All the Protonmail customers out there, what did you do about this?

For starters, I emailed Protonmail support.

Here's mine: Hi, Your homepage reads "By default, we do not keep any IP logs..."

This language is soft and misleading. Maybe in 2018 when I first began using ProtonMail it was good enough. But in 2021 it's not. I expect better from ProtonMail.

Replace immediately with something clearer. "By default we don't log IP, but may be required to by law enforcement. We recommend all customers connect through Protonmail through Tor. This month, 60% of our users connected through Tor".

If you can't come up with anything better for users, just fall back on your privacy statement verbatim and avoid any marketing language.

Think about a journalist in Afghanistan, a whistleblower in the USA, or a human rights activist in China. They're all engaging in potentially dangerous activities.

I advocate on behalf such people by supporting services like Protonmail with my money. If Protonmail isn't supporting these users, why should I bother supporting Protonmail?

I expect Protonmail to educate users like this about how Protonmail itself can be turned into an adversary. Educate users about how to use Tor. Do better. Improve the internet.

I look forward to your reply.

Also, registering a new account through Tor requires a phone number for verification, even though Proton says no unique identification is required to register. If this requirement isn't removed by the time I renew my account I will no longer renew.

From my understanding it depends on how naughty your current exit node has been. Most tor exits in my experience allow creation and you just need to verify another email (just use a random burner- they only block a few. Supposedly some well behaved exits require just a captcha but I've never seen it.

It would be nice if they had a tor presence so there would be no need to traverse an exit node. A lot of other privacy-forward sites do exactly this.

They do https://protonmail.com/tor

Sad to say, Proton's onion service is for their old version. Proton has recently rolled out a new updated version of their service, and as far as I'm aware they don't offer a Tor onion service for that newer version.

So Proton users who like to connect via Tor onion services have been faced with a choice of either staying on the old version of ProtonMail, or giving up on connecting via a Tor onion service. It definitely leaves the impression that they don't care much about Tor anymore, or that it's at best an afterthought for them.

I tested this, and you're right: Their Tor service runs the (in my opinion nearly as usable) older version.

It's plausible that Proton does not care about their Tor service, but there may be another reason: The new version relies more on Javascript code than their old version, and a Tor user is more likely to browse with scripts disabled than a regular user. Proton may be holding back the rollout of the newer version until they have tested it more without Javascript. This is only a hypothesis, and I came up with it just now; take it for what it is.

Tor + Scripts is not good. You're probably right on why there isn't a newer version on their onion service.

I don't think you can use Proton without JS. You need JS for cryptography; the emails get encrypted/decrypted/signed/verified on client-side.

Of course; should have been obvious.

Perhaps there is a greater reliance on scripts in the new version, but this makes it seem more likely that they've abandoned the Tor version.

I use proton-bridge and a normal email client, although I've never tried to use it with Tor.

I bet they initially configured it when Onion Routing was the new buzzword, and then lost interest when it wasn't the New Thang anymore.

Thanks. I thought they must.

https://protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7... is the URL that people should be using with Tor if they are concerned with being traced.

Using Tor to access a regular web site, ie: through an exit node, is (nearly) no different than using a proxy. Just assume all exit nodes are "naughty" and do your thing accordingly.

HN: Be careful when visiting Tor links that are suggested anywhere. There are many malicious clones of popular websites

For the record, that comes from GP's link to the ProtonMail website. But you are correct. Verify before clicking anything like that.

They do with the premium tier.

I simply closed my (free) account.

Their page is full of what are now obviously lies. They admit that in the cases of "extreme crimes" they might be forced to give up information. _By no stretch of the imagination are these peaceful political protests "extreme crimes"._

I specifically advocate for the sorts of people that Protonmail ratted out and had arrested - climate change activists.

From what I gathered from a (French) blog posting by a squatting collective, posted elsewhere in this thread, the arrests are in relation to an eviction.

The eviction was legally sanctioned, and violence was used on the officers. Several officers had to stop work for a few days, one officer for two weeks.

I myself am a middle-aged "have" , but I do worry about climate and I do empathize with those that "have not".

However, violence during an eviction is not peaceful. People were hurt, and a legal response was due. Seems to me that arresting someone after the fact, and dealing with the matter in a court of law is the peaceful thing to do?

When I read "extreme crimes", I don't think of a scuffle with the cops over what started as a misdemeanor arrest or non-criminal enforcement action. Protonmail should change their wording to be clear that governments can and do compel them to collect such information for ordinary crimes.

Yup, fully agree: Protonmail should just say "we comply with the law". Though at this point the security reputation of the Swiss should have given anyone pause to think (Crypto AG, Omnisec AG, etc)

My point was just that 1) the arrest was related to squatting, not the climate 2) these people, idealist and well-intentioned as they were, were not "peaceful" (at least, not when faced with a brigade of police officers)

(prepare the downvotes)

> The eviction was legally sanctioned, and violence was used on the officers. Several officers had to stop work for a few days, one officer for two weeks.

Usually they need to stop work for a few days because their hands/wrists are aching due to hitting too hard on protestors. Anti-riot are perfectly equipped and physically trained to be in fights, it's literally their job. And while there are generally at least a few "semi-pro" violent protestors on the other side, they are not so well equipped like the police.

+1

FWIW, what they were accused of was squatting, not protesting climate change. I still think that's a ludicrous abuse of police powers, but it's worth being accurate.

And in the spirit of accuracy : the reason for the arrest was the violence during an eviction (several injured police officers), not the squatting itself.

Ah, thank you. I didn't realise that. Appreciate the correction!

That's fine in my "paying ProtonMail customer" view. Use VPN + Tor if you don't want your IP address be known. I use ProtonMail to reduce my exposure to Google tracking/possibility of business execution leaks they might use in their favor and keep alternatives alive.

So does any non-Google email provider meet your criteria then?

Not being Google is just one of many criteria.

> Think about a journalist in Afghanistan, a whistleblower in the USA, or a human rights activist in China.

They are thinking about them. They want to make sure such people don't get them in trouble with the US or China, so they sell them out immediately.

I didn't do anything about this, because I expect any commercial service to log IPs at least for a short period of time to fight abuse. I'm using this service because I don't want the service provider's staff or someone that hacks their servers to be able to read my mails. Ideally I would like to also have privacy (through E2EE) when e-mailing other PM users, but I'm not counting on that. As the Tutanota case shows, such secure e-mail providers can be forced by law to intercept e-mails.

