a malicious script in a package that would scan your system, deduce your identity, and install something based on that, but in this case that means that it is just a malware in the first place. And that would mean that the app to be installed contains a "mutable" component of data that is not defined by the contents of the package but rather written upon post-install actions, so that is also dubious to include that for formally in the "app from that package" definition. In any case, such behavior would get your package banned from any app store or Linux distribution.
Yes, the US government and US courts (including the secret court FISC) have tools to compel Google, Apple and other vendors to install malware on users devices. This is exactly the point.
The US government routinely deploys malware to users devices, for multiple reasons. Here is a 2017 link about this: https://www.aclu.org/news/privacy-technology/challenging-gov...
Would you mind showing me some evidence that software update systems are able to push to you e.g. a different Android update based on your device ID or specific IP? (not just country geolocation) (PS: your link is about deploying malware through other routes, not by normal software updates)
Because all the other means I can think of are just basic malwarfare.
As you need to rely on a vendor/distributor to get updates, then of course they are able to push you malware, there is absolutely no going around this first ring of trust.
Conclusion : there is no point in accusing Proton of anything... there are just being software providers (FOSS by the way!!!).
Not sure if that counts as proper evidence, but I have seen some logs[0] albeit with encryption but from my understanding, they control the encryption keys or atleast certainly have the ability to change (if they get hacked themselves for example)
Would you like to see a proper evidence of the logging policy? I feel like I can try finding that again if you/HN community would be interested to see that.
Edit: also worth pointing out that keeping logs with time might be a form of meta-data, which depending on your threat-vector (journalism etc.) can be very sensitive info.
[0]: my another comment here: https://news.ycombinator.com/item?id=47624960
I'd like to see any kind of evidence that there's any substance of in these accusations of services not actually being private - not just theoretical theorycrafting about mechanisms.
And how does that compare to other services we have available and people actually use.
At some point, essentially everyone has to trust the product and more importantly, the company/the people in the company. Firstly its worth clarifying that there isn't really something akin to zero-trust in such cases. Thus the theoretical theorycrafting about mechanisms. Those show that you have to trust proton
Now, My issue with proton is that, they try to appear transparent but a lot of what they've done especially with proton meet seems to sometimes even be misleading. If they couldn't create EU/Swiss sovereign infrastructure for meet, then why are they using Cloud-act providers while within the same post talking about the implications of Cloud Act. There is some great irony in all of this and this is what is making me suspicious and how Proton seems to be misleading people rather than leading them towards more privacy.
At some point, it raises atleast some questions about trusting proton.
> And how does that compare to other services we have available and people actually use.
That depends on what service are you talking about from, Do you want a whole eco-system or are you happy with individual apps/companies focusing on one thing in a more unix-fashion of things.
Do you prefer non-profits or for-profit companies to handle such infrastructure?
How familiar you are with self-hosting and what is your threat vector?
Are you a corporate or a person yourself and what are your budget of things?
but just to give a pointer without asking these questions, Some good pointers are posteo.de, tutanota, infomaniak (has whole ecosystem) Within the calling system, I personally used to use fairmeeting.net, it used to have screen sharing option for free as well but looks like they might have paywalled it recently. You can find multiple jitsi community instances.
I feel like the only way to answer this question is if people ask with more depth. The threat model differs for everybody, for some people (like journalists), even just this proton meet fiasco is enough for them to reconsider proton ecosystem as a whole and consider it too threatening, especially with recent incidents and their lives being on the line. You might say, well where might they go and I feel like they might go to disroot (non-profit activism oriented) or tutanota or even posteo.de depending on what they might prefer.
I once did some tinkering with Proton Docs and I was able to find that the comments within Proton Docs when I used it via curl definitely felt like it had something like logs (I feel like I should try doing this again to have more definitive answer)
Either way, the response was encrypted but they hold the encryption key atleast within proton-docs.
I also want to say that Proton allows the ability to change password through OTP, (Something which I sorta appreciate[0]) but that means that their infrastructure can then have the ability to change password and you can toggle that functionality by sending a request to proton to allow OTP and on which number, so proton themselves can do that too. Unless, I am getting it wrong, by default, Proton still has your encryption keys and even if you change them (which 99% including me might not do), even then I definitely feel like there can be some concern.
