Clarifying ProtonMail and Huawei | Hacker News Reader

Clarifying ProtonMail and Huawei

protonmail.com

210 pointsgavingmiller64 comments

Looks like Bloomberg is doing the same as with the "implant" rumors and Supermicro a few months ago.

Gruber has a very nice disclaimer at the bottom of posts mentioning Bloomberg now:

"Bloomberg, of course, is the publication that published “The Big Hack” last October — a sensational story alleging that data centers of Apple, Amazon, and dozens of other companies were compromised by China’s intelligence services. The story presented no confirmable evidence at all, was vehemently denied by all companies involved, has not been confirmed by a single other publication (despite much effort to do so), and has been largely discredited by one of Bloomberg’s own sources. By all appearances “The Big Hack” was complete bullshit. Yet Bloomberg has issued no correction or retraction, and seemingly hopes we’ll all just forget about it. I say we do not just forget about it. Bloomberg’s institutional credibility is severely damaged, and everything they publish should be treated with skepticism until they retract the story or provide evidence that it was true."

https://daringfireball.net/linked/2019/09/05/gurman-touch-id

It's as if they wanted to make PM look bad so that customers would rather opt for an Email provider that the NSA can spy on...

As commonly with stories like this, people will see the Bloomberg story and not see the correction issued by ProtonMail. The harm is done, and ProtonMail is likely going to miss out on subscriptions because of Bloomberg's irresponsible publication. This tendency likely holds true even if Bloomberg were publishing the correction themselves, as it has been observed time and time again.

If you apply for a writer's job at Bloomberg or many of these media companies, people will ask you if you have a following on Twitter, Facebook and the like with which you can share content you write so that your employment poses a smaller risk to your new employer than someone with little to no following. That in itself might just make writers statistically more loyal to big tech than really necessary.

I'm still completely astonished by how little attention this got and that Bloomberg has never been forced through public pressure to offer a correction. It's bizarre given how large the story was when it first broke.

Bloomberg is based in a country with secret courts and secret gag orders for electronic surveillance (USA). Is is really that surprising that they have been unable to provide evidence regarding major electronic surveillance efforts?

The irony would be if they were under a gag order not to issue a retraction.

But that's diving down the paranoia rabbit hole.

Thanks for reminding about this. I really don't know why people take Bloomberg seriously after "The Big Hack" article. From my point of view, they lost all credibility and I no longer believe what they write.

SuperMicro didn’t sue Bloomberg. That should be a huge clue about the accuracy of the original article.

I wonder why ProtonMail is getting so much negative press. They are releasing articles like that to clarify "the truth" on a regular base. Even here on HackerNews, there are so many negative voices repeating the same things over and over again. Even and especially those that (seem to) have been rectified by ProtonMail. Usually, the people here seem to be neutral and fact-based, but as soon as ProtonMail is involved many are getting wild.

While I have an inactive account at PM, I'm not involved with them in any way. This is just an observation that I have made over the recent years.

That article does not clarify anything. I want to provide a link. It is nothing but thousands of words saying they aren’t partnering by putting an app in Huawei App Store.

For years companies used to provide all sorts of incentives to put apps in their store. It benefits them highly.

This is ridiculous: https://protonmail.com/blog/clarifying-protonmail-and-huawei...

> For years companies used to provide all sorts of incentives to put apps in their store. It benefits them highly.

Are you implying that Huawei is paying ProtonMail so that they put their app in the Huawei AppGallery? Can you provide any proof?

As if I needed more evidence that Bloomberg is below 0 on the credibility scale. They are officially a tabloid to me now.

I still find it useful to read mainstream media, even 'free' publications like Metro and the Evening Standard in London. What I do is not read them for news per se, but a sort of high level scan of what the publication's bias is. What narratives are being pushed? How has the publication ordered, or prominently displayed articles? What news is completely omitted?

For example, no mainstream media outlet in the UK covers Al Quds day in London (absolutely nothing about this on the BBC or print media). Facts on the ground at the most recent (and previous) marches is that there is a lot of Hezbollah flags flown.

Another example is the BBC’s treatment of Brexit on three flagship panel shows, Question Time, Politics Live and Any Questions where Remain commentators outnumber Brexit commentators 3 to 1.

In this instance, Bloomberg seems to be wanting to push the 'Huawei is spying on you' narrative as well as 'Proton Mail isn't secure' narrative.

Make what you will of the points above, maybe they mean something, maybe they don't. I just keep an open mind, try to think for myself, see things from different perspectives, and do my best not to fall for my own cognitive biases.