TBH in 2021 people engaging in potentially dangerous activities should be literate enough to understand, that no business will guarantee them full security and decline all requests from authorities to disclose their identity. The wording you suggest is equivalent of „do not dry your cat in microwave“ instruction - a legal protection from dumb customers, that does not contribute meaningfully to safety.

For the non-Swiss customers working with a Swiss provider can be a good enough protection to avoid inconvenience of Tor. After all, even in the mentioned case it required review and approval of 3 agencies before request came to Proton - from French police, from Europol, and then from Swiss authorities. If this is not enough barriers to protect from politically motivated prosecutions and corruption, then we have much bigger problem in Europe.

The problem is that engaging in "potentially dangerous activities" includes such a wide range of people. Think about a journalist in Afghanistan, a whisteblower in the USA, or a human rights activist in China. They're all engaging in potentially dangerous activities. Are they "dumb" because they don't understand all the ins and outs of surveillance? How about some empathy for them as users?

The proposed statement above is intended to help people like that.

Do I have such activities? Nope. But I believe that those activities should be enabled, whether for me in the future or others around the world.

I advocate on behalf such "dumb" people by supporting simple services like Protonmail with my money. If Protonmail isn't supporting these users, why should I bother supporting Protonmail?

Also ProtonMail's only reason for being is that they are supposed to provide some higher level of privacy. If they don't, how are they any different than a commodity grade SMTP/IMAP provider? I will withhold judgement until I know more about the case but the early context does not look good for ProtonMail's value proposition, which is the least of things.

Is it though? I don't know much about this company but their main selling point seems to be end to end encryption for mail messages. That's not a "privacy" feature by itself. Now it is a tool that you can use it to gain more privacy, but you could also have people who use it to cc all their emails to their entire facebook list. So it seems it all depends on how you use it and what type of privacy you try to achieve.

End to end encryption is a privacy feature by itself. The example of using an email service to send a mass email to a dislist is irrelevant to the possibility that it would also be able to preserve privacy in other communications. You could send an email directly to the local police chief if you wanted but that does not preclude wanting privacy elsewhere.

I think you are confusing privacy with security, which is a common mistake, not your fault -- end-to-end encryption is what secures the messages, by itself it does not ensure that the messages get to the right place or that the encryption keys are belonging to the right people. It needs to be used in combination with other methods and techniques. Explicit features that are in the domain of "privacy" would be ensuring messages are deleted on a regular basis, or some kind of key cycling, or an anonymizing service like tor, etc.

To use your example of emailing the police chief: let's say your threat profile is that you're being stalked by a criminal, and you want to email the police to give them information on this crime, but you don't want the criminal to know. If the criminal breaks into your email, or if your house is broken into and a hidden camera is placed behind your computer, it makes little difference whether you have end-to-end encryption or not, your privacy is still violated. Does that explain it better? Maybe Proton could have some better messaging around this, if their customers are getting privacy and security confused?

I think you're using a definition of end-to-end encryption that's too narrow, same with privacy. E2E schemes try to ensure that your messages can only be read by their intended recipient. That's undeniably a privacy feature, since having private messages read by a third party (without consent) would be a privacy violation.

Security and privacy are intertwined, imagine your server getting hacked (security problem) leading to your private documents being exposed on the internet (privacy violation).

I understand they are billed that way but in practice I don't believe they fulfill that goal, as the job of making the messages unreadable is mostly already done by transport security (SMTP TLS). Sure it can protect against some things if the mail server is the target, but as we see here, there is still a large amount of identifying metadata that they (unavoidably) have on you. The goal with "privacy" is to ensure that your communications are undetectable and unidentifiable, and I would hardly call it that if it's still regularly going through a well-known mail server attached to a highly identifiable account. And of course it depends on how much you actually use the E2E encryption which is technically optional, for example if you send/receive a lot of mail from gmail users that aren't using S/MIME, which still seems to be the case for a lot, then it won't be enabled and your messages are still vulnerable in a server hack.

* Think about a journalist in Afghanistan, a whistleblower in the USA, or a human rights activist in China*

The former's safe because no one's going to deliver IPs to Afghanistan and the latter are doomed, because the US and China are following a policy of total surveillance. That ship has sailed decades ago.

I wouldn't be surprised if they or anyone else in the future deliver users IPs to the Taliban government specially with they get recognition from more nations.

You do not have to understand all aspects of privacy to realize that governments may have sufficient resources to track your identity and to put enough pressure on businesses to provide information they need.

At the same time, Tor is not the only, the required and the sufficient way to ensure privacy. There are different circumstances requiring different approaches. In many cases Tor will be redundant, in some cases it may be impossible to use, will offer insufficient protection or will actually put the person in an immediate danger, so giving this kind of advice is at least equally harmful as not having full disclosure on logs.

> Are they "dumb" because they don't understand all the ins and outs of surveillance?

US military personell and from other nations is posting on TikTok. At least those probably don't work in reconnaissance.

They aren't stupid and this isn't a technical problem, it is a legislative problem. Real security has been undermined since the early 2000 and before. Western powers just ape China or Russia at this point.

That the Swiss people gave authorities these surveillance capabilities is pretty stupid though. Alpine air must have been pretty thin that day.

It’s not protection FROM your customers. It is protection FOR your customers. Most customers are not technically astute

A corporation is a power centralization, and government authority can lean on power centralization.

In general, regardless of what their TOS say, never believe that a corporation can't be compelled by the law to do anything they could physically do. CEOs can be jailed; when's the last time we heard of one actually going to jail over user privacy?

> CEOs can be jailed; when's the last time we heard of one actually going to jail over user privacy?

Ladar Levison from Lavabit came close. But even he admits that was because the FBI wanted to subvert every single Lavabit user's account (attempting vast overreach on the brazen assumption that "we are after Snowden" was going to pull the wool over everybody's eyes). Levison admits though, to having "responded to" at least two dozen subpoenas and complied with at least one warrant before.

https://en.wikipedia.org/wiki/Lavabit#Suspension_and_gag_ord...

The CEO of the phone company qwest claims that the insider trading charges he got prison for was only brought to court because he refused to allow the installation of NSA surveillance equipment.

https://en.wikipedia.org/wiki/Joseph_Nacchio

The point being made agrees with you, and is just saying that since protonmail can't help but obey sometimes, they should make the effort to educate their customers about that fact and whatever their customers can personally do to mitigate the risks of that fact.

> CEOs can be jailed; when's the last time we heard of one actually going to jail, period.

A customer that specifically chooses Proton for privacy, must read and agree to privacy policy, which explicitly states, that Proton may in fact keep temporary IP logs and that user may opt in for login IP logs. Requests from authorities may ask for this kind of information and Proton will have to provide it.

