Technology

It’s also worth clarifying that ProtonMail doesn’t collect IP addresses by default. Instead, the monitoring/ logging starts after ProtonMail gets a legal request.

They still have to adhere to legal requests.

The police gained access to the IP address because Swiss authorities chose to cooperate with the French government

We've seen this several times now. Proton is subject to Swiss law, just like every company in their respective countries. You choose Proton because Switzerland has the most privacy protections of any country on the planet (for now).

If you want private communications, don't use email. In fact, if we could all stop using email entirely, that'd be wonderful. There are hundreds of truly-private alternatives, many with no company involved at all.

Apart from it's an old story, discussed already back and forth, Proton's claims regarding privacy are really weak. Especially when it comes to presenting Switzerlamd as a privacy safehaven. Switzerland is a tax evasion savehaven, not a privacy safehaven, Proton. How Proton puts it: we provide world class privacy (but have to break our claims and comply with Swiss law immediately once there is a legitimate or not request from law enforcement, oepsie sorreyy!)

Why is this a surprise? IP Logging is pretty normal for any service.

2.5 IP logging: by default, we do not keep permanent IP logs in relation with your Account. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our Terms of Service (e.g. spamming, DDoS attacks against our infrastructure, brute force attacks). The legal basis of this processing is our legitimate interest to protect our service against non-compliant or fraudulent activities. If you enable authentication logging for your Account or voluntarily participate in Proton's advanced security program, the record of your login IP addresses is kept for as long as the feature is enabled. This feature is off by default, and all the records are deleted upon deactivation of the feature. The legal basis of this processing is consent, and you are free to opt in or opt out of that processing at any time in the security panel of your Account. The authentication logs feature records login attempts to your Account and does not track product-specific activity, such as VPN activity.

Source: Their privacy policy.

The lesson here is despite what a service says, don't trust it and take the appropriate measures to cover your tracks.

You can create an access the inbox through Tor at protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion

The important thing is to always access it through Tor.

Proton needs to get its head out of its ass and fire Andy already, grow a pair and get off Reddit and back onto Mastodon and face the backlash like actual adults.

Okay so I do remember this issue being brought up a long time ago so it's not exactly news and the author has a poor time lapse of events.

ProtonMail is not like a safe haven for any criminal operation, that would make Proton incredibly liable. Just like Telegram became with what's been happening with trafficking and children-related incidents.

Secondly, an IP address is like stupidly easy to get anyways on someone unless VPN.

There is just so many things wrong that people are not taking into account but I guess let others go on self-virtuous parades to demonize Proton. If you understand laws, this is not a problem. If you understand tech, you'd realize the same. If you understand both, then hooray! You get it.

Proton are very open about what they do and don't provide.

They're not going to protect you and they will turn on you the second they get a letter in the mail or a text from the cops.

But what they DO provide is the ability to register an email address (with a domain that isn't blocked by most services) without providing any other information. And, from there, you can encrypt it yourself if it is a particularly sensitive message.

As for IP logging? if only there were tools like VPNs and Tor to negate that.

So Protonmail was required to log the IP of the user after being ordered to via the proper international Swiss legal channeks, per Swiss/Europol law. And at some point recently, Protonmail thus removed the copy from their frontpage that advertised never tracking IPs.

What the article doesn't really explain, is what exactly changed about Swiss or euro law? And when? What rules or acts have sprung up that made this possible? Or, was this always something that was possible that has only just now made precedent?

It's important to hold accountable the named individuals who are harming individual security, safety, and trust in this manner so that they can be prevented from continuing to do so.

proton is arm in arm with the us government and republicans, so it should be expected that they'll track and sell you out.

Oh ffs. We have known for years that Proton is just a for profit company like any other. They dont give a fuck about you or your privacy. They never have and they never will.

"climate activists have been taking over commercial apartments" So ... trespassing? They breached privacy for apparent trespassing? Is that it?

I dont really blame Proton for this. Accessing anything on the internet on a clear connection and not through a VPN or TOR makes it your own damn fault when you get identified.