This is feedback from Proton Mail Team I got about this matter:
"Thank you for reaching out and sharing your concern. We understand why this story is alarming, and we want to give you a clear picture of what actually happened.
First, Proton did not provide any information to the FBI. The data was obtained by the Swiss Federal Department of Justice through a Mutual Legal Assistance Treaty (MLAT) process. Proton operates exclusively under Swiss law and only responds to legally binding orders from Swiss authorities, after all Swiss legal checks have been passed. This is clearly stated in our TOS and Privacy Policy.
In this specific case, Swiss authorities determined that the legal bar was met because a law enforcement officer had been shot, and explosive devices were involved during an incident in 2024. Switzerland has one of the strictest privacy frameworks in the world, and legal assistance is only granted in cases involving serious criminal matters.
Importantly, the only information that could be disclosed was a payment identifier because the user chose to pay by credit card although Proton accepts gift cards, cryptocurrency and cash. No emails, no message content, and no communications metadata were handed over. This actually demonstrates how little data Proton holds by design, our end-to-end encryption means we cannot access email content even if ordered to.
We hope this provides some reassurance. Please don't hesitate to reach out if you have any further questions.
Even if you only read the headline, you can work out the most likely story from logic. Someone else in this thread already said it: they're not gonna go to jail for you over a small subscription fee, of course they're complying with local laws and then the Swiss people handed it over to where they got the legal assistance request from. It's also not the first time Proton cooperated with a legal request from Swiss authorities, or Signal or other similar companies for that matter. The story tells itself no matter what part of it they decide to stick in the headline
Nothing of that email is new to me, and I didn't read the login-walled part which was like the third paragraph onward or something (I think it said it's free to read once you sign up, so not a paywall, but yeah either way)
I think 404 Media has an ethical obligation to provide Proton Mail’s response outside the article’s paywall. The word “Helped” in the headline is more sensational than stating that Proton “was required by Swiss law to provide...”
For readers who do not want to pay to read the article, the headline leaves incomplete context and creates a misleading impression of the story. That damages Proton’s reputation, and the missing context is only available if someone pays for the article, reaches out to Proton, or searches forums for substantive information.
> The records provide insight into the sort of data that Proton Mail, which prides itself both on its end-to-end encryption and that it is only governed by Swiss privacy law, can and does provide to third parties.
Didn't Proton already say that they were physically relocating their servers outside of Switzerland because the Swiss government couldn't be trusted?
Although I guess the server location didn't matter in this case since all they wanted was the billing information and the credit card info to identify the person.
> Didn't Proton already say that they were physically relocating their servers outside of Switzerland because the Swiss government couldn't be trusted?
They said they want to relocate to Germany which I would say in a polite way, is much worse in this regard.
In what sense? Germany has among the strongest judicial oversight for invasion of privacy in Europe. Due process is followed when securing search warrants that provide access to subscriber data (Germany does not have administrative subpoenas like in the US and other countries).
Former attempts at surveillance have been struck down in the Bundesverfassungsgericht, and the right to privacy has even been affirmed for foreigners (as opposed to other countries like the US that reserve that foreign nationals have zero due process rights for invasion of privacy).
Germany is an absolutely terrible choice for this. Other Email providers such as Tuta which also offer encrypted emails, were forced to install a backdoor. As soon as the police arrive, every future email sent to the account in question is copied unencrypted without the person being informed.
This is much worse than passing on payment details or stored backup email addresses, as Proton Mail is required to do in Switzerland.
> Other Email providers such as Tuta which also offer encrypted emails, were forced to install a backdoor. As soon as the police arrive, every future email sent to the account in question is copied unencrypted without the person being informed.
Important caveat: Tuta was required by a court to provide police with access to a customer's _unencrypted_ emails (ie regular SMTP mail). The police had also asked for a backdoor to Tuta's E2E emails, and that request was rejected by the courts.
But the idea behind Tuta and Proton is that emails are encrypted when they arrive in the inbox. The fact that emails sent between Tuta users are still safe offer little added value because distribution is far too limited. The reason people choose such a provider is that they do not want the authorities to have access to their mailbox, but this is undermined by a backdoor. Switzerland is much better off in terms of the legal situation in this area.
In the sense that it's a joke that caves in to the flimsiest pressure from a certain superpower. Although pressure is a bad choice, it's more like it's a wholy owned subsidy.
Their end-to-end encryption is pointless because the vast majority of any recipients will just leak the plaintext emails via their own account providers anyway. It only works under very specific circumstances (all parties are using it). I think their marketing overstates what their secure private email actually means.
Yes. If you send an email from a protonmail account to a gmail account that email is in google's system. Same if in the other direction. Would anyone using protonmail not know this. I would guess at least 99.9% of proton users understand this.
This should surprise exactly nobody after it was disclosed back in [checks notes] 2021 that ProtonMail gave up user data to law enforcement and also changed their TOS.
>after it was disclosed back in [checks notes] 2021 that ProtonMail gave up user data to law enforcement and also changed their TOS.
You shouldn't even need that. A warrant isn't a strongly worded letter that they can just turn down. It's the law. Therefore you should assume that if the police can get a warrant, they can get your data. Even for people who don't follow the law (criminals), there's no guarantee they won't snitch on you.
Source? We need the exact claim here, because there's a fine line between "we're in switzerland, so warrants aren't a thing!" (outright false) and "we're in switzerland, which have better privacy laws than other countries!" (debatable).
> Switzerland is a fundamentally different environment. Two of the things Switzerland is most famous for are also highly conducive to data protection: privacy and neutrality.
> When a law enforcement agency in the US requests user data from a Swiss company, it is illegal for that company to provide the data. At Proton, we reject all data requests from foreign agencies.
> Proton and other Swiss companies will only hand over user data when ordered to do so by a Swiss authority. And even then, Proton’s general policy is to challenge data requests whenever possible and only comply after all legal remedies have been exhausted.
So maybe your parent poster is confused? They do claim that being Swiss protects them from requests from foreign entities, but not Swiss entities. Which is what happened here, the Swiss authorities asked Proton for the data, then they handed it to the FBI.
Has Proton challenged the data and “only complied after all legal remedies have been exhausted”, though? That’s another question.
I wonder if the FBI knew it was going to be a pain in the ass asking for actual account access from the Swiss so they asked for financial records instead. Terrorism charges look pretty serious (regardless of how legitimate they are) so I'm sure that's what pushed the Swiss and Proton to comply.
But the Swiss have the notion of a warrant, no? So if a Swiss judge or official issues a proper warrant, then a Swiss company or citizen is obliged to comply with it.
Read the wording, they aren't complying with US warrants, they are complying with Swiss-issued warrants. US LE/Intel agencies figured out this loophole some 20 years ago.
Proton Mail complied with a legal demand they had no choice but to comply with, providing the basic shred of information the user willingly and knowingly provided.
You want to be anonymous? Don't use your credit card! Don't connect from your home internet connection. (I don't know whether this person did because I can't read the story due to login-requirement). Either way, total non-story. Anyone whose potential adversary is a powerful government should already know this stuff.
Either way, Proton didn't help the FBI. The article title is deceptive and implies a degree of insidiousness or dishonesty that has not been demonstrated by Proton in this case.
If I'm not mistaken, proton didn't give anything to the FBI, they provided what was required by law to the Swiss government who then gave it to the FBI. It's a small distinction but it matters.
> Like if the FBI subpoenas my public key and I comply, that’s helping them?
If you're helping the FBI to do their job (conducting federal investigations), then yes, you are helping the FBI. Unless your definition of "to help" includes the absence of any possibly coercive circumstance.
As a proton user I know I am not completely anonymous. I pay them for their bundle of services because I get VPN, encrypted password storage and email that isn't scanned for ads and other purposes.
Privacy and anonymity are a gradient. If I needed real opsec from government threats I wouldn't tie a credit card to a service.
If you don't want to receive the punishment for thought crimes, which is being threatened outright more loudly every day, it's increasingly difficult to actually have a dissenting voice online. Don't believe me? Set up a linux VM, Mullvad VPN with a killswitch, then run Tor browser. You MAY be able to get a TutaMail account, which requires a backup e-mail that disappears after a short period of time (allegedly), and then a Proton account with the TutaMail account as your required backup there, but all of the privacy-first "anonymous" services require some form of verification. Then, if the social media network isn't blocking you from signing up via a Tor exit nodes outright, you are immediately shadow banned.
I remain very annoyed with the massive number of engineers that are making it possible for people who can't figure out how to check their e-mail to utilize advanced technology to spy on us, steal our tax money, pervert the technologies we build, and indiscriminately murder innocent people.
We are a community of greedy ladder pullers and that's so disappointing.
I generally just use tor browser and proton (verified through a disposable email address only accessed via the tor browser) - seems secure enough for me?
To the extent it works that's a loophole. I can't speak to proton specifically but the majority of services don't want to permit disposable email because the entire point is to cut down on spam and abuse.
I can appreciate having the option of providing a phone number or email or whatever but I think the state of the ecosystem is telling. The option for anonymous email with PoW per outgoing email isn't provided despite largely addressing the commonly cited rationale for requiring some sort of verification. And we're still stuck bashing PGP, shilling for competing E2E message solutions while it's plain as day that the vast majority of commerce isn't going to move off of email any time soon. Meanwhile TLS can figure out how to distribute public keys via DNS as part of implementing ECH in all major browsers over a period of less than a decade.
While I don't use disposable emails I've been converting all my accounts to unique emails with either Firefox Relay[0] or using my personal website[1]. Bitwarden has made this easy as they let you import your Relay's API key and so every new site gets unique usernames and passwords[2]. It certainly is making it easier to block spam, and you get to know who is leaking your emails[3], and I've burned emails because of it. Frankly at this point the biggest problem is having a 20 year old gmail account. But the plus side of this type of system is that you can move your endpoint, so where Relay/CF directs the emails too, making you less reliant on your email provider[4].
There's pros and cons. On the plus side, unique identities for every site and by getting a catchall domain you can even generate valid addresses via pen and paper. Probably the biggest benefit is just searching emails. On the cons, document sharing can be a bigger pain than it already is (how is this still a pain all these years later?). Also, people get very confused when you tell them your email address is TheirCompanyName@godelski.mozmail.com (I don't actually have that domain, don't send emails there).
It's helpful but I think represents a fundamental flaw in our ecosystem.
> And we're still stuck bashing PGP
I can't believe we haven't normalized this in the nerdy spaces, at least not to the degree of things like Signal. It is a thing that can be entirely automated and both Thunderbird and NeoMutt are able to handle this for you and make it effectively seamless. The average person does want this stuff, but they don't want to think about it. The problem is that they think their stuff is already private, or they say it can be spied on but that they're not worth spying on so they think it is effectively the same thing.
[2] What doesn't help is how prolific OAUTH is becoming.
[3] Sorry, adding +something on your gmail won't work these days.
