ProtonMail: Alleged data breach was a “hoax and failed extortion attempt” | Hacker News Reader

ProtonMail: Alleged data breach was a “hoax and failed extortion attempt”

reddit.com

79 pointsdredmorbius42 comments

I'll continue to shill for the company's services unless anything becomes evident. Nobody has offered anything that ProtonMail / ProtonVPN wasn't able to explain adequately.

Nobody else I'm aware of offers their own data center infrastructure, which is extremely important as it's a key single point of failure in all other VPNs and email service. There is no better option for most people.

Obviously if you're going to use ProtonMail, it's always technically better to encrypt your emails with PGP or the like on top of it, but I still stand by my firm recommendation of their services.

I'd like to imagine ProtonMail is in the same set as Lavabit. I think many services portray themselves as if they're in said set, but I think its cardinality is very, very small.

Protonmail now support PGP encryption.

(Also noted by a dead comment.)

To be honest they always supported PGP encryption (they are the biggest contributor and lead Openpgpjs development). Since July it's possible to also send encrypted messages to external contacts.

ProtonMail is actually very committed to OpenPGP as a standard (it's evident by their engagement on the OpenPGP Mailing List).

Protonmail hadn't supported arbitrary sender or recipient keys. They've just issued a big update announcement that they're doing precisely that.

It works since July see this blog post: https://protonmail.com/blog/address-verification-pgp-support...

I don't know why they announced it now but I've been using it previously.

I tend not to trust ProtonMail that much after seeing this thread: https://old.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn... This is a reddit thread that criticizes ProtonVPN (same company as ProtonMain). The mod in charge of the sub offers a rebuttal to a criticism against them. Afterwards, the mod in charge of that sub locks it thereby preventing the accuser the ability to reply to that claim.

Now it is possible that nothing wrong happened, but every time a business tries to censor a criticism against them, I tend not to give the business the benefit of the doubt.

Was it the CEO who locked the thread, some developer, or some PR person? There's a difference though between an emotional reaction by an employee and a company's policy.

edit - I read the thread, it appears to be one of the original researchers from the project and a deliberate choice.

I thought PIA was fairly reputable - does anybody know any actual facts around the incident?

Based on this: https://old.reddit.com/r/IAmA/comments/9j35ry/i_am_dr_andy_y... It appears to be Andy Yen, the founder of ProtonMail.

When you say "PIA", are you referring to PrivateInternetAccess, or did you mean ProtonVPN?

private internet access

It was indeed a deliberate choice, and we have explained the reasons why here: https://news.ycombinator.com/item?id=18479922

Hi Jammy,

My name is Andrew from PIA. I don’t know about our reputation, and quite frankly, I don’t think it’s a good idea to simply blindly trust any VPN. You need to look at track record more so than anything else. To that extent, PIA is the only VPN that has been verified as not logging by courts on multiple occassions.

That being said, we have been subject to a slanderous defamatory campaign by ProtonVPN for some time. I chose to ignore it but now his claims are going too far.

This all started when I shared a few links proving that ProtonVPN was controlled by NordVPN/TESONET’s CEO and that the ProtonVPN android app was signed by Tesonet.

I believe I did the right thing by sharing the facts about ProtonVPN given it is a purported privacy company - I thought people would want to know their android app was signed by Tesonet which says it is a data mining and machine learning firm on their own website.

If I was born again and had the same decision in front of me, I would make the same decision in every lifetime.

If you think that me standing by my beliefs and values makes PIA lose reputation - I hope PIA losses ALL OF ITS rep.

> We have unfortunately had to lock the thread because there are some troll accounts continuing to push the misinformation being put out by Private Internet Access (a rival US-based VPN provider).

You don't trust the company because of that single post on reddit?

It’s possible that the moderators we’re deleting trollish comments.

This one didn’t seem like trolling at all, it was well written and it was replied to, which makes it a strong candidate to keep in liu of others.

There were a lot of posts on both the subreddit of ProtonMail and as comments in the threads on there. Plus threads on various privacy subreddits. It was a pretty wide dragnet campaign tbh.

Precisely. This was not the case of a couple accounts, it was hundreds of accounts, on all social media platforms, where a blanket locking of the thread became necessary. On Twitter alone, 500+ accounts: https://twitter.com/conspirator0/status/1036353291662360577

There was no misinformation put out by PIA. However, I, the co founder of PIA, did in fact link to facts showing that ProtonVPN was a Lithuanian company with the director being the same director as the director of Tesonet and NordVPN.

I also did point out that the ProtonVPN android app was signed by Tesonet.

This was all done on a hacker news thread. Not reddit - and one time.

I simply wanted people to be aware of this, so I said it once, since ProtonVPN is supposed to be a privacy company.

For doing this, I have been slandered and defamed and called names by Proton since.

ProtonVPN AG is a Swiss company owned by Proton Technologies AG, the Swiss company behind ProtonMail. The Proton entity in Lithuania is also controlled by ProtonMail.

If it is now controlled by you then that is a great first step.

Thank you for taking this serious.

We have always had control over the Proton brands. Proton has just two outside investors, FONGIT and CRV, and neither has anywhere near a controlling interest. We do take your concerns seriously though, and will aim for even more transparency.

I wouldn't trust any service that claims to respect their users privacy until there are multiple independent, highly respected organizations doing continuous vetting and verification of their claims.

