Comment on Alleged RCMP leaker says he was tipped off that police targets had 'moles' in law enforcement

• privacybro@lemmy.ninja ⁨11⁩ ⁨months⁩ ago

  False.

  Proton can not be made to spy on customers most they can do is hand over info they already have

  proton.me/blog/climate-activist-arrest

  Proton’s encryption cannot be bypassed by legal order. Tutanota’s can.

  source

  • ReversalHatchery@beehaw.org ⁨11⁩ ⁨months⁩ ago

    Proton can be legally ordered to start recording the IP address of a specific user. That’s why they recommend that you always connect through their Onion site.
    Other than that and if that’s possible, I think it may also be possible to legally order Proton to keep the unencrypted form of incoming emails for a specific user, but Proton did not said it in the article, and Swiss laws might protect them against that. It’s certainly possible technically, and good to be aware of it, I think.

    Sorry but I can’t open the second page, as it actively resists it. I suspect though that the problem with Tutanota was not their encryption, but their legal system, which required them to keep a copy of the incoming emails.

    Also, don’t mistake me, I’m all for protonmail, and I mean this. But did you know they only encrypt the email contents? Metadata like title, sender recipient and other things in the mail header don’t get encrypted.

    source

    • privacybro@lemmy.ninja ⁨11⁩ ⁨months⁩ ago

      you’re right about the IP thing. that’s a good clarification rather than just “spy”. i suppose it’s less dire than Tutanota not encrypting incoming mails if you use tor and vpn by default.

      yeah basically it more or less proves that swiss privacy is a bit stronger in this case vs Germany.

      on the proton encryption, i did know about this but does that apply to proton-to-proton, proton-to-NonProton, or both? if you have details on this let me know.

      either way the fact that they dont makes me feel that proton is a similar honeypot to signal and telegram, where they make a compromise with the five eyes, to give them metadata even if actual contents are safe. metadata can be much more powerful than contents often times

      in general email is just the worst protocol when it comes to privacy. sadly.

      source

      • ReversalHatchery@beehaw.org ⁨11⁩ ⁨months⁩ ago

        on the proton encryption, i did know about this but does that apply to proton-to-proton, proton-to-NonProton, or both? if you have details on this let me know.

        As I know it applies to both. Formerly they were asking (among other things) about the titles of your latest emails for account recovery. (after I have put all the links here I realized that these don’t give a details on whether this also applies to inter-proton messages…)

        A few sources:

        proton.me/…/proton-mail-encryption-explained

        Subject lines and recipient/sender email addresses are encrypted but not end-to-end encrypted.

        www.reddit.com/r/ProtonMail/comments/…/eiphhs7/?c…

        …stackexchange.com/…/why-is-some-meta-data-not-en…

        either way the fact that they dont makes me feel that proton is a similar honeypot to signal and telegram, where they make a compromise with the five eyes, to give them metadata even if actual contents are safe. metadata can be much more powerful than contents often times

        Yeah, might as well be. But if it is, I’m afraid we won’t get to know for a few decades, if ever. And I think it’s still better than the alternatives… the alternative email providers, that is.
        If it comforts you, in their reddit comment I linked they mention (in 2019…) that there’s a proposal they support for openpgp to be able to have an encrypted subject line.

        source

        • -> View More Comments