Top
Best
New

Posted by lehi 15 hours ago

Proton Mail suspended journalist accounts at request of cybersecurity agency(theintercept.com)
278 points | 148 commentspage 2
drnick1 12 hours ago|
And this is why I host my own email server, even if I am not a journalist investigating governments or anything of the sort. It's a matter of control over my computing.
abnercoimbre 9 hours ago|
Common folklore is that this is extremely onerous to self-host (and have it work successfully.) How did you go about it?
drnick1 9 hours ago||
The common folklore is just FUD. The main issue is deliverability to the likes of Google, Microsoft, Yahoo, etc. You need a clean fixed IP in non-residential block and a sufficiently aged domain or your mail will be flagged as spam or rejected. Alternatively, you can use a relay service for outbound email. Besides the deliverability issue, hosting email is fairly trivial from a technical standpoint; on Linux, the standard utilities are Postfix, Dovecot and OpenDKIM. The server is for my own use, so I don't even bother with spam and AV filters.

Even if you can't send email at all (unlikely if you use an outbound relay), there are very significant privacy benefits to having your own server. I send very few emails relative to the number I receive. You couldn't pay me enough to go back to one of big commercial providers.

bigiain 8 hours ago|||
> You need a clean fixed IP in non-residential block

Feels like that's carrying a lot of load there?

Where do you get those? I doubt any inexpensive VPS provider has any clean IP addresses? AWS charge you $5/month for an elastic IP address, and I bet you'd need to cycle through their pool of those looking for one that hasn't been blacklisted recently?

There's another thing to consider here too. I was selfhosting my own mail, but back in 2013/14 I investigated all my mail, and even though I'd avoided Google/Microsoft,Yahoo et al. - over 80% of my personal email was on their servers because that's where my correspondents were. I pretty much gave up maintaining my own (slightly over complicated) stuff and gave in and chose to accept the "Do no evil" company at face value. 4 or 5 years later that company no longer existed, even though they continue with the same name today.

crossroadsguy 6 hours ago|||
If I may say so, did you not just show in this very comment that that common folklore about self-hosting email "successfully" is not really FUD? :D
drnick1 9 hours ago||
As far as I can remember, you don't even get IMAP access on the Proton free tier. For me, that's a non-starter. The privacy claims are also mostly marketing, as it is basically impossible to verify what Proton actually does when approached by a three-letter agency. I wouldn't use email anyway if I had something to hide, the email protocol wasn't designed with secrecy of communications in mind. For that, Signal seems far better, or perhaps a self-hosted, encrypted Matrix room.
shauntest12321 3 hours ago||
Forward Email fan for the fact they are 100% open source. Easy access to the developers. All others closed source in most regards.
segmondy 14 hours ago||
When people show you themselves, believe them. Proton is no longer to be trusted. Use at your own risk.
sitzkrieg 14 hours ago||
proton always glowed but just straight up bending to unnamed agencies puts em rank and file with every single other provider
lo_zamoyski 13 hours ago|
Is refusal realistic? It's nice in the abstract, but in practice, there are plenty of ways to coerce illegitimate compliance.
bigiain 7 hours ago||
No company is gonna seriously refuse when their jurisdiction's equivalent of the FBI or NSA turn up with a court authorised order. As James Mikkens said: "YOU'RE STILL GONNA BE MOSSAD’ED UPON"

But it'd be nice to be able to expect your email provider to not cave in to a request from some other counties CERT organisation without pushing back for evidence and some sort of proper judicial authority behind the request.

crossroadsguy 6 hours ago||
This article, right? https://www.usenix.org/system/files/1401_08-12_mickens.pdf
Ey7NFZ3P0nzAe 5 hours ago||
I'm worried and surprised to see the many comments here that, contrary to what I'm used to reading here, nobody seems to have dug deeper, looked critically at the evidence. Quite a lot of just ad hominem and insinuations.

This looks like brigading to me. Which is the only way for govs to fight against protonmail: spreading doubt.

Hence I am reinforced to continue being a strong supporter of Proton.

