Hacker News Reader

Comment by simonh | Hacker News Reader

You can't buy immunity from the legal and law enforcement system, full stop. That's simply an unreasonable expectation.

What you can buy is various degrees and quality of sensible defaults and behaviours that serve your general interest in privacy and security. Privacy from casual snooping or commercial tracking, security from unsophisticated attacks or even sophisticated attacks if you're wiling to also sacrifice some convenience.

These are all worth having, and your choices of product and service provider can have a significant impact on them. I know little to nothing about ProtonMail but maybe they're a better bet than many other similar services, even if they're not perfect.

View on HN

Right but they could have said "we can be compelled to log IPs, you should use Tor if that's something you care about".

in TFA they claim they did in 2014 and hint that it's a reason they provide an onion site

Yes, but expecting a prospective user to read all your blog posts back to 2014 to discover a line saying you can be compelled to identify them is hardly transparent.

It’s linked from their main site Security page, and it’s in their Knowledge Base.

I can't tell if you're trying to make the above poster's point or argue against it.

A blog post from May 2014 isn't sufficient, no matter where it's linked from.

> Right but they could have said "we can be compelled to log IPs, you should use Tor if that's something you care about".

ding ding ding. pin this comment.

The do tell you this, up front, if you read.

Can you define what "up front" means to you in this example? Homepage, privacy policy, user agreement, tweets?

As posted elsewhere in another comment, https://protonmail.com/blog/protonmail-threat-model/

Not recommended

If you are attempting to leak state secrets (as was the case of Edward Snowden) or going up against a powerful state adversary, email may not be the most secure medium for communications. The Internet is generally not anonymous, and if you are breaking Swiss law, a law-abiding company such as ProtonMail can be legally compelled to log your IP address. A powerful state adversary will also be better positioned to launch one of the attacks described above against you, which may negate the privacy protection provided by ProtonMail. While we can offer more protection and security, we cannot guarantee your safety against a powerful adversary.

Buried in a blog post from May 19th, 2014 doesn't meet my definition of "up front".

https://protonmail.com/blog/protonmail-threat-model/

> The Internet is generally not anonymous, and if you are breaking Swiss law, a law-abiding company such as ProtonMail can be legally compelled to log your IP address.

The "Threat Model" blog post is linked from their main site.

Protonmail increasingly seems like one of those Tim Ferris type scams. The one where you build a nice solution and write a bunch of blog posts...

And then you just let it run for 10 years without doing any more work and it just rots away.

I fail to see why it is their duty, or in their interest, to explain the nuances of Swiss court orders and extent of their powers in their marketing material.

If its something you care about, you should not be making your choices on the basis of marketing splashes and you should certainly not need your email provider to explain Tor to you.

This seems like a logical fallacy many Linux users seem to make.

I want the benefits without being a mechanic. And I'm willing to pay money for it. Lots of money.

Protonmail cannot, cannot protect you on their own from all privacy concerns, nor can they educate you in a frontpage splash.

Proper Opsec for dissidents requires multiple layers and technologies and simply cannot rely on a single vendor. Any proper company accepting credit card payments is going to be subject to court orders and there are limits to their ability to resist them.

Protonmail has taken extraordinary measures to limit their exposure to those risks but anyone who is assuming they can e.g. be an enviro-terrorist or CCP dissident and be safe solely because they use Protonmail is terribly naive and ignorant..

Oh, but on the contrary. Money buys better lawyers, more time and more research capabilities so in essence you can reliably say, at least in the good ol' USA, that money can buy immunity. The same can be said in many other countries where the corruption of buying justice is more direct.

Hasnt the popularity of Signal been the result of their system literally not able to record IPs?

How do you think the Signal servers send data to your app if they don’t know, at least temporarily, the IP address of your device?

Whisper Systems say they don’t record/log that. But they are no more able to defy legal demands in their jurisdiction to do so than Proton Mail were.

you should read about standard intelligence operations and how underground resistance organizations have historically operated ie. French resistance in Nazi-Occupied France, etc. for a case study in covert comms.

the key you pointed to tho was regarding convenience. simple fact is that most of the usability desired in consumer email is not compatible with the practical design principles of covert communications.

Reply on news.ycombinator.com