sebiw

Title got renamed

Here's the video: https://developer.apple.com/videos/play/wwdc2019/710/

I think we should not think of "request" in the same way as a court order. This seems the essential difference to me.

By the way: The author of the post is an attorney at law and member of the Chaos Computer Club (CCC), which makes me believe that he wouldn't falsely accuse ProtonMail.

Quote from the post:

> ProtonMail even mentions a current case of real-time surveillance:

„In April 2019, at the request of the Swiss judiciary in a case of clear criminal conduct, we enabled IP logging against a specific user account which is engaged in illegal activities which contravene Swiss law. Pursuant to Swiss law, the user in question will also be notified and afforded the opportunity to defend against this in court before the data can be used in criminal proceedings.“

By writing of a „case of clear criminal conduct“ and of „illegal activities which contravene Swiss law“, ProtonMail violates the presumption of innocence against the monitored suspects. Such suspects are of course not informed by ProtonMail about ongoing real-time surveillance measures.

From the addendum:

> I was live-tweeting the event, including the interesting presentation by public prosecutor Walder. The remark that ProtonMail was a (potential) PDCS would have been too trivial to be live-tweeted. The insight on the other hand that ProtonMail voluntarily offers assistance for real-time surveillance, was spectacular and I therefore live-tweeted the statement. In its transparency report, ProtonMail – as mentioned above – itself refers to at least one case of real-time surveillance.

A sad day in the history of Switzerland. Especially in times of Snowden and mass surveillance revelations.

Use Rails 5 Release Candidate. Rails has everything you need to develop a web service / API for a mobile app.

Also, there is a new API-only mode in Rails 5 which could come in handy for your case (API development): http://edgeguides.rubyonrails.org/api_app.html

Hi Marco,

I'm so happy I finally have a person to talk to that seems to understand me.

Thanks for providing me the link to cobalt.io. I've never heard of that platform before. I just registered. My username is sebi

I'd think it would strengthen the position that you care about security if you would dedicate a page on your site to security. Would really like to see something like that. Not only as a security researcher, but also as a customer of yours.

I don't feel comfortable emailing out such a vulnerability if I can't tell to whom I'm writing and who can read the disclosure.

Don't know why they are issuing such a statement. As of right now it clearly isn't fixed.

I never asked for any money. Here's my full initial email to them:

"Hi

I would like to inform you about a critical security vulnerability on your site.

The vulnerability allows an attacker to reset the password of an account by simply knowing the targets email address.

Please reply with a signed S/MIME message and I will precisely explain the vulnerability to you.

Kind regards, ..."

4) would only make sense with signed DNS responses

I also think of it as "don't settle for what is already there".

German hosting provider Hetzner, also had a DNS outage about one hour ago.