That said, I'd still rather use those services than the likes of Facebook, Google, and Microsoft -- who flaunt their contempt for the privacy of their users, or whose business depends on spying on their users and the people their users associate with, and who've demonstrated time and time again that they can't be trusted.

Proton team here. We are very much against censorship, in fact that's one of our core principles. However, as mentioned on Reddit, we needed to lock the thread because too many bot and fake accounts were posting.

Many people fail to appreciate the full extent of the defamation campaign that was waged against ProtonVPN by PIA and others. This was not the case of a couple fake accounts that could be handled with manual moderation. We're talking literally hundreds of accounts trying to spread false information, to the point where it became a case study on fake news: https://twitter.com/conspirator0/status/1036353291662360577

The fact remains that to this day, ProtonVPN remains the only VPN service that has been thoroughly and continuously vetted by an independent third party, Mozilla no less: https://protonvpn.com/blog/mozilla-partnership/

You really need to stop making false claims of some “defamation campaign.”

Your business was registered in Lithuania and was owned by the owner of Tesonet/Nord. You signed your Android app with “Tesonet” as the name. I pointed these facts out and linked to them. Ever since, I have seen nothing but slanderous and defamatory attacks from you, as an individual and from Proton.

Why do you attack a truthful messenger?

Please stop this activity immediately. I’m asking you as a netizen. I did nothing wrong for pointing out these extremely scary peculiarities with ProtonVPN.

And now you attack me non stop for sharing facts with the internet one time on hacker news with links to sources - which everyone on HN agreed with and even found more peculiarities.

I guess you believe in censorship.

Where this crosses into defamation is using the fact that Proton has a small office in Vilnius (representing <10% of total headcount) to imply, without proof, that Proton is part of some Lithuanian data mining conspiracy.

This defamation becomes willful when an attempt is made to spread this to the press and on social media, even after the story has been debunked.

The data-mining narrative is false, has been verified as false by third parties, and that's where we would like to leave things.

Unfortunately as this false narrative still comes up from time to time, we still need to comment on this from time to time. What we can do from now on, since it bothers you, is to leave PIA out of it when responding. However, that won't change the fact that many people are aware the allegations were first made by PIA. This last point is beyond our reasonable control.

In combination with the fact that the Android App was signed by Tesonet, are you telling me that ME or OTHERS shouldn’t be concerned? Do you realize I was a protonmail user until I saw that shit?

Also, I haven’t seen any verification that anything is false - Tesonets one website CONTINUES to say they conduct said activities.

Finally, the allegations were made by Google Play and the Lithuanian Government.

Stop blaming me for bad decisions you regret to this day. That being said, I would appreciate if you leave my name and PIAs name out. I’m happy to get on an encrypted phone call with you - like on jitsi - to talk things out.

You have my contact since you sent me a cease and desist letter. This is not a VPN/pro internet thing to do by the way.

I don’t dislike you - so stop thinking this is anything else other than me seeing some really scary stuff and pointing it out.

If you saw that PIA’s app was signed by Tesonet wouldn’t you be like wtf?

Although the extortion is almost certainly false, this is a good moment for protonmail users to review their opsec procedures. Relying on a central authority for anything is risky, and the more valuable a central point becomes the bigger a target it gets...

I'm glad ProtonMail exists and would gladly shift my family domain over if it weren't so prohibitively expensive for the most basic of features :/

Although, I guess you get what you pay for. They're really communicative, even for their free offering.

Maybe I'm misreading something, but they appear to cost 4 Euro a month. How is that "prohibitively expensive"?

FastMail tiers are US$3/5/9 per user per month, so €4 doesn't seem wildly unreasonable.

I used to use protonmail. I think the reason I switched to fastmail was the calendar support and the ability to use thunderbird easily on linux. Possibly to sync contacts easier too.

When protonmail introduces those I'll be taking another look at them, but they're taking a while.

It was a nice service while I used it.

How do FastMail, ProtonMail, and Migadu stack up against each other nowadays?

It isn't, but when you look at competitors like Tutanota at ~$1/month (pay to upgrade whatever you want), they seem expensive.

I was deciding between ProtonMail and Tutanota, but decided on ProtonMail because their pm.me domain is really nice for business cards until I decide what my domain is. Once I get my domain set up, I'll reevaluate.

Aren’t they free for limited use?

Yes.

But when I had the choice I still went for another service because I don't like being forced into using a specific app just so I can read emails(yes, I know about their bridging app, but that's only available for PCs, no smartphones, and their Linux version isn't out yet even though it's still "scheduled for early 2018").

It's still in beta, but it's definitely "available", you just need to ask for it (bridge@protonmail):

https://www.reddit.com/r/ProtonMail/comments/86mlr5/bridge_f...

Usual 4chan (and maybe ulterior actors) action, throw manure around, see what sticks.

Why are those right wing conspiracy theories? Sorry I don’t really understand the context. They just don’t seem to have any political content to me but that is probably just ignorance on my part.

I think demonizing CNN is a favorite on the right and I know "Rampant pedophilia among high ranking government officials" is big among QAnon folk.

Ah thanks the QAnon link makes sense. That was the bit I was missing.

As an outsider to american politics, CNN seems a bit silly in how they present information. Just my opinion though, they give off a weird vibe compared to the boring news I prefer

https://www.reddit.com/r/ProtonMail/comments/9xovso/dont_bel...

a 4chan larp ends up as a denial on hackernews? is this notable?

Reply on news.ycombinator.com