The „opt-in“ part for login logs is particularly interesting, because in fact Proton recommends this as a security best practice. Whether it’s in the best interest of the customer or not, it’s an open question. I would say, in a risk model, where threat of human rights violation by Swiss government is much lower than risks of unauthorized party accessing the account, it makes sense. Tough luck for the criminals that followed this advice.

https://protonmail.com/privacy-policy

Anyone that uses ANY electronic device to plan and arrange clandestine opetations - IS AN IDIOT.

Do tell, how do you plan your clandestine operations?

3 days ago i did this very thing. when the oppressive govt banned internet, i had to talk to someone outside india and then i dictated them some text. reddit keeps ip logs for 100 days so i had a dormant account for over a year. i asked the guy to log in, type that message and post.

that way the govt can demand from reddit that account ip but since the only ip available is from outside india, they cant do shit.

i was ready to dictate base64 image character by character but the internet blockade remained for only 2 days so yeah. there are plenty of ways

You think nobody can tap phone records, when you called someone outside India?

Oppressive government?

ah yes. unless they are actively listening in am i not safe enough as compared to DPI censorship and network analyzers mandated by the said oppressive government?

Mass capture of telephony is real. Voice recognition is real. Text processing is real. All of these are low-tech these days.

By using the classics of course.

https://en.wikipedia.org/wiki/Histiaeus#Ionian_revolt_(499-4...

Sure the bitrate is a bit slow and it's UDP only but our governments have proved over and over again that they can't learn from history.

> In 499 BC, he shaved the head of his most trusted slave, tattooed a message on his head, and then waited for his hair to grow back. The slave was then sent to Aristagoras, who was instructed to shave the slave's head again and read the message, which told him to revolt against the Persians.

Since this was a trusted slave, the tattoo seems unnecessary. The slave could just tell Aristagoras "Histiaeus says to revolt against the Persians".

The fact that the slave had been signed confirmed the authenticity to the recipient.

There is trust and there is trust.

There was enough trust that the slave did not desert and that they were taking the message to the destination.

There was not enough trust that the slave would actually know the CONTENT of the message. As such the slave wouldn't even know to where to desert to :)

Do as terrorists and generals do.just use one mail account, never send mail, use the draft feature, and start everything as a discussion about an elaborate real world spy/crime novel.

I am betting on ravens

All analogue.

ADC means analog is trivially made digital. Analog is not an effective firewall unless it is physically shrouded from all sensor networks.

> . I know that when an individual uses an electronic device to communicate withothers in order to commit a crime, the individual’s electronic device will generallyserve both as an instrumentality for committing the crime, and also as a storagemedium for evidence of the crime. The electronic devices are an instrumentalityof the crime because it is used as a means of committing the criminal offense.The electronic devices are also likely to be a storage medium for evidence ofcrime. From my training and experience, I believe that an electronic device usedto commit a crime of this type may contain: data that is evidence of how theelectronic device was used; data that was sent or received; and other records thatindicate the nature of the offense.

Right from a recent court filing, search warrant.

If the tech. companies involved have monetized surveillance, and no I am not talking about the kind they do for advertising, but instead the $ for data on users/portal, all that jazz, fees for LE levels of access, cost for responses, etc the LE are also the customers too then?

I'm fine with Proton treating my data as a liability. Give me the tools to take away that liability by only sending them noise through an anonymous email address. I will pay for that.

Sure, the wording istingray suggested is a bit over the top. But the existing wording "By default, we do not keep any IP logs" is misleading. Why even say it? They should simply delete it.

I'd read that as "by default we don't keep logs, so we can't be compelled to provide IPs for sessions in the past. We can still be compelled to provide that information for current/future connections."

It is in contrast to the immediately following paragraph, which discusses a user-controllable setting that does cause ip logs to be retained permanently.

What immediately following paragraph? This is what I see:

https://i.imgur.com/6sZFn78.png

In the twitter screenshot linked to in this post, there is a discussion of the authentication logging feature in the immediately following paragraph (the screenshot discussing IP logging).

https://twitter.com/OnEstLaTech/status/1434576598418796549?t...

How do you understand „by default“ and „keep“ in this phrase? Does it actually mean that they do not collect the logs?

My first reading of "by default" here is that I can optionally enable it through my account.

Really, it's a phrase that means 3 things: I can enable it, ProtonMail can enable it[0], or the authorities can compel ProtonMail to enable it.

Saying any of that, or at least linking to a page that does, would be a smart move.

[0] https://protonmail.com/privacy-policy - "IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions"

Review and approval of 3 agencies is apparently not even a speed bump.

> If this is not enough barriers to protect from politically motivated prosecutions and corruption, then we have much bigger problem in Europe.

Well, in this case isn't it clear that these barriers were in fact not enough? Or do you think anti-squatting is a major enough problem that it warranted this level of international cooperation, without any politically motivated thinking?

> people engaging in potentially dangerous activities

These seem to have been climate activists engaging in sit-ins.

Surely these are the very sorts of people that secure accounts are intended to protect?

What kind of "climate activist" draws this much heat?

Seems like it was not strictly climate related in this case.

https://paris-luttes.info/communique-sur-l-affaire-de-la-145...

Looks like your run of the mill radical left occupation of housing (the stuff you see in big European cities like Berlin and Paris where they have that tradition).

Their bouts with law enforcement trying to evict them could be the reason for the arrests. If the google translate is not completely misleading then they refused to give their names or fingerprints when initially arrested.

UK has been arresting climate activists by the hundreds, it's pretty surreal here.

https://twitter.com/MetPoliceEvents/status/14342276656791429...

Probably one that threatens corporate interests.

Probably? Do you know anything about why they were arrested?

I once tried to create a Protonmail account over TOR and I believe they require a phone number from 'malicious' IPs so if you want anonymity Protonmail is not the service for you.

Yes, Protonmail requires a phone number to register over Tor!

Even though they claim no identity is required to register.

I confirmed this today when I created a fresh Protonmal account over Tor: https://news.ycombinator.com/item?id=28428092

If they don’t do this then spammers will use their service en masse and degrade the service for all customers by black holing their ips and domain through all other email providers.

Too bad, figure out a way to solve for it. I'm paying for private email service, not a pretty picture of the Swiss Alps on their website.

If they don't provide it, someone else will, and I'll pay them instead. This isn't the Hotmail age where everyone expects free email.

>This isn't the Hotmail age where everyone expects free email.

Protonmail does offer a free tier, which is the problem. I'm sure they would be happy to take a payment instead, as the whole point of phone verification is to impose a cost on account creation. Perhaps they can rework their account registration flow to offer the ability to upgrade to a paid account at the verification step.