I still use Proton Mail, and I trust their service more than GMail (I migrated from GMail to Proton Mail), but it's a nice reminder not to trust any corporation too much or get complacent with security. I really don't feel like rolling my own encrypted email solution so the question is, "Who am I willing to trust the solution to?" Ultimately I'm accountable to myself.

As for media bias, sometimes it is blatant, most times however I find it subtle. Either way it is pervasive. Unless you are scanning for it, I imagine it is incredibly easy not to think for yourself.

I sympathise with the BBC as it must be hard finding people who are both articulate enough to appear and coherent when defending Brexit.

Ah yes, this old chestnut: https://twitter.com/bbcquestiontime/status/92367597312354304...

It's a valid point, although probably not in the way the young man intends it.

In the interest of remaining fair and balanced, media ultimately has to appear biased, if the supporters of the issue are... unbalanced in appeal.

I think this is less of an issue with Brexit, as one can make a cogent argument for Leave (although that doesn't seem to be the popular argument).

But for something like chemtrails? How could you possibly hold a "debate" that a believer couldn't look at and say "You're just biased against my side?"

> Al Quds day in London

From what I can tell, the March on this day tends to attract less than 500 people. So lack of coverage is not a indication of BBC bias.

Regarding Brexit, Question Time seems to have Nigel Farrage on all the time, despite his lack of electoral success.

Still, I decide to take a look at last week's panel for you. And here is what I found:

Kwasi Kwarteng - Pro Brexit

Emily Thornberry - Remain

Layla Moran - Remain

Ian Blackford - Remain

Iain Dale - Pro Brexit

Richard Tice - Pro Bexit

No huge anti-Brexit bias in evidence.

Well Al Quds day might be perceived as news worthy due to Hezbollah being officially considered a terrorist organisation by the United Kingdom along with the United States, the European Union, the Arab League, the Gulf Cooperation Council, Israel, Canada, the Netherlands, Australia to name a few.

Considering London has suffered from multiple ideologically possessed terror attacks it might be worth reconsidering how newsworthy open support of a terrorist organisation is.

Additionally, the Jewish community in London are particularly sensitive to the march as Al Quds day brings about hate speech towards them.

I'm not saying Al Quds day should be banned in London, but I think a public dialogue and debate should be had. In my estimation the lack of it is due to the 'multiculturalism is our strength' narrative bias held at the BBC.

Now I'm not saying 'multiculturalism is bad', I'm the product of it, and I definitely think it has benefits. But there are problems with it, which need to be confronted and worked through for a better society. Without a doubt these are sensitive, and ugly issues, but pretending they don't exist because you are captured by bias, will not solve the issues.

As for your Brexit comment, I believe you are suffering from recency bias.

In a report published in January 2018 called ‘Brussels Broadcasting Corporation?’, think-tank Civitas in conjunction with the group News-watch, monitored thousands of hours of radio and TV shows dating back to 1999 including the BBC flagship Radio 4 programme Today.

Of 4,275 guests on Today between 2005 and 2015 who talked about the EU, only 132 were Brexiteers.

Put another way, just 3.2% of Today interviewees were anti-EU, despite consistent public support for EU withdrawal throughout this time.

There are also a plethora of articles about this on Google, so in a way you are kind of proving my point because the data is out there but you didn't want to, or think to, look for it.

However I'm far less concerned about being 'right' and far more concerned about dealing with reality... and I believe the more people that deal with reality there are the better the world will be.

> Facts on the ground at the most recent (...) marches is that there is a lot of Hezbollah flags flown.

[citation needed]. Flying the Hezbollah flag was made illegal by the British Parliament in March, ahead of the most recent march: https://www.algemeiner.com/2019/05/28/flying-the-hezbollah-f...

Thanks, I totally missed this piece of news and have fallen to bias myself! I gave up monitoring Al Quds day in 2018 after making a complaint to the BBC that got a boilerplate response. I just don't have the time or the resources to do anything about it.

The open support for Hezbollah was there in 2018 and in previous years... but from 2019 the reports I've read, it seems like the police enforced the new law. I would need to make a freedom of information request with the police to see if there were any arrests to verify this.

At the risk of making myself a punching-bag for downvoting, here.

Bloomberg is a source that investors and traders trust with getting them some level of access to the rumour mill (in the spirit of the saying that exists among traders that goes "buy the rumour, sell the news"). The problem here is that, fact or fiction, rumours affect the financial markets, and not knowing about them puts a market participant at a disadvantage.