[4] I'm actually looking. People say TutaMail but sorry, I need something I can use with either Thunderbird or NeoMutt... This is non-negotiable. Everyone has multiple email addresses these days and I'm not checking 30 different sites. The problem is already one of poor organization.
I know its effecitvely a vendor lock-in and not what you are looking for but I love the SimpleLogin integration that Proton made with Proton Pass.
I have it setup in my browser and phone. Whenever a website or app would like an email for an order or something else, it takes a single click to generate a named alias (using the website name) e
Which forwards emails to my normal inbox. Replying to any received emails also uses the alias.
The SimpleLogin interface could use some improvement though. Deleting unused ones is a bit tidious.
I use SimpleLogin with custom domains but kinda meh.
Brilliant for quick creation of temporary emails, but app troublesome and doesn't show the all options, but much to my disappointment they don't do proper SRS, so it invalidates any, ANY benefits from DMARC or such.
Emails that with SRS would have a proper From, organisation logo from BIMI record, now immediately end up in Spam and are marked as phishing attempts.
I had a better success with personal postfix server forwarding my catch-all alias mail to Gmail than I have with SimpleLogin.
The only thing that is better is that replying to emails is easier, but that could be done while staying compliant with SRS.
I regret buying the subscription and I won't be extending it. Should've go with a proper email service, not a glorified alias generator.
>"it's increasingly difficult to actually have a dissenting voice online."
If willing, I would appreciate some examples, actual or hypothetical. I have left a few comments regarding my concerns over AI and have been surprised by the hostile reactions. Much of my research kindof revolves around a central concern matching your statement. But my perspective is in a vacuum, out of touch with what others are dealing with. Feel free to ignore this if not comfortable.
Don't apologize for your truth. A lot of people on reddit/HN fancy themselves as free-thinkers and the moment something contradicts their reality they reveal themselves to be as emotionally vulnerable as the rest of humanity.
It was already going downhill a decade ago, eg, using bad think on video games.
But my personal experience is something snapped in a lot of people during COVID when people asked reasonable questions like — “is an experimental gene therapy really QALY positive in populations not at risk, such as healthy children?”
According to government actuarial tables, the answer was no: the UK government concluded that there was no point at which for those under 40 the immunizations prevented more serious outcomes than they caused. But people were (and often still are) absolutely rabid if you point out we (in administering a QALY negative treatment to a vulnerable population) decided to poison children and young adults en masse. I’ve had people look up my mother on Facebook for calmly citing UK government actuarial reports, which did the calculation on COVID vs vaccine harms.
That’s setting aside that on HN you’d get shadowbanned for even posting the clip of BLM leaders describing themselves as “trained Marxists” and BLM itself as Marxist in ideology. Apparently, no matter how politely you state facts, if HN froths irrationally in response it is an “inherent flamewar”.
But I’m not sure I qualify for what you’re asking, as I generally post under my true identity, not anonymously.
HN is a place where people don’t ask what is true with intellectual curiosity but classify opinions as “problematic” and justify bullying people based on that.
HN becomes emotionally upset if you discuss actuarial tables or quote people’s own words from their own presentations because those facts go against the narratives many on HN believe — and like many before them, people on HN believe censorship and bullying are justified by that emotional turmoil.
As you just did, impugning my character while carefully avoiding the veracity of my claims — only saying they’re “problematic”, as a good apparatchik would.
HN was one of the best places for finding cited research regarding covid and the mrna tech at the time.
With all the other conflicting information floating around online, it was a breath of fresh air to come to HN and see articles describing exactly how mrna works and why it was likely not a health risk, complete with thoughtful discussion. I'm too lazy to go look up citations and reference those old posts, so you can take this as anecdotal.
Little bit of projection in this comment, I would say. I didn’t reference your character, just your opinions - to equate the two is a bit juvenile - which now may be a reference to your character.
Also, “problematic” is perhaps the least emotional word I could have used, and yet you still found issue with it.
I would advise you stop viewing HN as a monolith, it will help you get over your victim complex, which will in turn hopefully help you see opinions as things worth changing based on new information, rather than value for your character.
Yeah it’s a euphemism and a bit of a shibboleth, which, like all shibboleths, can be a bit triggering to those who feel outgrouped by it.
I could’ve been more precise: “opinions that are based on weak evidence that confirm a certain preimagined view of the world rather than challenge it”.
I mean they made claims about the efficacy and risks of the COVID vaccine without sourcing them and used verbiage like "poisoning our children" to refer to vaccinating them. I think tip of the iceberg for "problematic opinions" is a fair response.
Just noting that I appreciate all the examples given here and by others, many of which made me feel a bit stupid and amnesic for asking my original question. I guess I have been over-focused on AI...
> That’s setting aside that on HN you’d get shadowbanned for even posting the clip of BLM leaders describing themselves as “trained Marxists” and BLM itself as Marxist in ideology. Apparently, no matter how politely you state facts, if HN froths irrationally in response it is an “inherent flamewar”.
Funny how you mention this like you expect everyone to take for granted that Marxist=bad and worth "hiding" etc... whereas negative reactions are likely due more towards that internal judgement discrediting yourself, vs trying to "hide the Marxism."
You think you can discredit people by saying "they're Marxists!" and yet you think people today are uniquely bad snowflakes about views they don't like. You're proposing that people are more likely to cry thoughtcrime now than in the past, by inadvertently exposing how you've bought into this idea of how just invoking the name of some old philosopher is worth demonization and has been for DECADES in many western countries...
Specs and logs, motes and beams.
Which specific points from which specific Marx texts piss you off so much?
(It's also funny that you didn't actually link to any of the things you stated. I don't care about the things you brought up enough to go hunting for them myself to try do prove or disprove you, but... do you really think saying "I can't cite these simple facts without getting in trouble" *without even citing them, just asking us to believe you that they're easily cite-able, is gonna go over so convincingly?)
I've said this a million times to people in this industry: we have a Real Problem with adderall, it's abuse, and the way it robs a person of their ability to feel empathy. Yes, you're a 10x engineer, yes you write amazing code, yes you can work and work and get. it. done. But you'll also be A-OK with dark patterns, just fine with spying on people who aren't you, and hell, you might even think building the first Terminator robots is an interesting project.
Hyberbolic? Sure. But we live in a society that reinforces the idea that the performance enhancement is worth it. But there is a cost, and what you've described is it.
I've been on it, never once felt a lack of empathy, or forwent my principles. If that's happening to a person, it's likely a mask is just being lifted.
It's absolutely a continuum, which implies to me there will be people with your experience. Of course, you may not have encountered a scenario where your principles were on the line!
But then, I'd also agree there would be loads of cases where it is a mask being lifted, but isn't that the point? Is there a meaningful difference between "revealing one's true self" and "being robbed of an essential part of humanity" when the outcome results in the same antisocial behavior?
i think it's silly to think we just need gooder coders with better morals. if the tech industry didn't do what it does it wouldn't enjoy the position in society it has.
if youre going against the regime of hyperpathologization please be strong and gentle. people dont want to have their pacifiers ripped out, whether that be by lifting the veil of hypercapitalistic coercion, or simply by making plain the wealth of side effects that can be entirely avoided by ignoring artificial diagnoses and seeking solutions more in line with our biology.
like no shit people are going to be more willing to do the bidding of evil when their decision making apparatus is unnaturally saturated. and no shit people are going to have adhd symptoms in a screen based society. its completely obvious. but me saying that is going to get down voted to oblivion. people don't enjoy having a comfortable narrative questioned; dissent (no matter how minor) is equivalent to full scale assault on perceptions of existence. that being said, i dont blame anyone for this, considering that the entirety of existence is currently geared towards forcing the populace into fight or flight mode, thus rendering null the capacity to exact societal change and disrupt the status quo.
people really do think their best interests are at the heart of billion dollar companies like those producing pharmaceutical goods !
Yep. I still need to say it. I still need this audience, at least time tiny fraction, to hear it. This "community" specifically is so high on it's own supply that these things should be shouted from the rooftops:
- You're a fallible human and your ideas aren't always good
- Disruption isn't always good
- Moving fast and breaking things is a great way to leave a path of destruction in your wake and piss off everyone around you, and isn't always good
- Change for the sake of change isn't always good
Let's boil that down to: the shit you come up with isn't always good. Or to put it another way, rarely does it seem "should we?" is ever considered alongside "could we?".
Finally, as if it weren't obvious: I am not here for fake internet points.
the populace has been trained to unequivocally reject any thought that goes against the prevailing narrative. they have been lobotomized, removing the capacity to discern shades of grey. so when things are shouted from the rooftops, automatically they considered not to be worth listening to. if you really want to change people's minds it needs to be done gently, and generally on an individual basis. thats all i wanted to suggest ... internet points are relevant because the less you have, the smaller your audience.
>Where you one that downvoted every post saying we should have unions in software so we can protect ourselves as a group
In other professions such unions inevitably end up building a chummy relationship with the government and going along with whatever it says, software engineering wouldn't be any different. If anything it'd be worse because the government could pressure the union into removing the license of engineers who make privacy-preserving software.
Well currently, it's people being denied entry or re-entry to the United States due to the content of their social media accounts. Also, people getting door-knocked by the FBI for making posts on Reddit.
Historically, there won't be trials for this when it gets worse, so there won't be anyone charged or convicted. They will eventually just be murdered by a secret police force.
You’re not being criminally charged and convicted of a thought crime in this situation. You’re just not welcome to join the party. Big difference. Foreigners have no right to enter the USA other than by what the law permits.
Now, I don’t necessarily agree that we should be denying visas to people based on reasonable disagreements with US policy—after all, existing citizens are entitled to share those same opinions! But “crime” means something, and that’s not what this is.
Marketing, largely. But indeed Americans are free to think and write as they please without criminal consequences. They certainly have more protections than the British do (especially around defamation).
It is a bit different than what we are discussing, but intent plays a huge role in Western justice. The same physical action can lead to vastly different outcomes.
A high profile interesting example of this is the assassination attempt on Brett Kavanaugh. If you look at the details none of the actions would have been an attempt if not for the intent.
It is an interesting thought experiment as to how many actions you have to take for a crime that you don’t commit to be charged as an attempt or more broadly as conspiracy and at what point people are allowed to change their mind. We see this in terrorism cases pretty frequently.
> The same physical action can lead to vastly different outcomes.
Well, yeah, that’s kind of obvious once you realize that tools can be used for multiple purposes. A hammer can be used to pound both nails (legal) and smash a person’s head in (not).
But the notion that “thought crimes” where people are being punished merely for their feelings and where no act in furtherance of the outcome has taken place is just baloney. At least in the West.
Where are the stories about all the other mail providers who routinely cough up everything about your email account, including full content, metadata, and full payment details, on a daily basis?
