Hacker News Reader

coffeeandbookson Security experts declare all Proton apps secure after security audit

This is so smart, I wish someone would have thought about this a long time ago!

Joking aside - making good privacy laws is not an easy task. “privacy” is not even easy to define, much less create fair laws around what will likely be an imperfect definition.

coffeeandbookson Security experts declare all Proton apps secure after security audit

> Well, conflating "security" with "following the law" seems odd. Do anyone realistically expect a legally incorporated company to not follow laws?

I’m talking about privacy, not security. And again, this has nothing to do with their official policies listed on their website, but rather their tendency to market themselves as “a super private e-mail provider built by CERN scientists.”

I think for many use cases (e.g., political activism) most peoples intuitive idea of privacy does not align at all with what ProtonMail actually provides.

> In the end, if you rely on any single company for both your security and privacy, you're playing a loosing game. Not hiding your IP when signing up for something when you're planning to do illegal activities? Maybe time to reconsider your opsec strategy.

Totally agree. But again, this is less about getting the average individual to rethink their op sec strategies, and more or less about ProtonMails proclivity to market themselves as an organization that solves these opsec problems for you.

This article is yet another example.

coffeeandbookson Security experts declare all Proton apps secure after security audit

ProtonMail has a bad history of irresponsible sensationalism. It’s like constantly marketing yourself as the most private e-mail service “built by CERN scientists” but who will give information about you to authorities:

https://www.engadget.com/protonmail-climate-activist-ip-swis...

I know that ProtonMail doesn’t claim to protect your IP address, but I don’t expect the average user to make that distinction.

This is another dumb article. Getting your service tested for vulnerabilities is good hygiene but it shouldn’t be used as marketing material to make users think your service is Fort Knox.

coffeeandbookson Zero-Knowledge Middleboxes: enforce network policies on encrypted traffic

> middlebox doesnt see plaintext, it sees encrypted TLS, decrypts it, inspects in memory, and ecnrypts it back again to send it to next hop.

So it sees the plaintext.