The article starts by saying in indicative mood "ProtonMail is in talks with Huawei Technologies Co. about including its encrypted email service in future mobile devices [...]" ...I don't really see a problem with that part of the statement since they were indeed in talks of some kind, and there's a certain bandwidth of what "including" could mean. It could just mean "making available through Huawei AppGallery", so there is nothing wrong with using indicative mood here.

In the second paragraph, the article switches the modality and says "The Swiss company’s service COULD come preloaded ..." Now, it could of course be the case, as people are alleging, that they just completely made that shit up and MANUFACTURED a rumour. But it could also be the case that they were reflecting a rumour that was already out there and sufficiently widespread that they thought that investors and traders should know about it. They used subjunctive mood using the auxiliary verb COULD to signal that there was something going on here about the modality of the statement.

ProtonMail speculated that a misunderstanding of their earlier announcement must have been the basis of Bloomberg's article. But I guess we'll never find out if that was indeed so.

ProtonMail clarified their earlier announcement and took issue with the word "partnership" being used to describe their relationship with Huawei, but, interestingly, they did not come flat out to respond to these assertions. For example, they did not say that preloading was not a topic that was discussed.

Now, it stands to reason that preloading would amount to Huawei handing a huge chunk of marketshare to ProtonMail, and then it's up to users to make up their minds about the likelihood of Huawei asking for quid-pro-quo and ProtonMail's response.

Rather than there being no basis at all for the Bloomberg article, another scenario could be that ProtonMail saw that making-up-of-minds play out on social media in response to the Bloomberg article and decided to do a one-eighty on that as a result.

...I guess we'll never know.

It's inconceivable that a manufacturer would preload an app without some kind of discussion of the app's content, and I think it's reasonable to be afraid of even a non-explicit quid pro quo from Huawei. If ProtonMail-on-Huawei is using so much as a new logging library because Huawei said the old one is insecure, I want to know about that.

upvote for citing indicative and subjunctive.

It's a recurring theme: Media outlets publish whatever they 'want' to believe with little due diligence and the product makers have to scramble to put up clarifiers.

Media outlets certainly do that, but can't product makers sue them for damages, when they publish false information that can tank a stock or kill a company's sales?

Usually not. To prove libel you have to prove: 1. the information is false, 2. The speaker knew it was false, 3. The speaker spread the false information with the intent to harm the plantiff. Without all three it isn't libel in the US.

I'd me more interested in their clarification on NordVPN, ProtonMail/VPN and the data gathering agency Tesonet.

Do you have a link?

The best way to learn about the incident is to read the discussions first-hand from the Hacker News, for example, by searching "inurl:ycombinator protonvpn tesonet". There is no point in reading any journalistic articles if you can read Proton's responses here, except one article [0] - a compilation of changing Proton's responses and them successively admitting more and more things not in their favor. The compilation starts at the part called "Online accusations fly".

[0] https://restoreprivacy.com/lawsuit-names-nordvpn-tesonet/

If protonmail keeps changing their story like that, it seems pretty damning for their credibility.

This particular "story" was also another hit piece from anonymous "sources". We previously responded here: https://www.reddit.com/r/ProtonVPN/comments/8ww4h2/protonvpn...

But you don't have to just take our word on it. ProtonVPN in particularly has been heavily scrutinized, by both Mozilla (who we partnered with) and also the European Commission (which is providing funding): https://protonvpn.com/blog/is-protonvpn-trustworthy/

In other words, there are plenty of non-anonymous, legitimate third party sources, who have checked things out and confirmed the story is bogus.

One main allegation was that Proton shares an address with another company, but it fails to mention that our office in Vilnius is in a 30 story office building with hundreds of other companies: https://www.instagram.com/p/BxMz62oHb6K/

Does an F-Droid release mean Proton will finally remove their GSF dependencies?

That is indeed the plan, although there may be issues with battery life that we need to resolve first.

I'd like to point out one thing. The people at ProtonMail are clearly under the belief that they are only subject to Swiss law because they are located in Switzerland. That's not my understanding of the law at all. Granted, it seems like an obvious conclusion but legally the truth seems to be different.

For instance, at my employer we had training on the GDPR rules and how they relate to us. We are a US based company with many global clients. However, we do have a physical presence in some EU countries so that does differ with the ProtonMail situation. However, in our training we were told that our business presence in the EU is irrelevant to the actual law because we would still be bound by it as it relates to our global clients. The layman's explanation we were given was that if you are using the internet to conduct digital business across country borders then you are pretty much subject to the laws of both nations between the client and the service provider.

That generally translates to defaulting to whichever law is more restrictive. For companies like Facebook and Google, they've rolled out GDPR style protections for everyone globally because it's much easier to do so than to only have it apply to a portion of their users, but that's a separate story.