If you're upgrading to a paid account, isn't that even worse than the initial step in terms of anonymity? I get that they need to make money to survive, but this requirement isn't displaced by e2ee - it provides a misleading and false sense of security.

Anonymity toward state actors is compromised in either situation, whether phone verification or payment validation.

Doubt I'm the only one who thinks this, but the value proposition of their service is cancelled by their stated terms, which at least they make available. I have similar doubts about the veracity of claims by VPN providers (including mine) in terms of not keeping logs.

tor remains the only usable anonymising method with a decent track record. It's a shame Protonmail discriminates against it.

They support Bitcoin as a payment method. If you take precautions (ie use a Monero -> Bitcoin payment service over tor) I don't see it as compromising your identity.

See, I like this idea. This is the type of thinking I'm paying Protonmail for.

> This isn't the Hotmail age where everyone expects free email.

It totally is.

I was running my own mail server for a while. The thing that finally pushed me into not bothering any more was when I looked at my logs and realised 82% of my non-spam non-marketing email was captured by google (where at least one recipient was either @gmail.com or a gsuite custom domain).

So you gave up? Decided to play dead?

They did figure out a way, they ask for phone number.

Nope. Figure out a way to make it anonymous or I'm out.

There is an easy solution to this one : just don't provide free tier or don't require verification for paying customers.

I try to sign up a protonmail through tor with brave browser at 2021/09/06. Everything goes well until last step.

  Are you human?

  If you are having trouble creating your account, please request an invitation and we will respond within one business day. Request an invite

That is what a “2FA mule” is for.

I have two - both on MVNOs, not in my name, and sitting in my office doing nothing but relaying sms to email:

https://news.ycombinator.com/item?id=28251107

If you need it one time for registration while staying anonymous using a burner SIM will work just fine. This way you anonimously create the account and then keep your location hidden using Tor. Authorities may even know who you are but will be unable to locate you.

But the mule only gives you some extra functionality, resilience, and is like having an email address just for spam or a home VPN endpoint. It gives you very little in terms of anonimity, which is why you'd go to Tor anyway. It's still in your proximity even if it's not in your name so anyone able to obtain your IPs from the services you use would also be able to get the location of your mule. And you forward to your own mail server which again does little to hide anything. That's a long traceable chain that can be compromised or at least broken (to force you out) at every link.

This is great to make sure companies don't sell your phone number or use it to create some social graph, and to access your accounts independent of your normal phone. But if you're looking to hide your identity or location from your service provider and the authorities then it's barely a speedbump.

Let me explain both my threat model and my use-case.

My threat model is not state level actors or law enforcement. My threat model is simply individuals working at providers I use that get curious and go hunting for my traffic. So, for instance, someone that works at my ISP or for my cellular provider or (github/twilio/twitter).

I don't want these private actors to see my name or my phone number. However, VOIP numbers are typically blocked by providers for purposes of authentication and security because they need you to "burn" an actual SIM card number just to incur costs on you. This is their blunt response to a rather difficult spam/scam problem that would just explode if no costs were involved.

...

My use-case is that I don't want to carry around three phones everywhere I go and eSIMs don't work for these functions (again, their numbers are often discriminated against). I also don't want a single SIM card to correlate across multiple providers - that is why I have three (one personal SIM (not in my name) and two "mule" SIMs).

...

"It's still in your proximity even if it's not in your name so anyone able to obtain your IPs from the services you use would also be able to get the location of your mule."

No, they are rarely in my proximity. In fact, at this moment they are 12000 miles away from me. I keep them at my office and might move them to a datacenter ... but only if I can convert them from a phone form factor to a rpi-with-cellular-hat form factor ... or maybe ssh into the phone ?

Well, remember - their interactions with these 2FA Mules are SMS only - there is no IP/network connection made here. So the providers, at least, don't have an IP address to look up. Also, in case it is not obvious, I fully control my entire mail and dns infrastructure - as in, I own the machines and rent the racks.

I created an account made explicitly to be used over Tor some time ago and I was never asked to provide any phone number, but maybe that changed at some point.

One thing I've noticed is that many HN users don't believe that courts can compel companies to take positive actions to surveil their customers. This incident illustrates that, yes, courts can compel companies to keep logs even if their infrastructure is built to not keep them at all.

We cannot rely on what companies say about their privacy guarantees, or rely on vendors' technical analysis of their own black box systems, because a simple court order can essentially be a backdoor.

Protonmail did not provide the authorities with the users IP address...they did allow the account to monitored which they are required by their laws to allow. It was the users sloppy OPSEC that allowed the authorities to eventually track them down. In the end, I believe, it was linking the user to a past Gmail account that finally did him in. Listen to this podcast episode, the presenter does a fairly good job summarizing the situation. The Privacy, Security, & OSINT Show – Episode 227

> ProtonMail is a well-known and well-regarded mail service and is often recommended to users looking to distance themselves from Google's less-than-ideal security practices. Unfortunately, however, ProtonMail was recently forced to cooperate with Swiss authorities in providing user data (date of account creation), which was subsequently handed over to American security authorities and enforcement agencies.

and

> Proton reached out to us to confirm that the only data provided to Swiss authorities was the date of account creation. [1]

[1] https://proprivacy.com/privacy-news/protonmail-authorities-u...

Lie that you care about user privacy, give sucke- I mean, users' data to law enforcement anyway, blame the users when they get nailed due to your snitching. It's a perfect business model!

Don't call it a "HoneyProt"!

Is this the same case? Maybe I'm missing some crucial info.

A week ago: "Proton reached out to us to confirm that the only data provided to Swiss authorities was the date of account creation." [1]

Today: Article published claiming Proton gave up user data. Did Proton officially now state they "allowed the account to be monitored"?

Am I getting this right?

[1] https://proprivacy.com/privacy-news/protonmail-authorities-u...

Not my problem. I pay Protonmail to work on behalf of users, and empower users to the extent allowed by law. This includes educating users about the adversarial actions that Protonmail itself can take against them (warrant, rogue employee, hackers). Otherwise I can take my $ elsewhere, email services are cheap.

> Protonmail did not provide the authorities with the users IP address...they did allow the account to monitored which they are required by their laws to allow.

Something their marketing material appears to disclaim. This is just excuse-making. ProtonMail did what ProtonMail has (for years!) led their customers to believe they would not do. And they did.

I think there's an argument to be made that any commercial email/messaging provider simply can't do what ProtonMail claimed to do. But that doesn't change the fact that ProtonMail did it.

