ProtonMail Complied with 5,957 Data Requests in 2022 – Still Secure and Private?

Re:ProtonMail Complied with 5,957 Data Requests in 2022 – St... by illiac786 on Saturday August 19, 2023 @08:19AM (#37187998)

You're asking for a negative proof. How do you want an email provider to demonstrate they are not storing your nonhashed password? I don't see how that's feasible. Audits are a step in that direction, but it's not like mathematical proof.

[ Parent | on HN ]

Re:ProtonMail Complied with 5,957 Data Requests in 2022 – St... by ImJamal on Saturday August 19, 2023 @02:38PM (#37191730)

That is my point. The protonmail person said they never have access to the decrypted key. As far as I can tell they can't prove it.

[ Parent | on HN ]

Re:ProtonMail Complied with 5,957 Data Requests in 2022 – St... by illiac786 on Saturday August 19, 2023 @02:44PM (#37191789)

So we agree you are asking for something impossible to prove? Not sure you got my point.

[ Parent | on HN ]

Re:ProtonMail Complied with 5,957 Data Requests in 2022 – St... by ImJamal on Saturday August 19, 2023 @05:06PM (#37193200)

I agree it is impossible. I don't like their claims that they don't have access to the decrypted keys and we can prove it by looking at the code. They could have access to the keys and looking at the code wouldn't prove they don't.

[ Parent | on HN ]

Re:ProtonMail Complied with 5,957 Data Requests in 2022 – St... by illiac786 on Sunday August 20, 2023 @02:38AM (#37196761)

I understand but I read the statement differently. It's a description of their security model simply. Sure they could be lying like any other company, so a certain amount of trust is required.

Unless you read and compiled the code yourself and run it locally, some level of trust is always required.

[ Parent | on HN ]