All security is porous. So there is every reason to believe that Proton or any other org will have a major breach at some point.
Comment on Standard notes: what about don’t put all your eggs in one basket rule?
Imprint9816@lemmy.dbzer0.com 5 months agoThis whole line of thinking seems to be based on FUD more then anything else.
There is no evidence or reason to believe some major compromise of proton will happen.
furrowsofar@beehaw.org 5 months ago
Imprint9816@lemmy.dbzer0.com 5 months ago
“All security is porous” is FUD pure reasoning and completely disregards the security audits Proton does to make sure its not anything like lastpass.
You are also assuming if proton was breached that it means all encrypted data would be available to the malicious party which is also extremely unlikely.
furrowsofar@beehaw.org 5 months ago
Security audits do not guarantee security. They are just the best we have. Just as code reviews do not guarantee good and trustworthy code. In the end, we do not know what we do not know. In the end, every system has its weaknesses.
Sure I believe Proton is a reasonable supplier. Even with that Proton for example is on the record of giving out user info to governments. I am sure they did not meet the expectations of that activist.
Imprint9816@lemmy.dbzer0.com 5 months ago
My point is Proton did something every legit business would do.
If your threat model is such that governments are going after you, you should be aware enough to not create an email with an IP that identifies you.
gamedeviancy@discuss.tchncs.de 5 months ago
No, I’m not saying that I don’t trust proton at all. I think that they have great services but as I wrote in the title - don’t put all eggs in one basket.
I think I won’t trust any company with holding ALL my data.
Imprint9816@lemmy.dbzer0.com 5 months ago
If all your eggs are encrypted, having those eggs in one basket or five doesn’t matter from a security perspective. Its the same reason you wouldn’t split up your passwords to multiple password managers.
LWD@lemm.ee 5 months ago
There’s a lot of metadata Proton passes around, and two of their oldest flagship products (email and VPN) require you to put a lot of trust in one company. For email, you trust them to encrypt them without snooping. For VPN, you trust them to not collect logs about where you’re going.
And in the former case, they were compelled to give up at least a little data in the not-so-distant past.
Imprint9816@lemmy.dbzer0.com 5 months ago
It doesn’t matter what is being discussed, if its about proton the email incident gets brought up. Here is the deal. No major company is going to break the law for its users. Had the activist been using proton vpn to create and access their email Proton would not have had the info they were forced to give up. The takeaway from the story is bad opsec is usually what gets people caught.
Whether you use Proton or someone else you will need to trust that service. If you don’t trust them, don’t use them. Its that simple, no need for conjured up FUD excuses.