> ProtonMail did what ProtonMail has (for years!) led their customers to believe they would not do.

My rule is to give any corporate statement about what they "will not do" exactly zero credence.

The only thing worth anything in that context is open source where independent programmers can verify that the code cannot support undesirable behaviors. And even then you're not safe, because code running on someone else's machine might actually be anything. So in the end, self-hosted open source software is the only way.

Right now that requires some degree of technical know-how, but I believe that's a solvable problem the same way operating systems have turned the technical practice of process management into something users don't even need to think about.

I've worked with back end webservices for 10 years or so but I'm struggling to understand the concept of allowing a singular account to be monitored. What does this actually mean? An account in all of the systems I've dealt with is basically the collective understanding of a bunch of database queries. How does one allow an account to be monitored in any way which is less frightening than providing an IP address from a log?

It means:

``` if user.isUnderInvestigation { log(request.sourceIP) } ```

People really don't seem to understand that Protonmail is a western company in a western country with pretty generous surveillance laws. Yes, your email text may be encrypted, but everything else is free game to the authorities unless you use additional protection.

I wonder how long the 'Swiss privacy' brand, which seems to be fairly valuable will hold if these things keep happening, I had to immediately think of Crypto AG

https://en.wikipedia.org/wiki/Crypto_AG

A lot of people don’t know about Crypto AG. It’s an amazing story!

Protonmail should be pushing more of this messaging in their branding. "Don't trust us further than you can throw us. We're doing our best, and here's what we recommend, use Tor, etc."

This is just not realistic, though.

I gave an example in another post. Basically "Hey, we respect your needs. However, we have to tell you that you should treat us as a bit of an adversary. We will do what we can as a private company, but ultimately we can be compelled by the government, rogue employee, or if somehow we get hacked. This is the case for any company, they just don't tell you it. We do. As our customer, here's what we recommend you do: Use Tor, fund open source, vote, etc."

Of course not, because a company that strikes the perfect balance of being sorta-in-the-right-direction but then also using deliberately deceptive language to pretend they're all-the-way-in-the-right-direction is going to outcompete companies that genuinely go all the way.

Why not?

Because of the dirty little secret of protonmail; it's actually just privacy cosplay. If they told people what's actually involved in having a truly private email account, most of their customers would say screw it and go back to Gmail.

"we aren't much better than Gmail from a privacy standpoint, but please still give us money"

Does every email provider but Gmail make the same misleading claim as ProtonMail? Fastmail for example?

I like and respect Fastmail.

but...

I live in Australia - and they're totally fucked by our laws and government policy.

"The Australian Federal Police (AFP) and Australian Criminal Intelligence Commission (ACIC) will now be able to access the computers and networks of those suspected of conducting criminal activity online, and even take over their online accounts covertly, under the Identify and Disrupt bill, which was passed by the Senate on Wednesday." -- https://www.innovationaus.com/extraordinary-new-hacking-powe...

and:

"Amends: the Surveillance Devices Act 2004 and Telecommunications (Interception and Access) Act 1979 to: introduce data disruption warrants to enable the Australian Federal Police (AFP) and the Australian Criminal Intelligence Commission (ACIC) to disrupt data by modifying, adding, copying or deleting data in order to frustrate the commission of serious offences online; and make minor technical corrections; " -- https://www.aph.gov.au/Parliamentary_Business/Bills_Legislat...

The question was if email providers have to choose misleading people about privacy or going out of business. Specifically about IP logs.

Fastmail's privacy page says "Your data is for you and no one else".[1] So they do mislead about that. I didn't see anything about IP logs though. And Fastmail was just an example.

[1] https://www.fastmail.com/privacy-and-security/

Most people accept search warrants signed by a judge for a crime. Proton mail was even nice enough to notify the user what they were the subject of a search.

With Gmail/Hotmail/etc your communication are at the finger tips of governments for non-criminal domestic surveillance. For example it has been alleged that the NSA leaked private emails of a journalist in order to score political damage.

https://nypost.com/2021/08/11/tucker-carlson-unmasking-claim...

I thought Gmail was much worse, scanning email contents etc.

The scanning of email contents that Gmail does is, from a privacy standpoint, indistinguishable from them simply sending you the email. Their server has to know the contents of that email either way.

>The scanning of email contents that Gmail does is, from a privacy standpoint, indistinguishable from them simply sending you the email

The privacy violation of creating a profile on me based on my mail to tailor ads is not the same thing as simply delivering mail.

In both cases exactly the same entities read your email: you, the sender, and Gmail.

I don't see how you could go "yeah, this is a privacy improvement" if your information is still visible to exactly the same entities, but one of them isn't really mentioning it.

The difference is that protonmail, again, doesn't scan any data in my emails. Google does, then stores and tailors and sells ads. My privacy is violated when google scans my mail, and not when protonmail doesn't.

I'm not sure what you're trying to get at with the word "scan" here, so hopefully this abstraction will be useful.

Imagine you have a message written on a piece of paper. You intentionally show this message to two people, Alice and Bob, and are fully aware that they have both read and can perfectly remember the entire contents of the message.

Now imagine that Alice thought about the message independently (not recalling it, but actually thinking new thoughts), and that Bob did not do this.

Are you claiming that Alice violated your privacy by thinking about something you showed her and asked her to remember? Or perhaps would it only be a violation of privacy if she then subsequently told you one of those thoughts?

I don’t understand what you’re attempting to achieve with this. You’re weirdly abstracting about something that doesn’t need to be. People want to be able to have a private email correspondence about, for instance, dildos, and then not have to be served dildo ads outside of that context.

> I don’t understand what you’re attempting to achieve with this.

I was hoping to achieve a "yes" or "no", to at least one of the two questions. I don't know what GP thinks "scan" means when describing how a computer processes text, and was hoping that an analogy to a more natural concept would allow for that to be made clear. What's the actual action being taken that's the violation? It's clearly not simply being able to read the message, but is it "thinking" about it (for lack of a better word)? That's how I interpreted the initial comment, but it seems very reactionary, so I wanted to make sure I understood it.

> People want to be able to have a private email correspondence about, for instance, dildos, and then not have to be served dildo ads outside of that context.

Totally fair, but that's no longer about privacy (unless your concern is someone else watching your monitor over your shoulder, in which case that person is the one breaking your privacy).

So if I tell a friend a secret, and they plaster it on my wallpaper, and then I have a different friend over for dinner, my different friend is the one violating my privacy?

In that case no-one has violated your privacy - your wallpaper is private, so friend A didn't, and you invited friend B over, so they definitely didn't.