Proton is one of the few services who accepts anonymous payment, and cannot themselves provide encrypted content in cleartext. They cannot save you from yourself, though.
i can’t speak for the journalists who wrote the story, but i assume it’s due to how prominently proton markets their email as safe/private/encrypted and then it turns out they may be sharing data with the swiss government who then gives it to the us government.
it absolutely should be news when the company who heavily promoted themselves to normies as safe, encrypted, and private is sharing customers data which is ending up in the hands of authoritarian foreign governments who are hunting for protesters.
This is a highly deceptive title. As if Proton proactively helped FBI, which is not even close to truth. Proton is not even in direct contact with FBI. It's Swiss government that forwarded the info to FBI.
A much better title would be:
Proton Mail Payment Info Helped FBI Unmask Anonymous 'Stop Cop City' Protester
Or
FBI Unmasked Anonymous 'Stop Cop City' Protester
via Proton Mail Payment Info
The point is informing the normies that your payment info is linked to your identity and a potential risk to your anonymity.
That clickbaity title makes me want to unsubscribe from their RSS feed.
> then it turns out they may be sharing data with the swiss government who then gives it to the us government.
Literally every legal business complies to law enforcement. They have to.
You can literally mail an envelope of cash to them and they'll credit your account. Probably the best way to remain anonymous. At worst, they'll have the zip code from where it was mailed from and potential fingerprints. But since an envelope isn't really a financial record, I doubt they would hold onto it.
Okay I think I just misunderstood. I guess I was assuming "paying for the service anonymously" meant "paying such that the person using the service is anonymous", not "anonymously paying for the service". Haha. Syntax is fun!
Wouldn't make more sense to not store information (or have it encrypted without proton having access to it), so they would have nothing to share even if they were forced to comply?
As it should be. All corporations must follow the law. If the police has an order signed by a judge then it is lawful and a necessity for society to work to follow the law.
What is horrifying are big corporations giving access to all user data without recourse. That my data in Europe is send to the USA and accessed without limits by their goverment is a crime and a very dangerous situation.
- Fighting crime in an open criminal case with judge oversight is a very good thing and part of keeping the rule of law.
- Collecting data from all users without probable cause is a crime and will have nefarious consequences for all of us.
Proton won’t lock me out of my email because I accidentally sang a copyrighted song in a Youtube video. That’s why I use it, not because it’s the pirate bay for email.
I’m aware Google bans accounts for wrong reasons, what I’m asking is about a case (as implied by OP) where they seemingly did so because someone sang a copyrighted song in a video. There are different degrees of bad, and that one would be up there.
You say it no longer is the case because they changed the rules. So does that mean it did happen? Could you share a link?
there are plenty of examples throughout history, although i haven’t heard much about it recently. tl;dr you don’t have a gmail account, you have a google account. if that account gets banned on one service, you may lose everything.
> tl;dr you don’t have a gmail account, you have a google account. if that account gets banned on one service, you may lose everything.
I’m perfectly aware.
> there are plenty of examples throughout history
I’m not asking about plenty of them, I’m asking about one. Has there been a case where, as you said, Google has banned an account because someone sang a copyrighted song in a video? That’s the one I want to read about.
I don’t have any sympathy for large corporations and I don’t use Google services, I just want to be informed about draconian tech decisions.
Did you make up that story? It’s OK if you did as a hyperbole, I just want to know.
Using Proton for privacy and security is quite ignorant. They are known to support legal requests without ever challenge that request. At least Yahoo has way better record than Proton. I use Proton, but never for privacy reason. It is as good as hotmail and yahoo mail. If you truly care privacy do it in another country. So qq mail and yandex mail have zero chance being look at by any western authorities. And the same with if you distrustful of China and Russia which cant look into Google mail.
> A court record reviewed by 404 Media shows privacy-focused email provider Proton Mail handed over payment data related to a Stop Cop City email account to the Swiss government, which handed it to the FBI.
Why is there a paywall AND anti-aging snake oil ads? Pick one. If that's the type of ad you sell it signals to me the site is absolutely not worth the subscription.
They should've prepared themselves and their customers better before that happens - one tiny example: there is no anon payment option listed at the main payment flow and no warning that credit card. Or maybe there is some smart way of not having permanent access to the payment identifier, only during the time of payment?
Re. at the moment not sure, that depends on their jurisdiction, but that's another thing - why don't they explain what's possible and what and why they did/didn't do?
I agree that they should offer private and anonymous payment like monero and cash. They do talk about using a VPN and Tor to hide your IP but its kind of hidden in the footer.
Proton isn't opsec, it's just the best available commercial clearweb host that still has to follow all the laws and comply with warrants, but won't be arbitrarily selling your metadata or engaging in the adtech garbage.
Kagi is to google as proton is to gmail.
You get web mail, custom domains, decent security, decent spam detection, solid features, and no PII being sold. Nice, clean, simple - I like paying them money. I feel good about doing business with them, and I don't run into that often these days.
Fastmail requires payment meaning it is very closely tied to your identity. Proton is one of the very very few who do not tie a new email account to your identity via phone number, payment info or alternative email (which requires phone, payment info etc..).
Even proton only provides webmail free - pop3/imap/smtp require payment. But that's still better than 99.99% of other webmail - everyone verifies via some method that ties to your personal info.
I don't know if sketchy is the right word but every* time I encounter a proton mail user on a mailing list, they are tinfoil-hat paranoid. Like they are a random nobody, but they are convinced that "the Russians" or "the Chinese" are constantly hacking at their laptop and they are constantly trying to harden everything so much one wonders why they even bother using computers at all.
* OK "every" is an exaggeration but enough that the impression has been formed.
Yes it does have access to your data, at least any email coming from or going to another mail provider. Because those are not end to end encrypted. Only encrypted in transit (and even that is optional). So they need to handle the plaintext at the point of transmission.
I really don't like this about proton, they're always going on about their encryption but most emails they've seen in plain text on their SMTP servers. Because that's just how SMTP works. And so has the provider of the other party.
Once they've put them in your mailbox they can't decrypt them again but I always consider a single exposure a loss of confidentiality. The only emails this doesn't apply to are those from people using PGP (yeah all three of them) and those on proton themselves.
In my view this Achilles heel makes most of their protections irrelevant. But they still market it as if it's the email equivalent of signal, which actually can't see what you say at any point of transit. And non technical people have no idea about the difference.
Ps I'm not blaming proton for not having a technical solution for this because interoperability makes it an unsolvable problem. But I do blame them for their marketing around it.
Why do police need big training centers to learn about the constitution and our rights, escalation of force, etc? I learned all that stuff in a single room when I was in the military.
Look at the numbers for number of people who die from interactions with police (both armed and unarmed) and then compare that to the extra violent deaths that happen because of defund the police polices and then let us know what you find. Only then can you make the claim you are implying. Otherwise you are doing the conspiracy theory thing where you present random data and then imply the idea you are pushing.
If the person or politics / group,they don't support then they have no problem just straight up making stuff up.
Like the hit piece of Elons Grok where it was "doxing" pornstars names,but in reality all it did was just search web online and got the info from the first website it could find.
But they made it seem like it was some hidden info that only Grok and Elon would know...
Sounds like you don’t understand doxing and may be overly sympathetic to a reactionary billionaire’s propaganda machine.
Doxing for the most part is simply aggregating publicly available information on an individual and broadcasting it to a wider audience. Rarely does it require more serious sleuthing or even “hacking”, although those are the more notorious instances because it involves someone who may have been trying to hide their identity for various reasons.
No, it's that people keep misusing that word for a broader and broader class of things. Pushing back on dilution of meaning isn't a lack of understanding.
Journalists should work for free. Which means that they are going to be paid by governments and corporations to spout propaganda because everyone has a mortgage to pay off...
I really don’t think 404 Media having a login gate is a red flag. They’re a business that needs to make money and the alternative to subscriptions is ads, which would be exponentially worse for user safety than what exists today.
Proton doesn't really protect anything email related unless the recipient is also using protonmail. The article also points out they sought payment data, not "IP and device ID" information.
This seems misleading inasmuch as your correspondents aren't all on the same mail servers.
Yes, correspondence between you and Build-A-Bear, and between you and your local terrorist cell, are unencrypted individually. But Build-A-Bear presumably doesn't know about your correspondence with the cell, and the latter presumably has some interest in not sharing organizational data access with the former.
I suppose you do have to trust that Proton isn't served a directive to snoop on your correspondence in transit with other providers. But that's still a much better position than leaving all of your historical data unencrypted at rest.
Or any similar service from another vendor? Or hosts their own email. If someone using Protonmail emails me, their data is also not getting sold for example, it's just stored on my laptop
> Proton only has access to your IP and device ID, not your data.
I like Proton. I use Proton.
However, the problem with proton is that if you access your email via a web browser, there's nothing stopping protonmail (to my knowledge) from reading your email from within their webapp via JS. This type of attack could be targeted at the behest of authorities.
So, actually, Proton COULD read your email (IFF you use webmail).
>So, actually, Proton COULD read your email (IFF you use webmail).
The authorities can also read your self-hosted email if they had a warrant to search your house. Even if you enable FDE they can do a cold boot attack.
Simple solution: put your server inside of a cabinet or enclosure that immediately powers it off if opened with a hidden micro switch. Additionally, write a little udev rule to immediately power off if any new USB device is connected or Ethernet is unplugged.
Is even that needed? Nothing e2ee about the emails you receive normally, they could just read them right away if they really wanted to. And that is to say nothing about the metadata.
That's 404 media's approach. That's why I only read their headlines.
In theory you could open up your protonmail account over tor and with bitcoin (or does that not work anymore?).
Its been a good while since I tried them out. Why I don't recommend them anymore is because when I didn't extend my subscription in time (expecting an account downgrade), my mail was locked and emails hold on to as random. Allowed to login only for payment.
That was one red flag from me, the second was when they shared IP address logs of a French protestor. E̶v̶e̶n̶ ̶t̶h̶o̶u̶g̶h̶ ̶a̶t̶ ̶t̶h̶e̶ ̶t̶i̶m̶e̶ ̶t̶h̶e̶y̶ ̶h̶a̶d̶ ̶a̶ ̶n̶o̶ ̶l̶o̶g̶s̶ ̶p̶o̶l̶i̶c̶y̶,̶ ̶i̶f̶ ̶I̶ ̶r̶e̶m̶e̶b̶e̶r̶ ̶c̶o̶r̶r̶e̶c̶t̶l̶y̶.̶ ̶O̶r̶ ̶i̶f̶ ̶I̶ ̶d̶o̶n̶'̶t̶.̶
>the second was when they shared IP address logs of a French protestor. Even though at the time they had a no logs policy, if I remeber correctly. Or if I don't.
You probably aren't remembering correctly given that specifically have a "login logs" option that can be toggled on/off.
I let my subscription expire and my account was never locked down or emailed held for ransom. I suspect there is another piece to the story you're either neglecting to mention or don't know.