To be honest, There is nothing like zero trust, that's what I learnt, You are still trusting Proton Aka The swiss laws behind it so that you know that they won't get legally forced to give more data than usual (like US companies for example) but they will still comply with the swiss laws (recent proton incident)
Then, secondly, you have to trust Proton themselves, but with something like this incident where Proton Meet might be omitting somethings, it doesn't paste a clear picture of transparency or trust.
I don't really know why Proton might create something like Meet especially with its infrastructure relying on the CLOUD Act, and then, try to sell it within the idea of privacy. They both are contradictory.
Proton is, creating lots of products, On one hand I can appreciate that, but on the other, as part of community, I feel frustrated/sad because they don't have some core features like proper proton drive rsync support or even some API[1]'s surrounding it. I tried to do the experiment in first place because I wanted to create a commenting engine for static websites which could use proton-drive as its backend. They really could gain a lot from transparency with proper API support and letting the community do things with it, but that's not really the case :/
I am still using Proton but they definitely aren't a bastion recently. I might still recommend Proton, but I sort of hope that companies self host some open source applications themselves, whether self-hosting with hardware or in a proper EU cloud like Hetzner/OVH.
But Incidents like these are making me a little more hesitant to recommend Proton nowadays.
[0]: as someone who had lost one of my previous accounts after my Keepassxc database got deleted because of me accidentally wiping my archlinux with tinkering with it, Now I use Bitwarden with OTP on proton.
[1]: I was able to make something like an API myself by relying on something like puppeteer, even with puppeteer though, it was really hard to make something like that. I couldn't create a public endpoint of it because having puppeteer instances for a commenting engine would be very resource intensive.
The articles format is awful and designed to wast your time.
This article also just points out the use of Livekit but doesn't deliver what that means for your security. Maybe instead of writing a hit piece you could have dug deeper, talked to Proton?
I've seen alot of articles and posters here being negative on Proton, calling it "shady", regurgitating facts that are supposed to be gotchas but have tons of nuance if you dig and am beginning to think there is some coordinated effort to get people not to use it.
I recall hearing some controversy around Australian legislation and Proton cooperation with authorities. Though haven't dug into court records or anything yet.
Is there a balanced view someone has summarized somewhere?
Are there some references you'd recommend where I can begin to read up?
From every instance I've seen, Proton has only ever done what is legally required of them by a warrant. They do not get to say no when asked to turn over what they do have; which is going to be things they can't avoid storing - like email addresses or recurring payment information an account has.
But they don't store logs and all actual data is E2E / at-rest encrypted, so that data does not exist for them to give away. There's no master key or back doors.
The problem is the gap between marketing promises and realities. Proton markets itself as a safe Swiss product[0] for activists[1], but the reality is their accounts often expose more than a casual user may expect, like a secondary email address[2] (often required to sign up) or payment info[3]. The Swissness is even more suspect according to this article, if it's true that they rely so heavily on American infrastructure and don't responsibly disclose this even in their privacy policy.
[0]: https://proton.me/blog/switzerland
[1]: https://proton.me/blog/protesters-free-speech
[2]: https://www.theregister.com/2024/05/13/infosec_in_brief/
[3]: https://slashdot.org/story/453084
This seems unreasonable. The entire point of Proton is that they themselves cannot access your data, that's how I've seen it advertised. The Swiss thing is more just that they can't be compelled to enable logging. (To be fair, though, maybe that's changed. it's been a while since I saw their home page and I don't exactly make a habit of disabling my adblock).
But I don't see how any reasonable person would not know that the email addresses and payment information that Proton must have access to would therefore be subject to disclosure to law enforcement. And for the vast majority of people, they aren't exactly on a tight watchlist where intelligence agencies are making thread boards to catch them committing for international crimes to make this matter.
Anyway, I especially don't understand the flack they get on this forum with people who do understand and should understand how hard it is to advertise technical features to normies.
Normal people aren't cyber criminals who needs to hide every spec of their trail from all governments. They just want to feel like no one is reading their messages or Internet history or passwords. Proton offers that, full stop.
A recovery email address is your data, and a company that prides itself on encryption could figure out a way to hash it too. Maybe I'm just below average here, but I expected that from them at a minimum. I was shocked to discover they didn't bother.
It's not unreasonable to think Proton should significantly tone down promises like "We support peaceful protest" while seriously downplaying what they will turn over[0], or promising "We are... committed to defending your freedom" on their homepage[1]. It's certainly reasonable to have a complete list of data processors in their own privacy policy.
[0]: https://proton.me/blog/protesters-free-speech
[1]: https://proton.me/
If proton hashed your email how the fuck would they send you an email? Did you even think this through?