I would entertain the idea that friend A is being a bit of a douchebag by painting stuff all over your house without you asking them to, but if you subscribe to that thought process you'd already be running an ad-blocker and this scenario wouldn't ever occur in the first place.

Having to use an ad-blocker for this purpose is a band-aid for a much deeper problem. Running a website isn't free and I want to support them by not blocking their ads. But when the ads are part of a scheme that targets my private and personal information, I'm no longer willing to hold up my end of that contract.

The act of analyzing my data is what is the violation. The act of telling me is simply revealing that violation. This is why, when the US intelligence agencies were scanning and analyzing everyone in America's cell phone history and social graph, without interaction or active intervention, it was a privacy violation even when it wasn't being used. It doesn't matter who sees it. The fact that it is being scanned and analyzed for possible future use and abuse is the problem. Yes, this means that a computer in the middle of the rainforest analyzing my mail offline and nothing else is a violation of my privacy. And no, I do not believe that the two, Alice and Bob, can be equated.

> The act of analyzing my data is what is the violation.

So to be 100% clear on this: if you tell someone information, and they think about that information, that's a violation of your privacy?

I've definitely always assumed that the right to think about information is intrinsically coupled with the right to know about that information. I wouldn't give someone data that I didn't want them to think about.

> for possible future use and abuse

This is a completely reasonable concern to hold, but surely "they could possibly do something bad later" applies to every email provider in existence.

>So to be 100% clear on this: if you tell someone information, and they think about that information, that's a violation of your privacy?

If your phone began analyzing your local photos for child porn, you'd probably be upset, no?

>This is a completely reasonable concern to hold, but surely "they could possibly do something bad later" applies to every email provider in existence.

True, but google is CURRENTLY abusing it by selling ads to me based on it.

> If your phone began analyzing your local photos for child porn, you'd probably be upset, no?

Yep. "local" here is the key word, though. If a service I uploaded photos to began doing that, I would not be upset. And indeed, just about every image-hosting website in existence already does this, because they're legally required to.

Gmail is markedly not a local service.

> True, but google is CURRENTLY abusing it by selling ads to me based on it.

This makes it seem like your concern is with the advertisement funding model, not with privacy.

You don’t see the difference between “seeing an email” en transit vs training a ML algorithm on it and extracting values like when will your airplane depart, when is your vacation, etc and automatically propagating that to other google products? I mean, it sure is comfortable, but you can sure as hell know that they build an extensive profile out of your private emails and your ads are targeted based on that..

> You don’t see the difference between “seeing an email” en transit vs [...] extracting values like when will your airplane depart, when is your vacation, etc

I do not see any difference between these parts, no. If a human read my email I would expect them to be completely incapable of not working these things out, so I'm not really too concerned if a computer does it either.

> training a ML algorithm on it

Also not really. If it were a machine learning algorithm that was trying to write realistic emails there'd be a reasonable concern of it revealing things about the training data, but when it's just generating ad recommendations based on only your data that only you see, I'm not too sure there's a serious privacy concern there. I'm unaware of any allegations that you could uncover private details about someone else's life by looking at an advertisement you received on your own email inbox.

> and automatically propagating that to other google products?

I would definitely perceive this differently depending on the product, as Google products are usually distinct enough that you can functionally treat them as if they were different companies (and often they either used to be, or eventually become so). So in this case there are now four entities that know the contents of the email: the sender, the recipient, Gmail, and e.g., YouTube.

But again, I've not heard any claims that Google are using the contents of your emails to decide what YouTube videos to recommend you. It's certainly not outside the realms of plausibility, but that seems like the kind of thing people wouldn't ever shut up about, so I'm surprised that I haven't heard about it if it is in fact happening.

> you can sure as hell know that they build an extensive profile out of your private emails

Oh absolutely, but I don't see how that's a privacy violation when you gave them your private emails. How much thinking does someone have to do about a message you gave them before it becomes a privacy violation?

> and your ads are targeted based on that..

This is the main reason I'm okay with it. Google's entire business model relies on them preventing anyone else from seeing that data, so that they're the only ones who can target ads that effectively. If there was a significant risk of data leaks then I can absolutely see why people would be concerned, but Google has some absolutely gargantuan incentives to avoid that.

That's the price of a free service. It's always been the gmail MO. Do you want to get something for nothing at all?

Yet protonmail doesn't do that at zero cost. I also gladly do pay for email providers.

So one business offers a loss leader and every competitor has to be rebuked for not matching them?

I don't trust any "secure" communications service that hasn't been subpoenaed and provided nothing in return. Having a national security letter canary doesn't hurt either.

I didn't ever have proof, just a gut feeling, but I never really bought into Protonmail. I created an account but rarely used it and as far as I know has been deleted for a few years now.

What are you using now?

Fastmail with a custom domain. I was using Lavabit before that.

From fastmail privacy policy:

> Each time you connect to our service, we log your IP address, your client identifier (browser or mail client information) and your username.

I'm sorry dude, but that decision from switching to fastmail was not very productive to counteract the specific case mentioned on the OP.

If anything, it's even worse since fastmail apparently always logs your IP.

Moreover: > We process mail sent and received from your account to block spam and fraud. We receive information from third party services to assist us in identifying spam.

Looks like your emails aren't even encrypted. If any government body what's your email bodies, they'll have it. They even share it with 3rd parties for fraud detection. With protonmail and similar services, they'll just log your IP if they're asked to do so, which you can obfuscate using a decent enough VPN.

theyre quite transparent about their service, and far more transparent than any of their competitors. the same criticism can also be leveled against your comment. "but i used tor, the defualt mode for which has js enabled and somehow it leaked my ip!" if you dont know what youre doing, and want to evade state law enforcement, you better figure out what youre doing. thats not on proton.

I was COO of a vpn company for several years. It’s almost impossible not to keep any ip info. We had issues with fraud and one of the best ways to prevent or limit it was to track IP address and save it for several months.

I agree PM should be more forthright in their messaging but realistically I don’t believe any company that takes payments and doesn’t track any info at all.

Did your company market itself as a no-logs VPN company?

I don’t remember the actual marketing message as it was about 7 years ago, but I know in the TOS it was carefully written to include that it had to collect some ip info to prevent fraud.

I wonder how many TOR nodes are run by the NSA?

Doesn't matter if you are going to an internal onion address

Why not? It would just mean that the NSA needs to own more routers than it would to break TOR->Public internet routing.