Yes, this happened 5-6 years ago, I've publicly complained before, and I paid with bitcoin. Those are the only details not included in my previous comment.
last time i tried they asked for an email to link the account to. I don't think they provide anonymous accounts anymore, but you can probably create one with another anonymous email.
>Sign up with no phone number:
Get a private email account without handing over more personal data than necessary, making it harder for advertisers, data brokers, and other services to track you online.
I guess it doesn't mention law enforcement so ¯\_(ツ)_/¯
The article explains that the account was identified based on a credit card payment for a paid account, which does not invalidate the statement in question IMO. Perhaps we differ on the definition of "private" or something else, but unless all parties are using proton, email is inherently insecure and somebody can/will have a record of your communication regardless.
> unless all parties are using proton, email is inherently insecure and somebody can/will have a record of your communication regardless.
That the person you're exchanging messages with, has your messages, is hardly a surprise. Not everyone-but-Proton sells your data though so it's not quite that black-and-white
I'm not sure what you were expecting here. If you have data and the police shows up with a warrant, you can't just tell them "nah we don't feel like it".
They could have used a VPN to connect to Proton and paid for their account with bitcoin or cash and then law enforcement would have had a very tough time. Instead, they paid with a method connected to their identity. Of course Proton handed it over when law enforcement came knocking.
If you don't want info being given to law enforcement by third parties, your best bet is to make it so that nobody else has access to it in the first place. You might get away with third parties that are in a jurisdiction unfriendly to wherever you live. Definitely don't hand over your info to a company in fricken' Switzerland and then be surprised when they comply with law enforcement requests for it.
What Proton sell you is reduction of anxiety. But that's a lie.
The whole idea of encrypted email is pointless. There's absolutely no guarantee it's encrypted in transit or encrypted at rest on any machines it transits through unless you encapsulate the messages with PGP and then you still leave a trail of envelopes everywhere. Any government who wants your data will come round and beat it out of you or the provider as best as they can. And if you have the pay the provider, as evidenced here, they can point to you and then beat you for it. Beating being metaphorical or otherwise.
Use any old shitty email provider and make sure you can move off it quickly if you need to. Standard IMAP, not weird ass proprietary stuff like proton. Think carefully what you do and say. Use a side channel for anything that actually requires security.
As a long time Proton customer...I am fairly certain Proton has always been completely upfront that they will comply with lawful requests for information from the Swiss authorities, if response is obligated by Swiss law. Therefore this isn't especially surprising.
This is just impossible. If they're going to be sending your email to gmail then they need to see what's in it. So they will have the data at some point. You have to trust their brown eyes that they don't look at it while it's going through their inbound and outbound servers. But they're selling it as a technical protection, not a trust-based one.
Personally, if you want private Comms, just don't use email. The protocol is just not suitable.
Exactly, you can use bitcoin, even cash. You can even add credits with PayPal or a credit card, in which case Proton (I assume) won't remember your payment data. But if you attach credit card info permanently to your account then it can be retrieved.
In trying to check this claim (I thought Proton did sensible things), I found that the submitted news article is not new at all:
> [Proton's] homepage touts that “With Proton, your data belongs to you, not tech companies, governments, or hackers.” However, [...] Proton previously handed over an IP address at the request of French authorities made via Europol to Swiss police. Yen wrote a Twitter post at the time, stating, “Proton must comply with Swiss law. As soon as a crime is committed, privacy protections can be suspended and we’re required by Swiss law to answer requests from Swiss authorities.” ---https://theintercept.com/2025/01/28/proton-mail-andy-yen-tru...
Big surprise: swiss company complies with swiss law!
And the same happened now, quoting the part of the submission that you can read without signing up:
> privacy-focused email provider Proton Mail handed over payment data related to a Stop Cop City email account to the Swiss government, which handed it to the FBI.
Anyway, regarding your claim, it's a whole rabbit hole of statements they made but broadly speaking it sounds like you're right: Vance supported legislation which Proton campaigned for and, subsequently (as of 2025-01), Proton loves the US Republican Party, believing they would stand up for 'the little guy'. To be fair, they bring some evidence that sound like it can be verified and back this opinion up somewhat, but even if it's a correct opinion on this sub-topic, it's still supporting authoritarianism. Anyway, this is where I'm going to stop trying to politically analyze their situation and just not recommend Proton anymore...
That seems quite irrelevant in the bigger picture. I'm not recommending a company that campaigns for an authoritarian party, not even to other people in that camp. It's just immoral
More informed by that comment, really? Did you read this[0]? As someone disinterested in the topic, the controversy seems very overblown and a knee jerk response. His position seems to have been pretty consistent over time.
I don't know what Proton did regarding Trump, but if you follow this principle to the end you might as well ditch technology and live in the forest. I'm not being hyperbole, everyone does business with or endorses someone on either side who does stupid shit.
Thank you for sharing. I was trialing Proton Mail but I will move away from it because of this. This is some teenage level crime and legitimate protesting that it threw away its reputation for.
This is feedback from Proton Mail Team I got about this matter:
"Thank you for reaching out and sharing your concern. We understand why this story is alarming, and we want to give you a clear picture of what actually happened.
First, Proton did not provide any information to the FBI. The data was obtained by the Swiss Federal Department of Justice through a Mutual Legal Assistance Treaty (MLAT) process. Proton operates exclusively under Swiss law and only responds to legally binding orders from Swiss authorities, after all Swiss legal checks have been passed. This is clearly stated in our TOS and Privacy Policy.
In this specific case, Swiss authorities determined that the legal bar was met because a law enforcement officer had been shot, and explosive devices were involved during an incident in 2024. Switzerland has one of the strictest privacy frameworks in the world, and legal assistance is only granted in cases involving serious criminal matters.
Importantly, the only information that could be disclosed was a payment identifier because the user chose to pay by credit card although Proton accepts gift cards, cryptocurrency and cash. No emails, no message content, and no communications metadata were handed over. This actually demonstrates how little data Proton holds by design, our end-to-end encryption means we cannot access email content even if ordered to.
We hope this provides some reassurance. Please don't hesitate to reach out if you have any further questions.
Best Regards, The Proton Mail Team"
It says all that in the article.
many people read the headline, immediately start commenting, and only afterwards maybe read the article.
a little snippet of the article can help reduce the number of people who have a knee-jerk reaction to whatever the headline says
Even if you only read the headline, you can work out the most likely story from logic. Someone else in this thread already said it: they're not gonna go to jail for you over a small subscription fee, of course they're complying with local laws and then the Swiss people handed it over to where they got the legal assistance request from. It's also not the first time Proton cooperated with a legal request from Swiss authorities, or Signal or other similar companies for that matter. The story tells itself no matter what part of it they decide to stick in the headline
Which is paywalled, so thanks for posting it here.
Nothing of that email is new to me, and I didn't read the login-walled part which was like the third paragraph onward or something (I think it said it's free to read once you sign up, so not a paywall, but yeah either way)
I think 404 Media has an ethical obligation to provide Proton Mail’s response outside the article’s paywall. The word “Helped” in the headline is more sensational than stating that Proton “was required by Swiss law to provide...”
For readers who do not want to pay to read the article, the headline leaves incomplete context and creates a misleading impression of the story. That damages Proton’s reputation, and the missing context is only available if someone pays for the article, reaches out to Proton, or searches forums for substantive information.
Not exactly the best article. Proton complied with a lawful Swiss request. Their ToS clearly state what they can provide if requests are lawful.
The Proton user had bad opsec by using a credit card to pay for the account.
Had Proton just turned data over to an out of jurisdiction LEA, then it's more of a complaint. But they followed their policy and law here.
Proton offers a Tor address for accounts requiring anonymity rather than just privacy. The crux of this is on the account user
> The records provide insight into the sort of data that Proton Mail, which prides itself both on its end-to-end encryption and that it is only governed by Swiss privacy law, can and does provide to third parties.
Didn't Proton already say that they were physically relocating their servers outside of Switzerland because the Swiss government couldn't be trusted?
Although I guess the server location didn't matter in this case since all they wanted was the billing information and the credit card info to identify the person.
> Didn't Proton already say that they were physically relocating their servers outside of Switzerland because the Swiss government couldn't be trusted?
They said they want to relocate to Germany which I would say in a polite way, is much worse in this regard.
In what sense? Germany has among the strongest judicial oversight for invasion of privacy in Europe. Due process is followed when securing search warrants that provide access to subscriber data (Germany does not have administrative subpoenas like in the US and other countries).
Former attempts at surveillance have been struck down in the Bundesverfassungsgericht, and the right to privacy has even been affirmed for foreigners (as opposed to other countries like the US that reserve that foreign nationals have zero due process rights for invasion of privacy).
Germany has strong privacy protections against businesses. But not against the state as they consider themselves above suspicion.
Is this a gut feeling, or is there a basis for this claim? My comment referenced solely due process in relation to the state.
Yes I've seen many news items about laws being introduced that were pretty invasive.
https://www.hrw.org/news/2021/06/24/germanys-new-surveillanc...
https://www.heise.de/news/Ausweispruefung-bei-Prepaid-SIMs-N...
https://netzpolitik.org/2016/projekt-aniski-wie-der-bnd-mit-...
Introduced or passed into law?
What does having to show an ID when registering a SIM card have to do with privacy of emails?
I'm talking about digital privacy in general. In many countries (like in Holland) this is not a requirement.
Also Germany was a big proponent of ChatControl, until they swerved at the last minute. Holland was against it every time.
> But not against the state as they consider themselves above suspicion.
That's a statement that I expect to infuriate just about everyone who lived in Eastern Germany, how do they get away with that argument?
[flagged]
Instead of posting "I googled sources and can confirm" please post your sources so everybody can confirm.
I do not think it is too much to ask someone to type “German court strikes down surveillance“ into Google. Here is the link though: https://www.google.com/search?q=German+court+strikes+down+su...
Germany is an absolutely terrible choice for this. Other Email providers such as Tuta which also offer encrypted emails, were forced to install a backdoor. As soon as the police arrive, every future email sent to the account in question is copied unencrypted without the person being informed. This is much worse than passing on payment details or stored backup email addresses, as Proton Mail is required to do in Switzerland.
> Other Email providers such as Tuta which also offer encrypted emails, were forced to install a backdoor. As soon as the police arrive, every future email sent to the account in question is copied unencrypted without the person being informed.
Important caveat: Tuta was required by a court to provide police with access to a customer's _unencrypted_ emails (ie regular SMTP mail). The police had also asked for a backdoor to Tuta's E2E emails, and that request was rejected by the courts.
But the idea behind Tuta and Proton is that emails are encrypted when they arrive in the inbox. The fact that emails sent between Tuta users are still safe offer little added value because distribution is far too limited. The reason people choose such a provider is that they do not want the authorities to have access to their mailbox, but this is undermined by a backdoor. Switzerland is much better off in terms of the legal situation in this area.
