What you can buy is various degrees and quality of sensible defaults and behaviours that serve your general interest in privacy and security. Privacy from casual snooping or commercial tracking, security from unsophisticated attacks or even sophisticated attacks if you're wiling to also sacrifice some convenience.
These are all worth having, and your choices of product and service provider can have a significant impact on them. I know little to nothing about ProtonMail but maybe they're a better bet than many other similar services, even if they're not perfect.
> The Internet is generally not anonymous, and if you are breaking Swiss law, a law-abiding company such as ProtonMail can be legally compelled to log your IP address.
The "Threat Model" blog post is linked from their main site.
And then you just let it run for 10 years without doing any more work and it just rots away.
Not recommended
If you are attempting to leak state secrets (as was the case of Edward Snowden) or going up against a powerful state adversary, email may not be the most secure medium for communications. The Internet is generally not anonymous, and if you are breaking Swiss law, a law-abiding company such as ProtonMail can be legally compelled to log your IP address. A powerful state adversary will also be better positioned to launch one of the attacks described above against you, which may negate the privacy protection provided by ProtonMail. While we can offer more protection and security, we cannot guarantee your safety against a powerful adversary.
A blog post from May 2014 isn't sufficient, no matter where it's linked from.
If its something you care about, you should not be making your choices on the basis of marketing splashes and you should certainly not need your email provider to explain Tor to you.
I want the benefits without being a mechanic. And I'm willing to pay money for it. Lots of money.
Proper Opsec for dissidents requires multiple layers and technologies and simply cannot rely on a single vendor. Any proper company accepting credit card payments is going to be subject to court orders and there are limits to their ability to resist them.
Protonmail has taken extraordinary measures to limit their exposure to those risks but anyone who is assuming they can e.g. be an enviro-terrorist or CCP dissident and be safe solely because they use Protonmail is terribly naive and ignorant..
ding ding ding. pin this comment.
Whisper Systems say they don’t record/log that. But they are no more able to defy legal demands in their jurisdiction to do so than Proton Mail were.
the key you pointed to tho was regarding convenience. simple fact is that most of the usability desired in consumer email is not compatible with the practical design principles of covert communications.
They do explain the threat model quite well but the information is scattered around (e.g. https://protonmail.com/blog/protonmail-threat-model/) and this matters in an era where the attention span of people is very short.
The cost is personal time and effort, not money. The software needed is generally free of charge. The goal being not a physical product or a service, but a level of knowledge and proficiency. To put it another way, "tech-savviness" cannot be purchased, it has to be achieved.
The cultural problem we face is that the so-called "0.1%" are leveraging their "tech-savviness" against the rest of the population, working for so-called "tech" companies, websites that make money by exploiting the privacy of the "99.9%" in the service of online advertising.
If we take HN comments as true, in some cases, these employees do not even believe in the bottom line they are working to support.1 They are not adopting the behaviour of the "99.9%", i.e., the "expected" behaviour required to sustain their employer's bottom line. Not sure about you, but that would not give me much confidence they are going to work very hard to protect other users' privacy.
The term "dogfooding" is sometimes used amongst tech companies to describe the situation where employees themselves partake in what they offer to non-employees, i.e., "users".2 To persons outside the tech bubble this can be quite amusing. Does this suggest they view their relationship to users as more like "human-to-dog" than "human-to-human". There is nothing inherently wrong with someone peddling something she does not believe in, however we might consider what is/are the reason(s) for her lack of faith.
To be clear, I am not suggesting the cultural problem can be solved. I am attempting to provide further reasons that digital privacy is, like the parent suggested, generally not something you can "buy".
1 Evidence appears periodically in HN comments. For example, yesterday: "Disclaimer: I work at Google. In cloud, not on Android. I am privacy conscious so I though I would give a try at Graphene OS, it was brutal."
