Sir Tim Berners-Lee joins Proton’s advisory board
protonmail.com
protonmail.com
Building an internet and providing privacy don't go hand-in-unlovable-hand with SaaS. Decentralization is an important solution to most threat models, as is having physical possession of your server and data. Centralization is the problem here.
Why complicate things when you could just acknowledge that email is archaic and unsuitable for privacy in 2021, and start running your own Matrix home server if you have something worth keeping private?
Trotting out Berners-Lee isn't helping their credibility following the environmental activist debacle. Actions speak louder than words. As has been evidenced, centralized privacy-oriented SaaS provided by businesses are not fit for purpose. Users should take responsibility for their own data and assume everything is compromised by default.
He's also sold a gimmicky cryptoart NFT through Sotheby’s, contributing to and indirectly endorsing environmental destruction. He of all people should be leading by example with how to make existing and future technologies more environmentally-friendly.
Didn't creating the web also indirectly cause a lot of environmental destruction? Oh, you mean that your energy use is strictly necessary, whereas other people using energy for something that doesn't interest you is morally wrong. Got it.
* ProtonMail Tor hidden service is mostly a joke. Their signup isn't available over it. This combined with no support for actually anonymous methods of payment make their advertising of "anonymous email" dubious. I understand the challenges involved, but if you can't overcome/mitigate them, then don't make those claims.
* Email is not a secure protocol and most every permutation of webmail is not securely implemented. Unless you're using PGP on the client side you will be trusting the provider.
* The steps required currently to run webapps and verify they haven't been altered are obtuse especially if you want to continue to get any kind of new features or updates.
How can they not be transparent? They don't have any technical reason to make any security claims.
With email it's either that or they go after wherever you're hosting from.
I'm struggling to figure out what comes after ProtonMail. It's clearly an evolutionary dead end but what succeeds it?
That is unlikely to ever happen as Signal doesn't allow any kind of third party clients. https://github.com/LibreSignal/LibreSignal/issues/37#issueco...
That said Matrix does lend itself to this. It's also worth noting one of the major VCs (Notion) that funded that has an interest in other email companies. So who knows maybe we will see an email message client based on Matrix protocol.
It certainly would be an improvement on relying on systems such as PGP and allow universal E2EE, but also E2EE to the border (required for many government/corporate) situations where auditing is required.
> I'm struggling to figure out what comes after ProtonMail. It's clearly an evolutionary dead end but what succeeds it?
Likely nothing. Many people that use services like this don't require anonymity. For that the threat model is absolutely fine. People seem to forget this page has existed literally since 2014: https://protonmail.com/blog/protonmail-threat-model/
I think people have blown this case out of proportion without really having any facts. Minimal details are actually known the nature of what the criminal charges are about.
There hasn't been any public verified information (court documents etc) pertaining to why the request was made. The most ProtonMail has said is that it was a judicial request made in Swizterland, and there was no avenue to appeal the request.
Media latched on to sensationalist phrases like "climate activist" and "squatter" and those things in itself don't actually tell us very much about the nature of the charges and evidence against the suspect. Those things may not even be the reason the request was made.
Any insights from the early days of the development of email? Does LibreSignal fork, provide interoperability, and just take over, becoming the "email" of tomorrow?
I'm a paying ProtonMail customer. I may be incorrect but am not distracted by the criminal charges stuff as you suggest. Protonmail stated they don't log IP on their homepage. What they meant was "unless the cops ask us". So now they've changed their marketing to update this. I'm satisfied but it also exposes the need to "trust our company", and that's just not sustainable, no matter the company.
The project was discontinued. You can't develop a "Signal client" without relying on Signal servers. If you do, then you'll need your own server and there is no facility for it to talk to other servers. That pretty much makes it dead in the water.
Something like Matrix which does have federation lends itself to that usecase though.
> Protonmail stated they don't log IP on their homepage. What they meant was "unless the cops ask us".
They don't log IPs if you don't enable advanced logs. They do however and have always said they will comply with legal requests from a Swiss court.