In the sense that it's a joke that caves in to the flimsiest pressure from a certain superpower. Although pressure is a bad choice, it's more like it's a wholy owned subsidy.
> prides itself both on its end-to-end encryption
Their end-to-end encryption is pointless because the vast majority of any recipients will just leak the plaintext emails via their own account providers anyway. It only works under very specific circumstances (all parties are using it). I think their marketing overstates what their secure private email actually means.
Yes. If you send an email from a protonmail account to a gmail account that email is in google's system. Same if in the other direction. Would anyone using protonmail not know this. I would guess at least 99.9% of proton users understand this.
No goverment is to be trusted if that is the main point.
This should surprise exactly nobody after it was disclosed back in [checks notes] 2021 that ProtonMail gave up user data to law enforcement and also changed their TOS.
>after it was disclosed back in [checks notes] 2021 that ProtonMail gave up user data to law enforcement and also changed their TOS.
You shouldn't even need that. A warrant isn't a strongly worded letter that they can just turn down. It's the law. Therefore you should assume that if the police can get a warrant, they can get your data. Even for people who don't follow the law (criminals), there's no guarantee they won't snitch on you.
they used to claim that being Swiss based protected them from warrants like this
Source? We need the exact claim here, because there's a fine line between "we're in switzerland, so warrants aren't a thing!" (outright false) and "we're in switzerland, which have better privacy laws than other countries!" (debatable).
I’m not the person who made the claim, but a basic web search led me to this page on their blog:
https://proton.me/blog/data-privacy-abortion
Quote (emphasis theirs, in bold):
> Switzerland is a fundamentally different environment. Two of the things Switzerland is most famous for are also highly conducive to data protection: privacy and neutrality.
> When a law enforcement agency in the US requests user data from a Swiss company, it is illegal for that company to provide the data. At Proton, we reject all data requests from foreign agencies.
> Proton and other Swiss companies will only hand over user data when ordered to do so by a Swiss authority. And even then, Proton’s general policy is to challenge data requests whenever possible and only comply after all legal remedies have been exhausted.
So maybe your parent poster is confused? They do claim that being Swiss protects them from requests from foreign entities, but not Swiss entities. Which is what happened here, the Swiss authorities asked Proton for the data, then they handed it to the FBI.
Has Proton challenged the data and “only complied after all legal remedies have been exhausted”, though? That’s another question.
I wonder if the FBI knew it was going to be a pain in the ass asking for actual account access from the Swiss so they asked for financial records instead. Terrorism charges look pretty serious (regardless of how legitimate they are) so I'm sure that's what pushed the Swiss and Proton to comply.
But the Swiss have the notion of a warrant, no? So if a Swiss judge or official issues a proper warrant, then a Swiss company or citizen is obliged to comply with it.
Swiss police requested the data and handed it to the FBI.
Read the wording, they aren't complying with US warrants, they are complying with Swiss-issued warrants. US LE/Intel agencies figured out this loophole some 20 years ago.
Citation needed. They really said they were above Swiss law?
Man 404 Media is really crushing it lately. Thanks to the team!
Proton Mail complied with a legal demand they had no choice but to comply with, providing the basic shred of information the user willingly and knowingly provided.
You want to be anonymous? Don't use your credit card! Don't connect from your home internet connection. (I don't know whether this person did because I can't read the story due to login-requirement). Either way, total non-story. Anyone whose potential adversary is a powerful government should already know this stuff.
Either way, Proton didn't help the FBI. The article title is deceptive and implies a degree of insidiousness or dishonesty that has not been demonstrated by Proton in this case.
> Either way, Proton didn't help the FBI.
> Proton Mail complied with a legal demand they had no choice but to comply with
If I'm not mistaken, proton didn't give anything to the FBI, they provided what was required by law to the Swiss government who then gave it to the FBI. It's a small distinction but it matters.
Not small, essential
Just like various .govs don't spy on ther own people, they get their friends to do it for them.
You seem to think those two quotes make a point, but for the life of me I’m not seeing it?
Are you trying to say that any compliance is by definition help? Like if the FBI subpoenas my public key and I comply, that’s helping them?
> Like if the FBI subpoenas my public key and I comply, that’s helping them?
If you're helping the FBI to do their job (conducting federal investigations), then yes, you are helping the FBI. Unless your definition of "to help" includes the absence of any possibly coercive circumstance.
An, so just semantics about “to help” and whether it involves volition.
As a proton user I know I am not completely anonymous. I pay them for their bundle of services because I get VPN, encrypted password storage and email that isn't scanned for ads and other purposes.
Privacy and anonymity are a gradient. If I needed real opsec from government threats I wouldn't tie a credit card to a service.
Does Proton store the payment information tied to an account for the duration of a potential chargeback period or indefinitely?
Whether they store such info for cryptocurrency payments as well (no chargeback risk) would be telling.
Unsurprising.
If you don't want to receive the punishment for thought crimes, which is being threatened outright more loudly every day, it's increasingly difficult to actually have a dissenting voice online. Don't believe me? Set up a linux VM, Mullvad VPN with a killswitch, then run Tor browser. You MAY be able to get a TutaMail account, which requires a backup e-mail that disappears after a short period of time (allegedly), and then a Proton account with the TutaMail account as your required backup there, but all of the privacy-first "anonymous" services require some form of verification. Then, if the social media network isn't blocking you from signing up via a Tor exit nodes outright, you are immediately shadow banned.
I remain very annoyed with the massive number of engineers that are making it possible for people who can't figure out how to check their e-mail to utilize advanced technology to spy on us, steal our tax money, pervert the technologies we build, and indiscriminately murder innocent people.
We are a community of greedy ladder pullers and that's so disappointing.
I generally just use tor browser and proton (verified through a disposable email address only accessed via the tor browser) - seems secure enough for me?
I use it often...
> verified through a disposable email address
To the extent it works that's a loophole. I can't speak to proton specifically but the majority of services don't want to permit disposable email because the entire point is to cut down on spam and abuse.
I can appreciate having the option of providing a phone number or email or whatever but I think the state of the ecosystem is telling. The option for anonymous email with PoW per outgoing email isn't provided despite largely addressing the commonly cited rationale for requiring some sort of verification. And we're still stuck bashing PGP, shilling for competing E2E message solutions while it's plain as day that the vast majority of commerce isn't going to move off of email any time soon. Meanwhile TLS can figure out how to distribute public keys via DNS as part of implementing ECH in all major browsers over a period of less than a decade.
While I don't use disposable emails I've been converting all my accounts to unique emails with either Firefox Relay[0] or using my personal website[1]. Bitwarden has made this easy as they let you import your Relay's API key and so every new site gets unique usernames and passwords[2]. It certainly is making it easier to block spam, and you get to know who is leaking your emails[3], and I've burned emails because of it. Frankly at this point the biggest problem is having a 20 year old gmail account. But the plus side of this type of system is that you can move your endpoint, so where Relay/CF directs the emails too, making you less reliant on your email provider[4].
There's pros and cons. On the plus side, unique identities for every site and by getting a catchall domain you can even generate valid addresses via pen and paper. Probably the biggest benefit is just searching emails. On the cons, document sharing can be a bigger pain than it already is (how is this still a pain all these years later?). Also, people get very confused when you tell them your email address is TheirCompanyName@godelski.mozmail.com (I don't actually have that domain, don't send emails there).
It's helpful but I think represents a fundamental flaw in our ecosystem.
I can't believe we haven't normalized this in the nerdy spaces, at least not to the degree of things like Signal. It is a thing that can be entirely automated and both Thunderbird and NeoMutt are able to handle this for you and make it effectively seamless. The average person does want this stuff, but they don't want to think about it. The problem is that they think their stuff is already private, or they say it can be spied on but that they're not worth spying on so they think it is effectively the same thing.[0] https://relay.firefox.com/
[1] Cloudflare will do email forwarding for you as will plenty of others: https://www.cloudflare.com/developer-platform/products/email...
[2] What doesn't help is how prolific OAUTH is becoming.
[3] Sorry, adding +something on your gmail won't work these days.
[4] I'm actually looking. People say TutaMail but sorry, I need something I can use with either Thunderbird or NeoMutt... This is non-negotiable. Everyone has multiple email addresses these days and I'm not checking 30 different sites. The problem is already one of poor organization.
I know its effecitvely a vendor lock-in and not what you are looking for but I love the SimpleLogin integration that Proton made with Proton Pass.
I have it setup in my browser and phone. Whenever a website or app would like an email for an order or something else, it takes a single click to generate a named alias (using the website name) e Which forwards emails to my normal inbox. Replying to any received emails also uses the alias.
The SimpleLogin interface could use some improvement though. Deleting unused ones is a bit tidious.
I use SimpleLogin with custom domains but kinda meh.
Brilliant for quick creation of temporary emails, but app troublesome and doesn't show the all options, but much to my disappointment they don't do proper SRS, so it invalidates any, ANY benefits from DMARC or such.
Emails that with SRS would have a proper From, organisation logo from BIMI record, now immediately end up in Spam and are marked as phishing attempts.
I had a better success with personal postfix server forwarding my catch-all alias mail to Gmail than I have with SimpleLogin.
The only thing that is better is that replying to emails is easier, but that could be done while staying compliant with SRS.
I regret buying the subscription and I won't be extending it. Should've go with a proper email service, not a glorified alias generator.
How old are the accounts?
>"it's increasingly difficult to actually have a dissenting voice online."
If willing, I would appreciate some examples, actual or hypothetical. I have left a few comments regarding my concerns over AI and have been surprised by the hostile reactions. Much of my research kindof revolves around a central concern matching your statement. But my perspective is in a vacuum, out of touch with what others are dealing with. Feel free to ignore this if not comfortable.
Don't apologize for your truth. A lot of people on reddit/HN fancy themselves as free-thinkers and the moment something contradicts their reality they reveal themselves to be as emotionally vulnerable as the rest of humanity.
[dead]
It was already going downhill a decade ago, eg, using bad think on video games.
But my personal experience is something snapped in a lot of people during COVID when people asked reasonable questions like — “is an experimental gene therapy really QALY positive in populations not at risk, such as healthy children?”
According to government actuarial tables, the answer was no: the UK government concluded that there was no point at which for those under 40 the immunizations prevented more serious outcomes than they caused. But people were (and often still are) absolutely rabid if you point out we (in administering a QALY negative treatment to a vulnerable population) decided to poison children and young adults en masse. I’ve had people look up my mother on Facebook for calmly citing UK government actuarial reports, which did the calculation on COVID vs vaccine harms.
That’s setting aside that on HN you’d get shadowbanned for even posting the clip of BLM leaders describing themselves as “trained Marxists” and BLM itself as Marxist in ideology. Apparently, no matter how politely you state facts, if HN froths irrationally in response it is an “inherent flamewar”.
But I’m not sure I qualify for what you’re asking, as I generally post under my true identity, not anonymously.
Your examples are tips of icebergs that indicate much more problematic opinions. I’m not shocked you received pushback.
