Do you still trust Proton Mail ? ? ?

[Frank in Bangkok]

On these forums, lots of comments about Proton Mail, mostly positive.
But ...

Did you know, "Proton Mail complied with nearly 6,000 data requests in 2022"

Proton Mail, in Switzerland, faced controversy when it complied with a legal request that led to the arrest of a French climate activist. Under Swiss law, Proton Mail was compelled to collect and provide information on the individual’s IP address to Swiss authorities, who then shared it with French police.

A recent case involving Spanish police this time, stems from Proton Mail providing the Spanish police with the recovery email address associated with a Proton Mail account ... Upon receiving the recovery email from Proton Mail, Spanish authorities further requested Apple to provide additional details linked to that email, leading to the identification of the individual.

This case is noteworthy because it involves a series of requests across different jurisdictions and companies, highlighting the complex interplay between technology firms, user privacy, and law enforcement. The requests were made under the guise of anti-terrorism laws.

Like before, Proton Mail’s compliance with these requests is bound by Swiss law, which mandates cooperation with international legal demands that are formalized through proper channels (Swiss court system).

In 2022 Proton Mail complied with nearly 6,000 data requests.

Source: Proton Mail Discloses User Data Leading to Arrest in Spain

Comments, please.

 

[Marzio]

Like before, Proton Mail’s compliance with these requests is bound by Swiss law

Are you surprised by that?

The service is advertised as a private mailbox, it's not advertised as a service for illegal activities.

 

[0xDEADBEEF]

If privacy is your concern, consider using email aliases that forward messages to your primary inbox. You can then protect the contents with encryption like PGP before it is forwarded: SimpleLogin PGP Encryption.

SimpleLogin (now owned by ProtonMail) offers this service, but you can also host the panel yourself with the help of online guides: Self-Hosted SimpleLogin.

Or use Addy to achieve the same: Free, Open-source Anonymous Email Forwarding | addy.io (How to self-host addy.io (AnonAddy) | addy.io).

Note: you just protect against the email provider reading your email, so of course there is some residual risk.

 

[yourbestchoice]

If a company is in possession of your data it is going to share it if the right person is going to knock their door. The best concept for privacy is when you don't need to trust someone else. Technologies like Tor or PGP fit perfectly for this. Don't fall for solutions with implemented encryption. If someone else than you has access to your private key they can encrypt your data too.

 

[mraleph]

If a company is in possession of your data it is going to share it if the right person is going to knock their door. The best concept for privacy is when you don't need to trust someone else. Technologies like Tor or PGP fit perfectly for this. Don't fall for solutions with implemented encryption. If someone else than you has access to your private key they can encrypt your data too.

Conventional wisdom is to not share auth credentials - passwords, keys etc. - with third parties whilst regulators strive to implement custodial wallets where you are legaly obliged to submit private keys to fiduciary agent.

TOR and any other VPN or proxy solution is good if you have a control - TOR nodes are significantly compromised. VPN providers must keep logs which is an element in KYC procedure.

OpenPGP assumes long term trusted keys, thus no PFS. There are experimental solutions for forwars secrecy where keys are changed with every transmission but they are against the intricate logic of OpenPGP.

For communication to be considered secure and if you do not strive to surveil and audit it, ephemeral cryptographic keys are mandatory thus achieving perfect forward secrecy.

 

[jafo]

On these forums, lots of comments about Proton Mail, mostly positive.
But ...


Proton Mail, in Switzerland, faced controversy when it complied with a legal request that led to the arrest of a French climate activist. Under Swiss law, Proton Mail was compelled to collect and provide information on the individual’s IP address to Swiss authorities, who then shared it with French police.

A recent case involving Spanish police this time, stems from Proton Mail providing the Spanish police with the recovery email address associated with a Proton Mail account ... Upon receiving the recovery email from Proton Mail, Spanish authorities further requested Apple to provide additional details linked to that email, leading to the identification of the individual.

This case is noteworthy because it involves a series of requests across different jurisdictions and companies, highlighting the complex interplay between technology firms, user privacy, and law enforcement. The requests were made under the guise of anti-terrorism laws.

Like before, Proton Mail’s compliance with these requests is bound by Swiss law, which mandates cooperation with international legal demands that are formalized through proper channels (Swiss court system).

In 2022 Proton Mail complied with nearly 6,000 data requests.

Source: Proton Mail Discloses User Data Leading to Arrest in Spain

Comments, please.

