Interestingly, ProtonMail's privacy policy lists a number of cases in which they may log your IP address permanently (including if you breach their Terms and Conditions). But a request from law enforcement is not one them.
Moreover, I would like to point out that ProtonMail is about encryption of email *content*. It is foolish to expect more from them. They won't protect your identity: law enforcement can know who you are and who you communicate with, but they cannot know the content of your emails (if you recipient uses encryption services as well).
I see that you want to protect Protonmail, but if they want to stop being misleading they can just remove the IP log sentence
I would much prefer this, as a Protonmail paying customer.
Tor is an improvement. It's still a limited tool.
I can't but help read your post in comic book guys voice.
Traffic analysis, at a cost, could establish that the suspect is using Tor.
TorMetrics shows slightly more than 1,250 currently-running Tor exit nodes. I'll presume this is typical, history shows it's pretty consisten over the past 3 months.
https://metrics.torproject.org/relayflags.html?start=2021-06...
I'm going to presume that a court could conceivably issue an order to log all Tor-based traffic. A state actor / APT might then be able to correlate a known IP and traffic at a given point in time with other data to identify a source IP. This might be combined with other measures to encourage circuit-jumping until the suspect is on a specific known or monitored Tor circuit.
Yes, costs increase. I don't see this as technically infeasible, however.
Might not be rolled out just for a house-squatter, however.
Frankly, I don't think anyone is safe from the tip of a nation state, even small ones. But I do think we should protect everyone else and Tor would have done that.
Because this was clearly civil disobedience and that is what we really should be protecting.
Just ... don't think it's a majykal bullet. It's not. Tradecraft matters, vulnerabilities exist. Examine and review your threat models.
Even if a nation state was targeting you, it would still take months for a timing/bandwidth attack to identify a user. Even then it would only provide your adversary a probability of certainty and requires consistent traffic from the victim through a compromised exit node.
No system is 100% perfect but tor will make most attacks prohibitively expensive.
Remember: all you need is 33 bits.
Here, data enter the Tor system, but don't leave it as the onion service itself has a Tor address.
Yes, traffic analysis and timing correlations may still be used to draw inferences, but again, costs are raised, and that's the critical factor.
I'm a privacy activist and certainly think that a company should be able to not keep logs. If the law in the country they are in (or area, see for example the data retention directive in the EU) we should of course (and I am) work to change those laws.
It should come as no surprise to anyone who is privacy minded and actively seek out privacy focused services that are located within the EU or Switzerland that your IP (or other information) can be requested with a warrant and that a company is required to hand that over.
I get that you think people should already know this, but do you feel they should be punished for not already knowing this, and not reminded by a company that markets itself on protecting its users? Protonmail was forced to get an IP address, but they're not forced to keep the fact that they respond to warrants a big secret.
Not everybody who is an activist is a big techie, or even computer-literate.
> We will only disclose the limited user data we possess if we are instructed to do so by a fully binding request coming from the competent Swiss authorities (legal obligation). While we may comply with electronically delivered notices (see exceptions below), the disclosed data can only be used in court after we have received an original copy of the court order by registered post or in person, and provide a formal response.
It would also be nice if they were allowed to notify the customer but I'm not familiar enough with Swiss laws to know if they can.
(also a paying Protonmail customer)
Of course Protonmail is accessible via Tor. Not that you should need to do that to remain private.
Gmail does all of this for free though, right?
Gmail Pro (paid G Suite) has never done that, and Gmail Perso (Free) hasn't done that since 2017.
Because I am aware of no reason to think that Google stores my gmail with zero access. I don't know for a fact that ProtonMail discards this information at the earliest opportunity nor do I know for a fact that they don't try to aggregate it to learn about you (or even people in general), but that is what I interpreted the pitch as.
But, look, of course if they get a subpoena they will have to start scanning your email if they are technically able to collect it. That's just a wiretap, and little would prevent the author and operator of the server software from doing whatever they want... and they're clear that if you aren't sending email between two compatible accounts that there is no E2EE.