It is in their privacy policy, https://web.archive.org/web/20210627220655/https://protonmai.... This snapshot is from earlier this year.
> We will only disclose the limited user data we possess if we are instructed to do so by a fully binding request coming from the competent Swiss authorities (legal obligation). While we may comply with electronically delivered notices (see exceptions below), the disclosed data can only be used in court after we have received an original copy of the court order by registered post or in person, and provide a formal response.
It's also mentioned on the threat model page https://protonmail.com/blog/protonmail-threat-model/ and
> The Internet is generally not anonymous, and if you are breaking Swiss law, a law-abiding company such as ProtonMail can be legally compelled to log your IP address.
Also mentioned in their transparency reporting https://protonmail.com/blog/transparency-report/.
So that never was if the "if the cops ask". There would be many cases that are denied, and we know this from their transparency reports.
The issue is some very silly people thought this meant a law abiding company would risk prosecution/contempt by not abiding by the law/courts. They failed to read any of the company's policies which have been on the website clear as day and got upset about that.
The reason Protonmail is modifying their marketing is to keep people happy who don't have the attention span to learn about any of the products they use from reading any of the documentation.
Given Protonmail trust issues Sir Lee ought to have avoided.
Signal mail service/client would be great too. Long time FastMail user but they too give fuzzy answers on mail privacy. Mailbox.org seems to be decent with encryption at rest.
They will do IP logging if they receive relevant court requests.
> Also provides ability to send encrypted mail with pre shared passwords. Good client apps too.
The only client app you can use is Tutanota's client/web browser.
Last I used it you couldn't export a whole mailbox (only individual mails and directories), you couldn't have folders more than 1 level deep, and you couldn't import email.
You also can't encrypt emails to Tutanota users without using a temporary mailbox on their server. They could very easily disable encryption to particular users.
You can't use third party clients (thunderbird, mutt mail.app etc), and if you're used to those it's a no-go.
People always question whether or not ProtonMail could give you dodgy js that exfiltrates your password/private keys, the same goes for Tutanota, but in the case of Tutanota, you have no option to use a mail client, ie code not written by them.
Your not required to log IP's as a service provider in Switzerland, however the ISP is required to do so.
Every message that I send is mainly related to work and personal communication is related to consumerism topics. Everything else is communicated in physical presence of the person that will receive the talk.
It is over. Internet is commercial outlet. I use it as such. Our devices are data collection tools. Our future is engineered towards automation of policing and processing. Decentralization of Internet will not be allowed and possibly be outlawed in the coming years.
In the moment in which VPN is prohibited I am prepared to go totally offline. I have so many books to read, and music to listen to without paying corporations a dime.
The basic computer functions that are needed in this context can be provided by old computers with Linux without a problem.
Welcome to the future, where you censor yourself willingly and avoid corporate technological advancements as a plague. :)
His name is occasionally trotted out to impress(?) people, and that's it.
Because that's what you do when someone is a Knight?
https://en.wikipedia.org/wiki/Tim_Berners-Lee#Awards_and_hon...
A good example of this can be seen in the Constitution of the US. "No Title of Nobility shall be granted by the United States: And no Person holding any Office of Profit or Trust under them, shall, without the Consent of the Congress, accept of any present, Emolument, Office, or Title, of any kind whatever, from any King, Prince, or foreign State."
It was the Queen who granted him the title, not Switzerland.
But on the positive side, one does not have to use PM. There’s plenty of encrypted e-mail providers out there that will not store any info whatsoever on their customers and should the police ever dare question them they’d rather die shooting than give them anything anyway.
Protonmail, from what I understand, does contest the requests it receives, but some they have to follow. My impression is that this would be true for any provider.
Also, your VPS provider can still be compelled to (try) deanonymize you.
E: ... aside from some sort of Tor-based attack, of course.
i can imagine this being not a difficult endeavour
What dark magic have you done to make this a reality?
To be fair though, his decision to approve EME as a web standard[0] has not had the disastrous effects that some of his critics imagined.
[0] https://www.theregister.com/2017/03/06/berners_lee_web_drm_w...