SilverElfin 14 hours ago||
I thought Proton was a confidentiality / privacy oriented thing. How do they even know who owns the accounts?
guywithahat 14 hours ago||
You can disable an account without knowing who owns it, although they do have credit card/payment information now, and I don't think new accounts get encryption services unless they pay.

That said, if your inbox is encrypted, protonmail does so on the client side with a second password. They can maybe delete the account, but proton mail doesn't know what the encrypted data is. What happens to new emails sent to a disabled address is anyone's guess though. Honestly I think they're doing the best they can given the circumstances

gruez 14 hours ago|||
>and I don't think new accounts get encryption services unless they pay.

source? Their compare plans page specifically lists "End-to-end encryption" as a feature for their free plan.

https://proton.me/mail/pricing#compare-plans

Sunspark 14 hours ago|||
You are trusting them. They control the client, how the keys are created/stored, etc. Javascript, etc. If they were to suddenly turn one day, they could.

This is the weakness of cloud services.

rvnx 14 hours ago|||
It is very possible for them to inject custom JS to a specific user.

You are the bosses at Protonmail, do you want police at 6 am shaking your kids, seize all your devices, loose all agreements with PayPal and Visa/MasterCard, because you want to protect a guy who distributes child pornography or plans a terrorist attack ?

No way, so you tap on the shoulder of the CTO and ask him to push a temporary update or turn on a feature flags, in order to collect the missing information.

This is true for all companies who control the client.

bigiain 7 hours ago||
From what we (at least I) know, this wasn't the police in Switzerland waking up senior management.

t was - without anyone admitting to it - probably KrCERT who requested the account suspension. KrCERT don't seem to have any legal jurisdiction in Switzerland.

"KrCERT/CC, which is an internal division of KISA, is a CSIRT with national responsibility and a focal point of contact for Korea on international cybersecurity incident handling." -- https://en.wikipedia.org/wiki/Korea_Internet_%26_Security_Ag...

I'd like to think if they 'tapped on the shoulder of the CTO ' of a company headquartered in Switzerland, he'd say "maybe, come back with an order from a relevant court or security agency in Switzerland and I'll get my team right on that".

j-bos 14 hours ago||||
Trusting them is almost guaranteed, but it doesn't have to be, sort of. The clients are opensource so you literally clone, audit, and run the clients locally.

Full disclosure, I use Proton and overall trust them so unless I see strong evidence of abuse or lies on their part I'm inclined to post contextualizing comments on stuff like this, b/c well I don't wanna host my own mail server, at least not in prod.

HeatrayEnjoyer 14 hours ago|||
Or just use an open source email client.

I would expect their own apps to be open source, are they not?

j-bos 14 hours ago|||
Indeed they are: https://github.com/ProtonMail

If you, or someone else, like please audit the repos. Could be cool to see trusted forks of some of the clients.

balamatom 13 hours ago|||
Using an email client requires a Proton Bridge thing that acts as a local IMAP/SMTP proxy: https://github.com/ProtonMail/proton-bridge

As if disabling the issue tracker and stonewalling pull requests wasn't bad enough, seeing how it is built out of multiple layers that communicate via gRPC was what made me instantly lose all trust in Proton. I don't know who's been doing their hiring but just from one look at that kludge it's evident they've lost the plot altogether.

(There's a third-party alternative called Hydroxide, but it's experimental. Haven't been able to send emails through it from Thunderbird yet, though I've only looked into this for a few hours recently.)

gruez 14 hours ago|||
Second paragraph of the article:

>But last month, Proton disabled email accounts belonging to journalists reporting on security breaches of various South Korean government computer systems following a complaint by an unspecified cybersecurity agency

mr90210 14 hours ago||
They all are until they get threatened.

Soon or later we will default to analog means. It’s not looking good.

demarq 4 hours ago||
Proton does not do anything it says in the tin.

Just a warning

pagansRpedos 14 hours ago||
It's because the journalists were covering the professor-student rape scandal at UIUC Champaign that was covered up by Champaign and other governing bodies.
bigiain 7 hours ago|
Citation required?

That's not what Phrak says here: https://phrack.org/issues/72/7_md

Where they say "Proton was used only for email and only to communicate with South Korea"

More comments...