They're doing the best they can, but at the end of the day it's literally impossible for them to have absolutely zero data.
They need your credit card number stored somewhere so they can repeatedly bill you. That's just how billing works. They need a recovery email on file so they can email that address.
That doesn't mean that they're not committed to defending freedom.
I'll echo what other people have said: this feels like a psyop. If I were the CIA, I would be doing exactly what you're doing here: spewing unreasonable nonsense about proton in an effort to discredit it so that I can push people towards insecure services.
Nothing even comes close to proton when it comes to email security and privacy. That doesn't mean that we cant criticize proton - we can, and we should. But it has to be legitimate critique.
> If proton hashed your email how the fuck would they send you an email?
By asking you to provide it again if you click the "recover account" button, comparing what you enter against the hash, and then sending recovery into to the valid email you provided
Proton cannot destructively hash the email address for recovery because they need to use it. And if they can use it, they are legally mandated to give it to LEO in warrants that include that data as scope.
You can argue they should have a password the user holds to encrypt the recovery address, but that's going into the territory of hurting normal users. You use a recovery address when you don't have your password or recovery phrase. Requiring a password for the recovery email would just mean more customers locked out requiring human intervention (if it's even possible for that account) to get access back for the customer. And remember, many users also use the same account for their password manager.
And no, Proton is 100% welcome to publicly support free speech and protest while not destroying their company and going out of business with all their executives jailed for not complying with non-optional, legally required, minimally exposing warrants from law enforcement.
Proton can claim what they want, but when they promote themselves as supporters of peaceful protests while quietly handing over account details for people engaging in them, that is false advertising.
This isn't much comfort when the swiss government bends over and takes other states up the ass at the slightest issue, eg https://www.404media.co/proton-mail-helped-fbi-unmask-anonym.... Why on earth is the swiss state acting like stooge for the fbi? Tell them to go fuck themselves like a normal person.
PGP/GPG (can never remember the difference) is the only privacy solution worth a damn and proton is just a gmail alternative with a nice interface.
If they advertise that they will protect their users privacy, then I don't see how complying with government snooping is an excuse. Either provide what you say you will or don't say that you will provide it.
Proton has never said they will refuse a warrant for what your email address or recovery account are. They say that the contents of your emails, calendars, notes, passwords, etc are not accessible to them and therefore cannot be spied on even if a warrant is fulfilled.
Proton's homepage says:
We are a neutral and safe haven for your personal data, committed to defending your freedom.
If you read that as "we'll break the law for you", it's a you problem.
The balanced view is Proton is a service that does not treat you as the product and does what I would describe as, the best it can, to provide privacy. They seem to avoid keeping data where they can but do cooperate with government when legally required to. The location they are in has more legal protections for privacy than most places.
If you are a normie wanting to not have your data sold and not have a company violating your privacy for non-legal reasons, they seem like a solid choice.
If you are worried about government level actors working against you or are the sort that gets put off at the idea of a service marketed as "privacy respecting" using any US based sub services, look elsewhere.
If you want references just start reading through comments on any topic here pertaining to proton.
I'm sorry I had to use a feature on my browser I rarely use which is summarize. I'm pretty sure your point is valid and concerning but the way that page was designed is just too painful to read.
I'm so tired of this particular kind of LLM (-assisted) slop. The engagement bait, the stupid little hacker-style animations, the drawn out text...
Please, people, use your own words, and don't overdo every little thing. It's tiring. When everybody does this, nobody stands out.
Yeah this same site did an article on some minor ubuntu bootloader drama some weeks ago and when I recognized the design I just stopped reading. If you have something to say don’t go out of your way to make it hard to parse.
Especially questionable choice by Proton not to opt for the self-hosted option. LiveKit offers an enterprise tier that even lets you set up your own mesh, so you are not dependent on their hosted infra.
To be fair, I'm running a selfhosted livekit deployment at work and it's a major pain in the ass.
Obviously proton should selfhost everything but I can understand why they didn't want to.
What’s painful about running LiveKit? What would make running WebRTC server easier?
Interesting how so much negative sentiment creeps out when there's a true European competitor to the big US tech companies.
They're Swiss, so while technically in Europe, they are not in the EU. Maybe they're closer than the US, but they're still a foreign tech company in the EU.
Switzerland has a unique deep integration with the EU even though it is not a member. It is not like the UK.