How MANY times do I have to keep repeating the SAME thing?

(1) There are NO mutes in prison!

(2)

 

[clemens]

If privacy is your concern, consider using email aliases that forward messages to your primary inbox. You can then protect the contents with encryption like PGP before it is forwarded: SimpleLogin PGP Encryption.

SimpleLogin (now owned by ProtonMail) offers this service, but you can also host the panel yourself with the help of online guides: Self-Hosted SimpleLogin.

Or use Addy to achieve the same: Free, Open-source Anonymous Email Forwarding | addy.io (How to self-host addy.io (AnonAddy) | addy.io).

Note: you just protect against the email provider reading your email, so of course there is some residual risk.

I must say that you really have a handle on everything that involves disappearing from digital surveillance and this world! You are a master at explaining how to avoid all tracking and tracing.

You should seek contract work with the lords of the underworld; they would pay you millions to help them vanish into thin air.

How MANY times do I have to keep repeating the SAME thing?

(1) There are NO mutes in prison!

(2)
View attachment 6764

agree so much

 

[Martin Everson]

Comments, please.

I don't trust my own mother. No sir

 

[Moonlighter]

So if you're trying to do something illegal and have a plaintext backup email leading to your personal identity, fingers should not point to Proton. They kept the email content encrypted as advertised but I guess many people mix up privacy with absolute anonymity.

Using a unique email as redirect with gmail or the likes is significantly worse from a privacy perspective as the mails are still stored in plaintext. Transport security (i.e. VPN / Tor / Proxy) won't help here.

 

[jafo]

So if you're trying to do something illegal and have a plaintext backup email leading to your personal identity, fingers should not point to Proton. They kept the email content encrypted as advertised but I guess many people mix up privacy with absolute anonymity.

Using a unique email as redirect with gmail or the likes is significantly worse from a privacy perspective as the mails are still stored in plaintext. Transport security (i.e. VPN / Tor / Proxy) won't help here.

This is precisely the tactic one should use, but instead, with "redirected" identity

PS. In case you all are wondering, a penal case, even in the cheapest city in the world, will cost you 250K for you to even have a modicum of winning success, but you WILL be a marked man.

Wouldn't it be better if you use the 250K
(1) to shield yourself, to bulletproof yourself,
(2) channel (redirect) the incoming assaults internally (intra-government), and
(3) have the gang members fight each other until the last man standing?

 

[mraleph]

How MANY times do I have to keep repeating the SAME thing?

(1) There are NO mutes in prison!

(2)
View attachment 6764

Things are very cruel yet simple.

Using a unique email as redirect with gmail or the likes is significantly worse from a privacy perspective as the mails are still stored in plaintext. Transport security (i.e. VPN / Tor / Proxy) won't help here.

By standard, email is a transparent protocol with readily available meta information (addressing, timestamps, routing etc.). Transport security - TLS - encrypts "data-in-transit" where those data isn't encrypted in mailbox - can be read by mail server administrator or another user with adequate privileges.

Several layers may be concieved for email security - from FDE (full disk encryption) such as LUKS and specificaly LVMonLUKS for proper volume management in order to protect the mailbox content, S/MIME or OpenPGP to protect individual content. But, the security depends on peers in ecosystem using content encryption.

ProtonMail somewhat uses the above set-up. But, it can't by default protect communication with contacts outside it's own ecosystem without overlay content encryption. It's simply not magic bullet.

 

[Marshal]

Are you surprised by that?

The service is advertised as a private mailbox, it's not advertised as a service for illegal activities.

Exactly. For a private mailbox they are one of the best on the market, but that doesn't mean they will protect you if you use it with an intent to commit a crime.

 

[jafo]

crime.

Mala in se or mala prohibita?

 

[incognitbro]

TOR and any other VPN or proxy solution is good if you have a control - TOR nodes are significantly compromised. VPN providers must keep logs which is an element in KYC procedure.

1. You have no evidence of this.
2. No, logging is not a legal requirement. Mullvad doesn't for example.

As far as the thread goes, use PGP if you want to send something privately as email wasn't made for privacy. Emails on proton are only encrypted if its to/from another proton user and so on

 

[mraleph]

1. You have no evidence of this.
2. No, logging is not a legal requirement. Mullvad doesn't for example.

As far as the thread goes, use PGP if you want to send something privately as email wasn't made for privacy. Emails on proton are only encrypted if its to/from another proton user and so on

We are discussing a fact that Proton AG cooperated with Swiss judicial authority in matters of international legal assistance in criminal matters.