I think everyone intuitively understands and knows this to be true. We can all think of cases where hackers have committed crimes that may only violate, for example, US laws and have been tried and convicted of such crimes even though they were committed overseas but the aggrieved party is the US or its citizens.

I think what ProtonMail is really saying is that because Switzerland doesn't have laws similar to China in this regard, China won't be able to convince Switzerland to extradite them to China for prosecution.

That's also why Russia threatened to ban them - because they know there is zero chance they will be willingly handed over to Russian authorities for this.

Not all countries handle international law violations the same. ProtonMail makes this clear in the above explanation - other foreign countries are welcome to make claims, but they must do so under Swiss law and Swiss courts. Swiss law, afaik, does not allow the Russians to simply claim all user records.

> The people at ProtonMail are clearly under the belief that they are only subject to Swiss law because they are located in Switzerland.

What led you to believe this is so clear?

These excerpts taken together:

1) "As a Swiss company, when it comes to the data of Proton users, we will only comply with the laws of Switzerland, the jurisdiction of our headquarters and where all of our servers are located. As we have always consistently stated in our terms and conditions and privacy policy, any requests which fall outside of Swiss law will be politely refused"

2) "Proton does not have offices, employees, subsidiaries, or any permanent establishments in China or Russia, and as such, we do not fall under the scope of these laws, nor can these laws be enforced against us. However, this does not mean authorities in these countries would not try to enforce the laws anyways."

It's actually a bit more nuanced. Any government in any country can at any time decide that their laws apply to you (because hey, it's a government, they can do whatever they want). However, unless you are operating in that country, there is very little they can do in terms of enforcing that upon you.

Yes, that's the point I was trying to make - your country would have to be willing to participate. That's risky, albeit to varying degrees, depending on the country a person/business reside in because governments can change their opinion at any moment or enter in new agreements to combat whatever they may deem as "global crime".

Well that's kind of dramatically different than how the press is portraying it.

I was a gmail user a few months ago and I switched my entire life over to protonmail because I didn't want to contribute to Google. I would have to say the most frustrating part of the switch is the somewhat perplexed look I get from people when they ask why I don't have gmail, they have to learn to spell proton, fascinating. I would imagine we will see quite a few hit pieces against protonmail in the coming years, and likely other email providers as more and more people make the switch to a service that markets privacy.

You can give myemail@pm.me instead of myemail@protonmail.com

Yes, but first you have to activate it in the protonmail settings.

Are email addresses on private domains not a thing where you're from?

I don't understand why people ever believed Protonmail's privacy claims to begin with? Not that I have reason to doubt them either, but their security seems nothing more than an unverified promise? I'm skeptical of my privacy protection coming from small companies that could easily be bought outright by governmental or political groups.

By posting this you're practically caving to the mass media. In the long term, it's best for everybody that you ignore them. Never pay the ransom or they will become more powerful.

What are you talking about? Did you even read the article?

This article sounds like suspicious excuse, really. I don't wan't to touch any device/service affiliated with Huawei/Chinese intelligence.

Is there any good&reputable replacement for ProtonMail?

Why was protonmail ever considered good or reputable?

ProtonMail does not support Yubikeys. I would like to ask all of HN to think seriously about this and what this means. ProtonMail does many things exactly right. This 1 oversight suggests something very very scary going on at the organization.

HN does not allow you to delete comments. I would ask that if you think that not having Yubikeys does not require a significant and immediate answer from the ProtonMail team, to sign your name (I will) at the bottom of your response. If you can’t do that, perhaps provide a burner email address.

Dan Ehrlich

dan@ehrlichserver.com

CISSP, CCSP, CISM

EDIT: spacing between my signature, change of comment to commentS

Can you elaborate why not supporting Yubikeys (yet) "suggests something very very scary going on at the organization"?

Yubikeys are one of the few forms of 2FA that are highly resilient to being phished. Google has not only an option to restrict SMS 2FA, but an additional one below to restrict “all 2FA options except security keys” in GSuite.

It has been known for some time that TOTP 6 digit codes are easy to intercept. SMS Codes can also be intercepted, or gained via SSB7 vulns/ SIM jacking. This made things like Google Authenticator or Authy more resilient but certainly still quite vulnerable.

To intercept and exploit MFA in ProtonMail would absolutely trivial for a skilled single person to do. DNS poisoning + this github library would be all you needed: https://github.com/kgretzky/evilginx2

EDIT: replaced quotemark with asterisk

That does not really answer my question. Why does missing support for Yubikeys "suggest [that] something very very scary going on at the organization"? Supporting Yubikeys is probably already in their list of planned features. But ProtonMail is a relatively small company and the user base requesting that feature might be relatively small. Yes, security is one of their top-most priorities but so is earning money. The latter requires a large paying audience where other features might be more important.