That’s exactly my point:
HN is a place where people don’t ask what is true with intellectual curiosity but classify opinions as “problematic” and justify bullying people based on that.
HN becomes emotionally upset if you discuss actuarial tables or quote people’s own words from their own presentations because those facts go against the narratives many on HN believe — and like many before them, people on HN believe censorship and bullying are justified by that emotional turmoil.
As you just did, impugning my character while carefully avoiding the veracity of my claims — only saying they’re “problematic”, as a good apparatchik would.
Do you have a citation for said actuarial tables? I think HN is often critical of objective claims without objective references.
HN was one of the best places for finding cited research regarding covid and the mrna tech at the time.
With all the other conflicting information floating around online, it was a breath of fresh air to come to HN and see articles describing exactly how mrna works and why it was likely not a health risk, complete with thoughtful discussion. I'm too lazy to go look up citations and reference those old posts, so you can take this as anecdotal.
Little bit of projection in this comment, I would say. I didn’t reference your character, just your opinions - to equate the two is a bit juvenile - which now may be a reference to your character.
Also, “problematic” is perhaps the least emotional word I could have used, and yet you still found issue with it.
I would advise you stop viewing HN as a monolith, it will help you get over your victim complex, which will in turn hopefully help you see opinions as things worth changing based on new information, rather than value for your character.
Much indeed. The word "problematic" is one of the most terribly overused words in today's age.
Yeah it’s a euphemism and a bit of a shibboleth, which, like all shibboleths, can be a bit triggering to those who feel outgrouped by it.
I could’ve been more precise: “opinions that are based on weak evidence that confirm a certain preimagined view of the world rather than challenge it”.
Ah a fancy description for religion!
I would like to say that this is why my country turned to atheism but really it was the Sunday morning.
I mean they made claims about the efficacy and risks of the COVID vaccine without sourcing them and used verbiage like "poisoning our children" to refer to vaccinating them. I think tip of the iceberg for "problematic opinions" is a fair response.
Just noting that I appreciate all the examples given here and by others, many of which made me feel a bit stupid and amnesic for asking my original question. I guess I have been over-focused on AI...
> That’s setting aside that on HN you’d get shadowbanned for even posting the clip of BLM leaders describing themselves as “trained Marxists” and BLM itself as Marxist in ideology. Apparently, no matter how politely you state facts, if HN froths irrationally in response it is an “inherent flamewar”.
Funny how you mention this like you expect everyone to take for granted that Marxist=bad and worth "hiding" etc... whereas negative reactions are likely due more towards that internal judgement discrediting yourself, vs trying to "hide the Marxism."
You think you can discredit people by saying "they're Marxists!" and yet you think people today are uniquely bad snowflakes about views they don't like. You're proposing that people are more likely to cry thoughtcrime now than in the past, by inadvertently exposing how you've bought into this idea of how just invoking the name of some old philosopher is worth demonization and has been for DECADES in many western countries...
Specs and logs, motes and beams.
Which specific points from which specific Marx texts piss you off so much?
(It's also funny that you didn't actually link to any of the things you stated. I don't care about the things you brought up enough to go hunting for them myself to try do prove or disprove you, but... do you really think saying "I can't cite these simple facts without getting in trouble" *without even citing them, just asking us to believe you that they're easily cite-able, is gonna go over so convincingly?)
If there’s nothing wrong with Marxism then his comment is a golden opportunity to show all the positive outcomes of Marxist policies/governments.
Any functioning national health service. Any national education system. Transport networks. Nations with unprivatised water systems.
I've said this a million times to people in this industry: we have a Real Problem with adderall, it's abuse, and the way it robs a person of their ability to feel empathy. Yes, you're a 10x engineer, yes you write amazing code, yes you can work and work and get. it. done. But you'll also be A-OK with dark patterns, just fine with spying on people who aren't you, and hell, you might even think building the first Terminator robots is an interesting project.
Hyberbolic? Sure. But we live in a society that reinforces the idea that the performance enhancement is worth it. But there is a cost, and what you've described is it.
I've been on it, never once felt a lack of empathy, or forwent my principles. If that's happening to a person, it's likely a mask is just being lifted.
this is a statement you can't possibly be sure of and the fact you're making it shows a lack of reflection.
It's absolutely a continuum, which implies to me there will be people with your experience. Of course, you may not have encountered a scenario where your principles were on the line!
But then, I'd also agree there would be loads of cases where it is a mask being lifted, but isn't that the point? Is there a meaningful difference between "revealing one's true self" and "being robbed of an essential part of humanity" when the outcome results in the same antisocial behavior?
i think it's silly to think we just need gooder coders with better morals. if the tech industry didn't do what it does it wouldn't enjoy the position in society it has.
if youre going against the regime of hyperpathologization please be strong and gentle. people dont want to have their pacifiers ripped out, whether that be by lifting the veil of hypercapitalistic coercion, or simply by making plain the wealth of side effects that can be entirely avoided by ignoring artificial diagnoses and seeking solutions more in line with our biology.
like no shit people are going to be more willing to do the bidding of evil when their decision making apparatus is unnaturally saturated. and no shit people are going to have adhd symptoms in a screen based society. its completely obvious. but me saying that is going to get down voted to oblivion. people don't enjoy having a comfortable narrative questioned; dissent (no matter how minor) is equivalent to full scale assault on perceptions of existence. that being said, i dont blame anyone for this, considering that the entirety of existence is currently geared towards forcing the populace into fight or flight mode, thus rendering null the capacity to exact societal change and disrupt the status quo.
people really do think their best interests are at the heart of billion dollar companies like those producing pharmaceutical goods !
> like no shit people are going to be ...
Yep. I still need to say it. I still need this audience, at least time tiny fraction, to hear it. This "community" specifically is so high on it's own supply that these things should be shouted from the rooftops:
- You're a fallible human and your ideas aren't always good - Disruption isn't always good - Moving fast and breaking things is a great way to leave a path of destruction in your wake and piss off everyone around you, and isn't always good - Change for the sake of change isn't always good
Let's boil that down to: the shit you come up with isn't always good. Or to put it another way, rarely does it seem "should we?" is ever considered alongside "could we?".
Finally, as if it weren't obvious: I am not here for fake internet points.
the populace has been trained to unequivocally reject any thought that goes against the prevailing narrative. they have been lobotomized, removing the capacity to discern shades of grey. so when things are shouted from the rooftops, automatically they considered not to be worth listening to. if you really want to change people's minds it needs to be done gently, and generally on an individual basis. thats all i wanted to suggest ... internet points are relevant because the less you have, the smaller your audience.
>annoyed with the massive number of engineers that are making it possible
Where you one that voted for laws that protected our privacy?
Where you one that upvoted comments in forums that said software engineers needed a standard ethics?
Where you one that downvoted every post saying we should have unions in software so we can protect ourselves as a group.
Or were you greedy like the rest of us saying, I don't want any of those things because I can make more money without it.
This is were the hunt for more money has taken us, and it only gets worse from here.
>Where you one that downvoted every post saying we should have unions in software so we can protect ourselves as a group
In other professions such unions inevitably end up building a chummy relationship with the government and going along with whatever it says, software engineering wouldn't be any different. If anything it'd be worse because the government could pressure the union into removing the license of engineers who make privacy-preserving software.
Right, because governments don't have other ways of forcing companies to do what they want anyway.
Looks over at Anthropic
Who in the Western world is being charged with, convicted of, and punished for “thought crimes”? Be specific, please.
Well currently, it's people being denied entry or re-entry to the United States due to the content of their social media accounts. Also, people getting door-knocked by the FBI for making posts on Reddit.
Historically, there won't be trials for this when it gets worse, so there won't be anyone charged or convicted. They will eventually just be murdered by a secret police force.
You’re not being criminally charged and convicted of a thought crime in this situation. You’re just not welcome to join the party. Big difference. Foreigners have no right to enter the USA other than by what the law permits.
Now, I don’t necessarily agree that we should be denying visas to people based on reasonable disagreements with US policy—after all, existing citizens are entitled to share those same opinions! But “crime” means something, and that’s not what this is.
Uh what? Where's all that "freedom" we heard about for the last 80 years?
Marketing, largely. But indeed Americans are free to think and write as they please without criminal consequences. They certainly have more protections than the British do (especially around defamation).
It is a bit different than what we are discussing, but intent plays a huge role in Western justice. The same physical action can lead to vastly different outcomes.
A high profile interesting example of this is the assassination attempt on Brett Kavanaugh. If you look at the details none of the actions would have been an attempt if not for the intent.
It is an interesting thought experiment as to how many actions you have to take for a crime that you don’t commit to be charged as an attempt or more broadly as conspiracy and at what point people are allowed to change their mind. We see this in terrorism cases pretty frequently.
> The same physical action can lead to vastly different outcomes.
Well, yeah, that’s kind of obvious once you realize that tools can be used for multiple purposes. A hammer can be used to pound both nails (legal) and smash a person’s head in (not).
But the notion that “thought crimes” where people are being punished merely for their feelings and where no act in furtherance of the outcome has taken place is just baloney. At least in the West.
[flagged]
Where are the stories about all the other mail providers who routinely cough up everything about your email account, including full content, metadata, and full payment details, on a daily basis?
Proton is one of the few services who accepts anonymous payment, and cannot themselves provide encrypted content in cleartext. They cannot save you from yourself, though.
i can’t speak for the journalists who wrote the story, but i assume it’s due to how prominently proton markets their email as safe/private/encrypted and then it turns out they may be sharing data with the swiss government who then gives it to the us government.
it absolutely should be news when the company who heavily promoted themselves to normies as safe, encrypted, and private is sharing customers data which is ending up in the hands of authoritarian foreign governments who are hunting for protesters.
> Proton Mail Helped FBI Unmask Anonymous 'Stop Cop City' Protester
This is a highly deceptive title. As if Proton proactively helped FBI, which is not even close to truth. Proton is not even in direct contact with FBI. It's Swiss government that forwarded the info to FBI.
A much better title would be:
Proton Mail Payment Info Helped FBI Unmask Anonymous 'Stop Cop City' Protester
Or
FBI Unmasked Anonymous 'Stop Cop City' Protester via Proton Mail Payment Info
The point is informing the normies that your payment info is linked to your identity and a potential risk to your anonymity.
That clickbaity title makes me want to unsubscribe from their RSS feed.
> then it turns out they may be sharing data with the swiss government who then gives it to the us government.
Literally every legal business complies to law enforcement. They have to.
They accept anonymous payment? I could've sworn they require an account...
You can literally mail an envelope of cash to them and they'll credit your account. Probably the best way to remain anonymous. At worst, they'll have the zip code from where it was mailed from and potential fingerprints. But since an envelope isn't really a financial record, I doubt they would hold onto it.