2 The term is alleged to have first appeared one the joelonsoftware.com website and to have originated at Microsoft.
You can. It's just not that cheap, and not quite as convenient.
edit: for those curious, discussion on HN 3 years ago https://news.ycombinator.com/item?id=18238581
I'm not saying "think of the children", I'm saying "think of law enforcement and the judicial system"
thinking about it now in retrospect, do you think that really could have been a possibility? I don't.
The only thing I am saying is that if real privacy is not a possibility (and it may very well not be), they shouldn't pretend they are selling real privacy. I am not saying they should find a way to do the impossible and legally avoid laws. I am saying they should not pretend their service is any more private than it actually is.
Think of it this way: imagine someone starts advertising a magic potion that stops aging. People buy it, but they predictably continue to age and die. If someone starts protesting, we shouldn't say "what are you complaining about? what do you want the seller to do? break the laws of nature? that's ridiculous." We should say, "we really should stop that guy from making baseless promises about his potions".
I use Protonmail to provide tools for journalists, teachers, and whistleblowers, and people who are in danger from folks who mark them "criminals".
Wat? You better stop sending anything incriminating via the mail, they totally can and will open your letters if there's a court order.
And to be clear, I don't think people have any kind of right to create, disseminate, or even view CP. But that doesn't mean that any guarantees to data privacy should be thrown away.
I don't think they are. What Apple & friends are doing is voluntarily. There's no requirement for e.g. your webhoster do scan your data, or your email provider to scan your emails. Case in point: ProtonMail doesn't, and they're not violating the law by not doing so.
I'm not saying "think of the climate", I'm saying "think of law enforcement and the judicial system"
thhinking about it now in retrospect, do you think that really could have been a possibility? I don't.
If you don't, then they won't either for whatever activities you're doing, that aren't as reprehensible as CSAM, but some government may think otherwise.
It's kind of depressing reasoning maybe. But if a privacy-preserving system is actually that, then even the most technically-savvy terrorists and child abusers should have no qualms about using it as well.
But, you have the right to expect that the dry cleaner and parking garage will take reasonable care with your belongings and will not act in ways that are negligent, the signs they put up notwithstanding.
There's no scapegoating, it's a question of what should a reasonable person expect from a transaction. Protonmail said they don't keep logs by default and that they also need to respect court orders.
All of the above and more.
You can’t have privacy; you need to be actively participating in our society or you’re dead. As soon as you try to build it you’ll realize it’s a full time job and you won’t be able to afford to eat on what it pays.
Only 5% of people in the US still hunt. We are coupled to the modern systems we have (unless MIT is right and it falls apart soon).
You want privacy, go off grid. Those of us living on grid will be sure to leave you be and keep everything we build for ourselves.
None of us explicitly cheered on the end of privacy but we did cheer on the engineering effort that made it happen. Despite numerous voices warning us.
Ciao.
As you point out, that requires both parties be on the blockchain. If you want to send/receive off-chain, you would probably just set up a trusted relay. e.g. send an ethereum tx to emailrelay.eth and it would forward it over the SMTP system. Send an email from a SMTP client to [email protected] and it’ll do the reverse. This implementation would have the relay see all your plaintext messages. Not much different from how centralized email services like gmail operate, in practice.
There’s nothing that makes any of this technically infeasible to a knowledgeable dev today — maybe it even already exists (ethmail.cc shows there’s at least interest in it). Transaction fees kill this from a practicality point of view. Probably you want to roll this out on a layer 2 network, and those are still pretty new things.
That depends on the amount. If it's small it could be a feature.
Provide pointer to message via side channel to recipient.
Done.
Now, that has OTHEHR problems. So, as anything but a napkin sketch, don't take it too seriously.
Their threat model and all threat scenarios should be front and centre on their front page and sign up page. That is if they care about user privacy not just the bottom line. They have a choice between better-informed customers or more money, and so far, they have chosen the latter.
What this and the new Apple debacle have proven to me is that privacy is not a product that can be purchased. If you want real privacy, you have spend a lot of time learning how to preserve your privacy. No matter what Apple and ProtonMail and similar companies tell you, you cannot buy privacy off-the-shelf.