It’s such an oversight that to quote someone from early 20th century ... “is this stupidity or is this treason”.

Not doing this was a deliberate choice. The benefits of implementing it outweigh at maybe a dozen orders of magnitude not implementing it.

The very scary thing btw is simple. They were bribed the same way the WordPress Core Contributors have been for years. Let me discuss this quickly, and I’m happy to name names in a separate posting (Gary Pendergast out of Australia is going to jail though along with another America dev). That being said please review this discussion where several core contributors admit to not even reading an extremely important path from arguably one of the best PHP developers in the world (certainly in terms of security): https://core.trac.wordpress.org/ticket/39309

you're getting no traction with your argument because you're grossly overreaching with it.

not having yubikey support is obviously not "very very scary" since most people (even on hn) don't have yubikeys and we don't run around with our tails between our legs.

many reasons can lead to not supporting yubikey yet, including the simplest, which is that it's lower on the priority list for a resource-constrained organization. or another likely explanation: yubikey has unsolved ux issues that keep it a niche product (for now), so demand simply isn't there.

this seems to be an important issue for you, so if you want to effect change, then you need to come across as well-reasoned, not fud-filled. (edit: and don't let perfect be the enemy of good.)

I'd prefer to see them spending time on polishing their mobile app, which lacks in UX in important areas. For instance offline access to received, but yet unopened emails simply doesn't work. There is a (mis)feature where email bodies are downloaded only on notification, but in my case emails remain unavailable offline and Protonmail support was unhelpful.

But even if email-via-notification worked, it is still pretty much unusable. My usecase is to get to wifi, download emails and get offline, but with Proton mail I'd have to be super careful not to have my app open when enabling connection to wifi, otherwise it instantly downloads all headers and shows no notification, because app is in a foreground, after that there is simply no way to download message bodies other than opening them one by one in all folders. Surprisingly support saw not problem with this UX either.

This comment comes across as particularly callous. They are saying a part of why they may support the Huawei app store is to continue to provide access to the app to those in developing countries, and your response is to say you'd prefer them spend time on your personal UX pet peeve...

I don't use ProtonMail but this seems like a fairly fundamental issue rather than a personal pet peeve. In my naivety, it also seems like the kind of issue that would cause considerable pain in developing countries who might likely have spotty internet connections, which would lead them straight into said issue.

So whilst it might have been meant callously, from my third party glance it seems quite important.

It is personal in a sense that it is a personal experience and I am unsatisfied customer because of that. Offline access is pretty fundamental feature and it is utterly broken, when I see that they are going to spend company limited resources on a goal which doesn't benefit me as a customer, of course I am questioning whether their interests are aligned with mine.

FWIW, offline access is even more important in developing countries, yet devs living in Switzerland and clearly having no probem with their 4G coverage are failing to realise that.

As a counter, I wouldn't prefer that — yes, there are UX improvements to be made to both the app and the Web UI, but I think multiple distributions channels are welcome.

Ideally, pushing the APK to multiple distribution channels is mostly a one-time job to integrate with their build and deploy pipelines and then it's relatively business-as-usual, so I would imagine it won't take away a lot from development effort in other places once up & running.

As a non-Google Play user, I'm installing via Aptoide (a platform I don't _really_ trust yet) and relying on signatures to validate that the package is valid. Any moves by ProtonMail to offer '1st party' distributions (e.g. F-Droid) is really welcome.

I'd prefer WireGuard support.

But I guess there just is not enough demand for that.

You'd prefer WireGuard support in an email service? What do you mean by that?

For ProtonVPN. Same company. Statement made on the assumption that resources spend on ProtonMail can be spend on ProtonVPN (which I admit is a stretch).

Given how simple WireGuard is to set up I don't understand why they don't support it. Their UI etc, sure. Then just make it alpha or beta or whatever. I'd happily test it. Give feedback, etc.

Meanwhile, I paid for a 2 year sub and barely use it because of this reason. Instead, I run a WireGuard VPN _to_ my home cable connection.

OK for ProtonVPN I am less confused about where your request is coming from. But I still don't see why your ProtonVPN subscription is totally useless to you because of no WG.

Your WG tunnel to your home is nice for accessing home stuff from outside, and for protecting your use of the coffee shop wifi, but it isn't anonymizing your traffic to your home ISP or to websites you use, which is a big reason for using a VPN product.

Reply on news.ycombinator.com