so if you want to subscribe to a vpn, and you were considering proton, maybe dont
-
@floriann they turned over payment and subscriber details, and the person using the email used their personal bank/credit card to pay, and that data exposed their identity.
Mystified as to why Proton did it. That was a major business-limiting action. Really dumb. Kompromat maybe? Truckload of money? Been on the wrong side for years but let it slip this time?
Whatever the reason, it's useful to know that they're worse than the obvious ones like Google and MS--because Proton lies about their standards and practices.
-
Mystified as to why Proton did it. That was a major business-limiting action. Really dumb. Kompromat maybe? Truckload of money? Been on the wrong side for years but let it slip this time?
Whatever the reason, it's useful to know that they're worse than the obvious ones like Google and MS--because Proton lies about their standards and practices.
@jakebrake @floriann so turns out theres this MLAT thing between the us and switzerland, and the fbi was able to get swiss authorities to pressure proton into turning over subscriber data
-
-
@jakebrake @floriann so turns out theres this MLAT thing between the us and switzerland, and the fbi was able to get swiss authorities to pressure proton into turning over subscriber data
@Viss @jakebrake @floriann I've got to say "not complying with legal instructions in your own jurisdiction" seems like an even worse business-limiting decision.
-
so if you want to subscribe to a vpn, and you were considering proton, maybe dont
Joseph Cox (@josephcox@infosec.exchange)
New from 404 Media: Proton Mail, the privacy-focused email service, gave authorities data that let the FBI unmask an anonymous 'Stop Cop City' protester. It was payment data linked to the anonymous email account. From that, FBI ID'd them, then tracked their movements https://www.404media.co/proton-mail-helped-fbi-unmask-anonymous-stop-cop-city-protestor/
Infosec Exchange (infosec.exchange)
@Viss I'm more inclined to recommend people not to pay for 404 Media. That headline is not only horribly inflammatory and biased - it's flat out wrong.
Proton followed what's stated in their ToS by complying with Swiss law. All companies, everywhere, do.
If you need anonymity and not just privacy, account holders should use the options provided for that OPSEC. Proton has such as well.
-
R relay@relay.infosec.exchange shared this topic
-
@bhhaskin @floriann the best examples of these sorts of things are when american law enforcement goes after csam peddlers in another country. they'll usually mention that it was like, interpol or whoever they worked with, and that'll be clearly written about as such.
but this article only mentions proton, and the fbi
which, again, says they worked directly.
and if thats the caseproton turned over logs without any "legal pressure to". willingly.
@Viss @bhhaskin @floriann "subscriber information received from the Swiss Mutual Legal Assistance Treaty Unit" - so the FBI basically asked the Swiss police, that got the data and forwarded it back under the umbrella of a long standing treaty between the countries/authrities. This should not be surprising at all btw, but somehow for many VPN customers it is. -
@krypt3ia yeah but then theres the lavabit way. just dont log. or log in such a short timeframe that the bureaucracy makes it impossible to get shit done in time
@Viss that won't prevent your datacenter operator from turning over your payment information.
Some people never miss a chance to get mad at Proton for doing the exact thing Proton say they'd do in this situation, which is also the exact same thing any other lawful provider would do under the same circumstances.
-
@Viss I'm more inclined to recommend people not to pay for 404 Media. That headline is not only horribly inflammatory and biased - it's flat out wrong.
Proton followed what's stated in their ToS by complying with Swiss law. All companies, everywhere, do.
If you need anonymity and not just privacy, account holders should use the options provided for that OPSEC. Proton has such as well.
-
@Viss @bhhaskin @floriann "subscriber information received from the Swiss Mutual Legal Assistance Treaty Unit" - so the FBI basically asked the Swiss police, that got the data and forwarded it back under the umbrella of a long standing treaty between the countries/authrities. This should not be surprising at all btw, but somehow for many VPN customers it is.
@buherator @floriann @Viss @bhhaskin mull *cough* vad
-
I think all of this stems from the "Proton helped FBI" headline. They didn't. "Switzerland helped the USA" wouldn't get as many reactions.
There's OPSEC failure here, but trying to pin this on Proton is to look in the wrong place. It would not be any different were it any other privacy focused provider.
-
I think all of this stems from the "Proton helped FBI" headline. They didn't. "Switzerland helped the USA" wouldn't get as many reactions.
There's OPSEC failure here, but trying to pin this on Proton is to look in the wrong place. It would not be any different were it any other privacy focused provider.
@troed @Viss I disagree. Proton convinced US people that their comms will be safe at a foreign provider (them). Were users naive to believe this? Yes, but this is victim blaming.
I agree that Proton is not the only bad provider in the market. Actually, the whole market exists because all the providers communicate dishonestly. -
@troed @Viss I disagree. Proton convinced US people that their comms will be safe at a foreign provider (them). Were users naive to believe this? Yes, but this is victim blaming.