Yeah, there's another thread showing a similar trend. In a strange way it's making Trump's incessant nonsensical big-upping of himself and the US as-a-whole make sense in a cultural context that I hadn't thought was as pervasive as maybe it is. It explains that polls still show 30% support.
I don't think I'll ever be not surprised by this.
Due to some comments the CEO made regarding a few Trump decisions there are a number of people that believe that the company supports the current US government and are looking for any link they can to prove it.
[dead]
This is the worst form of Article I've ever seen. Did the author read this? Is there even really an author or did Chatgpt just write all of it and generate the page?
<aspiration-rant>
It may or may not be Proton Meet or Mail, but all I want is ZK E2EE (email at rest, text always similar to Signal) "Lavabit" with better tech architecture, without mandatory KYC de-anonymization, hosted in some US non-compliant location on real hardware they physically control, by a small, worker-owned co-op cadre of talented technical people who run a tight ship. Bonus points if they offer VPS and OpenVPN/wireguard exit nodes too.
</aspiration-rant>
easiest way to private video calls is just to self-host Jitsi Meet anyway
I just love people who go on their soapbox to complain about a newer alternative when the status quo is worse
"nooo but proton mail complies to court orders!!111" wow shocking I know right? Do you think the other providers don't?
These are usually the same people who forget rubber-hose decrypting works
"But they use LiveKitCloud" yes - however we don't know half the story
Can Proton BYOK over their infra?
LiveKit's website TOS with a generic user - not ProtonMail. We don't know if there are any agreements there
> "all disputes are governed by the laws of the State of California"
Yes this is common with TOS.
> Their privacy policy explicitly acknowledges FTC jurisdiction and states the company will "access, preserve, and disclose your information"
This is the important part, not the other one above it
> showed active connections to 161.115.177.32 on port 443, a LiveKit-owned IP block (ARIN OrgId LIVEK) hosted on Oracle Cloud Infrastructure
Good test, but what/where was the originating IP? Was it using Brave's VPN (to the US) by any chance?
TBH I'm still more annoyed about the 90 day cookie - that was just rude
So again "why don't we have better privacy respecting options?" Maybe because if we try to do it some "privacy advicates" will throw a massive fit complaining about all its shorcomings (and still not pay for the service)
People complain because Proton specifically advertises privacy, mainstream providers don't. Which is pretty reasonable as far as complaining goes.
Good job on mocking others though :*
Proton does offer more privacy than mainstream providers, because they have less information to hand over when courts compel them.
Proton isn't perfect by any means, but the idea that there is no meaningful privacy difference between Proton and (for example) Gmail because both respond to court orders is flat-out false.
Your complaint is not at all what the article is about.
The article is showing that the proton claim that their new service is private from the US government data acquisition, including inability to access call metadata, is a lie (an intentional misrepresentation of the known truth by Proton).
https://en.wikipedia.org/wiki/Deniable_encryption
You’ve missed the point: being deceptive is not ok, regardless of whether “the status quo is worse”.
This is actually kind of hilarious. “We don’t store your data when you use our service. You hand it over in real time when you use it.”
Please remind me: Is there any legitimate business venture that can operate outside the laws of the country they are registered?
If there is, why don’t these people who write blog posts and comments about how “this is all a scam!!” “It’s a psyop! “They” control it all!” If it’s all black and white, if there no real difference between a company like Proton and Google or Microsoft, then why don’t they create a business that provides a service where there’s no way to any government know anything at all, ever? They’ll be printing money..
But perhaps the conspiracy realm and public broadcast of ideals is more attractive than a real business.
Yes, you shouldn’t trust 100% in a person let alone a group of people that form a company. Grow up.
What a shitty website. I got to about the third slowly-fading-in-picture-of-text block and realised that whether or not I wanted to read it, it's more effort than it's worth.
May I suggest reader view in FF? It's the first thing I do when I open an article (Ctrl+Alt+R)
Some text (e.g. what metadata is included) are only in the animation -- not in the reader view.
The animation is just some text fading in. If you want to read those text, the only way is disable reader mode and wait..
No, if a website is that obnoxious I just close the tab. It is not worth yet another mental drain on my limited attention span to read slop.
Just give me the boring single .htm page with your thoughts or a Wordpress site with minimal plugins. I'd hate to think the strain the author puts on people with accessible needs making this.