By default, all Proton brandes products and services are recording the end user URI, session timestamps and metrics including their VPN service.

Any VPN, from IPSec to OpenVPN and Wireguard or any other L2/L3 by design require the above mentioned.

Same goes for any other VPN provider that is operating legally. And I stipulate, legally


OpenPGP or S/MIME protects only content, not meta - the addressing which is often more informative than the actual content.

But, yes, any content encryption is better than a lack of it.

 

[incognitbro]

We are discussing a fact that Proton AG cooperated with Swiss judicial authority in matters of international legal assistance in criminal matters.

By default, all Proton brandes products and services are recording the end user URI, session timestamps and metrics including their VPN service.

Same goes for any other VPN provider that is operating legally. And I stipulate, legally


OpenPGP or S/MIME protects only content, not meta - the addressing which is often more informative than the actual content.

But, yes, any content encryption is better than a lack of it.

Yes, protonMAIL sent the info they stored like IP used at signup and so on, irrelevant to your claim.

What would be illegal would be if a VPN company did log and then refused to comply when served a subpoena, but if you never stored it in the first place (running the VPN servers only in RAM) its fully legal. Signal is a good example of what I'm talking about as they really had no info on users to send except signup date and last connection.

Theres no legal requirement to log as a VPN company so stop spreading lies.

 

[mraleph]

Yes, protonMAIL sent the info they stored like IP used at signup and so on, irrelevant to your claim.

What would be illegal would be if a VPN company did log and then refused to comply when served a subpoena, but if you never stored it in the first place (running the VPN servers only in RAM) its fully legal. Signal is a good example of what I'm talking about as they really had no info on users to send.

Theres no legal requirement to log as a VPN company so stop spreading lies.

Quite a discussion. Please, restrain yourself from accusatory stance.

Do you actually know how any VPN server backend works - Wireguard, OpenVPN, IPSec, SoftEther etc.

What is "running a VPN servers only in RAM" A statement by certain provider? Do you know what they mean under "read-only image containing the entire software stack, OS and all."? It's called a docker - non persistent container. And, it's not in RAM Type of containerization technology.

Whilst a claim that ephemeral container doesn't have a persistent storage is true, it's also true that in order to faciliate end user's connections to backend servers you need to write their credentials to that same container(s). Contradictio in adiecto. But this is not an engineering forum.

I remember a zeolots that were quite confident whilst stating that now defunct SkyECC, Encrochat and other service providers are running "system" in RAM and having "hybrid encryption"... It's a history now.

IP used at signup? Do you know how email server backend works? How the actual messages are routed - it requires your URI at specific time...

Heated debate and emotional bursts will not change the facts.

 

[incognitbro]

Quite a discussion. Please, restrain yourself from accusatory stance.

Do you actually know how any VPN server backend works - Wireguard, OpenVPN, IPSec, SoftEther etc.

What is "running a VPN servers only in RAM" A statement by certain provider? Do you know what they mean under "read-only image containing the entire software stack, OS and all."? It's called a docker - non persistent container. And, it's not in RAM Type of containerization technology.

I remember a zeolots that were quite confident whilst stating that now defunct SkyECC, Encrochat and other service providers are running "system" in RAM and having "hybrid encryption"... It's a history now.

IP used at signup? Do you know how email server backend works? How the actual messages are routed - it requirea your URI at specific time...

Heated debate and emotional bursts will not change the facts.

I haven't accused you of anything though.
Yeah I do know how it works but nice googling, using Docker is not the only way to do it but irrelevant.
Some providers lying and/or being incompetent doesn't negate the fact that its not illegal to not log and these "kyc laws" you mentioned do not exist.
Naming technical stuff just for the sake of it when it was not the subject?
I'm not, show me the log requirement by law now.

 

[mraleph]

I haven't accused you of anything though.
Yeah I do know how it works but nice googling, using Docker is not the only way to do it but irrelevant.
Some providers lying and/or being incompetent doesn't negate the fact that its not illegal to not log because of "kyc laws" or whatever you claimed.
Naming technical stuff just for the sake of it when it was not the subject?
I'm not, show me the log requirement by law now.

There is no need to heat a rather serious debate.

ProtonMail is usable to the extent, already discussed and understood. Like a regular email provider once outside of closed ecosystem.