Okay I think I just misunderstood. I guess I was assuming "paying for the service anonymously" meant "paying such that the person using the service is anonymous", not "anonymously paying for the service". Haha. Syntax is fun!
Wouldn't make more sense to not store information (or have it encrypted without proton having access to it), so they would have nothing to share even if they were forced to comply?
As it should be. All corporations must follow the law. If the police has an order signed by a judge then it is lawful and a necessity for society to work to follow the law.
What is horrifying are big corporations giving access to all user data without recourse. That my data in Europe is send to the USA and accessed without limits by their goverment is a crime and a very dangerous situation.
- Fighting crime in an open criminal case with judge oversight is a very good thing and part of keeping the rule of law.
- Collecting data from all users without probable cause is a crime and will have nefarious consequences for all of us.
Know the difference.
https://archive.is/cGvKG
Proton won’t lock me out of my email because I accidentally sang a copyrighted song in a Youtube video. That’s why I use it, not because it’s the pirate bay for email.
> Proton won’t lock me out of my email because I accidentally sang a copyrighted song in a Youtube video.
Is there a specific story you’re referring to? Mind sharing a link? I have no intention of disputing it, I just haven’t heard of that particular case.
They updated YouTube rules so it no longer is the case.
But just the other week there were stories all over HN about Google banning accounts for accidental Gemini ToS violations
I’m aware Google bans accounts for wrong reasons, what I’m asking is about a case (as implied by OP) where they seemingly did so because someone sang a copyrighted song in a video. There are different degrees of bad, and that one would be up there.
You say it no longer is the case because they changed the rules. So does that mean it did happen? Could you share a link?
there are plenty of examples throughout history, although i haven’t heard much about it recently. tl;dr you don’t have a gmail account, you have a google account. if that account gets banned on one service, you may lose everything.
> tl;dr you don’t have a gmail account, you have a google account. if that account gets banned on one service, you may lose everything.
I’m perfectly aware.
> there are plenty of examples throughout history
I’m not asking about plenty of them, I’m asking about one. Has there been a case where, as you said, Google has banned an account because someone sang a copyrighted song in a video? That’s the one I want to read about.
I don’t have any sympathy for large corporations and I don’t use Google services, I just want to be informed about draconian tech decisions.
Did you make up that story? It’s OK if you did as a hyperbole, I just want to know.
it’s hyperbole as far as i know
Proton = Privacy Theater. Always has been.
Using Proton for privacy and security is quite ignorant. They are known to support legal requests without ever challenge that request. At least Yahoo has way better record than Proton. I use Proton, but never for privacy reason. It is as good as hotmail and yahoo mail. If you truly care privacy do it in another country. So qq mail and yandex mail have zero chance being look at by any western authorities. And the same with if you distrustful of China and Russia which cant look into Google mail.
> A court record reviewed by 404 Media shows privacy-focused email provider Proton Mail handed over payment data related to a Stop Cop City email account to the Swiss government, which handed it to the FBI.
As memers say, of all things that didn't happen, this one didn't happen the most.
Why is there a paywall AND anti-aging snake oil ads? Pick one. If that's the type of ad you sell it signals to me the site is absolutely not worth the subscription.
Dumb Lavabit with extra privacy-washed marketing.
> Proton did not provide any information to the FBI ... Swiss justice department > This is an important distinction
Not really, that's a minute procedural distinction without a difference.
> can only happen after all Swiss legal checks are passed.
Oh, don't worry, US also has some "checks", just as useful!
> we understood that a law enforcement officer was shot and explosive devices were involved
And now you're just compounding your fail by siding with the notorious liars against your own customers.
What do you think they should’ve done when faced with a legal warrant from the jurisdiction they operate in?
They should've prepared themselves and their customers better before that happens - one tiny example: there is no anon payment option listed at the main payment flow and no warning that credit card. Or maybe there is some smart way of not having permanent access to the payment identifier, only during the time of payment?
Re. at the moment not sure, that depends on their jurisdiction, but that's another thing - why don't they explain what's possible and what and why they did/didn't do?
I agree that they should offer private and anonymous payment like monero and cash. They do talk about using a VPN and Tor to hide your IP but its kind of hidden in the footer.
https://proton.me/tor
https://proton.me/support/payment-options
Quote:
You can pay for any Proton subscription with Bitcoin — but it won’t appear as a payment option when you first create your account.
To use Bitcoin, create a free Proton Account, then upgrade to a paid subscription in your account settings.
Quote:
We accept cash payments in US dollars (USD), euros (EUR), or Swiss francs (CHF).
btc is the opposite of private and anonymous. They do accept cash by mail but not on there main page.
Let me guess .. they weren't going after a "protestor" like the headline would try to lead you to believe.
"Authorities were investigating [them] for their connection to arson, vandalism and doxing"
And there it is.
I don't know what is in the water, but "I can do crimes, as long as it's part of a protest" seems to be what people actually think these days.
Civil disobedience means accepting punishment. Literally "letter from Birmingham jail" was sent from a jail in Birmingham for a reason.
People will never understand, Proton is a privacy based email server, it is not the dark web where you can do as you please without consequences.
Proton only has access to your IP and device ID, not your data. With IP and device ID, you can easily track an user like finding the ISP, etc.
Do you wanna do naughty things?? Don't use such services do to so.
And ironically,this 404 Media is the only place I found covering this information and they require you to login to read the whole thing.
Hmmmmmmmmmmmmmmmmmmmmm red flag big time!!!!
Proton isn't opsec, it's just the best available commercial clearweb host that still has to follow all the laws and comply with warrants, but won't be arbitrarily selling your metadata or engaging in the adtech garbage.
Kagi is to google as proton is to gmail.
You get web mail, custom domains, decent security, decent spam detection, solid features, and no PII being sold. Nice, clean, simple - I like paying them money. I feel good about doing business with them, and I don't run into that often these days.
Sounds like Fastmail, except Fastmail is less sketchy and has better deliverability.
Fastmail requires payment meaning it is very closely tied to your identity. Proton is one of the very very few who do not tie a new email account to your identity via phone number, payment info or alternative email (which requires phone, payment info etc..).
Even proton only provides webmail free - pop3/imap/smtp require payment. But that's still better than 99.99% of other webmail - everyone verifies via some method that ties to your personal info.
What's sketchy about proton?
I don't know if sketchy is the right word but every* time I encounter a proton mail user on a mailing list, they are tinfoil-hat paranoid. Like they are a random nobody, but they are convinced that "the Russians" or "the Chinese" are constantly hacking at their laptop and they are constantly trying to harden everything so much one wonders why they even bother using computers at all.
* OK "every" is an exaggeration but enough that the impression has been formed.
How is Fastmail vs Proton?
Yes it does have access to your data, at least any email coming from or going to another mail provider. Because those are not end to end encrypted. Only encrypted in transit (and even that is optional). So they need to handle the plaintext at the point of transmission.
I really don't like this about proton, they're always going on about their encryption but most emails they've seen in plain text on their SMTP servers. Because that's just how SMTP works. And so has the provider of the other party.
Once they've put them in your mailbox they can't decrypt them again but I always consider a single exposure a loss of confidentiality. The only emails this doesn't apply to are those from people using PGP (yeah all three of them) and those on proton themselves.
In my view this Achilles heel makes most of their protections irrelevant. But they still market it as if it's the email equivalent of signal, which actually can't see what you say at any point of transit. And non technical people have no idea about the difference.
Ps I'm not blaming proton for not having a technical solution for this because interoperability makes it an unsolvable problem. But I do blame them for their marketing around it.
> Do you wanna do naughty things?? Don't use such services do to so.
Is that really what happened here?
https://en.wikipedia.org/wiki/Stop_Cop_City
[flagged]
Why do police need big training centers to learn about the constitution and our rights, escalation of force, etc? I learned all that stuff in a single room when I was in the military.
So yea, “not like that” indeed.
Look at the numbers for number of people who die from interactions with police (both armed and unarmed) and then compare that to the extra violent deaths that happen because of defund the police polices and then let us know what you find. Only then can you make the claim you are implying. Otherwise you are doing the conspiracy theory thing where you present random data and then imply the idea you are pushing.
Can you give me examples of where police were actually defunded?
I lived in Oakland. It happened there (and about a dozen other major cities). Gaslighting voters is how you lost to Trump.
404 Media has an excellent track record and is very reputable, if you're saying the "red flag" applies to them.
Meh,they got their own agenda.
If the person or politics / group,they don't support then they have no problem just straight up making stuff up.
Like the hit piece of Elons Grok where it was "doxing" pornstars names,but in reality all it did was just search web online and got the info from the first website it could find.
But they made it seem like it was some hidden info that only Grok and Elon would know...
Sounds like you don’t understand doxing and may be overly sympathetic to a reactionary billionaire’s propaganda machine.
Doxing for the most part is simply aggregating publicly available information on an individual and broadcasting it to a wider audience. Rarely does it require more serious sleuthing or even “hacking”, although those are the more notorious instances because it involves someone who may have been trying to hide their identity for various reasons.
> don’t understand doxing
No, it's that people keep misusing that word for a broader and broader class of things. Pushing back on dilution of meaning isn't a lack of understanding.
What’s the utility of narrow definition of doxing? It’s a form of harassment. Who benefits from a narrow definition, aside from harassers?
I think we’re pretty far away from “falsely accused of doxing”. What’s it going to be? “I was just writing a research paper!”
Journalists should work for free. Which means that they are going to be paid by governments and corporations to spout propaganda because everyone has a mortgage to pay off...
this
I really don’t think 404 Media having a login gate is a red flag. They’re a business that needs to make money and the alternative to subscriptions is ads, which would be exponentially worse for user safety than what exists today.
Proton doesn't really protect anything email related unless the recipient is also using protonmail. The article also points out they sought payment data, not "IP and device ID" information.
This seems misleading inasmuch as your correspondents aren't all on the same mail servers.
Yes, correspondence between you and Build-A-Bear, and between you and your local terrorist cell, are unencrypted individually. But Build-A-Bear presumably doesn't know about your correspondence with the cell, and the latter presumably has some interest in not sharing organizational data access with the former.
I suppose you do have to trust that Proton isn't served a directive to snoop on your correspondence in transit with other providers. But that's still a much better position than leaving all of your historical data unencrypted at rest.
> unless the recipient is also using protonmail
Or any similar service from another vendor? Or hosts their own email. If someone using Protonmail emails me, their data is also not getting sold for example, it's just stored on my laptop
Even if it's another self hosted service, proton still needs the plain text in order to send it to them with transit encryption only.
Proton does have interoperability with PGP/GPG but very few people use that because of its UX.
> Proton only has access to your IP and device ID, not your data.
I like Proton. I use Proton.
However, the problem with proton is that if you access your email via a web browser, there's nothing stopping protonmail (to my knowledge) from reading your email from within their webapp via JS. This type of attack could be targeted at the behest of authorities.
So, actually, Proton COULD read your email (IFF you use webmail).