From what I understand, connecting to an onion address 'just' involves 6 routers, not the typical 3. (Of course an oversimplification.)

Or am I misunderstanding your threat model here?

>A global passive adversary is the most commonly assumed threat when analyzing theoretical anonymity designs. But like all practical low-latency systems, Tor does not protect against such a strong adversary. Instead, we assume an adversary who can observe some fraction of network traffic; who can generate, modify, delete, or delay traffic; who can operate onion routers of his own; and who can compromise some fraction of the onion routers.

Sounds like a 51% attack on crypto blockchains.

Yes, but this doesn't require 51%, at least as users typically use Tor.

Tor Nodes are more the interest of the DoD, since they started the project and have interest in continuing it.

I was a paying customer. I just cancelled.

I can't understand what just happened. I truly believed it's all save and secure.

I hope you emailed them to say why. Share the email here if you don't mind.

24 hours later, ProtonMail deletes "By default, we do not keep any IP logs".

I'll call that a win for all customers who emailed Protonmail about this.

HN discussion: https://news.ycombinator.com/item?id=28443449

In the US companies can make canary statement... https://en.wikipedia.org/wiki/Warrant_canary

Those canary things seem so 2018.

In 2021 the most powerful canary statement should be "Don't trust us. Seriously, treat us as an adversary. We still want you to be our customer of course, but here's how we really recommend you use our service, Tor, semi-anonymous payments, etc. In God we trust, for everyone else use math."

Anybody serious has moved from "perimeter security" to "zero trust" in network architecture. We need to treat more of the real world the same way.

Any new tools developed with that in mind for us mortals?

Would love to sign up for some Tor-first services. So far the best we've got are Tor services that mirror public ones.

That canary statement would kill their userbase. Seriously, who expects a company to admit the value they provide is not much? They expect the more savvy users (ie, those who need the privacy, typically) to understand basic OPSEC.

I admit that the marketing is bad, I do not agree with it, and I do not tolerate it in terms of my own OPSEC. But, there's just no way they would just admit they provide hardly any value besides, in a VPN's example, being a tube to another place, and just another tube with ends that can be stopped.

Not having that canary may LITERALLY kill some of their users. If they have some decency they should own up to the truth and if they end up being out of business they will have a lot of goodwill for their next business.

And I 100% agree that they should. I'm just saying there's an incredibly slim chance they will. From a business perspective, which is the perspective they always take, it makes no sense.

> In the US companies can make canary statement...

What is far less clear is if you can trust the continuation of a canary statement to indicate the absence of the action it denies, since it is both legally disputed whether continuation of the statement could be mandated by government and because anyone who has an interest in the PR value of providing a canary statement also potentially has the same interest in continuing it as long as it is impractical to falsify.

>it is both legally disputed whether continuation of the statement could be mandated by government

Is compelled speech seriously in jeopardy? I saw the github issue for signal saying that some (EFF?) lawyers said that canaries are not that helpful, but that just implies that the government CAN compel speech. That would be bigger news than mentioned as an aside on a Github issue, I'd like to believe that would be news...

The canary is dead, and the fact is widely publicised, if not necessarily well known.

Our canary[1] - the very first one[2] - is alive and well.

In fact, it turned 15 years old this past April[3].

[1] https://www.rsync.net/resources/notices/canary.txt

[2] https://en.wikipedia.org/wiki/Warrant_canary#Usage

[3] https://twitter.com/rsyncnet/status/1387090538273206274

Who is "our" here? rsync.net?

https://www.rsync.net/resources/regulatory/privacy.html

Gotchya.

I was referring to Protonmail's canary specifically, in the event that wasn't clear.

"Also, our VPNs are useless"

_all_ VPNs are useless. They are the biggest security theater and a massive success of marketing. But really, it's completely bazaar to trust a VPN provider.

They provide protection from your local network, but you they can do all the same things and more.

That's just false though. If you're trying to hide from the CIA, then sure they are useless.

I just want to prevent my ISP from throttling my torrents.

You really can't talk about the "use" of any of these tools without a threat model.

*bizarre Not bazaar. And really both words are spelled quite bizarrely.

Your local network might be a dangerous country

You need a VPN provider outside your legislation of course. Access is still not impossible, but much more unlikely. Perhaps choose a country not on good terms with your own.

Yes. Yes! I’ve never understood how people argue that they are somehow better than an ISP by default.

My ISP throttles connections (strangely including Zoom).

My ISP mines my data and sells it to the highest bidder despite costs not coming down.

My ISP determines what I can look at and can't (such as torrent sites).

My ISP is participating in anti-competitive behavior and I need the internet but I don't have a meaningful way to tell them to fuck off.

My VPN doesn't log. My VPN doesn't filter my traffic. My VPN reduces what my ISP can know about me and monetize me. My VPN allows me to access sites appearing in different countries or as a different user which changes what content websites serve to me, including price of products.

VPNs are a soft security practice, but one hell of a way to tell your ISP to fuck off. I think there's this group of people that say "oh, a security feature isn't bullet proof, therefore it is useless." But this is just dumb. All security features are probabilistic in nature and depend not only on how you use them, but your threat model and the will of your adversary. For people, like me, trying to escape dragnet operations VPNs do help. But alone they aren't enough and that's okay.

Well said.

My ISP is subject to my local laws. Which are not good, in terms of my privacy.

My VPN provider is not - but is obviously subject to their local laws. Which are almost certainly also not good for my privacy either.

Spreading the threat across two different jurisdictions is without doubt "somehow better" than just using my ISP, at least in the case of protection against snooping by non serious crime law enforcement.

(Where I am, organisations like local councils, the taxi commission, fishing inspectors, and dog catchers - can all access our "mandatory telecommunications metal data retention" stuff with very little oversight... While my VPN is still in five eyes, so there's no point pretending national security, intelligence, or serious crime like terrorism/drugtrafficing would have no trouble getting cross jurisdictional access, I'm pretty sure the fishing inspectors or dog catchers won't have that sort of access.)

What threat model are you trying to protect from by using VPN, and why is HTTPS + DoH (DNS over HTTPS) not sufficient for that threat model ?

HTTPS still reveals the domain you're requesting, last I checked.

The eSNI/ECH extensions fix that.

It can’t fix the problem that it reveals the ip address you’re connecting to though. Even if the sites you’re visiting are all on servers that virtual host heaps of other sites as well, it certainly narrows that haystack down to a handful of bits of hay with your bright shiny needle standing out in the middle.

...if you manually turn it on in Firefox and the websites you're connecting to support it.

I don't know where things stand with other browsers.

Because not everything uses a bloated, web-first protocol.

I get letters and my internet turned off if I torrent on my ISP I don't using VPN. Simple as.

In Sweden we got the "datalagringsdirektivet" that says that every operator must keep their traffic for 6 months. VPN-providers are not bound to this law so that's my reason.

what we would then do is work with them to get that login through tor nodes we monitor and go from there

