Technology

It’s also worth clarifying that ProtonMail doesn’t collect IP addresses by default. Instead, the monitoring/ logging starts after ProtonMail gets a legal request.

They still have to adhere to legal requests.

Apart from it's an old story, discussed already back and forth, Proton's claims regarding privacy are really weak. Especially when it comes to presenting Switzerlamd as a privacy safehaven. Switzerland is a tax evasion savehaven, not a privacy safehaven, Proton. How Proton puts it: we provide world class privacy (but have to break our claims and comply with Swiss law immediately once there is a legitimate or not request from law enforcement, oepsie sorreyy!)

"climate activists have been taking over commercial apartments" So ... trespassing? They breached privacy for apparent trespassing? Is that it?

Just switch over to a privacy focused mail service like... uh... like... well shit.

The police gained access to the IP address because Swiss authorities chose to cooperate with the French government

We've seen this several times now. Proton is subject to Swiss law, just like every company in their respective countries. You choose Proton because Switzerland has the most privacy protections of any country on the planet (for now).

If you want private communications, don't use email. In fact, if we could all stop using email entirely, that'd be wonderful. There are hundreds of truly-private alternatives, many with no company involved at all.

Why is this a surprise? IP Logging is pretty normal for any service.

2.5 IP logging: by default, we do not keep permanent IP logs in relation with your Account. However, IP logs may be kept temporarily to combat abuse and fraud, and your IP address may be retained permanently if you are engaged in activities that breach our Terms of Service (e.g. spamming, DDoS attacks against our infrastructure, brute force attacks). The legal basis of this processing is our legitimate interest to protect our service against non-compliant or fraudulent activities. If you enable authentication logging for your Account or voluntarily participate in Proton's advanced security program, the record of your login IP addresses is kept for as long as the feature is enabled. This feature is off by default, and all the records are deleted upon deactivation of the feature. The legal basis of this processing is consent, and you are free to opt in or opt out of that processing at any time in the security panel of your Account. The authentication logs feature records login attempts to your Account and does not track product-specific activity, such as VPN activity.

Source: Their privacy policy.

The lesson here is despite what a service says, don't trust it and take the appropriate measures to cover your tracks.

You can create an access the inbox through Tor at protonmailrmez3lotccipshtkleegetolb73fuirgj7r4o4vfu7ozyd.onion

The important thing is to always access it through Tor.

proton is arm in arm with the us government and republicans, so it should be expected that they'll track and sell you out.

Proton needs to get its head out of its ass and fire Andy already, grow a pair and get off Reddit and back onto Mastodon and face the backlash like actual adults.

Proton are very open about what they do and don't provide.

They're not going to protect you and they will turn on you the second they get a letter in the mail or a text from the cops.

But what they DO provide is the ability to register an email address (with a domain that isn't blocked by most services) without providing any other information. And, from there, you can encrypt it yourself if it is a particularly sensitive message.

As for IP logging? if only there were tools like VPNs and Tor to negate that.

Nothing unexpected from a company that openly espouses fascism.

So Protonmail was required to log the IP of the user after being ordered to via the proper international Swiss legal channeks, per Swiss/Europol law. And at some point recently, Protonmail thus removed the copy from their frontpage that advertised never tracking IPs.

What the article doesn't really explain, is what exactly changed about Swiss or euro law? And when? What rules or acts have sprung up that made this possible? Or, was this always something that was possible that has only just now made precedent?

It's important to hold accountable the named individuals who are harming individual security, safety, and trust in this manner so that they can be prevented from continuing to do so.

Oh ffs. We have known for years that Proton is just a for profit company like any other. They dont give a fuck about you or your privacy. They never have and they never will.