I mean I agree, but this kind of mindset is stupid. Blaming everyone for your inconvenience gets you nowhere. I can complain, or I can fix
Many posts on this thread complain about how hard and unpleasant to read the article is. How is that not a valid complaint? And calling their "mindset" stupid... wow.
Question is will the government learn anything meaningful if they subpoena the LiveKit providers? (Including and excluding HNDL)
After reading the whole article I was left with the same question.
I think they can know the IP from every participant in the call and some other metadata?
> some other metadata
"We kill people based on metadata."
- Michael Hayden (former NSA and CIA director)
For small groups SFU like Livekit is not needed at all. Still E2E and realtime collab. I wrote such a thing: https://brie.fi/ng
SFU is nice because it gives everyone privacy. Neither you or ISP know who you are communicating with.
Otherwise if everything is trusted I love that we can have conversations without depending on others over the internet :)
There's nothing bad about SFU, particularly the version you wrote, which forms the basis of Livekit. It would be my first choice for supporting larger groups in Briefing anyway. If the traffic is E2EE, it doesn't matter if an SFU is involved. The critical part is the signalling, in my opinion. This is where the initial communication is established. In the current version of my app, whose source code is yet to be published, this can happen via an untrusted server.
Proton is the most shady company out there, especially with the fact that they try to make you put all your eggs into their basket. I stopped using their email (when they used to be an only email company) when they dropped the .ch domain. Same goes with botched security products like grapheneOS and the likes, when the hardware is backdoored, the modem is tracking you more than your psycho ex, yet you are given these illusion of security to buy.. you are not, in fact, you are gonna get more obvious for fingerprinting than using an average iPhone like most people and blend in. Honeypot, hornets nest, whatever the terminology but the concept being used and is still used to lure people in and make the job easier to ID them than going after them in the wild.
What do you use/recommend that are better alternatives?
They definitely still have the .ch domain
Only on old emails, my old one still has that double password access.
nope, you can make new emails with .ch as well, just not on the free tier. I am looking at my settings now. .ch is definitely an option when creating new emails. I believe pm.me is also only for paid plans.
Interesting, thanks. They must’ve changed it then since last time i logged in.
Is this the web version design of the "moon landings were a hoax" conspiracy poster?
[dead]
yo, livekit acts as independent controller for call detail records under their own dpa. that means proton's privacy constraints don't even apply to that data. livekit can hand call records to us law enforcement without notifying proton
> Proton’s launch blog post for their new video conferencing product contains this paragraph: “laws like the US CLOUD Act can compel US-owned video conferencing platforms to hand over any data they store, even if the servers reside outside of the United States. This creates serious compliance challenges for organizations bound by GDPR, CCPA, or similar data protection laws. That’s why we’ve created Proton Meet.”
Actually, it creates an incompatibility, period.
How much I dislike all this weasling around, trying to find a gap, where none exists, hoping, that the law won't be followed to the letter, lack of interest in following the law to its logical conclusion, all in the name of wanting to conduct business in an easier way, even if not adhering to the law. I wish all those companies trying that would be gone. Let us have solutions that are inside the EU, many of us don't want the US big tech crap any longer. I wish that governments and people in charge of public institutions and their tech decisions realized this. Instead they weasle around and try the "But we are using Microsoft in the EU!" as if that is worth a dime.
Try convincing me, that a company like MS in EU won't oblige, when the command from MS in the US comes to send over some data. Good luck!
Proton has too many services. I wonder how many more they will introduce until Proton Drive will finally receive a Linux Desktop client? The worst thing about "we have everything" services, that they will actively try to shove you each and every service repeatedly on each occasion. As "do not put all your eggs in single basket" type of user I absolutely have this marketing nonsense.
The quiz at the end of the article is wild honestly.
What the hell kind of horrible website did I just click on. That may perhaps be the single worst format of any web page I have EVER visited in my entire life. Wow.
A lot of AI generated horseshit.
[dead]
Pretty funny because a few weeks ago some dude felt compelled to virtue signal about how he was moving off American-controlled services like Gmail, as some ostensible protest against Trump and the Iran War. I pointed out that Proton Mail, one of the services he moved to, is ultimately controlled by the US Gov, and my comment got flagged lol.
Proton being at the behest of Uncle Sam has been old news for a while.
"Proton Mail, one of the services he moved to, is ultimately controlled by the US Gov,"
Would you mind elaborating, pretty please?