We can talk about how they should have been clearer about the need to use Tor to avoid IP logging (even if they don't do it, someone between you and ProtonMail certainly could). That's a good idea. But they are actually very clear that E2EE with your email is not what you should expect in general. And I don't think they have much incentive to scan my email from unencrypted sources to do anything nefarious, but I don't think anyone has any ability to prove they do or don't at present.
No service is capable of completely hiding IPs and still getting you the data. If you "threat model" includes hiding from Western governments, I'd recommend not using the internet.
But that is not a proton issue that is an issue with our current governments.
"Hey, we respect your needs. However, we have to tell you that you should treat us as a bit of an adversary. We will do what we can as a private company, but ultimately we can be compelled by the government, rogue employee, or if somehow we get hacked. This is the case for any company no matter what they promise or avoid telling you. We do tell you. As our customer, here's what we recommend you do: Use Tor, fund open source, vote, etc."
You’re telling us that you never considered that an incorporated company, bound by democratic laws, would be required to respond to criminal activity warrants?
What fantasy land do HNers on this thread live in?
Is there any evidence this is what happened?
An alternate scenario is that they were not keeping logs, and were then compelled by the authorities to start keeping them on that user.
I'm not taking sides on privacy or the threat of govt (or other sourced) tyranny, I'm just explaining the logic to answer your question:
Let's say you engaged in a long history of using protonmail innocently, then one day you decided to start commiting crimes for the first time and attract police interest. You would know that your historical logs were not kept, and it was only after you started attracting police attention that you would be at risk of incriminating yourself through proton mail. Maybe, on the run from the law, it would be safe for you to hide at your old friends house because there was no log to link you to him.
Yes, it is also the case that you may not have realized that ordinary behavior had been criminalized by an evil govt all along blah blah blah... I'm just pointing out that there is a difference where you saw none.
in the case where they receive a court order, they first log your IP and then they give it.
but you know this from their terms of service.
if you stop using protonmail when you start your criminal career, they will not give your IP because they didn't save it.
it's different in the end, not the same.
This is also why I don't get protonmail in the first place. Unless you use pgp or equivalent, you'll always be subject to law enforcement. Just that protonmail cares more and caters more to activists and so might not give it out without checking that the asker is really legit and then give the minimal amount possible. But they'll always be able to turn over your emails and log IPs, it's not protonmail's fault the laws were voted into action like this.
They tout that off-by-default statement on their homepage, underneath the header of "Anonymous Email," with the closing sentence of "Your privacy comes first."
So why even market that? It provides no meaningful security.
There is a difference between "available to police, not retroactively, and only with a valid warrant" and "available to any government agency constantly and in bulk, as well as to data-collecting commercial entities, Russian and Chinese hackers, and their dogs". Don't you agree?
They're not being as transparent as possible in their marketing, which is at odds with their allure of security.
We are trusting they wouldn't comply or no one would make that request?
This is the benefit if being located in Switzerland, where banking is one of the main pillars of the economy and which historically has been much more supportive of personal privacy than most other countries.
They eventually caved under US pressure on some things, so it's not such a "haven" as it used to be, but I believe it is still the country that respects individuals' rights the most.
Not perfect by any means, just better than most others.
I, for one, will not renew my ProtonMail account if that's their status quo.
Unless you are naive enough to assume that ProtonMail is incapable of logging IP addresses (in which case they'd be incapable of serving HTTP requests...see the problem?) then they can log. And they most certainly aren't going to declare independence from Switzerland and refuse to turn on IP logging when required to by law.
Whereas with E2E-E, they actually are incapable of turning over readable emails.
Sure, the law would (hopefully) be changed, but at the moment, this is the best they can legally do?