>So, actually, Proton COULD read your email (IFF you use webmail).
The authorities can also read your self-hosted email if they had a warrant to search your house. Even if you enable FDE they can do a cold boot attack.
I believe that you would not expect that level of interaction with LEAs for a "stop cop city" dude that hasn't even been charged with a crime.
I'd count that up as a hypothetical win of the self-hosted main in your own location.
If you are Dr. Evil, OTOH, other calculi apply.
Just out of curiosity, what is a cold boot attack?
https://en.wikipedia.org/wiki/Cold_boot_attack
tl;dr they pull the decryption keys from your computer while it's still running, which of course it is because your mail server has to be up 24/7.
Simple solution: put your server inside of a cabinet or enclosure that immediately powers it off if opened with a hidden micro switch. Additionally, write a little udev rule to immediately power off if any new USB device is connected or Ethernet is unplugged.
So a trip-switch for the server?
How would one access it if one needed to do config changes or, really, anything the server for legitimate purposes?
ssh in and shut down first (and/or just use a properly reliable filesystem).
Mail transfer can tolerate multi-hour interruptions. Imagine the drama if it couldn't!
If you can ssh in, couldn't they ssh in?
That is fascinating! Thanks for sharing!
[dead]
What if you use encryption?
FDE stands for "Full Disk Encryption" in this context.
[flagged]
You always put trust in the vendor even if they use e2ee because the end clients are made by them.
They can just send things without e2ee from any of their clients (not just web).
> This type of attack could be targeted at the behest of authorities.
No? How can authorities tell them how to do their business?
Is even that needed? Nothing e2ee about the emails you receive normally, they could just read them right away if they really wanted to. And that is to say nothing about the metadata.
Here you are: https://archive.ph/Zvw3O
>Proton is a privacy based email server, it is not the dark web where you can do as you please without consequences.
If you are so hard-pressed to do something, then maybe setup your own smtp server
That's 404 media's approach. That's why I only read their headlines.
In theory you could open up your protonmail account over tor and with bitcoin (or does that not work anymore?).
Its been a good while since I tried them out. Why I don't recommend them anymore is because when I didn't extend my subscription in time (expecting an account downgrade), my mail was locked and emails hold on to as random. Allowed to login only for payment.
That was one red flag from me, the second was when they shared IP address logs of a French protestor. E̶v̶e̶n̶ ̶t̶h̶o̶u̶g̶h̶ ̶a̶t̶ ̶t̶h̶e̶ ̶t̶i̶m̶e̶ ̶t̶h̶e̶y̶ ̶h̶a̶d̶ ̶a̶ ̶n̶o̶ ̶l̶o̶g̶s̶ ̶p̶o̶l̶i̶c̶y̶,̶ ̶i̶f̶ ̶I̶ ̶r̶e̶m̶e̶b̶e̶r̶ ̶c̶o̶r̶r̶e̶c̶t̶l̶y̶.̶ ̶O̶r̶ ̶i̶f̶ ̶I̶ ̶d̶o̶n̶'̶t̶.̶
>the second was when they shared IP address logs of a French protestor. Even though at the time they had a no logs policy, if I remeber correctly. Or if I don't.
You probably aren't remembering correctly given that specifically have a "login logs" option that can be toggled on/off.
Thanks for the update of the current state.
I think at the time there was confusion around their policies
"ProtonMail logged IP address of French activist after order by Swiss authorities"
https://techcrunch.com/2021/09/06/protonmail-logged-ip-addre...
I let my subscription expire and my account was never locked down or emailed held for ransom. I suspect there is another piece to the story you're either neglecting to mention or don't know.
Yes, this happened 5-6 years ago, I've publicly complained before, and I paid with bitcoin. Those are the only details not included in my previous comment.
Oh see I didn't pay with bitcoin. Maybe they have a differeny policy with that? Hmm...
You can still pay with cash!
last time i tried they asked for an email to link the account to. I don't think they provide anonymous accounts anymore, but you can probably create one with another anonymous email.
What device identifier are you referring to, something like the MAC addresses of your network cards? How are they retrieving that via a browser?
Wild that it says this on their site:
>Sign up with no phone number: Get a private email account without handing over more personal data than necessary, making it harder for advertisers, data brokers, and other services to track you online.
I guess it doesn't mention law enforcement so ¯\_(ツ)_/¯
The article explains that the account was identified based on a credit card payment for a paid account, which does not invalidate the statement in question IMO. Perhaps we differ on the definition of "private" or something else, but unless all parties are using proton, email is inherently insecure and somebody can/will have a record of your communication regardless.
> unless all parties are using proton, email is inherently insecure and somebody can/will have a record of your communication regardless.
That the person you're exchanging messages with, has your messages, is hardly a surprise. Not everyone-but-Proton sells your data though so it's not quite that black-and-white
You're not wrong, but I think it just means you can never be 100% safe, as even the recipient of your message may be secretly working against you.
I'm not sure what you were expecting here. If you have data and the police shows up with a warrant, you can't just tell them "nah we don't feel like it".
You can do what Signal does: store basically no data, so that you don't have any data to hand over.
They could have used a VPN to connect to Proton and paid for their account with bitcoin or cash and then law enforcement would have had a very tough time. Instead, they paid with a method connected to their identity. Of course Proton handed it over when law enforcement came knocking.
If you don't want info being given to law enforcement by third parties, your best bet is to make it so that nobody else has access to it in the first place. You might get away with third parties that are in a jurisdiction unfriendly to wherever you live. Definitely don't hand over your info to a company in fricken' Switzerland and then be surprised when they comply with law enforcement requests for it.
When a SWAT team drops in nobody's gonna take a bullet for your emails.
This is disappointing. I would pay up to $10/month for an email provider who would go to jail for me.
https://en.wikipedia.org/wiki/Bulletproof_hosting
Actually neat. No mail deliverable issues?
> I would pay up to $10/month for an email provider who would go to jail for me.
You might need to pay more than that.
I think I could be convinced to do $11/month if they'd also be willing to die for me.
Well I guess Proton cannot be trusted. You know what they say, centralization corrupts absolutely
What Proton sell you is reduction of anxiety. But that's a lie.
The whole idea of encrypted email is pointless. There's absolutely no guarantee it's encrypted in transit or encrypted at rest on any machines it transits through unless you encapsulate the messages with PGP and then you still leave a trail of envelopes everywhere. Any government who wants your data will come round and beat it out of you or the provider as best as they can. And if you have the pay the provider, as evidenced here, they can point to you and then beat you for it. Beating being metaphorical or otherwise.
Use any old shitty email provider and make sure you can move off it quickly if you need to. Standard IMAP, not weird ass proprietary stuff like proton. Think carefully what you do and say. Use a side channel for anything that actually requires security.
Thanks for pointing that out. I always do too. I'm always surprised how many people here aren't aware of this.
You can pay proton anonymously according to some other comments here...
As a long time Proton customer...I am fairly certain Proton has always been completely upfront that they will comply with lawful requests for information from the Swiss authorities, if response is obligated by Swiss law. Therefore this isn't especially surprising.
The key is and always has been to make sure that someone like Proton simply doesn't have the information so they can't give it away.
This is just impossible. If they're going to be sending your email to gmail then they need to see what's in it. So they will have the data at some point. You have to trust their brown eyes that they don't look at it while it's going through their inbound and outbound servers. But they're selling it as a technical protection, not a trust-based one.
Personally, if you want private Comms, just don't use email. The protocol is just not suitable.
Exactly, you can use bitcoin, even cash. You can even add credits with PayPal or a credit card, in which case Proton (I assume) won't remember your payment data. But if you attach credit card info permanently to your account then it can be retrieved.
It's wild to me that people are downvoting this. Nobody is going to jail for you...
I don't think any commercial entity can be trusted to break the law on behalf of customers who only pay a small fee each
In this case, it was Swiss courts who forced them to comply, not foreign courts.
And from what little I can tell from the article, it was account payment data, not content from the account.
Proton was never designed or advertised to resist this kind of threat.
Given they were praising Trump, Vance, and gang - I called it then.
I cancelled my Proton account when all of that hit Mastodon. Their VPN was good, but I dont support nazies and their toadies.
I wasn't even aware of anything around Proton and specific US political parties. Thank you for your post, as it led me to some searching.
The single most useful link I found was this Reddit thread:
https://www.reddit.com/r/ProtonMail/comments/1i2nz9v/on_poli...
Good enough reason to never trust them.
In trying to check this claim (I thought Proton did sensible things), I found that the submitted news article is not new at all:
> [Proton's] homepage touts that “With Proton, your data belongs to you, not tech companies, governments, or hackers.” However, [...] Proton previously handed over an IP address at the request of French authorities made via Europol to Swiss police. Yen wrote a Twitter post at the time, stating, “Proton must comply with Swiss law. As soon as a crime is committed, privacy protections can be suspended and we’re required by Swiss law to answer requests from Swiss authorities.” ---https://theintercept.com/2025/01/28/proton-mail-andy-yen-tru...
Big surprise: swiss company complies with swiss law!
And the same happened now, quoting the part of the submission that you can read without signing up:
> privacy-focused email provider Proton Mail handed over payment data related to a Stop Cop City email account to the Swiss government, which handed it to the FBI.
Anyway, regarding your claim, it's a whole rabbit hole of statements they made but broadly speaking it sounds like you're right: Vance supported legislation which Proton campaigned for and, subsequently (as of 2025-01), Proton loves the US Republican Party, believing they would stand up for 'the little guy'. To be fair, they bring some evidence that sound like it can be verified and back this opinion up somewhat, but even if it's a correct opinion on this sub-topic, it's still supporting authoritarianism. Anyway, this is where I'm going to stop trying to politically analyze their situation and just not recommend Proton anymore...
It seems they aren't violating the promise about "your data", and are handing over "their data" (IP addresses, payment data)
That seems quite irrelevant in the bigger picture. I'm not recommending a company that campaigns for an authoritarian party, not even to other people in that camp. It's just immoral
[flagged]
We do care. Someone's gotta stand up to it.
They’ll still be in business in 20 years. So much for all that standing up.
Well I care. I am more informed because of their comment. I now know that I must avoid Proton.
More informed by that comment, really? Did you read this[0]? As someone disinterested in the topic, the controversy seems very overblown and a knee jerk response. His position seems to have been pretty consistent over time.
[0]: https://medium.com/@ovenplayer/does-proton-really-support-tr...
I don't know what Proton did regarding Trump, but if you follow this principle to the end you might as well ditch technology and live in the forest. I'm not being hyperbole, everyone does business with or endorses someone on either side who does stupid shit.
[flagged]
[flagged]
> The only whinging I see is people using terms like Nazi for everyone they disagree with
what an oddly specific example
What’s oddly specific about it?
Thank you for sharing. I was trialing Proton Mail but I will move away from it because of this. This is some teenage level crime and legitimate protesting that it threw away its reputation for.