"Their homepage says..."

Is the parent suggesting that no one should bother to read the Terms and Privacy Policy, linked to from the homepage. https://protonmail.com/privacy-policy

Despite the parent's claim, the Privacy Policy says the company may log IP address. Temporarily. Irrespective of any request from local authorities regarding a specific user. IOW, they may log anyone's IP address temporarily regardless of whether the particular user is casuing trouble; they can log IP address for everyone. The policy says they log this data for the purposes of preventing fraud and abuse. The problem for privacy-conscious users is that if they log the data, then that entices authorities to try to successfully request it.

The policy, which imposes no obligations on the company BTW, reads as follows:

"IP Logging: By default, we do not keep permanent IP logs in relation with your use of the Services. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions (spamming, DDoS attacks against our infrastructure, brute force attacks, etc). The legal basis of this processing is our legitimate interest to protect our Services against nefarious activities."

There is nothing that says "By default we do not retain any logs". This clearly states they may be expected to retain IP logs. ("IP logs may be kept temporarily...")

But wait there's more.

"We will only disclose the limited user data we possess if we are instructed to do so by a fully binding request coming from the competent Swiss authorities (legal obligation)."

This clearly states the company may disclose the data they possess, e.g., IP logs collected to combat fraud and abuse, if in response to a request from competent local authorities.

Further down is a curious statement about decrypting messages.

"If a request is made for encrypted message content that we do not possess the ability to decrypt, the fully encrypted message content may be turned over."

Why include a statement such as this, specifically the part that says "that we do not possess the ability to decrypt". The company already specified it may disclose the data it possesses. This further statement suggests there could be some situation where they may have the ability to decrypt some messages. Besides their own communications with customers, why would they ever have encrypted messages that they can decrypt. They could state something like "If the request is made for encrypted communications addressed to us or sent by us, ...", but they do not. As such, their statement must include other messages, too.

> "IP Logging: By default, we do not keep permanent IP logs in relation with your use of the Services. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our terms and conditions (spamming, DDoS attacks against our infrastructure, brute force attacks, etc). The legal basis of this processing is our legitimate interest to protect our Services against nefarious activities."

Just how transient do logs need to be to fit this criteria?

Am guessing the 7 years or so we need for some of our specific logs might fit the temporary definition too.....

Nothing is even defined. There is nothing in this policy that obligates the company to do, or restricts the company from doing, anything.

This is the way most tech company "Privacy Policies" are written.

There is a significant difference between a statement such as "We (Company) do not do X" versus a promise such as "Company shall not do X" or a statement such as "We do Y. We may do Z" versus a promise such as "Company shall do Y."

Why not have our own "Policies" as users that we publish for tech companies to read. In them, we could describe what we do and what we do not do, and what we may or may not do. Tech companies could rely on these statements. You can see how silly that sounds. Yet users are expected to read and rely on hundreds of different "privacy policies", collection of non-binding statements like "We take privacy seriously".

Solid points. A report card for various privacy policies would be useful. Seen anything like that?

I wouldnt trust any of them to be honest. Privacy policies really arent worth anything.

I would look for websites that generally do not ask for data. Then send them the minimum data you can get away with. I would avoid "signing in" or "signing up" to any website. There is an immense amount of data and information available from free from the web, no "account" is necessary.

For example I dont send any extra HTTP headers like Cookies or User-Agent, I dont use Javascript. I dont request images, CSS. I dont automatically follow links in src tags. Yet I can still read and comment on HN and I can read every website posted to HN. Thats a lot of websites. I can read them just fine while not sending them any more data than is needed. Because I do not use a large, complex graphical browser sponsored by an online ad-supported vendor to make HTTP requests, I can easily control what I send. This is far better IMO than sending unknown amounts of data (letting the websites control what the browser sends via headers, Javascript and src tags) and then hoping the websites dont do things with the data that we dont like.

Privacy policies do not limit websites from collecting data nor do they limit how the data can be used. They are "policies" not agreements. If a website operator does things behind the scenes that violate privacy but that it does not disclose in a "privacy policy" what can a user do. How would the user even know. Or the website could clearly violate their own "privacy policy", but no one outside the website's operators would know. Even if users discover the violation, what would be the repurcussions. Its too late, because a violation means privacy has been blown.

Show me a case where a tech company got sued for violating a privacy policy. How can anyone prove a violation if the operations of the website are not open for public inspection.

The GDPR is meant to address this problem, check out https://www.enforcementtracker.com/ to see what the most recent rulings are.

Your observations are correct, the regulation is able to deal with the damage after it was done, and apply some form of punishment after the fact. It takes whistleblowers and activists to reveal some of the wrongdoings, otherwise the violations remain unknown to us.

Therefore there has to be a greater push towards proactive measures - letting people vote with their wallet by making informed choices; the prerequisite for that is for the relevant information to be available to them.

Have a look at some of the research I've been involved in, we're trying to solve this exact problem: http://privacy-facts.eu/

Wow neat how do you browse the web, Lynx?

Generally I use custom utilities for HTTP generation, URL extraction, chunked transfer decoding, URL encoding/decoding, GZIP/ZIP/PDF/MP4 extraction, etc. Thus I can use any TCP client I want to make HTTP requests from the command line. I do not need a browser to request content. Nor do I need projects like curl or projects that use libcurl like youtube-dl. For large downloads I use tnftp. The shell script I use to download YouTube videos is 424 bytes.

For reading HTML I prefer links. It has the best rendering of HTML tables, IMO, and is for me the easiest source code to work with. I did use lynx back in the late 90's but would never go back to it. Its bloated. Its slow. Im not sure why anyone interested in text-only browsers would use it other than they are unaware of or have not tried alternatives.

Kind of limited since it's only evaluating websites, but https://tosdr.org/ attempts to implement this as a plugin.

Edit: And amusingly it only gives protonmail.com a B.

There is a project for bringing relevant privacy facts closer to users, so they can make informed decisions before choosing to buy a specific product or service. Check out the second screenshot on this page: http://privacy-facts.eu/features/

The idea is to express everything in unambiguous terms, so there's no way to weasel out of it with "yeah, but not by default" or, "well, it depends", etc.

I pasted an email I sent to Protonmail above. If they can't come up with language that's clear, use text from their privacy policy verbatim. Start educating users not to trust anything but what's in the policy, and even treat that as adversarial.

Devils advocate: Why trust the policy. Can you enforce it. If yes, then how.

Agreed -- "even treat that as adversarial".