Proton’s mails are encrypted… between proton accounts. Send an email to a hotmail account and bye-bye encryption. Proton does rely on PGP so you can use that if the recipient supports it.
Comment on Proton Mail Discloses User Data Leading to Arrest in Spain
Alk@lemmy.world 1 month ago
This is non-news, like all tech companies, they are bound by law to do this. It happens more than 6000 times per year for Proton. However, this user just had bad opsec. Proton emails are all encrypted and cannot be read unless law enforcement gets your password, which Proton does not have access to. Even if Proton hands over all data.
0x0@programming.dev 1 month ago
EncryptKeeper@lemmy.world 1 month ago
They mean encrypted at rest. As in, Proton cannot hand over a copy of all your emails to a law enforcement agency, they don’t have access.
Evotech@lemmy.world 1 month ago
Mail stored in proton is encrypted
asdfasdfasdf@lemmy.world 1 month ago
proton.me/support/password-protected-emails
A Password-protected Email is an email that requires a password to open it. It’s a way you can send a secure, end-to-end encrypted email to anyone who isn’t on Proton Mail.
ID411@lemmy.dbzer0.com 1 month ago
Proton doesn’t get a free ride here.
They are bound Swiss law and should not be retaining any identifying information.
If they are going to give up everything they have on you when the feds come knocking, they shouldn’t keep anything or they shouldn’t market themselves as private and secure .
QuaternionsRock@lemmy.world 1 month ago
The user specifically requested that Proton retain this PII for account recovery.
Speaking of which, how do they implement recovery emails? Do they save your private keys only if account recovery is enabled?
Periodicchair@lemmy.world 1 month ago
Recovery email only restores access to the account, so you can get future emails. But all data is lost, emails sent in the past (saved emails) are not recovered.
proton.me/support/set-account-recovery-methods
asdfasdfasdf@lemmy.world 1 month ago
No, Proton does get a free ride here. The information they provided was the recovery email address, which they were required to do by law.
The only data they don’t encrypt (can see) is that which they absolutely need to store unencrypted. If they encrypt your recovery email address, then… they can’t send you any recovery emails to it since they can’t see it.
This is 100% the fault of the user.
All any service can do is give you the best tools available to maintain your privacy, but they can’t stop you from shooting yourself in the foot.
Firefox is also great for privacy, but if I use it to fill out some info on some phishing sites then that’s not a them problem.
NightAuthor@lemmy.world 1 month ago
Don’t forget that most of your email arrives at their servers unencrypted, supposedly they immediately encrypt it, but you have to take their word on that. And there’s always the possibility that they are forced or just decide to make a copy of emails as they’re encrypting for your inbox.
EncryptKeeper@lemmy.world 1 month ago
They are bound by Swiss Law, so they have to comply with lawful orders. They are very up front about this even within their marketing that pertains to protection from other government authorities. They are also very good at explaining exactly what is protected and what inherently isn’t. A recovery email isn’t. In order for a recovery email to work by its very nature, Proton has to have a record of it. But at the same time they don’t require you to set one. Proton hasn’t done anything that they’ve promised not to. There comes a point where you need to put a little effort into understanding the product you’re using.
ID411@lemmy.dbzer0.com 1 month ago
Don’t tell me, tell the guy they gave up . ?
They market to activists and people concerned with the business of protest, not Swiss law experts - and are very much are not up front about what could happen if they are contact by LE. Of course They don’t hide it, but you won’t find it on the front page, where they trumpet about Swiss privacy… You and I know the detail, many users may not.
At the end of the day, they attract a lot of activists and protesters to their service, with the offer of “safe and secure email. “ .
They hold a database of all them, in a jurisdiction that requires them to comply with legal requests for information.
They service some 6000 such requests from their database of every year, or around 30 per day.
You can decide for yourself who this efficient and eminently accessible single source of protesters information helps the most.
EncryptKeeper@lemmy.world 1 month ago
This information was just as clearly and easily accessible by the guy who was caught, as it is to you, and to me. If you’re going to commit crimes using a cloud service, the onus is really on you to put in a minimal amount of effort to familiarize yourself with what is protected and what isn’t. Proton is extremely up front about this, and give you all the information you need to be safe.
Proton never advertised to a single user that all your data is safe from the Swiss government. On the contrary, their main selling point is that the Swiss government is the primary driver of their secure offering. They encrypt what they can using zero trust encryption, and that is left over is secured by the Swiss Governments laws regarding businesses sharing information with foreign governments.
RootBeerGuy@discuss.tchncs.de 1 month ago
But if you use their service for free, you do not have to provide any identifying info. As far as I am aware there is no check what you enter is legit and there is no requirement to supply a backup address. So the whole solution for a user to stay anonymous as much as they can with Protonmail is simply to not enter any identifying info.
sudneo@lemm.ee 1 month ago
How do you imagine a recovery email to work, if the provider doesn’t store it, and you lost access to your email by definition in the moment you need it? Recovery email is not needed, you can totally use your account without and proton doesn’t ask for it. It’s a feature where you obviously are disclosing that piece of information and link two accounts. It’s either that or not using that feature.
barsquid@lemmy.world 1 month ago
It would be cool if they stored a hash of the recovery email, then you type it out during the recovery process and they can send if the hash matches what they got.
sudneo@lemm.ee 1 month ago
Sure, but that’s essentially a weaker recovery password (which also is an option in Proton).
Also that poses quite some challenges for email verification (say, you make a typo when you first write your address), let alone the fact that you won’t see what emails you have configured essentially, which is also bad UX.
I think it’s much simpler to have recovery email as it is and -if one doesn’t want to associate proton account with any other account- offer other recovery methods, which are available (phrase and phone number).