I agree that Proton is not the only bad provider in the market. Actually, the whole market exists because all the providers communicate dishonestly.They're comms are safe. Proton handed out what little information they have - which in this specific case included payment details which could've been avoided had the payment been done through other available means.
I don't see this as anyone being a bad provider. If you need protection from state actors you need a whole different level of OPSEC than to go sign up with someone who clearly state they will obey any lawful request for data.
-
They're comms are safe. Proton handed out what little information they have - which in this specific case included payment details which could've been avoided had the payment been done through other available means.
I don't see this as anyone being a bad provider. If you need protection from state actors you need a whole different level of OPSEC than to go sign up with someone who clearly state they will obey any lawful request for data.
@troed @Viss Let's put it this way: the acc owner is in the same situation as if they used Gmail for free (if they were smart authorities would even have a harder time connecting the person to IPs and other metadata). This is speculation, but I'd bet that the relevant comms is already collected from the users or the recipients devices/e-mail accounts too.
So what is exactly the value Proton provided here that the user paid for? -
@troed @Viss Let's put it this way: the acc owner is in the same situation as if they used Gmail for free (if they were smart authorities would even have a harder time connecting the person to IPs and other metadata). This is speculation, but I'd bet that the relevant comms is already collected from the users or the recipients devices/e-mail accounts too.
So what is exactly the value Proton provided here that the user paid for?That a proper legal request had to be made instead of Gmail just handing out everything because someone asked. Additionally, Proton cannot decrypt your email content so the contents of the communication is still secure (unless the account owner made the choice to communicate with less secure providers which, again, would be their choice).
-
@buherator @floriann @Viss @bhhaskin mull *cough* vad
@dey @buherator @Viss @bhhaskin
This probably wouldn't have changed anything because the victim paid using credit card details finally leading to de-anonymization. In that regard mullvad offers the same as proton.
-
@dey @buherator @Viss @bhhaskin
This probably wouldn't have changed anything because the victim paid using credit card details finally leading to de-anonymization. In that regard mullvad offers the same as proton.
@floriann @buherator @Viss @bhhaskin this is indeed a nuanced and age old discussion based on your own threat model. How deep someone willing to go. If you are up against nation state no amount of "protection" is enough. You want vpn exit node with tor entry for a decent anonimity. VPNs that offer anonymous payment are close enough. Still you can be outed with browser fingerprint or any other leaks in OS. Oh well.
-
That a proper legal request had to be made instead of Gmail just handing out everything because someone asked. Additionally, Proton cannot decrypt your email content so the contents of the communication is still secure (unless the account owner made the choice to communicate with less secure providers which, again, would be their choice).
@troed @Viss " Gmail just handing out everything because someone asked" This was a headline exactly because this was likely illegal. Let's assume that providers abide the law.
"unless the account owner made the choice to communicate with less secure providers" - which is exactly why the claimed e-mail privacy claimed by Proton et. al. is an oxymoron. -
@troed @Viss " Gmail just handing out everything because someone asked" This was a headline exactly because this was likely illegal. Let's assume that providers abide the law.
"unless the account owner made the choice to communicate with less secure providers" - which is exactly why the claimed e-mail privacy claimed by Proton et. al. is an oxymoron.Gmail does not seem to require that requests are made lawfully: https://newrepublic.com/post/206088/homeland-security-67-year-old-us-citizen-criticized-email
Additionally, Gmail _can_ and will hand out the contents of emails which Proton cannot.
Regarding believing your email contents would be safe because you use Proton and send emails to Gmail I'm sorry - it's not victim blaming to point out bad OPSEC. It's like crashing a car because you didn't take the time to learn how brakes work.
-
Gmail does not seem to require that requests are made lawfully: https://newrepublic.com/post/206088/homeland-security-67-year-old-us-citizen-criticized-email
Additionally, Gmail _can_ and will hand out the contents of emails which Proton cannot.
Regarding believing your email contents would be safe because you use Proton and send emails to Gmail I'm sorry - it's not victim blaming to point out bad OPSEC. It's like crashing a car because you didn't take the time to learn how brakes work.
@troed @Viss "hand out the contents of emails which Proton cannot" - OK let's not dive into if G should have obeyed a subponea... In both cases the accounts came under scrutiny because authorities _already knew_ email contents. Gmail would even have the benefit of not having payment info (also, cheaper).
(Btw. Proton can absolutely leak all your e-mails e.g. from the frontend they serve to you.)
"it's not victim blaming to point out bad OPSEC" - by this logic we shouldn't criticize charlatan doctors, because their patients should know medicine better? -
@Viss @bhhaskin @floriann "subscriber information received from the Swiss Mutual Legal Assistance Treaty Unit" - so the FBI basically asked the Swiss police, that got the data and forwarded it back under the umbrella of a long standing treaty between the countries/authrities. This should not be surprising at all btw, but somehow for many VPN customers it is.
@buherator @floriann @Viss @bhhaskin well crypto is also supported, here is their response from LI:
