Proton Mail gave FBI payment data from Swiss servers, proving encrypted email privacy has limits when governments use legal treaties to demand user information.
  • durinn@programming.devEnglish
    2·
    5 months ago

    In addition to what @gravitas@lem.ugh.im said, as long as any third party is involved in the handling of PII, there should be no expectation of privacy whatsoever. For instance, I use Mullvad VPN, but that is as much a political/ideological statement to me as it is but one countermeasure against malicious actors in a very complex cyber environment. I could go on about how Mullvad has proven over and over - through third party audits and through actual incident response - that they have zero data to hand over to the authorities. But I won’t, because that’s not the point here. The point is: if I was involved in something that made me interesting to the authorities in any capacity, putting my trust, privacy, security and life in the hands of one company would not be the way to go about it. Not even in Mullvad, which I otherwise use.

    Good OpSec is not about relying on technical solutions. It’s about real-world threat modeling, assessment, having three backup plans and careful execution.

    Is it morally questionable for Proton to cooperate with the authorities going after activists? Yes. Should there be any expectation of privacy and/or security from the end user’s point of view? No.

    Manage your expectations and scheme accordingly.

    • A🔻atar of 🔻engeance@lemmy.mlEnglish
      02·
      5 months ago

      I think we can guess how little we ought to trust Mullvad by looking at its server list. They have Israel, the Baltic Israels, and the Asian Israels. Egregiously obvious.

  • gravitas@lem.ugh.im
    1·
    5 months ago

    Im not a fan of proton, but this trend of blaming corps for individuals poor opsec (paying with a method linked to their real identity) is pretty lame.

    Do people using these services actually expect a corporation to break laws or violate court orders on behalf of their users?

    Proton regularly releases very clear info about how often they comply with legal orders, this isnt a secret and its certainly not protons fault that activists had poor opsec.

    • A🔻atar of 🔻engeance@lemmy.mlEnglish
      0·
      5 months ago

      It’s not something you can avoid by simply not using a credit card. Proton can, at their discretion (such as if you use VPNs outside the imperial core, in which case it happens reliably and instantly) lock you out of your entire account to demand a phone number. Vanishingly small % of people will not have their personal identity exposed by cell data & be ready to deal with losing their account on short notice. It’s the same shady tactic that Discord uses to get phone numbers from reluctant people and it should not be tolerated.

    • atrielienz@lemmy.worldEnglish
      2·
      5 months ago

      Privacy ≠ Anonymity.

      They are not the same thing, and proton are very transparent about what they will and won’t do in this regard.