Put alert warning that account has logging enabled
Change the service so collecting logs is not possible
Stop adding captcha to tor users login because you want to identify users
Frequently not legal
>Put alert warning that account has logging enabled
See above. Gag orders a problem with government in general. They do have a warrant canary page though, as well as a transparency report.
https://protonmail.com/blog/transparency-report/
>Change the service so collecting logs is not possible
You mean stop serving HTTP and MX requests?
>Stop adding captcha to tor users login because you want to identify users
You mean let bots brute-force my password?
I think trusting your security or privacy to website-based email is a bad idea. If the email is being displayed in your browser, then the authorities can coerce the company that owns the website to include JavaScript in that page that sends the plaintext content to them too -- or demand the website's TLS key and start intercepting the traffic that you see.
The only encryption-based security that you can reliably trust is encryption that happens locally on a device you control, and that doesn't involve a web page or website loaded from a 3rd party.
If you want privacy protection with real end-to-end encryption that the government can't get past trivially with court orders, use services where the decryption happens on devices that you own, such as WhatsApp or Signal or iMessage. If you must use email, do the encryption yourself on a hardened Linux distribution like Tails using PGP for email encryption; but this is much harder to set up than the above secure messengers.
I wouldn't say ProtonMail is a scam, but a trivial software change on their server-side would let the authorities see your email every time you do. If they can be compelled to make that change then the "encryption" you're paying for is worth nothing. The next time you sign in, a court-required modified version of their server software can capture your password, and then use whatever key derivation function gives them your encryption key.
This might not even require the company to actively participate. In the case of Snowden and LavaBit email, the US Government demanded LavaBit's TLS certificate so as to intercept the communications themselves at the ISP layer when LavaBit refused to comply with narrower court orders to provide information about his account.
What could police do with ProtonMail's TLS certificate and court authority to intercept and MITM traffic for your account? They can probably capture your password, use that to read all of your old email, and at minimum read your email as you read it. Even if decryption is happening in the browser somehow with JavaScript, that JavaScript is coming from the origin server that the government now controls by virtue of MITMing the traffic with the site's TLS cert, and so they can insert JavaScript that logs a plaintext copy of either the emails or the encryption key needed to decrypt them.
There is no security with web-based communications if the companies involved can be coerced with a court order. US based firms would be required to hand over their TLS cert if they weren't willing to help track someone, and at that point the government could do anything to your traffic.
The only secure encryption happens on your device with no browser involved.
By comparison, if you're using an iPhone, in theory the US Government could try to force Apple to modify WhatsApp/Signal on your phone, or force the App developers to do so. These companies would all fight tooth-and-nail in court against doing so. Plus, you can configure your iPhone to disable automatically updating apps, so once you have a working version of WhatsApp installed, unless Apple has some backdoor-ability to push an update of it to your phone anyway, you could turn off app update and be cautious & picky about when you choose to update WhatsApp or Signal. What I don't know how to do is verify the integrity of their binaries: to confirm that what you're getting is the same app distributed to everyone. Facebook would appeal to SCOTUS before allowing a government to install a backdoor into WhatsApp; so would Apple, based on their response to the government's request to unlock the San Bernadino shooter's phone.
All that being said, if the government's goal is simply to discover your identity, which was the case here, then Signal and WhatsApp won't help you. Their accounts are based on a phone number. If the govt has your phone number then unless it's a burner acquired with no name registration then they'll know who you are, and regardless will be able to find out approximately where you are, if you continue to use that phone number. They can triangulate where you are fairly rapidly with modern technology, and this is assuming that the cell company can't simply send a signal asking the phone for its GPS-based location; but even if the govt only knows your nearest cell towers, narrowing that down to a building is a matter of minutes once they're in the area.
If you need to communicate in a way that keeps your identity a secret then you're probably best off using a free email service over Tor from a machine running Tails Linux, accessed from various locations that provide public wifi.
If they were forced to log the IP address, they can be forced to log user password. This makes entire encrypted mailbox useless.
