Maybe what they mean is that the swiss authorities have no legal basis on which to force them to serve a modified, backdoored, client like the one you're talking about.
And "Unlike competing email services, we do not track you."
Nowhere does it say "Unless your government asks the Swiss government then we'll capture, log and report every IP address you use".
Source: https://protonmail.com/security-details
Screenshot: https://imgur.com/a/gfUcYme
And this marketing copy was rewritten after this incident.
Before this incident it didn't say "opt out of tracking". How does one "opt out", by using Tor?
It used to say, in bold print, "No tracking or logging of personally identifiable information".
No weasel words about requiring the user to take some unspecified action to "opt out". No asterisks or caveats or warnings of any kind.
It also used to explicitly promise: "we do not record metadata such as the IP addresses used to log into accounts".
Now that part is mysteriously gone.
Pretty shitty to quietly flush this down the memory hole, then pretend nothing's changed, blaming and gaslighting users for not understanding.
Source: https://web.archive.org/web/20210607023937/https://protonmai...
Screenshot: https://imgur.com/a/R1muChN
Other email providers keep logs that they provide to governments when there's a legal order.
What's the point of bragging about "no tracking or logging" if you're just going to track and log like every other email provider if the government asks for it?
And they would. They don't keep those records. However, when a government agency shows up with a court order that states they have to cooperate and provide those records going forward they must comply.
> What's the point of bragging about "no tracking or logging" if you're just going to track and log like every other email provider if the government asks for it?
Again: a reasonable person would not assume that their email provider is a criminal enterprise that does not comply with the law.
No one with the least understanding of the internet could suppose that Protonmail could not be forced to provide the IP address associated with a user's login, which I assume is what happened here.
I think PM's approach is more lipstick on a pig. It may be a good looking pig compared to the other pigs (gmail), but it is still a pig. Blue ribbon pigs are still a pig.
Am expecting some real change if PM wants my $.
The idea that someone can just pay €60 per year and expect to be safe from State prosecution seems so naive.