I asked whether you know how those server backends work and your comment is "nice googling"? Well, you gave a key words - it was easy to identify to whom you were refering to. No, there are various containerization technologies - docker and podman just one of those. But, when you affirmatively state about "VPN servers in RAM" I just asked how the credentials are updated?

Technical stuff is a devil in the detail.

Btw, they are not KYC laws.

Because the original thread subject is about Swiss Proton AG, the following federal law regulates provider's obligations

https://www.fedlex.admin.ch/eli/cc/2018/31/en
with possible exemptions.

Proton AG was given such exemption in regards to surveilance capacities - inability to decrypt content.

I will not enter into debate without point. Pay attention about "no logs policy" contradiction in this at

https://protonvpn.com/support/no-logs-vpn/
"This notably differs from Swiss regulations for other online services such as email which is generally not no-logs and can require IP disclosure in the event of a Swiss criminal investigation. That’s why if your threat model requires hiding your IP from Swiss authorities when using Proton Mail, we recommend using a VPN or Tor."

vs.

this from

https://proton.me/blog/switzerland
"In October 2021, The Swiss Federal Administrative Court ultimately agreed with us and ruled that email companies cannot be considered telecommunication providers(new window). This means Proton isn’t required to follow any of the SPTA’s mandatory data retention rules, nor are we bound by a full obligation to identify Proton Mail users. Moreover, as a Swiss company, Proton Mail cannot be compelled to engage in bulk surveillance on behalf of US or Swiss intelligence agencies(new window)."

Not everything is declared explicitly. You may not like it, but, just because some vendor or provider is writing that it's not under EU and US jurisdiction doesn't mean that it can't be compelled thru due process before Swiss courts to cooperate with authorities from US and EU jurisdictions. Just a word game.

 

[incognitbro]

There is no need to heat a rather serious debate.

ProtonMail is usable to the extent, already discussed and understood. Like a regular email provider once outside of closed ecosystem.

I asked whether you know how those server backends work and your comment is "nice googling"? Well, you gave a key words - it was easy to identify to whom you were refering to. No, there are various containerization technologies - docker and podman just one of those. But, when you affirmatively state about "VPN servers in RAM" I just asked how the credentials are updated?

Technical stuff is a devil in the detail.

Btw, they are not KYC laws.

Because the original thread subject is about Swiss Proton AG, the following federal law regulates provider's obligations

https://www.fedlex.admin.ch/eli/cc/2018/31/en
with possible exemptions.

Proton AG was given such exemption in regards to surveilance capacities - inability to decrypt content.

I will not enter into debate without point. Pay attention about "no logs policy" contradiction in this at

https://protonvpn.com/support/no-logs-vpn/
"This notably differs from Swiss regulations for other online services such as email which is generally not no-logs and can require IP disclosure in the event of a Swiss criminal investigation. That’s why if your threat model requires hiding your IP from Swiss authorities when using Proton Mail, we recommend using a VPN or Tor."

vs.

this from

https://proton.me/blog/switzerland
"In October 2021, The Swiss Federal Administrative Court ultimately agreed with us and ruled that email companies cannot be considered telecommunication providers(new window). This means Proton isn’t required to follow any of the SPTA’s mandatory data retention rules, nor are we bound by a full obligation to identify Proton Mail users. Moreover, as a Swiss company, Proton Mail cannot be compelled to engage in bulk surveillance on behalf of US or Swiss intelligence agencies(new window)."

Not everything is declared explicitly. You may not like it, but, just because some vendor or provider is writing that it's not under EU and US jurisdiction doesn't mean that it can't be compelled thru due process before Swiss courts to cooperate with authorities from US and EU jurisdictions. Just a word game. Theres a big difference between refusing to cooperate and not being able to provide info you never kept in the first place.

Well for starters, yes you have this annoying tendency of just spamming random terms that half of the time have literally nothing to do with what you are replying to. I'm not sure what the purpose is, is it to just come off as smarter while also avoiding to give a proper response? I'm not going to entertain this nonsense further because its a sloppy copout.

And I'm not sure what the contradiction is supposed to be, their VPN and email are clearly 2 different services and thus got different requirements. If I own a restaurant and an EMI its not like I have the same reporting requirements on both and they work vastly different.

Mullvad for example is in Sweden so it cannot be an EU law either, think its on a country by country basis (if at all). I never claimed that VPN companies don't have to comply, all I did was refute your claim that VPN providers are required to log by law. Theres a big difference between not cooperating and not being able to send info you were never legally forced to keep in the first place.