so if you want to subscribe to a vpn, and you were considering proton, maybe dont

[viss@mastodon.social]

so if you want to subscribe to a vpn, and you were considering proton, maybe dont

Joseph Cox (@josephcox@infosec.exchange)

New from 404 Media: Proton Mail, the privacy-focused email service, gave authorities data that let the FBI unmask an anonymous 'Stop Cop City' protester. It was payment data linked to the anonymous email account. From that, FBI ID'd them, then tracked their movements https://www.404media.co/proton-mail-helped-fbi-unmask-anonymous-stop-cop-city-protestor/

Infosec Exchange (infosec.exchange)

[krypt3ia@infosec.exchange]

@Viss No vpn is safe, really.

[viss@mastodon.social]

@krypt3ia i run my own, on my own hardware, in a datacenter

[floriann@infosec.exchange]

@Viss you can pay Proton by cash via mail to stay anonymous.

[viss@mastodon.social]

@floriann and you would go to those lengths to pay them even though they'd turn over your logs still? tsk tsk

[krypt3ia@infosec.exchange]

@Viss Even so.

[krypt3ia@infosec.exchange]

@Viss You get on the naughty list, they will just access it with warrant.

[viss@mastodon.social]

@krypt3ia yeah but then theres the lavabit way. just dont log. or log in such a short timeframe that the bureaucracy makes it impossible to get shit done in time

[bhhaskin@social.bitsofsimplicity.com]

@Viss @floriann that's any business though right?

[viss@mastodon.social]

@bhhaskin @floriann in america - but proton isnt american. so why are they complying with a foreign law enforcement agency?

[viss@mastodon.social]

@bhhaskin @floriann like, the fbi cant issue a warrant to like, austria or switzerland or wherever. they have zero jurisdiction. so if proton isnt american, and they handed logs over to the fbi, it means they did it willingly

[bhhaskin@social.bitsofsimplicity.com]

@Viss @floriann I mean this isn't the 90s anymore, most countries have legal mechanics in place for that kind of thing.

[viss@mastodon.social]

@bhhaskin @floriann yes - and having had to partake in some of them, those mechanics are:
- folks here try to figure out who the folks on the other side are they need to get ahold of
- one agency here tries to talk to another agency there
- they basically have to do puppydog eyes and beg
- the other agency can tell them to get fucked if they want

and that entire exchange makes it into the news articles, cuz both agencies get credit

[viss@mastodon.social]

@bhhaskin @floriann the best examples of these sorts of things are when american law enforcement goes after csam peddlers in another country. they'll usually mention that it was like, interpol or whoever they worked with, and that'll be clearly written about as such.

but this article only mentions proton, and the fbi

which, again, says they worked directly.
and if thats the case

proton turned over logs without any "legal pressure to". willingly.

[bhhaskin@social.bitsofsimplicity.com]

@Viss @floriann hard to say without knowing the details. It could just be a poorly written article, or an article that is trying to push a narrative. (Can't actually read it behind the paywall)

A hypothetical could be that the FBI reached out to visa and asked them to have a business comply or lose access to payment services. Not saying that is what happened, but just that there could be a ton of reasons why it happened.

It wouldn't surprise me in the least if Proton willingly handed over, though. Just pointing out that really in this day and age that is any business.

[viss@mastodon.social]

@bhhaskin @floriann

[viss@mastodon.social]

@bhhaskin @floriann so it looks like america and switzerland have a deal where the cops here can get the cops there to comply.

sigh

[floriann@infosec.exchange]

@Viss i can't access the article so I don't know to which logs you are referring to.

In general proton has a no logs policy but I guess they might be forced logging access to specific accounts on demand.

To mitigate this they offer Tor access. I personally don't use Proton and I think if some state actor is after you probably can't stay anonymous using convenient services.

I don't trust any VPN providers because it is the best Crypto AG like business appliance I can think of.

It's easy to tell the people to avoid Proton VPN because they might track you down when authorities walk in their offices and pull the business files out of the folders - but I can't think of any VPN this is better protected in that regard.

[viss@mastodon.social]

@floriann they turned over payment and subscriber details, and the person using the email used their personal bank/credit card to pay, and that data exposed their identity.

[floriann@infosec.exchange]

@Viss @bhhaskin well I guess it's not that easy - there are mutual legal agreements to speed things up. And as far as I can tell european won't easily reject a request from us authorities because they fear punishment.