"Controlled" is a bit hyperbolic, but there's a collaboration agreement between the USA government and the Swiss government, so Proton has to comply with requests from for example the FBI. Quoting a comment by Proton staff on Reddit
> First, let's correct the headline: Proton did not provide information to the FBI. What happened is that the FBI submitted a Mutual Legal Assistance Treaty (MLAT) request, which was processed by the Swiss Federal Department of Justice and Police. Proton operates exclusively under Swiss law, and we only respond to legally binding orders from Swiss authorities, after all Swiss legal checks have been passed. This is an important distinction.
> [...]
> The only information Proton could provide was a payment identifier because the user chose to pay with a credit card. This is information the user themselves provided to us through their choice of payment method. Proton also accepts cryptocurrency and cash payments, which would not have been linkable to an identity.
So basically, don't trust Proton with information unless you want the FBI to know it.
"So basically", what a weird conclusion to take out of it, just don't pay with your credit card for services you can pay cash or crypto.
Sorry, perhaps the takeaway is clearer when you see the full quote [0]. I omitted it for space, here's the relevant part
> Third, let's talk about what was actually disclosed. No emails were handed over. No message content. No metadata about who the user communicated with. The only information Proton could provide [...]
Yes, paying by crypto prevents Proton from disclosing your identity that way. Is there anything preventing Proton from disclosing the email content or metadata? Do they claim they won't disclose that? Clearly they do allow themselves to disclose metadata [1]
> For example, in ransomware cases, we can preserve information about which victims contacted the suspect, so that victims can be notified.
So, "just don't pay with a credit card" comes with the additional caveat of "don't email somebody you don't want the FBI to know you emailed". Whether you also need to "don't write anything you don't want the FBI to know", I haven't investigated further, but you could perhaps look that up yourself. I will just assume that to be the case based on what I've seen.
[0] https://www.reddit.com/r/privacy/comments/1rltej7/comment/o8... [1] https://proton.me/legal/law-enforcement
There are limits of what you can encrypt, in all of the cases of proton being critiqued for its compliance with law I haven't seen any instance of them being able to disclose email content, where metadata is "who we're sending email to", which is, I assume, not encryptable if you want an usable service. That being said, the quote does make your pov clearer, thank you for that.
> Is there anything preventing Proton from disclosing the email content or metadata?
Mmh.. The fact that it is encrypted client-side ? I mean the code is open-source fgs. [0][1][2]
[0]https://github.com/ProtonMail/android-mail [1]https://github.com/ProtonMail/ios-mail [3]https://github.com/ProtonMail/WebClients
Yeah, if you trust that they will never push a backdoor to your client on the request of Swiss law enforcement. It's a web app "fgs".
They also admit to scanning all mail to and from non-Proton accounts "for spam". So what's stopping them from one day adding a small if statement that just writes that data to disk, for specific "interesting" users?
Regarding metadata, I sure hope you have nothing to hide in the below emphasized:
> Account Activity: Due to limitations of the SMTP protocol, we have access to the following email metadata: *sender and recipient email addresses, the IP address incoming messages originated from, attachment name, message subject, and message sent and received times*. We do NOT have access to encrypted message content, but unencrypted messages sent from external providers to your Account, or from Proton Mail to external unencrypted email services, are scanned for spam and viruses to pursue the legitimate interest of protecting the integrity of our Services and users. Such inbound messages are scanned for spam in memory, and then encrypted and written to disk. We do not possess the technical ability to scan the content of the messages after they have been encrypted. We also have access to the following records of Account activity: number of messages sent, amount of storage space used, total number of messages, last login time. User data is never used for advertising purposes.
https://datatracker.ietf.org/doc/html/rfc5321
Please quote where in that document the answer to my question is:
> Is there anything preventing Proton from disclosing the email content or metadata?
Also please link me to the source code of Proton's server-side code, so I can audit their scanning of all incoming and outgoing mail, to verify it's not logging them. What you linked above is just the clients.
that's why they have independent audits.
After Proton has repeatedly turned over users of their email account to law enforcement, always with many excuses, their claims about no ability for any government to see what's going on on their network ran very hollow.
I know Brave has offered their talk video conferencing service for awhile, but I don't know if any serious network analysis has been performed on it. https://talk.brave.com/
For document collaboration, I'm not aware of much else that's private/encrypted (etc) however. https://www.privacyguides.org/en/document-collaboration/
Privacy and anonymity are not the same.
I am fundamentally against spyware that constantly monitors you and reports anything. Because of the constant and pre crime nature of it.