Tor solves this. Protonmail's Tor support is lukewarm. They have a Tor based login without captchas. It's mentioned on their homepage in the bottom menu under "Onion Site", (/tor). And there's one blog post from 2017 that still promotes their v2/shorter onion address.
I expect Protonmail to push its users to login through Tor. "Don't trust us, trust math". Embed Tor support in their apps as well. Rebuild their iOS app to offer to drive all connections through Tor.
And frankly, for $50 a year for email, I expect Protonmail to be thinking ahead about this, rather than me coming up with dumb ideas on a forum. Protonmail was neat in 2018 but 3 years later it's stagnant.
Tor is mentioned on their homepage in the bottom menu under "Onion Site". However, this menu link redirects to their Tor placeholder page, rather than directly to the Tor service: https://protonmail.com/tor
There's one blog post from 2017 that still promotes their old v2 onion address: https://protonmail.com/blog/tor-encrypted-email/
Protonmail's Tor service is located at: https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7...
Alright then, what more do you want them to do? Spend millions in court fighting every warrant issued for their users and go bankrupt defending criminal activity?
1. whether or not your request stays within the tor network or not (if you use the .onion address, no need for an exit node)
2. given both entry and exit nodes can be literally all over the world: your threat opposition level. I doubt the NSA will be happy to help French authorities trying to catch a teenager who blockaded a government parking garage).
from https://pando.com/2014/12/09/clearing-the-air-around-tor/
From where I stand, the only difference here is that ProtonMail has to receive the warrant before they give up all the info they have on you, and others may do it voluntarily even without that, just to keep on the good side of the police, but since it's not exactly hard to achieve such warrants (and in the US, as we learned, it's ok for the police to lie on such warrants and they know no punishment will come to them even if the lie is discovered later) the difference is minimal. If you have something the police really wants to see, and they can reveal it, they will.
What if authorities ask, serve this user this malicious JacaScript code to obtain their encryption key?
PM has to obey and the result is the same.
How is that any different from them being compelled to disable or weaken clientside encryption?
In both cases they're being compelled to make changes to their service.
The camel's nose is clearly already under the tent. Everybody needs to start diffing javascript served by them.
It would be nice if there were something like Perspectives[0] or Binary Transparency / Sigstore[1] to raise the alarm when something like this happened, but the threat would also be avoided if ProtonMail was available as a SecureBookmark[2].
[0] https://www.techrepublic.com/blog/data-center/ssl-tls-certif...
[1] https://security.googleblog.com/2021/03/introducing-sigstore...
The GP says that it's possible under German law. Is it "FUD" to say that it could end up being possible under Swiss law?
Shouldn't there be fear, uncertainty, and doubt about any channel that activists use to communicate with each other?
They come off as a very dodgy company willing to twist the truth themselves. They claim that they can provide E2EE for email, being careful not to give away the fact that this is impossible for regular emails to non-PM customers.
Frankly I only use them because they're the biggest "private" email service and that provides a kind of safety in numbers.
While I concur that it's a bit misleading nothing is stopping you from using your own key and mail client (albeit with their "bridge" solution) to send E2EE e-mails.
If you rely on the keys they generate you can export them and use them accordingly but one should be weary of the handling of said keys if they were compelled to make a backdoor as others have noted.
That being said this does leave a bad taste in my mouth.
I have seen a ton of disturbing pieces about ProtonMail. Every time I've looked into them, they seem to be maliciously motivated and usually not true, or otherwise twisting of the truth. This has been a confusing thing for me because why is there a small subset of people so vehemently against them?
In this case, I'm not surprised. They say quite clearly they can be compelled to collect IP addresses - including in the linked tweet. This seems like a pretty clear cut case of them being compelled to provide an IP address. What the authorities can't do, is read that person's email. And that's what I and others pay for.
I'm not sure what there is to be upset about here? Other than perhaps France prosecuting this individual to begin with? If we had faith that ProtonMail wouldn't hand over anything to the government, why would anyone even care about having encrypted emails?