On the other hand i am actually not fundamentally against turning over data when independent judges sign a warrant.
This is arguably a very tight rope to walk but i think thats the most realistic comporomise between my right to privacy and the right of others to get justice when something is done onto them.
Perhaps you may not remember the US government's tendency to invade privacy for suspicious reasons (that is, at the very least extra-legal and sometimes downright unconstitutional).
You mentioned a warrant. I do not believe that has been a required threshold.
E.g., https://judiciary.house.gov/media/in-the-news/jordan-biggs-d...
I am not American so my lense may be a different one. What I am coming from is basically an extension of the German Laws that Govern the Mail Secret (Briefgeheimnis) which actually is constitutionally enshrined in the German constitution.
But has notable exceptions that can be made uppon federal law. The burden for these is supposed to be pretty high.
I think this should not happen willy nilly. And if thats the case in the US I am obviously against it.
It is a complex multi layered subject because it has to weigh the rights of multiple people against each other.
It's absolutely a required threshold in Switzerland
Sadly this is not binary.
Its not binary but rather orthogonal.
I think this comment deserves some nuance. Every company has to comply to local laws. Unless you want to run something illegal, at which point it's not a very reliable alternative for all your mail and more.
Proton in some cases was forced to turn over whatever they knew of a few accounts, according to Swiss law. They try to obfuscate as much as possible, so they can't turn over complete e-mail conversations. But some info is in there, and they have to turn that over. But (correct me if I'm wrong) they have to only comply to Swiss law, when there's a court order.
I like to point out often the yellow vests protesters being ratted out by Proton as good example of how misleading their marketing is. French police contacted Swiss police to get the id of the accounts, Swiss told proton to hand over the data. Problem is - under French law, their police would not be able to get that data from local providers.
Proton - HK owner, dev team in Bulgaria and marketing with mythical claims of "Swiss company privacy". For a company that is selling essencially trust, they sure are shady as f...
Maybe you need to use it over NordVPN to be really secure /s
When have Proton turned their data over to law enforcement without a Swiss court order?
What do you mean by "excuse"? What kind of excuse would a company need to comply with the law of it's government?!
I'm always confused by the conspiratorial takes that think there's some service out there _not_ bound by the legal system where it resides. Obviously Proton obeys the law and gives up data when it has to. Where are the services that don't do that? Somalia?
I think the key difference is the amount of data the service can offer when it is asked to do so by some legal entity. Signal famously claims to barely have any useful data to turn over when ordered to do so [1]. If some provider states they are pricacy-focused and protect your data from governments, but can still offer loads of your private data when ordered to, that damages their privacy claim.
EDIT: "some provider like Proton" -> "some provider", never wanted to imply Proton specifically did or does this.
[1] https://signal.org/blog/looking-back-as-the-world-moves-forw...
> If some provider like Proton states they are pricacy-focused and protect your data from governments, but can still offer loads of your private data when ordered to, that damages their privacy claim.
"Loads" of private data? When has this allegedly happened or how would it technically even be possible?
Well, Proton themselves say they will provide information about who has contacted a randsomware attacker to law enforcement. https://proton.me/legal/law-enforcement
So that probably has happened. Whether they've even provided other private data I don't know, but
> how would it technically even be possible
Well, it's not possible if you trust their claims about E2EE, but that is just a claim. How's that any different from a non-encrypted email provider saying they won't provide your emails to others? It all comes down to trust in the end.
They don't claim email is E2EE. Of course they need to know email metadata to route messages. That's unavoidable if you are using email. It's not encapsulated like that.
Yes they do (the storage of your emails on their servers, that is). See this comment for a summary of their claims and reality https://news.ycombinator.com/item?id=47625229
Edit: A reply to your misunderstanding and accusation below:
What do you mean? By "provide your emails to others" I obviously mean the email *contents*, not the email *address*. (Which I also clarified with "the storage of your emails on their servers"). You know, the very thing that is almost the whole selling point of Proton: that they keep the contents of your emails encrypted so "only you" can access them.
> Proton Mail protects the contents of all your messages with zero-access encryption, meaning no one can read them except you and your recipients. Messages you send to other Proton Mail accounts are always end-to-end encrypted, as are emails sent to non-Proton Mail accounts when you use Password-protected Emails.
https://proton.me/security/end-to-end-encryption
Also, what in the SMTP protocol requires Proton to *store* that metadata? Could they not simply delete it after using it (or, crazy idea, encrypt it in the same way the message contents are encrypted in storage), so they would be unable to respond to law enforcement requests the next week, say? They did also previously claim that they didn't log user's IP addresses. Why would they claim something like that, if it's "obvious to anyone who knows" that it's a false claim? Marketing aimed towards their not so technically savvy userbase?
https://www.theregister.com/2021/09/07/protonmail_hands_user...
Let me also remind you that I was replying to a question about "how would it technically even be possible" to "offer loads of your private data when ordered". My reply was, it's easily possible for them to offer your metadata, and you still need to trust their claims about heir implementation of E2EE to believe they won't offer your message contents.
You're very quick to accuse people of spreading misinformation. Let me hit back with an accusation of my own, which is that Proton's PR team have a habit of regularly trying to discredit any critique as "misinformation". Perhaps you've just read too many of their rebuttals?
They simply don't. Please stop spreading misinformation.
https://proton.me/mail/privacy-policy
> Account Activity: Due to limitations of the SMTP protocol, we have access to the following email metadata: sender and recipient email addresses, the IP address incoming messages originated from, attachment name, message subject, and message sent and received times.
This would be obvious to anyone knows how email works. It would be very silly for them to claim otherwise.
Thank you for bringing back the Signal's statement, btw.
can you expand on the "loads" part? ip and payment option?
Keyword is "like": a service like Proton. No idea if and what data they have offered to their government. I was merely trying to offer an explanation to the parent commenter, who was wondering how people can critique pricacy-focused services offering data when required by law.
You seem to be hiding behind this "like" while writing into comments about Proton - making accusations and theories that imply it's Proton that actually does that.
Fair enough, I agree. In Proton case, I'm biased because I used to work there ~2019-2022 and the company was basically printing money from subscriptions alone (covid likely helped with that), while fighting (pretty successfully) every request to avoid providing even that limited metadata, because alternative of ruining your core strength - privacy - meant the death of the business. I don't know if anything changed, but I'd bet the goals remain largely the same - providing good-enough privacy any commercial company can realistically give you. Unencrypted user data in this business is poison, and they're well aware fwiw.
But don't they have both the encrypted data and the decryption keys? I don't remember giving them my keys to use, and I can look at my stuff from multiple devices so the keys aren't stored on my device.
So they must have the ability to look at all that encrypted data anyway?
Did you not notice that you have to type in a password?
your password is your key, you can check networking to see if it is being sent in raw text or not.
I mean, is it really a conspiracy theory to want or believe that there are services (based in Europe) that don't hand over any and all user data to the USA government when asked? It's probably wrong to believe it to be the case, but just because it's wrong doesn't make it "conspiratorial".
It's quite hypocritical of Proton to claim that they protect against government surveillance when they do things like this though [0]. Their legal team has probably ensured they don't claim anything strictly false, but the implication and the reality are wildly different.
[0] https://freedom.press/digisec/blog/proton-mail-is-not-for-an...
Proton's marketing definitely makes it sound like they are fully anonymous and wouldn't even have anything to hand over to law enforcement. Look at the wording they use to describe the product.
Proton has always-on end-to-end encryption and zero‑access encryption, meaning even we do not have access to your data.
[...]
Based in Europe, Proton ensures your data is protected by some of the world’s strongest privacy laws. Because Proton isn’t a US‑based company, we can’t be compelled by laws such as the US CLOUD Act to hand over your data to the US government or terminate your services. [1]
[1] https://proton.me/business/blog/proton-workspace
Obviously as we have seen, they 100% can and will hand over your data to the US government. Yes, it's in the privacy policy/ToS & they're compiling with local laws. But that's clearly not how that reads.
[In 2021, the Switzerland-based vendor provided local police with the IP address and device details of a netizen the cops were trying to identify. That individual – a French climate activist who was already known to police – was later arrested.
Shortly after that kerfuffle, Proton removed the claim that it didn't track user IP addresses from its website. Proton has also previously been accused of offering real-time surveillance of users to authorities.] [2]
[2] https://www.theregister.com/2024/05/13/infosec_in_brief/
See also: ProtonMail filters this into its junk folder: New claim it goes out of its way to help cops spy https://www.theregister.com/2019/05/29/protonmail_dismisses_...
A search on your favorite search engine of 'instances where proton has turned over user info to the government' will provide further reading.
[dead]
Proton takes privacy so seriously that they even took the GitHub Issues section of proton-bridge offline /s